Privacy Policy — Ironman88

This Privacy Policy ("Policy") is published by Ironman88 ("we", "us", "our", "the Platform") and applies to all personal data processed in connection with your use of the Ironman88 website accessible at ironman88.cam, including all associated gaming services, account features, payment processing activities, and customer support interactions.

Ironman88 is an online gaming and sports betting platform serving players across Malaysia, including members based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. As a data controller, Ironman88 determines the purposes and means by which your personal data is processed.

By creating an account on Ironman88, making a deposit, or otherwise using any feature of the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data in the manner described herein. If you do not agree to this Policy, you must not use the Ironman88 platform.

This Policy should be read together with our Terms & Conditions and our Responsible Gambling policy, which together constitute the full framework governing your relationship with Ironman88.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, IP address, payment details, and account activity records.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, and deletion.
• "Data Controller" means Ironman88, which determines the purposes and means of processing personal data.
• "Data Processor" means any third party that processes personal data on behalf of Ironman88, such as payment service providers and identity verification companies.
• "Data Subject" means you — the individual whose personal data is being processed.
• "KYC" means Know Your Customer — the identity and age verification processes required under applicable regulatory obligations.
• "Cookie" means a small text file placed on your device by a website for tracking, preference, or session management purposes.
• "Third Party" means any natural or legal person other than you, Ironman88, or Ironman88's authorised data processors.

Ironman88 collects personal data from you in the following contexts: during account registration, during the KYC verification process, during the course of your use of the Platform, when you contact our customer support team, and automatically through technical tracking mechanisms during your browsing sessions.

We collect only the minimum personal data necessary for the purposes described in this Policy. Where a specific category of data is optional, we will indicate this clearly at the point of collection.

Ironman88 uses your personal data for the following specific purposes:

1. Account Management: To create, maintain, and administer your Ironman88 account, including processing deposits and withdrawals, managing your account balance, and enabling access to the Platform's features.
2. Identity & Age Verification (KYC): To verify that you meet the minimum age requirement of 21 years, to confirm your identity, and to fulfil our obligations under applicable anti-money laundering (AML) and Know Your Customer (KYC) regulations.
3. Payment Processing: To process deposits and withdrawals made via Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and RHB, as well as cryptocurrency channels (BTC/USDT).
4. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, identity theft, bonus abuse, and other prohibited activities on the Platform.
5. Responsible Gambling: To monitor your gambling behaviour for indicators of problem gambling, to enforce any self-exclusion or account limit requests you have made, and to comply with our responsible gambling obligations.
6. Customer Support: To respond to your queries, complaints, and support requests through live chat, email, and WhatsApp channels.
7. Legal Compliance: To comply with applicable laws and regulations, including responding to lawful requests from regulatory authorities, courts, or law enforcement agencies.
8. Platform Improvement: To analyse usage data in aggregate form to improve the Platform's design, functionality, game selection, and overall user experience for Malaysian players.
9. Marketing Communications: Where you have provided explicit consent, to send you promotional offers, bonus notifications, and platform updates by email or SMS. You may withdraw this consent at any time through your account settings.

Ironman88 processes your personal data on the following legal bases, depending on the nature and purpose of each processing activity:

• Performance of a Contract: Processing that is necessary to fulfil our contractual obligations to you under our Terms & Conditions — for example, creating your account, processing deposits and withdrawals, and delivering gaming services.
• Legal Obligation: Processing that is required to comply with applicable laws and regulatory requirements, including KYC verification, AML reporting, and data retention obligations under relevant financial regulations.
• Legitimate Interests: Processing undertaken to protect Ironman88's legitimate business interests where these do not unduly override your privacy rights — for example, fraud detection, platform security, and aggregate analytics for service improvement.
• Consent: Processing activities for which Ironman88 relies on your explicit prior consent, including direct marketing communications and the placement of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Ironman88 uses cookies and similar tracking technologies to operate the Platform, enhance your user experience, and gather analytical data. A cookie is a small text file stored on your device when you visit a website.

The following categories of cookies are used on the Ironman88 Platform:

• Strictly Necessary Cookies: Essential to the operation of the Platform. They enable core functions such as session management, login persistence, and security features. These cookies cannot be disabled.
• Functional Cookies: Allow the Platform to remember your preferences, such as language selection and display settings, to provide a more personalised experience on subsequent visits.
• Analytical Cookies: Used to collect aggregate statistical data about how visitors interact with the Platform — pages visited, session duration, error reports — to help us improve Platform performance for Malaysian users.
• Security Cookies: Used for fraud detection, account authentication, and protection against cross-site request forgery (CSRF) and other security threats.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may impair the functionality of the Ironman88 Platform. Most modern browsers allow you to view, delete, and block cookies from specific websites through the browser's privacy or settings menu.

Ironman88 does not sell your personal data. We may share your data with carefully selected third parties only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Service Providers: To process deposits and withdrawals via approved Malaysian payment channels, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and partnered banks (Maybank, CIMB, Public Bank, Hong Leong, RHB). These providers process your financial data as independent data controllers under their own privacy policies.
• Identity Verification Providers: To conduct KYC and age verification checks using your identity documents and personal details. These providers are contractually bound to process your data only for verification purposes.
• Gaming Content Providers: Limited technical session data may be shared with licensed game providers to enable participation in their games and to validate game outcomes. Game providers do not receive your identity or financial data beyond what is technically required.
• Regulatory & Law Enforcement Authorities: Where required by law, court order, or regulatory direction, we may disclose your personal data to government agencies, law enforcement authorities, or our licensing regulator. We will inform you of such disclosure where legally permitted to do so.
• Fraud Prevention Networks: In cases of suspected fraud, money laundering, or other prohibited activity, we may share relevant data with fraud prevention services and, where required, with financial intelligence units.
• Professional Advisers: Lawyers, auditors, and consultants engaged by Ironman88 may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.

