Ong918 Privacy Policy

1Introduction

This Privacy Policy ("Policy") is issued by Ong918 ("we", "us", "our", "the Platform") and applies to all personal data collected from individuals ("Users", "Players", "you") who access or use the website at ong918.cam and all associated pages, mobile interfaces, and related digital properties.

Ong918 operates as an online entertainment platform offering casino gaming, sports betting, and related services primarily to English-speaking users across Malaysia, including players in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam. As a platform that processes financial transactions and verifies user identities in compliance with anti-money laundering requirements, we necessarily collect and process certain personal data as described in this Policy.

We are committed to handling your personal data with integrity, transparency, and proportionality. We collect only what we need, use it only for the purposes described in this Policy, and give you meaningful control over how your information is managed. This Policy should be read alongside our Terms & Conditions, which form part of the overall agreement between you and ong918.

2Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or any combination thereof.
• "Data Controller" means Ong918, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party engaged by ong918 to process personal data on its behalf, subject to data processing agreements.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "KYC" means Know Your Customer verification procedures, including identity and address verification required under anti-money laundering obligations.
• "Cookie" means a small text file placed on a User's device by a website for the purpose of recognising the device on future visits.
• "Account" means a registered user account on the ong918 Platform.
• "Sensitive Data" means personal data that by its nature warrants heightened protection, including financial data, identification documents, and responsible gambling self-assessment information.

3Data We Collect

Ong918 collects personal data from you through several channels: directly when you register an account or interact with the Platform, automatically through your use of the Platform, and from third parties where permitted by law and necessary for compliance purposes.

When you create an account, we collect: full legal name, date of birth, residential address, email address, phone number, and chosen username. This data is required to establish your account and verify your eligibility to use the Platform.

To comply with anti-money laundering (AML) obligations and to verify your age and identity before processing withdrawals, we collect copies of government-issued identification documents (such as Malaysian MyKad or passport) and proof of address (such as a utility bill or bank statement dated within three months). This data is handled with enhanced security measures as described in Section 8.

We collect records of all deposits, withdrawals, and gaming transactions conducted through the Platform. This includes payment method identifiers (such as the last four digits of a bank account, e-wallet account reference, or partial card number), transaction amounts in MYR, timestamps, and transaction reference numbers. Full payment credentials — such as complete bank account numbers — are processed exclusively by our authorised payment service providers and are not stored by ong918.

We record your gaming activity on the Platform, including games played, wager amounts, session durations, win and loss records, and bonus redemption history. This data is used for account management, responsible gambling monitoring, fraud detection, and regulatory compliance.

We automatically collect certain technical information when you visit the Platform, including: IP address, device type and operating system, browser type and version, referring URL, pages visited, session duration, and clickstream data. This information is collected via cookies and server logs as described in Section 9.

When you contact our customer support team via live chat or email, we retain records of that correspondence, including your queries, the responses provided, and any account information referenced in the exchange. This data is retained for quality assurance, training, and dispute resolution purposes.

If you use our responsible gambling tools — including deposit limit settings, self-exclusion requests, or cooling-off periods — we record those preferences and instructions. This data is treated as sensitive and is accessible only to authorised personnel involved in player protection operations.

4How We Use Your Data

Ong918 uses your personal data only for legitimate purposes that are proportionate to the data collected. We use your personal data for the following specific purposes:

1. Account creation and management — establishing, maintaining, and administering your ong918 account, including password reset and account security functions.
2. Payment processing — facilitating deposits and withdrawals in MYR through Malaysian payment methods including Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency.
3. Identity and age verification — confirming that you meet the minimum age requirement of 21 years and that your identity documents are genuine, in compliance with KYC obligations.
4. Anti-money laundering compliance — monitoring transaction patterns to detect and prevent money laundering, fraud, and financial crime, as required by applicable regulations.
5. Fraud detection and platform security — identifying suspicious activity, preventing multi-accounting, and protecting the integrity of the Platform for all users.
6. Responsible gambling — monitoring gaming behaviour for signs of problematic gambling, enforcing deposit limits and self-exclusion settings, and complying with responsible gambling obligations.
7. Customer support — responding to your enquiries, resolving disputes, and improving the quality of our support services.
8. Platform improvement and analytics — analysing anonymised usage data to improve the performance, features, and user experience of the Platform.
9. Legal compliance — meeting obligations under applicable laws, responding to lawful requests from regulatory or law enforcement authorities, and maintaining required records.
10. Marketing communications — sending you promotional offers, bonus notifications, and personalised recommendations, where you have consented to receive such communications or where we have a legitimate interest to do so.

5Legal Basis for Processing

Where applicable data protection law requires us to identify a legal basis for each category of processing, we rely on the following:

• Contractual necessity — processing required to perform the contract between you and ong918, including account management, payment processing, and KYC verification.
• Legal obligation — processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and responses to lawful authority requests.
• Legitimate interests — processing for fraud detection, platform security, responsible gambling monitoring, and general analytics, where these interests are not overridden by your privacy rights.
• Consent — processing for direct marketing communications and non-essential cookies, where you have provided clear and affirmative consent that you may withdraw at any time.

6Disclosure to Third Parties

Ong918 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data with third parties only in the following limited circumstances:

Your financial data is shared with our authorised payment processors — including operators of Maybank2u, CIMB Clicks, Public Bank online banking, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — solely for the purpose of processing your deposit and withdrawal transactions. These providers operate under their own privacy policies and are bound by data processing agreements with ong918.

For KYC and AML compliance, we may share your identity documents and personal details with third-party identity verification service providers. All such providers are bound by contractual data protection obligations consistent with applicable law.

We may disclose your personal data to government agencies, financial intelligence units, law enforcement bodies, or regulatory authorities where we are required to do so by applicable law or pursuant to a lawful court order. We will notify you of any such disclosure where permitted by law to do so.

We engage third-party service providers for cloud hosting, data analytics, customer support software, fraud detection tools, and platform security monitoring. These providers access only the data necessary to perform their specific service function and are contractually prohibited from using your data for any other purpose.

In the event of a merger, acquisition, restructuring, or sale of all or part of ong918's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy practices of the new controller before the transfer takes effect.

7Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to any longer retention periods required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where anonymised data is used for aggregate analytics, it is no longer considered personal data and is not subject to this Policy.

8Data Security

Ong918 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security programme includes:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and ong918 servers is encrypted using 256-bit SSL/TLS protocols.
• Data encryption at rest: Sensitive personal data stored on our servers is encrypted using industry-standard encryption algorithms.
• Access controls: Personal data is accessible only to authorised ong918 personnel on a need-to-know basis, enforced through role-based access control systems.
• Network security: Our infrastructure is protected by firewalls, intrusion detection systems, and continuous security monitoring.
• Penetration testing: We conduct regular security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident response: We maintain a documented data breach response procedure. In the event of a data breach affecting your rights, we will notify affected users and relevant authorities within the timeframes required by applicable law.

9Cookies & Tracking Technologies

Ong918 uses cookies and similar tracking technologies to operate the Platform, maintain session security, analyse usage patterns, and improve user experience. The following categories of cookies are used:

These cookies are essential for the Platform to function and cannot be disabled. They enable core functionality such as user authentication, session management, security token verification, and payment gateway integration. No consent is required for these cookies.

These cookies remember your preferences — such as your preferred language, display settings, and session continuity — to provide a more personalised experience. They are not strictly necessary but enhance Platform usability.

We use anonymised analytical cookies to understand how users navigate the Platform — which pages are visited most, where users encounter difficulties, and how the Platform performs across different devices and connection types. This data is used exclusively to improve the Platform and is never used to identify individual users.

You may disable non-essential cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. Instructions for managing cookies vary by browser — consult your browser's help documentation for specific guidance.

10International Data Transfers

Ong918's primary operations and data infrastructure are located in Asia. In the course of operating the Platform, your personal data may be processed by service providers located outside Malaysia — for example, cloud infrastructure providers or identity verification services operating in other jurisdictions.

Where personal data is transferred outside the jurisdiction in which it was collected, we ensure that appropriate safeguards are in place to protect your data at a standard consistent with applicable Malaysian data protection law. These safeguards include contractual data protection clauses incorporated into our agreements with overseas processors and, where applicable, reliance on adequacy determinations by relevant regulatory authorities.

11Your Rights

Subject to applicable law and certain limited exceptions (such as where exercising a right would conflict with AML obligations or an ongoing investigation), you have the following rights in relation to your personal data held by ong918:

To exercise any of these rights, please contact us as described in Section 15. We will respond to all verified requests within 30 days. Where a request is complex or voluminous, we may extend this period by a further 30 days, notifying you of the extension within the initial 30-day window.

12Minors & Age Verification

The ong918 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from persons under the age of 21, and we do not permit persons under 21 to register an account or use any service offered on the Platform.

Age verification is conducted as part of the KYC process. Any account found to have been registered using a false date of birth or by a person under 21 will be suspended immediately, all associated personal data will be handled in accordance with our data retention obligations, and any winnings held in the account will be forfeited in accordance with our Terms & Conditions.

13Third-Party Links

The ong918 Platform may contain references to or indirect interaction with third-party services, including the payment platforms of Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, and GrabPay, when you initiate a deposit or withdrawal. These third-party platforms operate under their own privacy policies and terms of use, over which ong918 has no control.

Ong918 does not embed third-party advertising networks, social media trackers, or external analytics scripts on its Platform. We do not link to external websites for commercial or informational purposes within the main Platform interface. Any data shared with third-party payment providers is limited strictly to what is necessary to complete the relevant financial transaction.

14Policy Amendments

Ong918 reserves the right to update or revise this Privacy Policy from time to time in response to changes in applicable law, our data processing practices, or the features and services offered on the Platform.

Where a change is material — meaning it significantly affects how we collect, use, or share your personal data, or meaningfully alters your rights — we will provide at least 14 days' advance notice via the email address registered to your account or by displaying a prominent notice on the Platform before the change takes effect.

Non-material changes (such as clarifications to existing language, typographical corrections, or administrative updates) may be made without advance notice, but the version date at the top of this document will be updated to reflect the revision. We encourage you to review this Policy periodically. Your continued use of the Platform after any revised Policy takes effect constitutes your acceptance of the updated terms.

15Contact & Complaints

If you wish to exercise any of your data rights, have a question about this Policy, wish to withdraw consent for any processing activity, or have a complaint about how ong918 handles your personal data, please contact us using the details below:

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. In Malaysia, queries relating to personal data protection may be directed to the Department of Personal Data Protection (JPDP) under the Personal Data Protection Act 2010 (PDPA).