Privacy Policy Pools — Our Commitment to Protecting the Personal Data of Malaysian Members

1Introduction & Scope of the Pools Privacy Policy

Pools ("we", "the platform", "Pools Games") is fully committed to protecting the privacy of every member and user of our platform. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of personal information you provide to us, or that we collect through your use of the Pools platform.

This Policy applies to all registered Pools members, visitors to pools.games, users of the Pools mobile app, and anyone who interacts with our platform in any capacity. It covers all services offered by Pools, including slots, Live Casino, table games, deposit and withdrawal systems, promotional programmes, and customer support services.

If you are under 18, please do not use the Pools platform or provide us with any personal information. Should we discover that we have inadvertently collected data from a minor, we will take immediate steps to delete that information.

2Types of Personal Data Collected by Pools

Pools only collects personal data that is strictly necessary to provide you with a safe, fair, and high-quality service. The following are the categories of data we collect:

Data You Provide Directly:

• Full name as per Malaysian identity card (MyKad)
• An active Malaysian phone number
• A valid email address
• Date of birth (for age verification)
• Malaysian bank account or e-wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks) for deposit and withdrawal purposes
• Copies of identity documents (during the KYC process) where required
• Your communications with the Pools customer support team

Automatically Collected Data:

• IP address and device information (device type, operating system, web browser)
• Platform usage data including games played, bets placed, and session duration
• Deposit and withdrawal transaction logs
• Cookie data and similar tracking technologies (see Section 9)
• General geolocation information based on IP address
• Login records including time, date, and device used

3How Pools Uses Your Personal Data

The personal data you provide to Pools is used for the following purposes, all of which are directly related to the delivery of our platform services to you:

Platform Operations: To register and manage your Pools account, process deposits and withdrawals using your preferred Malaysian payment methods, verify your identity and eligibility, and provide access to all games in the Pools collection, including premium slots, live casino, and table games.

Security & Compliance: To detect and prevent fraud, money laundering, and other unlawful activities; conduct mandatory KYC processes; comply with applicable legal and regulatory requirements; and maintain the overall integrity of the Pools platform.

User Experience: To personalise your gaming experience on Pools based on your play history; to present promotions and offers relevant to your playing style; to send important notifications regarding your account, transactions or policy changes; and to continuously improve the platform's interface and functionality.

Responsible Gaming: To monitor gameplay patterns in order to identify early signs of problem gambling; enforce the self-exclusion limits you have set; and ensure the Pools platform is used responsibly, in line with our commitment to member wellbeing.

Communications: To send transactional emails, security notifications, policy updates, and — with your consent — marketing communications about the latest Pools promotions and offers that may interest you.

4Legal Basis for Data Processing at Pools

Every instance of personal data processing carried out by Pools has a valid legal basis under Malaysia's Personal Data Protection Act 2010 (PDPA). The following outlines the bases we rely on according to each processing purpose:

• Contract Performance: Data processing necessary to provide Pools services to you under your membership agreement — including account management, payment processing, and access to games.
• Legal Obligations: Processing required to comply with Malaysian legal obligations, including KYC requirements, anti-money laundering (AML) reporting, and other compliance duties imposed on online platform operators.
• Legitimate Interests: Processing for fraud detection, platform security, internal analytics to improve Pools services, and responsible gambling purposes — where our legitimate interests do not override your fundamental rights and freedoms.
• Consent: For marketing communications, non-essential cookies, and any other processing not covered by the categories above, we obtain your explicit consent beforehand.

5Sharing & Disclosure of Personal Data

Pools does not sell, rent, or trade members' personal data to any third party for their own marketing purposes. We only share your data in the following limited circumstances and with appropriate safeguards in place:

Service Providers: We share necessary data with third-party service providers that help us operate the Pools platform — including payment service providers (to process transactions via Touch 'n Go eWallet, GrabPay, DuitNow, and other methods), gaming software providers, cloud hosting services, and customer support systems. All such providers are bound by strict confidentiality and data protection agreements, and may only use your data for the purposes we specify.

Legal Requirements: Pools may disclose your personal data to Malaysian government authorities, law enforcement agencies, or regulatory bodies when required to do so by law, court order, or direction from a competent authority — including for fraud investigation or anti-money laundering purposes.

Protection of Rights: We may disclose information as necessary to protect the rights, property, or safety of Pools, our members, or the public when we believe such disclosure is necessary or appropriate.

Business Transfers: In the event of a merger, acquisition, or sale of Pools assets, members' personal data may be transferred to the successor entity. We will notify you by email and in-platform notification before your data becomes subject to a different Privacy Policy.

