Privacy Policy — imaju

imaju processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to fulfil our obligations under the Account agreement, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC/AML obligations and financial recordkeeping requirements.
• Legitimate Interests: Processing carried out in pursuit of imaju's legitimate business interests, such as fraud prevention, platform security, responsible gambling monitoring, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes such as marketing communications, where you have provided explicit, freely given, and revocable consent. You may withdraw your consent at any time by updating your Account preferences or contacting our support team.

imaju does not sell, rent, or trade your Personal Data to any third party. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Service Providers: Malaysian banks (including Maybank, CIMB, Public Bank, Hong Leong Bank), e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), and payment gateway operators (DuitNow, FPX) require transaction data to process deposits and withdrawals. These entities process your data as independent data controllers under their own privacy policies.
• Identity Verification Providers: Third-party KYC service providers engaged by imaju to assist with document verification and fraud screening. These providers act as Data Processors under contractual data processing agreements.
• Game Content Providers: Licensed international gaming studios that deliver game content to the Platform may receive anonymised session data for the purpose of game performance monitoring. No personally identifiable information is shared with game providers.
• Regulatory Authorities: imaju may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or pursuant to our obligations under applicable gaming and anti-money-laundering regulations.
• IT & Infrastructure Providers: Cloud hosting, server management, and cybersecurity service providers who process data on imaju's behalf under strict contractual confidentiality and security obligations.

imaju retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal and regulatory obligations. The general retention principles we apply are as follows:

• Active Account Data: Personal Data associated with an active Account is retained for the duration of the Account's existence and for a minimum period of five (5) years following permanent Account closure.
• Financial Transaction Records: Transaction data is retained for a minimum of seven (7) years in accordance with financial recordkeeping requirements applicable to licensed gaming operators.
• KYC Documentation: Identity verification documents are retained for the period specified by our operating licence and applicable anti-money-laundering regulations, typically five (5) to seven (7) years from the date of submission.
• Marketing Data: Email addresses and marketing preferences are retained until you withdraw consent, opt out of communications, or request deletion, whichever occurs first.
• Technical Logs: Server logs and device data are retained for up to twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with industry best practices for data destruction.

imaju uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us deliver a functional and personalised experience.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable core functionality such as session management, secure login, and navigation. These cookies cannot be disabled without impairing the Platform's core services.
• Performance & Analytics Cookies: These cookies collect anonymised information about how visitors use the Platform — such as which pages are visited most frequently and how users navigate between sections. This data is used solely to improve Platform performance and user experience.
• Functional Cookies: These cookies remember your preferences, such as language settings and display configurations, to provide a more personalised experience on return visits.
• Marketing Cookies: With your consent, imaju may use cookies to deliver relevant promotional content based on your Platform activity. You may opt out of marketing cookies at any time.

imaju implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, destruction, alteration, or disclosure. Our security framework includes:

• Transport Encryption: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher, ensuring that data in transit cannot be intercepted by third parties.
• At-Rest Encryption: Personal Data stored on imaju's servers is encrypted using AES-256, an industry-standard symmetric encryption algorithm.
• Access Controls: Access to Personal Data is restricted to authorised imaju personnel on a strict need-to-know basis. All internal access is logged and subject to periodic audit.
• Two-Factor Authentication: imaju offers two-factor authentication (2FA) to all Players as an additional layer of Account security. Players are strongly encouraged to enable 2FA in their Account settings.
• Penetration Testing: The Platform undergoes regular security assessments and penetration testing by independent security professionals to identify and remediate vulnerabilities.
• Incident Response: imaju maintains a documented data breach response procedure. In the event of a security incident affecting your Personal Data, we will notify affected players and relevant authorities within the timeframes required by applicable law.

While imaju takes all reasonable steps to protect your data, no system is entirely impenetrable. Players are reminded to maintain strong, unique passwords and to notify imaju support immediately if they suspect unauthorised access to their Account.

As a player and data subject, you hold the following rights in relation to your Personal Data held by imaju. To exercise any of these rights, please contact our support team using the details in Section 14 of this Policy. We will respond to verified requests within fourteen (14) business days.

The Platform is strictly intended for individuals aged 21 (twenty-one) years and above. imaju does not knowingly collect, process, or retain Personal Data belonging to individuals under the age of 21. Registration and use of the Platform by minors is strictly prohibited.

Where imaju discovers or has reasonable grounds to suspect that Personal Data has been collected from an individual under the age of 21, we will:

• Immediately suspend the associated Account;
• Void all transactions and balances associated with the Account;
• Permanently delete all Personal Data collected from the underage individual as soon as reasonably practicable, except where retention is required for legal or regulatory compliance purposes;
• Refund any real-money deposits to the originating Payment Method.

Parents and guardians who believe that their child may have registered an Account with imaju are encouraged to contact our support team immediately [email protected] so that the Account may be investigated and closed without delay.

imaju operates infrastructure that may involve the transfer of Personal Data to countries outside Malaysia for the purposes of cloud hosting, fraud detection services, and platform analytics. Where such transfers occur, imaju ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that required under applicable Malaysian data protection principles.

Safeguards employed for international transfers include: contractual data processing agreements incorporating standard data protection clauses; data transfer impact assessments conducted prior to engaging new international processors; and technical security measures applied uniformly across all processing environments regardless of geographic location.

imaju reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or Platform functionality. Where amendments are material, imaju will notify registered Players via email or by displaying a prominent notice on the Platform prior to the changes taking effect.

The effective date of the current version of this Policy is indicated at the top of this document. We encourage Players to review this Policy periodically to remain informed of how imaju handles their Personal Data. Your continued use of the Platform following an update to this Policy constitutes your acknowledgement of the revised terms.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by imaju, please contact our Data Protection team using the details below. All data subject rights requests must be submitted with sufficient information to verify your identity as the registered Account holder.