Introduction
iMenang ("iMenang", "we", "us", "our") operates the online casino and sports betting platform accessible at https://imenang.cam. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you — or that you provide to us — will be processed by us.
iMenang is committed to operating in a transparent and accountable manner in relation to the personal data of our members. This Policy is designed to comply with applicable data protection legislation, including the Personal Data Protection Act 2010 of Malaysia (PDPA 2010), and to reflect international best practices in data privacy governance.
This Policy applies to all personal data processed by iMenang in connection with your registration, use, and membership of the iMenang platform, regardless of the device or channel through which you access our services. It should be read alongside our Terms and Conditions, which govern the overall terms of your membership.
By registering an account on iMenang or continuing to use the platform after this Policy has been published or updated, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.
Definitions
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
Any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial information, device identifiers, and behavioural data.
The individual to whom the personal data relates — in the context of this Policy, you as a registered or prospective member of the iMenang platform.
The entity that determines the purposes and means of processing personal data — in this context, iMenang.
Any third party that processes personal data on behalf of iMenang, pursuant to a data processing agreement and acting under iMenang's documented instructions.
Any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction, whether or not by automated means.
Know Your Customer — the identity and document verification process conducted by iMenang to confirm member identity and comply with applicable anti-money laundering and regulatory requirements.
Personal Data We Collect
iMenang collects personal data that is necessary for the lawful and efficient operation of the platform. The categories of personal data we collect are as follows:
3.1 Identity & Contact Data
- Full legal name as it appears on a government-issued identification document
- Date of birth
- Email address
- Mobile telephone number
- Residential address, including city, state, and postcode
3.2 Verification & KYC Data
- MyKad number or passport number
- Copies of government-issued identification documents (front and back)
- Proof of residential address (utility bills, bank statements)
- Source-of-funds documentation where required
- Facial biometric data for liveness checks, where applicable and with consent
3.3 Financial & Transaction Data
- Bank account numbers and registered account name
- E-wallet identifiers (GrabPay, Touch 'n Go eWallet, Boost)
- Transaction history, including deposits, withdrawals, and wager records
- Payment method preferences
3.4 Technical & Usage Data
- IP address and approximate geolocation data
- Device type, operating system, browser type and version
- Session timestamps, login history, and activity logs
- Game play history, betting patterns, and platform interaction data
- Cookie identifiers and tracking pixel data (see Section 10)
3.5 Responsible Gambling Data
- Self-imposed deposit limits, loss limits, and session limits
- Self-exclusion records and cooling-off period history
- Responsible gambling tool interaction records
How We Collect Personal Data
iMenang collects personal data through the following channels and mechanisms:
- Direct submission: Data provided by you during account registration, KYC verification, deposit or withdrawal requests, support enquiries, and participation in promotions.
- Automated technical collection: Data collected automatically when you access the platform, including server logs, cookies, device fingerprinting, and analytics tools.
- Third-party payment providers: Transaction confirmation data received from GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, and Malaysian banking partners during payment processing.
- Identity verification services: Data received from third-party KYC and identity verification service providers engaged by iMenang.
- Fraud prevention and compliance databases: Data received from financial crime screening services and sanctions list providers as part of our anti-money laundering compliance obligations.
- Customer support interactions: Records of Live Chat conversations, email correspondence, and support ticket history.
Data Processing & Use
iMenang processes your personal data for the following specific and legitimate purposes:
| Purpose | Data Used |
|---|---|
| Account registration and management | Identity data, contact data, login credentials |
| Identity verification (KYC) | Identification documents, date of birth, address |
| Processing deposits and withdrawals | Financial data, payment method details, transaction history |
| Delivery of gaming and betting services | Account data, usage data, game history |
| Customer support and complaint handling | Contact data, account data, correspondence records |
| Fraud prevention and security monitoring | Technical data, transaction data, device identifiers |
| Anti-money laundering (AML) compliance | Identity data, financial data, source-of-funds information |
| Personalised promotions and bonus offers | Usage data, betting history, VIP tier data |
| Responsible gambling monitoring | Betting patterns, responsible gambling settings, usage data |
| Platform analytics and product improvement | Aggregated and anonymised usage data |
iMenang does not use your personal data for purposes other than those described above without first obtaining your explicit consent, unless processing is required to comply with a legal obligation.