6Pools Data Security Measures

Pools takes the security of our members' personal data seriously. We implement multiple layers of technical and organisational safeguards to protect your data against unauthorised access, disclosure, alteration or destruction:

• 256-bit SSL Encryption: All communications between your device and Pools' servers are encrypted using TLS 1.3 — the same security technology used by Malaysia's leading banks, including Maybank and CIMB.
• Data-at-Rest Encryption: Sensitive data stored in the Pools database — including passwords and financial information — is encrypted using AES-256 standards.
• Access Controls: Only Pools staff with a legitimate operational need are granted access to members' personal data, and all such access is monitored and regularly audited.
• Continuous Security Monitoring: A 24-hour threat detection system monitors all activity within the Pools platform to identify any unauthorised access attempts or suspicious behaviour.
• Regular Security Audits: The Pools platform undergoes regular independent security assessments to identify and address any vulnerabilities before they can be exploited.
• Incident Response Plan: Pools has clear procedures in place for handling any data security breach — including prompt notification to affected members in accordance with Malaysian legal requirements.

While we take all reasonable precautions, no security system can be guaranteed to be completely infallible. You also play an important role in protecting your data by using a strong, unique password for your Pools account and never sharing your login credentials with anyone.

7Data Retention Periods at Pools

Pools retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required under applicable Malaysian law:

• Active Account Data: For as long as your Pools account remains active, plus any additional period required to fulfil legal obligations following account closure.
• Financial Transaction Records: A minimum of seven (7) years from the date of the transaction, in compliance with Malaysia's anti-money laundering and financial record-keeping requirements.
• Support Communication Logs: Three (3) years from the date of last communication, for reference and dispute resolution purposes.
• KYC Data: Five (5) years after the business relationship with Pools ends, in line with Malaysian compliance requirements.
• Responsible Gaming Monitoring Data: Retained for as long as necessary to fulfil responsible gambling obligations, and may be kept for a longer period in cases of self-exclusion.

Once the relevant retention period expires, Pools will securely delete or anonymise your personal data using methods that ensure it cannot be recovered or re-identified. You may request early deletion of your data (subject to legal obligations) through the mechanism described in Section 8.

8Your Rights Regarding Personal Data at Pools

As a Pools member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights in relation to the personal data we hold about you:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request that we correct any personal data that is inaccurate or incomplete.
• Right to Erasure: You have the right to request the deletion of your personal data in certain circumstances, subject to our legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your data under certain circumstances.
• Right to Data Portability: You have the right to receive the personal data you have provided to us in a machine-readable format.

To exercise any of the rights above, please submit a written request to [email protected], including your full name, Pools account number, and details of the right you wish to exercise. Pools will respond to valid requests within 21 calendar days. For complex cases, we may require up to 30 days and will notify you of this extended timeline.

9Pools Cookie Policy

The Pools platform uses cookies and similar tracking technologies to enhance your experience, maintain your login session, and analyse platform usage for the purpose of continuous improvement. The following are the types of cookies we use:

Essential cookies cannot be disabled as they are required for the Pools platform to function properly — including maintaining your login session and keeping your account secure. Functional and analytics cookies can be managed through your web browser settings or via the privacy settings panel within your Pools account.

Please note that disabling certain cookies may affect the functionality of some parts of the Pools platform. If you disable functional cookies, for example, you may need to reset your preferences each time you log in.

10Links to Third-Party Websites

The Pools platform does not contain links to unrelated third-party websites. However, in the context of payment services, you may be redirected to the official interface of your e-wallet or bank provider (such as Touch 'n Go eWallet, GrabPay, or the Maybank2u portal) to complete a transaction.

All links to third-party websites or interfaces are for operational purposes only and are subject to the respective providers' own privacy policies. Pools is not responsible for the privacy practices or content of these third-party websites. We encourage you to read the privacy policy of each third-party service you use alongside the Pools platform.

11Amendments to the Pools Privacy Policy

Pools reserves the right to amend this Privacy Policy from time to time to reflect changes in our practices, new Malaysian legal requirements, or developments to the Pools platform. When we make material changes, we will notify you through:

• An in-platform Pools notification will be displayed when you log in after the amendment takes effect
• A notice email sent to the registered email address on your Pools account
• Updates the "Last Updated" date at the top of this page

Amendments typically take effect 14 days after notice is given, allowing you sufficient time to review the changes. Your continued use of the Pools platform after an amendment takes effect constitutes your acceptance of the updated Privacy Policy.

If you do not agree with any amendment, you have the right to request the closure of your Pools account and the deletion of your personal data (subject to legal retention obligations) before the amendment takes effect by contacting [email protected].

Previous versions of this Privacy Policy are available upon request — please contact our support team if you wish to review a superseded version.

12Contact Us About Data Privacy at Pools

If you have any questions, concerns, or complaints regarding how Pools handles your personal data, or if you wish to exercise any of the data rights outlined in Section 8, please reach out to us through the following channels:

When submitting a privacy-related request, please include your full name, Pools account number, a clear description of your request, and any identity documents required for verification. Pools will acknowledge receipt of your request within 3 business days and provide a full response within the stipulated timeframe.

If you are dissatisfied with how we have handled your privacy request or complaint, you have the right to lodge a complaint with the Malaysian Communications and Multimedia Commission (MCMC) or the relevant regulatory body under Malaysia's PDPA.