Privacy Policy

This Privacy Policy ("Policy") is issued by Dafabc ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals ("you", "the Player", "the User") who access or use the Dafabc website at https://dafabc.cam and all related services, features, games, payment integrations, and communication channels operated by the Platform.

Dafabc recognises the importance of privacy and is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy describes what personal data we collect, the purposes for which it is processed, how it is stored and protected, who it may be shared with, and the rights that are available to you in relation to that data.

By creating an account on the Platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. This Policy should be read alongside our Terms & Conditions, which form the primary governing agreement between you and the Platform.

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including names, contact details, identity documents, payment information, and behavioural data.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Dafabc, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third party engaged by Dafabc to process personal data on its behalf and under its written instructions (e.g., payment processors, analytics providers).
• "Cookies" — Small data files stored on your device by your browser when you visit the Platform, used to recognise returning users and maintain session state.
• "KYC" — Know Your Customer procedures, including identity and age verification processes required by the Platform.

Dafabc collects the categories of personal data described in the table below. Data is collected only to the extent necessary for the purposes described in this Policy.

Dafabc collects personal data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, or contacting customer support.
• Automated Technologies: Data collected automatically when you interact with the Platform, including through cookies, server logs, and session tracking technologies.
• Payment Providers: Transaction confirmation data received from FPX, DuitNow, and e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay) following payment events initiated by you.
• Third-Party Verification: Identity or address verification data obtained from third-party KYC service providers engaged to assist with age and identity verification.
• Platform Activity: Behavioural and gameplay data generated by your use of games, sports betting markets, and other Platform features.

Dafabc processes personal data for the following clearly defined purposes. We do not process personal data for any purpose beyond those listed unless additional consent is obtained or the processing is required by law:

• Account Management: To create, maintain, operate, and close player accounts, including authentication, customer support interactions, and account security.
• Payment Processing: To execute deposit and withdrawal transactions via FPX, DuitNow, and e-wallet channels, verify payment source legitimacy, and maintain transaction records as required by financial regulations.
• KYC & Fraud Prevention: To verify the identity and age of account holders, detect and prevent fraudulent activity, money laundering, and other prohibited conduct on the Platform.
• Platform Improvement: To analyse aggregated usage data and identify areas for product improvement, game library enhancement, and user experience optimisation.
• Customer Support: To respond to enquiries, resolve disputes, and maintain records of support interactions for quality assurance purposes.
• Responsible Gambling: To monitor gameplay patterns for indicators of problem gambling, administer self-exclusion requests, and enforce deposit and session limits configured by the player.
• Legal & Regulatory Compliance: To fulfil obligations imposed by applicable laws and to respond to lawful requests from regulatory or law enforcement authorities.
• Service Communications: To send transactional communications relating to your account, including deposit confirmations, withdrawal notifications, and security alerts.

Dafabc processes personal data on the following legal bases:

• Contractual Necessity: Processing necessary for the performance of the agreement with you as a registered player — including account creation, payment processing, and customer support.
• Consent: Where you have explicitly agreed to specific processing activities, such as the use of analytical cookies or receipt of promotional communications.
• Legitimate Interests: Processing carried out for purposes that are in the legitimate interests of Dafabc, including fraud detection, platform security, and service quality improvement, provided such interests are not overridden by your data protection rights.
• Legal Obligation: Processing required to comply with applicable legal or regulatory obligations, including financial record-keeping and mandatory identity verification requirements.

Dafabc does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties strictly on a need-to-know basis and only to the extent necessary for the specified purpose:

• Payment Service Providers: Malaysian banking institutions and e-wallet operators (including those operating the FPX and DuitNow networks) involved in processing your deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and age verification service providers engaged to validate account holder identities in compliance with anti-fraud and responsible gambling obligations.
• IT Infrastructure Providers: Cloud hosting, server, and cybersecurity service providers engaged to operate and protect the Platform's technical infrastructure.
• Analytics Providers: Aggregated and anonymised usage data may be shared with analytics service providers to support platform performance analysis. No identifiable personal data is shared for this purpose.
• Legal & Regulatory Authorities: Personal data may be disclosed to law enforcement agencies, regulatory bodies, or courts where required by applicable law or in response to a lawful order.

