Kokoplay Privacy Policy

This Privacy Policy (hereinafter "the Policy") is issued by Kokoplay (hereinafter "Kokoplay", "we", "us", or "our") and governs the collection, use, storage, disclosure, and protection of personal data relating to all individuals (hereinafter "User", "you", or "your") who access or interact with the website located at kokoplay.cam and all associated subdomains and mobile-optimised versions thereof (hereinafter "the Platform").

Kokoplay operates as an English-language online gaming and sports betting platform serving Malaysian players across Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, Bangsar, and throughout Malaysia. As such, the personal data we process includes financial information associated with Malaysian Ringgit (MYR) transactions and identity documents required for regulatory compliance in the online gaming sector.

By accessing the Platform, creating an Account, or using any of the Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to the terms of this Policy, you must not use the Platform.

This Policy should be read alongside our Terms and Conditions and Responsible Gambling Policy, both of which form part of the overall legal framework governing your use of Kokoplay.

In this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, payment account details, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Data Controller" means Kokoplay, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third-party entity engaged by Kokoplay to process personal data on its behalf and in accordance with its instructions.
• "KYC Data" means identity and address verification documents submitted by Users in compliance with Know Your Customer requirements, including copies of national identity documents (MyKad), passports, and proof of address documents.
• "Transaction Data" means records of deposits and withdrawals processed through accepted payment methods including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, USDT TRC20, Bitcoin, and 7-Eleven Cliqq.
• "Cookies" means small text files placed on your device by the Platform for the purposes described in Section 8 of this Policy.

Kokoplay collects the following categories of personal data in the course of operating the Platform and providing the Services:

Kokoplay collects personal data through the following channels and methods:

• Direct submission: Data you actively provide during account registration, identity verification (KYC), payment processing, support interactions, or completion of responsible gambling self-assessment forms.
• Automated technical collection: Data collected automatically when you access or interact with the Platform, including IP addresses, browser fingerprints, session logs, and cookie-derived data.
• Payment processors: Confirmation data received from payment service providers — including Touch 'n Go eWallet, Boost, GrabPay, Maybank online banking, CIMB, Public Bank, DuitNow, FPX, and cryptocurrency networks — necessary to confirm and reconcile transactions.
• Third-party identity verification services: Data received from KYC verification service providers engaged to confirm the authenticity of identity documents submitted by Users.
• Fraud detection services: Risk signals and device reputation data received from third-party fraud prevention and anti-money laundering screening services.

Kokoplay processes personal data on the following legal bases, depending on the category of data and the purpose for which it is processed:

• Contractual necessity: Processing required to perform the contract between Kokoplay and the User — specifically, to operate the gaming platform, process deposits and withdrawals in MYR, manage accounts, and provide the Services you have signed up for.
• Legal obligation: Processing required to comply with applicable legal and regulatory obligations, including Know Your Customer (KYC) identity verification, anti-money laundering (AML) screening, record-keeping requirements, and responding to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing carried out in pursuit of Kokoplay's legitimate business interests, where those interests are not overridden by your privacy rights — including fraud prevention, security monitoring, platform improvement, and responsible gambling compliance.
• Consent: Processing based on your express consent, including the sending of optional marketing communications (where opted in). You may withdraw consent for consent-based processing at any time by contacting our support team or updating your Account preferences.

Kokoplay uses the personal data we collect for the following specific purposes:

• To establish, manage, and operate your Kokoplay account, including processing your registration, authenticating your identity, and maintaining your account settings and balance.
• To process deposits and withdrawals via your selected payment method (including Touch 'n Go eWallet, Boost, GrabPay, bank transfer, cryptocurrency, or 7-Eleven Cliqq), and to reconcile transaction records in MYR.
• To conduct Know Your Customer (KYC) identity verification as required before processing first-time or elevated withdrawal requests.
• To administer bonuses, promotions, VIP tier assignments, and loyalty rewards in accordance with the applicable terms and conditions.
• To provide customer support, resolve disputes, and respond to account-related inquiries submitted via live chat or email.
• To monitor platform usage for fraud detection, money laundering screening, and the identification of prohibited conduct as defined in the Terms and Conditions.
• To fulfil our responsible gambling obligations — including monitoring for signs of problem gambling behaviour, processing self-exclusion requests, and administering deposit and loss limit settings.
• To send transactional communications including deposit confirmations, withdrawal updates, security alerts, and account notifications.
• To send optional marketing communications about promotions and new features, where you have opted in to receive such communications.
• To comply with legal and regulatory obligations, including maintaining records required by applicable law and responding to lawful requests from regulatory or law enforcement bodies.