Legal Basis for Processing
iMenang processes your personal data on the following legal bases under applicable data protection law:
- Contractual necessity: Processing required to perform our obligations under the iMenang Terms and Conditions, including account registration, game delivery, and payment processing.
- Legal obligation: Processing required to comply with applicable law, including KYC and anti-money laundering obligations under Malaysian financial regulations and international compliance standards.
- Legitimate interests: Processing carried out to pursue iMenang's legitimate business interests, including fraud prevention, platform security, and product analytics — provided such interests are not overridden by your fundamental rights and freedoms.
- Consent: Processing carried out with your explicit prior consent, including personalised marketing communications and optional data collection features. You may withdraw consent at any time by contacting our support team, though withdrawal of consent will not affect the lawfulness of prior processing.
Data Sharing & Disclosure
iMenang does not sell, trade, or rent your personal data to any third party for their own commercial purposes. Your personal data may be shared only in the following strictly controlled circumstances:
7.1 Payment Service Providers
Transaction data is shared with Malaysian payment providers — including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, and partner banks (Maybank, CIMB, Public Bank, RHB, Hong Leong) — solely to the extent necessary to process your deposit and withdrawal transactions.
7.2 Identity Verification Partners
Identity and document data is shared with contracted KYC service providers for the purpose of conducting mandatory identity verification. These providers act as Data Processors under binding data processing agreements and are prohibited from using your data for any other purpose.
7.3 Regulatory & Law Enforcement Authorities
iMenang may be required by law to disclose your personal data to relevant governmental, regulatory, or law enforcement authorities, including in connection with anti-money laundering investigations, court orders, or mandatory regulatory reporting obligations. Such disclosures will only be made to the extent required or permitted by applicable law.
7.4 Group Companies & Affiliates
Personal data may be shared within the iMenang corporate group for internal operational and compliance purposes, on a need-to-know basis, subject to equivalent data protection standards.
7.5 Professional Advisers
Personal data may be disclosed to legal, audit, or financial advisers engaged by iMenang where such disclosure is necessary for the provision of professional services, subject to binding confidentiality obligations.
All third parties with whom iMenang shares personal data are bound by contractual obligations requiring them to maintain the confidentiality and security of your data, and to process it only in accordance with iMenang's documented instructions and applicable law.
Data Retention
iMenang retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:
- Active account data: Retained for the duration of your membership and for a period of at least five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
- KYC and identity documents: Retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later.
- Transaction records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial regulatory requirements.
- Customer support records: Retained for three (3) years from the date of the final correspondence, unless the matter remains unresolved or subject to a legal hold.
- Technical and usage logs: Retained for twelve (12) months in identifiable form, after which data is anonymised or deleted.
- Marketing consent records: Retained until consent is withdrawn, plus an additional period of one (1) year for compliance record-keeping.
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with iMenang's data disposal procedures.
Data Security
iMenang implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security infrastructure includes, but is not limited to:
- 256-bit SSL/TLS encryption for all data transmitted between your device and the iMenang platform.
- Encryption at rest for sensitive data stored in our databases, including payment details and identity documents.
- Role-based access controls restricting staff access to personal data on a strict need-to-know basis.
- Regular third-party security audits and penetration testing of our platform infrastructure.
- Intrusion detection and anomaly monitoring systems operating 24/7.
- Multi-factor authentication for all staff access to systems containing personal data.
- Incident response procedures for managing and notifying data breaches in accordance with applicable notification requirements.
