Privacy Policy

This Privacy Policy ("Policy") is issued by Datochai ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at datochai.cam ("Platform"). It sets out how Datochai collects, uses, discloses, stores, and protects personal data provided by or obtained from users ("you", "Player", "data subject") of the Platform.

Datochai is committed to handling personal data responsibly and in accordance with applicable data protection principles. This Policy is intended to be read in conjunction with our Terms and Conditions, which govern your use of the Platform, and our Responsible Gambling Policy.

By registering an account, making a deposit, or otherwise using the Datochai Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not accept this Policy, you must not use the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

Datochai collects personal data in the categories set out below. The specific data collected depends on the services you use and the stage of your interaction with the Platform.

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (to verify you are aged 21 or above);
• Email address and telephone number;
• Residential address, including city and postcode;
• Username and encrypted password hash.

3.2 Identity Verification (KYC) Data

• Copies of valid government-issued photo identification (MyKad, Passport, or Driver's Licence);
• Proof of residential address (utility bill or bank statement dated within 90 days);
• Selfie photograph holding the presented identity document;
• Additional documents requested under enhanced due diligence procedures.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records denominated in MYR;
• Payment method details (e-wallet account references, bank account names, cryptocurrency wallet addresses) — note that Datochai does not store full card numbers;
• Transaction timestamps, amounts, and processing status;
• Source of funds declarations where required under AML procedures.

3.4 Gaming Activity Data

• Game session logs including start/end times, wager amounts, and outcomes;
• Sports betting selections, odds accepted, and settlement results;
• Bonus and promotion usage records;
• Responsible gambling limit settings and self-exclusion history.

3.5 Technical & Device Data

• IP address and geolocation data (country and city level);
• Device type, operating system, and browser version;
• Session duration and Platform navigation patterns;
• Cookie identifiers and similar tracking technologies.

3.6 Communications Data

• Records of live chat conversations with our support team;
• Email correspondence sent to or received from [email protected];
• Survey responses and feedback submissions.

Datochai collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make deposits or withdrawals, contact our support team, or respond to surveys;
• Automatically: Through cookies, web beacons, server logs, and similar tracking technologies as you navigate and interact with the Platform;
• From third-party service providers: Identity verification partners, payment processors (including Touch 'n Go eWallet, Boost, GrabPay, FPX banking network, and DuitNow), fraud prevention services, and analytics providers may supply supplementary data to validate or enrich the information you provide;
• From publicly available sources: Regulatory watchlists, politically exposed persons (PEP) databases, and sanction screening lists consulted for AML compliance purposes.

Datochai processes your personal data for the following specific, legitimate purposes:

Datochai processes personal data on the following legal bases, depending on the specific purpose:

• Contractual necessity: Processing required to perform the contract between you and Datochai — including account creation, payment processing, and game service delivery;
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML legislation, KYC obligations under gaming licensing requirements, and financial record-keeping;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement — where such interests are not overridden by your rights and interests;
• Consent: Processing for direct marketing communications, optional analytics cookies, and any other purpose where we have sought and obtained your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Datochai does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share personal data with the following categories of recipients, strictly as necessary for the purposes described in Section 5:

• Payment service providers: Including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, and cryptocurrency processing services — to facilitate deposits and withdrawals;
• Identity verification providers: Third-party KYC and document verification services that assist with age verification and identity checks;
• Fraud and AML screening services: Providers of sanctions screening, PEP checks, and transaction monitoring tools used in our compliance programme;
• Game content providers: Game studios that supply casino and live dealer games may receive anonymised session data for RNG certification and audit purposes;
• IT and hosting providers: Cloud infrastructure and platform hosting services operating under data processing agreements with Datochai;
• Regulatory and law enforcement authorities: Where required by law, court order, or lawful regulatory instruction — Datochai will disclose personal data to competent authorities. Where legally permitted, we will notify you of such a request;
• Professional advisors: Lawyers, accountants, and auditors acting under professional confidentiality obligations.

Datochai retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and to meet applicable legal and regulatory retention obligations. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity logs: Retained for a minimum of three (3) years from the date of the session;
• Support communications: Retained for two (2) years from the date of the last interaction, unless a dispute remains outstanding;
• Marketing consent records: Retained until consent is withdrawn, and for one (1) year thereafter as evidence of consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymised, the resulting data may be retained indefinitely for statistical and analytical purposes.

The Datochai Platform uses cookies and similar tracking technologies to provide, maintain, and improve the service. The categories of cookies used are as follows:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect Platform functionality. Analytics cookies require your consent and can be declined or withdrawn at any time without affecting your ability to use the Platform.

Datochai implements a range of technical and organisational security measures proportionate to the sensitivity of the personal data processed. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and Datochai's servers;
• Encryption at rest for sensitive data fields including KYC documents, financial records, and authentication credentials;
• Password hashing using industry-standard algorithms — Datochai never stores passwords in plaintext;
• Two-factor authentication (2FA) available to all account holders for additional login security;
• Access controls restricting personal data access to authorised personnel on a need-to-know basis;
• Regular security assessments and vulnerability testing of Platform infrastructure;
• Incident response procedures for the detection, containment, and notification of personal data breaches.

While Datochai takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is entirely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying Datochai promptly if you suspect unauthorised access to your account.

Subject to applicable law, you have the following rights in relation to your personal data held by Datochai. To exercise any of these rights, please contact us at the details provided in Section 15.

Datochai will respond to data subject requests within thirty (30) days of receipt. Where a request is complex or numerous, the response period may be extended by a further two months, with notice provided within the initial 30-day window. We may request proof of identity before processing a data subject request.

The Datochai Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process for all account holders.

If Datochai becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, we will immediately suspend the relevant account, delete the associated personal data, and return any account balance to the payment source used to fund the account.

If you believe that a minor has registered an account or accessed the Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action.

The Datochai Platform may integrate with or reference third-party services — including payment processors such as Touch 'n Go eWallet, Boost, GrabPay, and FPX-connected banks — whose own privacy policies govern the handling of personal data within their respective systems. Datochai is not responsible for the privacy practices of third-party services accessed through or in connection with the Platform.

When you make a deposit or withdrawal via a third-party payment method, the relevant payment service provider will also process your transaction data in accordance with their own terms and privacy policy. Datochai recommends reviewing the privacy policies of any third-party services you use in connection with your Datochai Account.

Datochai reserves the right to amend this Privacy Policy at any time. When material changes are made, we will update the "Last updated" date at the top of this page and, where practicable, notify registered account holders via email or an in-Platform notification.

Your continued use of the Platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes to this Policy, you should cease using the Platform and may request account closure in accordance with our Terms and Conditions.

We encourage all users to review this Policy periodically to stay informed about how Datochai protects their personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact Datochai's data protection team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line for data subject requests;
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform. Our support team can direct your enquiry to the appropriate team;
• Response Time: Privacy enquiries via email are typically responded to within 2 business days. Formal data subject access requests are processed within 30 days as required.

Where you are not satisfied with Datochai's response to a privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances.