iron888 Privacy Policy for Malaysian Players

Definitions and scope

In this policy, “personal data” means information that identifies an individual or can reasonably be linked to an identifiable person. “Processing” includes collecting, recording, organising, storing, reviewing, using, sharing, restricting and deleting personal data. “Services” refers to the iron888 website, mobile interface, account facilities, casino games, live dealer content, sports betting markets, payment functions and support channels.

“Service providers” are organisations that support iron888 with functions such as identity verification, website hosting, fraud monitoring, payment processing, game delivery and customer support. Service providers may process information only for authorised purposes and subject to appropriate contractual or legal safeguards.

Information iron888 collects

The information collected depends on how you use iron888. Some details are supplied directly by you, while technical and transaction information may be generated automatically when you access the platform.

• Registration data: legal name, date of birth, residential address, nationality, username and contact details.
• Identity data: MyKad, driving licence or passport information, proof of address, photographs, selfies and verification results.
• Payment data: transaction references, deposit and withdrawal amounts, bank or eWallet ownership details and partial payment identifiers.
• Account activity: login history, casino sessions, sports wagers, bonuses, MYR balances, withdrawals and responsible gambling settings.
• Technical data: IP address, device type, operating system, browser, language settings, approximate location and security events.
• Communication data: support conversations, complaints, verification enquiries and communication preferences.

iron888 does not ask users to disclose account passwords, full card security codes or one-time banking codes through ordinary support conversations. Players should never send such information by email or unsecured chat.

How personal data is collected

iron888 collects information when you register, update your profile, upload KYC documents, request a withdrawal, choose an account limit, place a wager or contact support. Information may also be received from payment providers, identity verification services, fraud prevention databases and game or sportsbook suppliers when necessary to operate an account securely.

Technical information is generated when your browser or device communicates with iron888. This can include connection logs, page views, device identifiers and records of security checks. Such information helps maintain stable mobile performance across common Malaysian networks and detect unusual login behaviour.

Purposes of data processing

iron888 processes personal data only where there is an appropriate operational, contractual, legal, security or consent-based reason. Principal purposes include:

• Creating, administering and securing an iron888 account.
• Confirming identity and enforcing the minimum age requirement of 21.
• Processing MYR deposits and withdrawals through eligible payment methods.
• Recording and settling casino, live casino and sports betting activity.
• Preventing fraud, bonus abuse, duplicate accounts, collusion and unauthorised access.
• Applying deposit limits, cooling-off periods, self-exclusion and other responsible gambling controls.
• Responding to questions, account disputes and support requests.
• Maintaining platform security, service quality and mobile performance.
• Meeting applicable international licensing, financial crime and record-keeping obligations.

Where iron888 relies on legitimate operational interests, those interests are considered against the privacy impact on the player. Information will not be used for an unrelated purpose without an appropriate basis or further notice.

KYC and age verification

Casino-style services at iron888 are restricted to adults aged 21 and above. Identity verification supports age enforcement, payment ownership checks, account security and anti-fraud controls. iron888 may ask for a valid Malaysian MyKad, driving licence or passport, proof of address issued within the previous three months, a selfie or evidence that a payment method belongs to the account holder.

Verification documents must be uploaded through the secure iron888 account area. Review access is limited to authorised personnel and approved verification providers that require the information for their assigned purpose. A typical review may take 24–48 hours, although incomplete, inconsistent or higher-risk submissions may require longer.

MYR payments and financial information

When a player uses Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong or an eligible card, iron888 may receive transaction status, account ownership confirmation, reference numbers and limited payment details. A bank, eWallet or card provider may separately process information under its own privacy practices.

iron888 uses payment information to complete transactions, verify ownership, investigate chargebacks, comply with financial crime controls and resolve account disputes. Full card credentials should not be stored by iron888 where tokenised or provider-managed processing is available. Payment records may need to be retained after account closure to satisfy applicable security, accounting or compliance obligations.

Cookies and device technologies

iron888 may use cookies and similar technologies to keep users signed in, remember language or display preferences, protect sessions, identify technical problems and understand how website features perform. Essential cookies support security and core functionality and may be necessary for the service to work correctly.

Preference and analytical technologies may help iron888 improve navigation and mobile loading performance. Browser controls can be used to remove or block cookies, but restricting essential cookies may prevent login, security verification or account functions from operating as intended.

iron888 does not authorise cookies to collect passwords, one-time banking codes or unrelated private content from a user's device.

Disclosure of information

iron888 does not sell personal data as a standalone commercial product. Information may be disclosed only where reasonably necessary to operate services, protect users, comply with applicable requirements or investigate suspected misconduct.

• Payment processors may receive information required to complete MYR deposits and withdrawals.
• Identity providers may receive KYC details needed to confirm identity, age or document authenticity.
• Casino, sportsbook and technology suppliers may process limited account or activity identifiers for service delivery.
• Security providers may review device, network and transaction information for fraud prevention.
• Professional advisers or competent authorities may receive information where disclosure is legally required or necessary to protect legitimate rights.

Each disclosure is limited to information reasonably relevant to the stated function. Service providers are expected to apply confidentiality, security and data-handling requirements appropriate to the sensitivity of the information.

International data transfers

Because iron888 operates within an international online gaming environment, information may be processed outside Malaysia by hosting, payment, verification, security or game service providers. Privacy and data protection standards may differ between jurisdictions.

Where personal data is transferred internationally, iron888 seeks to use appropriate contractual, organisational and technical safeguards. Access should remain limited to authorised purposes, and recipients should be required to protect the information consistently with their obligations to iron888.

Data retention

iron888 retains personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, licensing, security, dispute resolution and financial record requirements. Retention periods can differ according to the type of record and account status.

Account identity records, transaction histories and responsible gambling restrictions may need to remain available after closure. For example, a self-exclusion record may be retained to prevent a player from bypassing a requested restriction. When information is no longer required, iron888 may delete it, anonymise it or place it beyond ordinary operational use.

Security measures

iron888 applies technical and organisational measures designed to protect personal data from unauthorised access, loss, misuse, alteration or disclosure. Measures may include HTTPS encryption, access controls, password protection, system monitoring, role-based permissions, backup procedures and staff confidentiality requirements.

No online service can promise absolute security. Players also have an important role: use a unique password, secure the registered device, avoid shared public networks when accessing payments and never disclose one-time codes. Suspected unauthorised access should be reported to iron888 promptly.

Your privacy rights

Subject to identity verification, applicable law and legitimate retention requirements, a user may ask iron888 to take certain actions concerning personal data. A request may be limited where disclosure would affect another person's privacy, compromise fraud prevention or conflict with a binding record-keeping obligation.

iron888 may request information needed to confirm that the person making a privacy request is the account holder. This protects users from fraudulent access requests. A response will be provided within a reasonable period, taking account of the request's complexity and any applicable requirements.

Responsible gambling information

Account activity may be reviewed to administer responsible gambling controls and identify patterns that could indicate potential harm. Relevant information may include deposit frequency, session length, repeated limit changes, failed payments and communication with support.

iron888 may use this information to display a reminder, suggest a break, restrict account activity or support a self-exclusion request. Responsible gambling information is treated as sensitive and should be accessible only to personnel who need it for player protection, compliance or account administration. Further details are available on the Responsible Gambling page.

Children and underage users

iron888 is not intended for anyone under 21. An underage person must not register, deposit, wager or submit identity information. Where iron888 reasonably believes that an account belongs to an underage user, access may be suspended while age is investigated.

A parent or guardian who believes that an underage person has supplied personal information should contact support. iron888 will review the report and take appropriate action, subject to identity, security and record-keeping requirements.

Policy updates

iron888 may revise this Privacy Policy when services, security practices, payment methods or applicable requirements change. The revised version will display an updated effective date. Material changes may also be communicated through the account interface or another appropriate channel.

Users should review this page periodically. Continued use of iron888 after an update means that the user has received the revised notice, but it does not replace separate consent where consent is specifically required.