Privacy Policy — How Indratogel Protects Your Data

This Privacy Policy ("Policy") is issued by Indratogel ("the Company", "we", "us", or "our") and applies to all personal data collected through the Indratogel online gaming platform accessible at indratogel.cam ("the Platform"), including all associated pages, services, features, and customer support channels.

Indratogel is committed to protecting the privacy and personal data of every player who accesses or uses the Platform. This Policy has been prepared in accordance with internationally recognised data protection principles and is intended to provide Malaysian players — and all other users of the Platform — with clear, comprehensive information about our data practices.

By registering an account, depositing funds, placing bets, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Indratogel is the Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a contractual obligation.
• "Data Subject" — the individual to whom personal data relates; in the context of this Policy, principally the registered player.
• "KYC" — Know Your Customer verification procedures required for identity confirmation, age verification, and source-of-funds compliance.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for a stated purpose.
• "Cookie" — a small text file placed on a user's device by a website for the purposes of session management, analytics, or personalisation.

Indratogel acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, Indratogel is responsible for determining why and how your personal data is processed, and for ensuring that such processing is carried out lawfully, fairly, and transparently.

Indratogel operates the Platform under international online gaming licensing. The Company's data protection practices are designed to meet internationally recognised standards and to respect the reasonable privacy expectations of Malaysian players and all other users of the Platform.

For all data protection enquiries, rights requests, or complaints, please contact our Data Protection contact point as detailed in Section 16 of this Policy.

Indratogel collects personal data across several categories depending on your level of interaction with the Platform. The following table sets out the principal categories of personal data we collect, the source of that data, and whether provision is mandatory or voluntary:

All processing of personal data by Indratogel is conducted on one or more of the following legal grounds:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and Indratogel (i.e., your account registration and use of the Platform). This covers registration data, financial data, KYC verification, and account management.
• Legal Obligation: Processing is required to comply with applicable laws, including anti-money laundering (AML) obligations, gaming licensing requirements, and international compliance standards. This primarily covers KYC data, transaction records, and responsible gambling documentation.
• Legitimate Interests: Processing is necessary for the legitimate interests of Indratogel or a third party, provided those interests are not overridden by your data protection rights. This covers fraud prevention, platform security, technical data collection, gameplay analytics, and improvement of customer support services.
• Consent: Where processing is based on your freely given, specific, and informed consent — most notably for direct marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Indratogel processes your personal data for the following specific purposes:

• Account creation and management: Registration, login authentication, account security, and profile maintenance.
• Transaction processing: Handling MYR deposits and withdrawals via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank integrations.
• Identity and age verification: KYC checks to confirm that all players are aged 21 or above and to meet regulatory obligations.
• Fraud detection and prevention: Monitoring for suspicious activity, multi-account detection, bonus abuse patterns, and unauthorised access attempts.
• Responsible gambling compliance: Administering deposit limits, session controls, self-exclusion requests, and player protection monitoring.
• Platform personalisation: Tailoring game recommendations, language preferences, and promotional content based on your activity and stated preferences.
• Customer support: Responding to enquiries, complaints, and support requests via live chat, email, and other channels in English, Bahasa Melayu, or Mandarin.
• Marketing communications: Sending promotional emails, bonus notifications, and platform updates where you have opted in to receive such communications.
• Legal and compliance obligations: Maintaining records as required under gaming licence conditions, AML regulations, and applicable international standards.
• Platform analytics and improvement: Analysing gameplay patterns, page performance, and user behaviour to improve platform features and user experience.

Indratogel does not sell your personal data to any third party. We may share your personal data with the following categories of third parties only to the extent necessary and under appropriate contractual safeguards:

• Payment Processors: FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong Bank), DuitNow operator, and e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay) for the purpose of processing MYR deposits and withdrawals.
• KYC Verification Providers: Third-party identity verification services used to validate government-issued identification documents and conduct age verification checks.
• Game Content Providers: Software and game providers whose titles are hosted on the Platform may receive anonymised gameplay data for technical and licensing compliance purposes.
• IT and Security Service Providers: Cloud infrastructure, cybersecurity, and data storage providers engaged by Indratogel under data processing agreements.
• Regulatory and Legal Authorities: Competent governmental or regulatory authorities where disclosure is required by applicable law, court order, or gaming licence conditions.
• Fraud Prevention Agencies: Industry-wide fraud and anti-money laundering detection networks where required for compliance purposes.

All third-party Data Processors engaged by Indratogel are required to process personal data solely in accordance with Indratogel's documented instructions and applicable data protection standards. We do not permit third-party Data Processors to use your data for their own independent marketing or commercial purposes.