Kokoplay does not sell, rent, or trade personal data to third parties. We may share personal data with external parties only in the following circumstances, and only to the extent strictly necessary for the stated purpose:

• Payment processors and financial institutions: We share transaction data with payment service providers — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, and cryptocurrency network services — solely to facilitate the processing of your deposits and withdrawals.
• Identity verification (KYC) providers: We engage regulated third-party KYC service providers to verify the authenticity of identity documents. These providers process identity data in accordance with their own privacy policies and applicable data protection standards.
• Fraud prevention and AML services: We may share technical and identity data with fraud detection and anti-money laundering screening services to identify and mitigate fraudulent activity and financial crime.
• IT infrastructure and hosting providers: We engage cloud infrastructure and hosting service providers to operate and maintain the Platform. These providers act as data processors under our instructions and are bound by data processing agreements.
• Legal and regulatory authorities: We may disclose personal data to governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or regulatory directive.
• Business reorganisation: In the event of a merger, acquisition, or sale of Kokoplay's assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

Kokoplay uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your gaming session, and security cookies that protect your account from unauthorised access. These cookies cannot be disabled without disrupting core Platform functionality.
• Functional cookies: Remember your preferences, such as language settings, preferred payment method, and display options, to personalise your experience on return visits.
• Analytics cookies: Collect anonymised data on how Users navigate the Platform — pages visited, session duration, game categories accessed — to help us understand usage patterns and improve the service.
• Security and fraud prevention cookies: Assist in identifying unusual access patterns, detecting automated bot activity, and preventing account takeover attacks.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled through browser settings without preventing your ability to use core gaming and account features.

Kokoplay retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, comply with applicable legal obligations, and resolve any disputes or enforce agreements that may arise.

The following general retention periods apply, subject to variation where specific legal obligations require longer retention:

• Account and identity data: Retained for the duration of the account relationship plus a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping obligations.
• Transaction data: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the business relationship.
• Support communications: Retained for a minimum of two (2) years from the date of the last communication, to facilitate dispute resolution and quality assurance.
• Technical and usage data: Typically retained in identifiable form for up to twelve (12) months, after which data may be anonymised and retained for analytical purposes without limitation.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised. Where data is anonymised rather than deleted, the anonymised dataset no longer constitutes personal data and is not subject to this Policy.

Kokoplay implements appropriate technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the Platform is encrypted using TLS/SSL protocols (256-bit encryption) to prevent interception.
• Encryption at rest: Sensitive personal data, including KYC documents and payment account information, is stored in encrypted form within our database infrastructure.
• Access controls: Access to personal data within Kokoplay's internal systems is restricted to authorised personnel on a need-to-know basis. Staff with access to personal data are bound by confidentiality obligations.
• Two-factor authentication: Available to all Users to add an additional layer of protection to their accounts. We strongly encourage all Users to enable this feature.
• Real-time monitoring: Kokoplay operates continuous security monitoring systems to detect and respond to suspicious access attempts, anomalous account activity, and potential data security incidents.

While Kokoplay takes all reasonable precautions, no method of electronic transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Kokoplay will notify affected Users promptly and take all appropriate remedial action.

Subject to applicable law and any overriding legal obligations, you hold the following rights with respect to the personal data Kokoplay processes about you. To exercise any of these rights, please submit a request to our support team at [email protected] with sufficient information to identify your account and specify the nature of your request. We will respond within a reasonable timeframe, typically within 30 days.

The Kokoplay Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data from any individual under the age of 21. Age verification is conducted as part of the account registration and KYC processes.

If Kokoplay becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any winnings accrued through an account operated by a minor will be forfeited in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a minor under your care has accessed or used the Kokoplay Platform, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action without delay.

Kokoplay reserves the right to amend, update, or replace any provision of this Privacy Policy at any time, at its sole discretion, to reflect changes in law, regulatory requirements, platform functionality, or data processing practices.

Where a material change is made to this Policy — particularly any change that affects how we use your personal data or the rights available to you — Kokoplay will provide advance notice by:

• Sending an email notification to the address registered on your account; and/or
• Displaying a prominent notice on the Platform prior to the change taking effect.

The "Last updated" date at the top of this document will be revised each time the Policy is amended. We encourage you to review this Policy periodically to stay informed of how Kokoplay protects your personal data. Your continued use of the Platform following the publication of an amended Privacy Policy constitutes acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or Kokoplay's data processing practices, please contact us through the following channels:

• Email (data privacy inquiries): [email protected] — please include "Privacy Request" in your subject line. We aim to respond within 30 days.
• Live Chat: Available 24 hours a day, 7 days a week through the chat widget on the Platform. Average response under 3 minutes.

For responsible gambling related data requests — including self-exclusion, deposit limit settings, or account restriction — please refer to our Responsible Gambling page or contact support directly. Responsible gambling requests are handled with the highest priority.

For general platform queries, account inquiries, or payment support, please refer to our FAQ page which addresses the most common questions from Malaysian players.