You are also responsible for maintaining the security of your own account credentials. iMenang strongly recommends using a unique and complex password and enabling any available two-factor authentication on your account. If you suspect that your account has been accessed without your authorisation, please contact iMenang support immediately.
Cookies & Tracking Technologies
iMenang uses cookies and similar tracking technologies on the platform to enhance user experience, maintain session continuity, and collect analytical data. The types of cookies used by iMenang are as follows:
10.1 Strictly Necessary Cookies
These cookies are essential for the operation of the platform, including maintaining your login session and ensuring the security of your account. They cannot be disabled without significantly impairing your ability to use the platform.
10.2 Performance & Analytics Cookies
These cookies collect aggregated and anonymised information about how members use the iMenang platform, including which pages are visited most frequently and how users navigate between sections. This data is used solely to improve platform performance and user experience.
10.3 Functional Cookies
These cookies allow the platform to remember your preferences, such as language settings and display preferences, to provide a more personalised experience during your session.
10.4 Managing Cookies
You may control or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the iMenang platform. Details of your browser's cookie management options can be found in your browser's help documentation.
Your Rights as a Data Subject
Under applicable data protection law, including the PDPA 2010, you have the following rights in relation to your personal data held by iMenang. You may exercise any of these rights by contacting our data protection point of contact via the details set out in Section 15.
Right of Access
You have the right to request a copy of the personal data iMenang holds about you, together with information about how it is being processed.
Right to Correction
You have the right to request correction of any inaccurate or incomplete personal data held by iMenang without undue delay.
Right to Erasure
You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable legal retention obligations.
Right to Restrict Processing
You may request that iMenang restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
Right to Data Portability
Where processing is based on consent or contractual necessity and carried out by automated means, you may request that iMenang provides your data in a structured, machine-readable format.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing carried out on the basis of consent.
iMenang will respond to all verified data subject requests within 21 business days of receipt. We may need to verify your identity before processing a request to ensure we are disclosing or amending the correct data. We reserve the right to decline requests that are manifestly unfounded, excessive, or contrary to our legal obligations.
Minors & Age Restriction
The iMenang platform is strictly restricted to individuals who are 21 years of age or older. iMenang does not knowingly collect, process, or retain personal data of individuals under the age of 21.
During the account registration process, all applicants are required to confirm their date of birth, and identity verification (KYC) procedures are in place to detect and prevent underage registration. Where iMenang identifies that a member account has been registered by an individual under the age of 21, the account will be immediately suspended, all associated balances will be withheld pending investigation, and the personal data of the underage individual will be securely deleted in accordance with applicable law.
If you have reason to believe that a minor has registered an account on iMenang, please contact our support team immediately so that we can take appropriate action.
International Data Transfers
iMenang primarily processes and stores personal data within secure data centre facilities. In certain circumstances, personal data may be transferred to, and processed by, service providers located in jurisdictions outside Malaysia, including in connection with cloud infrastructure services, identity verification platforms, and live dealer game studios operating from licensed facilities in Eastern Europe and Asia.
Where personal data is transferred internationally, iMenang ensures that adequate safeguards are in place to protect your data, including through contractual clauses requiring recipient parties to maintain data protection standards equivalent to those applicable in Malaysia. By using the iMenang platform, you acknowledge and consent to such international transfers where necessary for the delivery of our services.
Policy Amendments
iMenang reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our data processing practices, or the services we offer. When material changes are made to this Policy, we will notify registered members via email or an in-platform notification at least fourteen (14) days before the changes take effect, where practicable.
The "Last Updated" date displayed at the top of this Policy will be revised on each occasion the Policy is amended. You are encouraged to review this Policy periodically to stay informed of how iMenang handles your personal data. Continued use of the iMenang platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by iMenang, please contact our data protection point of contact through any of the following channels:
When submitting a data subject request, please include your full name, registered email address, and a clear description of your request to enable us to process it efficiently. We may need to verify your identity before we are able to fulfil your request.