Indratogel uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you access the Platform. The table below describes the categories of cookies we use:

You may manage cookie preferences through your browser settings. Disabling essential cookies will impair Platform functionality and may prevent you from accessing your account. Disabling functional or analytics cookies will not affect your ability to use the Platform's core features.

Indratogel retains personal data only for as long as is necessary to fulfil the purposes described in this Policy or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of the active account relationship plus 5 years following account closure, to meet AML and gaming licence record-keeping requirements.
• Transaction Records: Retained for a minimum of 5 years from the date of the transaction, in accordance with financial compliance obligations.
• KYC and Identity Documents: Retained for a minimum of 5 years from account closure or the date the KYC check was completed, whichever is later.
• Support and Communication Records: Retained for 2 years from the date of the final communication, unless the communication relates to a complaint or legal matter, in which case the standard 5-year period applies.
• Analytics Data: Aggregated and anonymised within 12 months of collection. Raw analytics data is deleted after 13 months.
• Marketing Consent Records: Retained for the duration of the active marketing relationship and for 3 years following opt-out, to evidence the withdrawal of consent.

Where data is no longer required, Indratogel will securely delete or anonymise it using industry-standard methods. Where data is anonymised beyond re-identification, it falls outside the scope of this Policy.

Indratogel implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS 1.3 (minimum). All payment data processed via FPX, DuitNow, and e-wallet integrations travels over encrypted channels.
• Encryption at Rest: Personal data and identity documents stored in Indratogel's systems are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data receive data protection training and are bound by confidentiality obligations.
• Password Security: Account passwords are stored in hashed and salted form. Indratogel does not store passwords in plaintext and cannot retrieve your password — only reset it through a verified process.
• Penetration Testing: The Platform undergoes regular security assessments, including penetration testing and vulnerability scanning, by qualified third-party security specialists.
• Incident Response: Indratogel maintains a documented data breach response procedure. In the event of a breach likely to result in risk to your rights and freedoms, affected players will be notified without undue delay.

As a data subject, you hold the following rights in relation to your personal data processed by Indratogel. These rights may be exercised by contacting us as described in Section 16:

All data rights requests are acknowledged within 5 business days and fully resolved within 30 calendar days of receipt. Complex requests may be extended to 60 days with written notification. Requests can be submitted by email to the contact details in Section 16 of this Policy. We may need to verify your identity before processing any rights request.

The Indratogel Platform is strictly intended for persons aged 21 years and above. Indratogel does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all registered accounts.

If Indratogel becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, the relevant account will be suspended immediately, all associated data will be securely deleted (subject to any applicable legal retention obligations), and any deposits held in that account will be returned to the payment source.

If you believe that a minor may have registered on or accessed the Platform, please contact our support team immediately at the details provided in Section 16 of this Policy.

Indratogel operates under international licensing and may process or store personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, Indratogel ensures that appropriate safeguards are in place to protect the data, including:

• Transfer to jurisdictions that provide an adequate level of data protection as assessed against internationally recognised standards;
• Binding contractual obligations on recipient Data Processors, including standard data protection clauses that impose equivalent obligations to those set out in this Policy;
• Technical and organisational security measures appropriate to the risk of the transfer.

Indratogel will not transfer your personal data to any jurisdiction that does not offer adequate protection without your explicit prior consent or without the implementation of appropriate contractual safeguards.

The Platform may integrate with or reference third-party services including payment processors (such as the providers behind DuitNow, FPX, and Malaysian e-wallet platforms), game software providers, and live streaming infrastructure.

These third-party services operate under their own privacy policies and are not governed by this Policy. Indratogel is not responsible for the data practices of third-party service providers beyond the Data Processing Agreements we have in place with each engaged processor. We encourage you to review the privacy policies of any third-party services you interact with in connection with Platform use.

The Indratogel Platform does not contain links to external third-party websites beyond those necessary for payment processing and identity verification. Where such integrations exist, they are disclosed in this Policy.

Indratogel reserves the right to amend this Privacy Policy at any time to reflect changes in data processing practices, regulatory requirements, or Platform functionality. Material changes will be communicated to registered players via email notification and/or a prominent on-Platform notice at least 7 days prior to the amended Policy taking effect, except where immediate amendment is required to comply with applicable law.

Minor amendments — such as corrections to typographical errors, clarifications that do not change the substance of the Policy, or administrative updates — may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the most recent revision.

Your continued use of the Platform following the effective date of an amended Policy constitutes your acceptance of the revised terms. The current version of this Policy is always accessible at indratogel.cam/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the Indratogel Data Protection team using the details below. When submitting a data rights request, please include your registered username and a description of your request to allow us to process it efficiently.