Dafabc processes payment data exclusively in Malaysian Ringgit (MYR) through the following verified Malaysian payment channels:

• FPX (Financial Process Exchange) — operated under the oversight of Payments Network Malaysia (PayNet).
• DuitNow Transfer — the real-time payment network supported by all major Malaysian banks including Maybank, CIMB, Public Bank, RHB, and Hong Leong.
• Touch 'n Go eWallet, Boost, and GrabPay — licensed Malaysian e-wallet operators subject to Bank Negara Malaysia oversight.

Full card numbers, bank account credentials, and e-wallet PINs are never stored on Dafabc's servers. Payment transactions are completed through secure tokenised redirects to the respective payment provider's environment. Dafabc retains only the transaction reference number, amount, payment method type, and timestamp for record-keeping purposes.

All payment accounts used to deposit funds must be registered in your own name. Dafabc will not process withdrawals to payment methods that differ from those used for deposits without satisfactory KYC documentation confirming ownership.

Dafabc uses cookies and similar technologies to operate and improve the Platform. The following cookie categories are in use:

Essential cookies cannot be disabled as they are required for the Platform to function. Functional and analytics cookies may be declined by adjusting your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform but may affect certain preference features.

Dafabc retains personal data for the following periods, after which data is securely deleted or anonymised:

• Active Account Data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, to meet legal, regulatory, and dispute resolution obligations.
• Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• KYC Documents: Identity verification documents are retained for a period of five (5) years following the end of the customer relationship.
• Support Communications: Customer support records are retained for three (3) years following the closure of the relevant support case.
• Analytics Data: Anonymised aggregate analytics data may be retained indefinitely as it does not constitute personal data.

Dafabc implements a comprehensive range of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmissions between your device and the Platform's servers.
• AES-256 encryption at rest for sensitive data fields including identity documents and financial records.
• Bcrypt password hashing — plaintext passwords are never stored.
• Multi-factor authentication (MFA) available to all account holders and mandatory for administrative access.
• Regular third-party security audits and penetration testing of the Platform infrastructure.
• Strict internal access controls — personal data is accessible only to authorised personnel with a documented business need.
• Intrusion detection systems and real-time monitoring for anomalous access patterns.

Notwithstanding the above, no internet-based platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own login credentials and are advised to use strong, unique passwords and to enable two-factor authentication.

As a data subject, you hold the following rights in relation to your personal data held by Dafabc. To exercise any of these rights, please contact our support team via live chat or at the email address listed in Section 16 of this Policy.

We will acknowledge all data rights requests within five (5) business days and aim to complete them within fourteen (14) business days. Complex requests may require up to thirty (30) days, in which case we will notify you of the extended timeline.

The Dafabc Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals below this minimum age threshold.

All account registrations are subject to age verification during the KYC process. Where it is discovered that personal data has been submitted by or on behalf of an individual under the age of 21, that data will be deleted immediately and the associated account will be permanently closed. Any funds held in such an account will be returned to the originating payment method following verification.

Where personal data is processed by third-party service providers whose systems are located outside of Malaysia, Dafabc ensures that appropriate safeguards are in place prior to any such transfer. Safeguards may include standard contractual clauses, binding corporate rules, or equivalent data protection mechanisms.

Payment transactions processed through Malaysian banking channels — including FPX, DuitNow, Maybank, CIMB, Public Bank, RHB, Hong Leong, Touch 'n Go eWallet, Boost, and GrabPay — are processed domestically within Malaysia's financial infrastructure and do not involve international data transfer.

Dafabc reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered players via email and by displaying a prominent notice on the Platform. The revised Policy will be published on this page with an updated Effective Date.

Your continued use of the Platform following publication of a revised Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how we handle your personal data. If you do not agree with a revised Policy, you may request account closure in accordance with the procedures described in our Terms & Conditions.

For any privacy-related questions, data rights requests, or concerns about how Dafabc handles your personal data, please contact our Data Protection team through the following channel:

• Live Chat: Available 24 hours a day, 7 days a week, directly within the Dafabc Platform.
• Email: [email protected] — please include "Privacy Request" in the subject line.

Our team will acknowledge your request within five (5) business days. For data rights requests, we aim to provide a substantive response within fourteen (14) business days from the date of acknowledgement. Where requests are complex or numerous, this period may be extended by up to a further thirty (30) days, and we will inform you accordingly.

You also have the right to lodge a complaint with a competent data protection supervisory authority in the jurisdiction where you reside or where the alleged infringement occurred, if you are dissatisfied with our handling of your personal data or a data rights request.