Privacy Policy

This Privacy Policy ("Policy") is issued by d200m ("we", "us", "our") and describes how we collect, process, store, and protect personal data provided by users ("you", "Player", "User") of the d200m online gaming platform accessible at https://d200m.lat.

d200m operates an English-language online casino and sports betting platform serving the Malaysian market. Our services include live casino games, slot machines, sports betting (covering Liga Super Malaysia, EPL, UFC, and other international events), lottery products, and arcade titles. All financial transactions on the Platform are conducted in Malaysian Ringgit (MYR) via locally recognised payment methods including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency channels.

By creating an account or otherwise using the d200m Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should not use the Platform.

For the purposes of this Policy, the following terms carry the meanings assigned below:

The Data Controller responsible for your personal data collected through the d200m Platform is d200m, the operator of the website at https://d200m.lat. All data subject rights requests, privacy enquiries, and complaints should be directed to d200m's Data Protection contact, details of which are provided in Section 15 of this Policy.

d200m processes personal data in compliance with applicable data protection legislation relevant to its operations and to the Malaysian users it serves. Where d200m engages third-party Data Processors to carry out specific functions on its behalf — such as payment processing, identity verification, or fraud detection — such processors are contractually bound to handle your data in accordance with d200m's instructions and applicable data protection standards.

d200m collects personal data through several channels: directly from you during registration and account use, automatically through your use of the Platform, and from third parties where permitted by law (such as KYC verification providers). The categories of personal data we collect are set out below.

4.1 Registration & Account Data

• Full legal name;
• Date of birth (for age verification purposes);
• Email address;
• Mobile phone number;
• Username and encrypted password;
• Residential address (city, state — e.g., Kuala Lumpur, Petaling Jaya, Shah Alam);
• Preferred language (English, Bahasa Melayu, or Chinese).

4.2 Identity Verification (KYC) Data

• Government-issued identification number (e.g., MyKad NRIC number or passport number);
• Copies of identity documents submitted for age and identity verification;
• Proof of address documentation;
• Payment method ownership verification documents (e.g., screenshot of e-wallet account).

4.3 Financial Transaction Data

• Deposit and withdrawal history (amounts, dates, payment methods);
• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay account references);
• Bank account details where applicable (for DuitNow, FPX, and direct bank transfer transactions via Maybank, CIMB, Public Bank, Hong Leong, or RHB);
• Cryptocurrency wallet addresses (where USDT TRC20 or Bitcoin is used).

4.4 Gaming & Betting Activity Data

• Wagering history including bet amounts, game titles, outcomes, and timestamps;
• Sports betting selections (including Liga Super Malaysia, EPL, UFC, and other markets);
• Bonus and promotion usage records;
• Responsible gambling tool settings (deposit limits, session time limits, self-exclusion status).

4.5 Technical & Usage Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type;
• Session duration and navigation patterns on the Platform;
• Cookie identifiers and similar tracking technologies (see Section 10).

4.6 Communications Data

• Content of support chat transcripts and email correspondence;
• Records of complaints and dispute correspondence.

d200m processes your personal data on one or more of the following lawful bases:

d200m uses the personal data collected for the following purposes:

• Account Creation & Management: To register your account, authenticate your identity, maintain your profile, and manage account settings.
• KYC & Age Verification: To verify that you meet the minimum age requirement of 21 years, and to confirm your identity before processing withdrawal requests.
• Transaction Processing: To facilitate MYR deposits and withdrawals via your chosen payment methods — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, and cryptocurrency channels.
• Game Delivery & Personalisation: To deliver the games and betting markets you access, maintain your wagering history, and personalise your experience where applicable.
• Responsible Gambling Compliance: To monitor wagering patterns, apply deposit and loss limits, process self-exclusion requests, and send responsible gambling alerts where warranted.
• Fraud & Security: To detect, investigate, and prevent fraudulent transactions, collusion, money laundering, and unauthorised account access.
• Customer Support: To respond to your enquiries, process complaints, and maintain records of support interactions for quality and compliance purposes.
• Legal Compliance: To meet our obligations under applicable legislation, including anti-money laundering regulations, and to respond to lawful requests from regulatory or law enforcement authorities.
• Marketing Communications: With your consent, to send you promotional offers, bonus notifications, and news about new features or games. You may opt out at any time via account settings.
• Platform Improvement: To analyse usage patterns and improve the functionality, stability, and user experience of the d200m Platform.

d200m does not sell your personal data to third parties. We may share your personal data with the following categories of recipients where necessary and lawful:

• Payment Processors: Your financial data is shared with the relevant payment service providers (e.g., operators of Touch 'n Go eWallet, Boost, GrabPay, or the relevant banking institutions handling DuitNow and FPX transactions) solely for the purpose of processing your deposit or withdrawal.
• KYC & Identity Verification Providers: Your identity documents and personal details may be shared with accredited identity verification services to complete the KYC process required before withdrawal.
• Fraud Detection Services: Transactional and behavioural data may be shared with third-party fraud detection and anti-money laundering platforms as part of d200m's compliance obligations.
• Regulatory & Law Enforcement Authorities: Where required by law or by a binding order from a competent authority, d200m will disclose personal data to the relevant governmental or regulatory body.
• Technology Infrastructure Providers: d200m uses reputable cloud hosting and data infrastructure providers. These providers act as Data Processors under contract and are permitted to process your data only for the purposes specified by d200m.
• Professional Advisers: In limited circumstances, personal data may be shared with our legal advisers, auditors, or insurers under strict confidentiality obligations.

d200m retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and as required or permitted by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with d200m's data disposal procedures. Anonymised data — data from which all identifying information has been irreversibly removed — may be retained indefinitely for statistical and analytical purposes.

d200m implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction.

Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser/device and d200m's servers is encrypted using TLS 1.2 or higher (HTTPS). This applies to all account interactions, payment processes, and KYC document uploads.
• Encryption at Rest: Sensitive data stored in d200m's databases — including KYC documents and financial records — is encrypted using AES-256 encryption.
• Access Controls: Access to systems containing personal data is restricted on a need-to-know basis. All internal access is authenticated, logged, and subject to periodic review.
• Two-Factor Authentication: Two-factor authentication (2FA) is available to all Players as an additional layer of account security and is strongly recommended.
• Intrusion Detection: d200m's infrastructure is monitored around the clock for anomalous access patterns, intrusion attempts, and suspicious activity.
• Third-Party Security Audits: d200m engages independent security specialists to conduct periodic penetration testing and vulnerability assessments of its platform infrastructure.

Notwithstanding the above, no data transmission over the internet or storage system can be guaranteed as entirely secure. While d200m takes all reasonable measures to protect your personal data, we cannot warrant absolute security. Players are encouraged to use strong, unique passwords and to enable 2FA on their accounts.

d200m uses cookies and similar tracking technologies to operate the Platform, improve user experience, and — with your consent — personalise the content you see. A cookie is a small text file placed on your device when you visit the Platform.

You may manage your cookie preferences through the cookie consent banner displayed on your first visit to the Platform, or at any time through your browser settings. Disabling cookies beyond strictly necessary cookies may affect the functionality of certain Platform features.

As a data subject, you hold the following rights in relation to your personal data held by d200m. To exercise any of these rights, please contact our support team as described in Section 15.

d200m will respond to all data subject rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 30 days, and you will be notified of any extension within the initial 30-day period. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.

d200m strictly prohibits the use of its Platform by individuals under the age of 21. We do not knowingly collect personal data from minors. Age verification is a mandatory step in the KYC process, and d200m applies additional safeguards to detect and prevent underage registration.

If d200m becomes aware or reasonably suspects that personal data has been collected from an individual under 21 years of age, the following actions will be taken immediately:

• The relevant account will be suspended pending investigation;
• All personal data associated with the minor will be securely deleted upon confirmation of age;
• Any deposits made by the minor will be returned to the originating payment method after deducting any amounts legitimately owed.

Parents and legal guardians who believe that a minor under their care may have created an account on d200m are encouraged to contact our support team immediately.

d200m's primary operations are oriented toward the Malaysian market, and a significant portion of data processing takes place within infrastructure hosted in the Asia-Pacific region. However, some service providers engaged by d200m — including KYC verification partners, cloud infrastructure providers, and fraud detection services — may process data in servers located outside Malaysia.

Where personal data is transferred to a country or territory outside Malaysia, d200m ensures that appropriate safeguards are in place to protect your data to a standard consistent with this Policy. Such safeguards include contractual obligations between d200m and the recipient entity in the form of data processing agreements that impose appropriate data protection requirements.

If you would like further information about the international transfers applicable to your personal data, please contact us using the details in Section 15.

d200m may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. When material changes are made, we will notify registered Players via the email address associated with their account, or through a prominent notice on the Platform, at least 14 days before the changes take effect.

Non-material changes (such as corrections of typographical errors or clarifications that do not alter the substance of the Policy) may be made without prior notice. The "Last Updated" date at the top of this document will always reflect the most recent revision.

Your continued use of the d200m Platform following the effective date of any amended Privacy Policy constitutes your acceptance of the updated Policy. We recommend reviewing this page periodically to stay informed of how your personal data is being protected.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by d200m, please reach out to us through the following channels:

• Live Chat: Available 24/7 on the d200m Platform. Live chat is the fastest way to reach our support team, with an average response time of 3–5 minutes. Our agents are fluent in English, Bahasa Melayu, and Mandarin Chinese.
• Email: [email protected] — for formal data subject rights requests, privacy complaints, and detailed enquiries. We aim to acknowledge all email correspondence within 2 business days and to provide a substantive response within 30 calendar days.

When submitting a data subject rights request, please include your full account username and a clear description of the right you wish to exercise. This helps us locate your record promptly and process your request accurately.

If you are not satisfied with d200m's response to your privacy concern, you may have the right to lodge a complaint with the relevant data protection authority applicable in your jurisdiction.