All third parties with whom Ironman88 shares personal data are required to process it in accordance with applicable data protection law and are contractually prohibited from using it for any purpose other than the one for which it was shared.

Ironman88 primarily processes personal data in connection with its operations serving Malaysian users. In certain circumstances, your personal data may be transferred to, stored in, or processed in jurisdictions outside Malaysia — for example, in connection with data processors or game providers whose servers are located in other countries.

Where such international transfers occur, Ironman88 takes appropriate measures to ensure that your personal data continues to receive an adequate level of protection equivalent to that provided under applicable Malaysian data protection standards. Such measures may include the use of contractual data processing agreements, standard data transfer clauses, or transfers to jurisdictions recognised as providing adequate data protection.

If you have questions about the specific safeguards applied to any international transfer of your personal data, you may contact Ironman88's support team at the contact details provided in Section 15 of this Policy.

Ironman88 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and for as long as required by applicable law or regulatory obligation.

• Account Data: Retained for the duration of your account and for a minimum period of five (5) years following account closure, in accordance with AML regulatory requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years following the completion of the verification process, or longer where required by applicable law.
• Transaction Records: Deposit and withdrawal records, including MYR amounts and payment method identifiers, are retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Records: Live chat transcripts, email correspondence, and support ticket records are retained for three (3) years from the date of the interaction.
• Marketing Consent Records: Records of your marketing consent (or withdrawal thereof) are retained for the duration of any associated processing activity plus one (1) year.
• Technical & Log Data: Server logs and session data are retained for a maximum of twelve (12) months from the date of collection, after which they are anonymised or securely deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in such a way that it can no longer be attributed to any identifiable individual.

Ironman88 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes the following:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Ironman88 Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. Encrypted connections are indicated by the HTTPS prefix in your browser's address bar.
• Data Storage Encryption: Sensitive personal data and financial information stored on Ironman88's systems is encrypted at rest using AES-256 encryption.
• Access Controls: Access to systems containing personal data is restricted to authorised Ironman88 personnel on a strict need-to-know basis. All staff with access to personal data undergo regular data protection training.
• Two-Factor Authentication (2FA): Available for all Member accounts and mandatory for all Ironman88 administrative systems to prevent unauthorised access.
• Fraud Monitoring: Automated and manual fraud detection systems continuously monitor account activity, transaction patterns, and login behaviour for signs of compromise or misuse.
• Penetration Testing: Regular third-party security assessments are conducted on Ironman88's platform infrastructure to identify and remediate vulnerabilities.
• Incident Response: Ironman88 maintains a documented data breach response procedure. In the event of a data security incident that poses a risk to your rights, we will notify affected data subjects and relevant authorities in accordance with applicable law.

While Ironman88 employs robust security measures, no online system is entirely immune from security risks. You are encouraged to maintain a strong, unique password for your Ironman88 account and to notify us immediately if you suspect any unauthorised access.

As an individual whose personal data is processed by Ironman88, you hold the following rights in respect of your data. To exercise any of these rights, please contact our support team using the details in Section 15.

Ironman88 will respond to all verifiable data rights requests within thirty (30) days of receipt. In complex or high-volume cases, this period may be extended by a further sixty (60) days, in which case we will inform you of the extension and the reason for it. We may ask you to verify your identity before processing a data rights request to protect against unauthorised access to account information.

The Ironman88 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect or process personal data from any person under the age of 21.

All new member registrations are subject to age verification as part of our KYC process. Where we discover that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete the personal data concerned to the extent permitted by law, and take appropriate steps to prevent further access.

If you are a parent or guardian and have reason to believe that your child has registered an account on Ironman88, please contact our support team immediately using the contact details provided in Section 15 of this Policy.

The Ironman88 Platform may contain hyperlinks to third-party websites, including information resources, payment service providers, and licensing authority websites. This Privacy Policy applies exclusively to personal data processed by Ironman88 and does not extend to any third-party website, application, or service that may be linked from the Platform.

Ironman88 does not control the privacy practices or data processing activities of third-party websites and accepts no liability for the privacy or security of personal data processed by such third parties. We strongly recommend that you review the privacy policy of any third-party website before submitting personal data to it.

Ironman88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date of any revised version will be clearly indicated at the top of this page.

Where changes to this Policy are material — meaning they significantly affect how we collect, use, or share your personal data — we will provide advance notice to registered Members via email or through a prominent notification on the Platform at least fourteen (14) days before the changes take effect.

We encourage you to review this Privacy Policy periodically to remain informed of how Ironman88 protects your personal data. Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

For all privacy-related enquiries, data rights requests, or questions regarding this Privacy Policy, please contact the Ironman88 Data Protection team through the following channels. All enquiries are handled by trained staff and responded to within the timeframes specified in Section 11.

• Email: [email protected] — please include "Privacy Request" in the subject line for prompt routing to the appropriate team.
• Live Chat: Available 24 hours a day, 7 days a week — including all Malaysian public holidays — in English, Bahasa Melayu, and Mandarin. Average first response: 3–5 minutes.
• WhatsApp: Contact details are available to verified Members through the Platform's Account support section.

When submitting a data rights request, please provide your registered username and the email address associated with your Ironman88 account to allow us to verify your identity and locate your data efficiently.