Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how OvoSlot ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "the User", "the Player") who access or use our online casino and sports betting services.

OvoSlot operates in accordance with internationally recognised data protection principles and applicable law. We are committed to handling your personal data transparently, responsibly, and securely at every stage of our relationship with you — from registration through to account closure.

By registering an account on OvoSlot, using any of our services, or browsing our platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

2 Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably identify a natural person, either directly or in combination with other data.
• "Processing" — any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — OvoSlot, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of OvoSlot under contract, such as payment processors or KYC verification providers.
• "KYC" — Know Your Customer; the identity verification process required to comply with anti-money laundering regulations and our licensing obligations.
• "Cookies" — small text files placed on your device by our platform for purposes including session management, analytics, and preference storage.
• "Sensitive Data" — a special category of personal data requiring heightened protection, including financial data, identity documents, and data relating to health or vulnerability.

3 Data We Collect

OvoSlot collects the following categories of personal data, depending on your level of engagement with the Platform:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification.
• Date of birth (to verify that you are 21 years of age or older).
• Residential address — including street, city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam), state, and postcode.
• Email address and phone number used for account communications and two-factor authentication.
• Username and encrypted password.

3.2 KYC & Verification Documents

• Copies of government-issued photo identification (Malaysian IC, passport, or driver's licence).
• Proof of residential address (utility bill, bank statement, or official government letter dated within three months).
• Proof of payment method ownership (e.g., Touch 'n Go eWallet account screenshot, bank statement showing account holder name for Maybank, CIMB, Public Bank, or Hong Leong accounts).
• Selfie or video verification where required by enhanced due diligence procedures.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts in MYR, dates, and payment method references.
• Partial payment identifiers (e.g., last four digits of a card, e-wallet account name) — full card numbers are never stored by OvoSlot.
• Bonus and promotional credit activity.
• Account balance history.

3.4 Gameplay & Betting Data

• Game session logs including titles played, bet amounts, win/loss records, and session duration.
• Sports betting activity including markets wagered, odds accepted, and outcomes.
• Bonus wagering progress and completion records.

3.5 Technical & Device Data

• IP address and approximate geolocation derived from it.
• Device type, operating system, and browser version.
• Session timestamps, login history, and platform activity logs.
• Cookie identifiers and similar tracking technologies (see Section 11).

3.6 Communication Data

• Records of live chat conversations, email correspondence, and support tickets.
• Complaint and dispute records.
• Responses to surveys or feedback requests where voluntarily submitted.

4 How We Collect Your Data

We collect personal data through the following channels:

• Directly from you: information you provide during account registration, KYC submission, deposit or withdrawal requests, support interactions, and any voluntary communications with our team.
• Automatically: technical and device data collected by our platform systems when you browse, log in, or engage with any feature of the Platform.
• From third-party service providers: identity verification bureaus, payment processors (including DuitNow, FPX, and e-wallet operators), and fraud detection partners who may share data about you in connection with our KYC and anti-money laundering obligations.
• From publicly available sources: where relevant to fraud prevention, sanctions screening, or compliance with our licensing conditions.

5 Data Processing & Purpose

The following table summarises the primary purposes for which we process your personal data and the corresponding data categories involved:

6 Legal Basis for Processing

OvoSlot processes your personal data on the following legal bases:

• Contractual necessity: processing required to perform our contract with you, including account management, payment processing, and delivery of gaming services.
• Legal obligation: processing required to comply with our licensing conditions, anti-money laundering regulations, and age verification requirements.
• Legitimate interests: processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement — where such interests are not overridden by your data protection rights.
• Consent: processing for optional marketing communications, where you have freely given specific and informed consent that can be withdrawn at any time.

7 Data Sharing & Disclosure

OvoSlot does not sell or rent your personal data. We may share your data with the following categories of recipients where necessary and proportionate:

7.1 Payment Processors

To process deposits and withdrawals in MYR, we share relevant transaction and identification data with authorised payment processors. This includes operators of Touch 'n Go eWallet, Boost eWallet, GrabPay, DuitNow, FPX, and major Malaysian banking institutions including Maybank, CIMB, Public Bank, and Hong Leong Bank. These providers are contractually required to handle your data securely and are prohibited from using it for purposes beyond payment processing.

7.2 Identity Verification & AML Providers

To satisfy our KYC and anti-money laundering obligations, we engage accredited identity verification bureaus and sanctions screening services. These processors handle KYC document data under strict contractual confidentiality obligations.

7.3 Regulatory & Licensing Authorities

We may be required to disclose player data to our licensing authority or law enforcement bodies where required by our licence conditions or by a valid legal order. We will notify you of any such disclosure to the extent permitted by law.

7.4 Platform Service Providers

We use trusted third-party providers for cloud hosting, platform analytics, and customer support infrastructure. These providers act as data processors under our instruction and are bound by data processing agreements that prohibit independent use of your data.

8 Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by our licensing obligations and applicable law. As a general guide:

• Account and identity data: retained for the lifetime of your account and for a minimum of five (5) years following account closure, to comply with anti-money laundering and licensing record-keeping requirements.
• Transaction and financial data: retained for a minimum of five (5) years from the date of the transaction.
• KYC documents: retained for the duration of account activity and five (5) years post-closure, unless a shorter period is permitted by our licensing authority.
• Support and communication records: retained for three (3) years from the date of the last interaction, or longer where the communication relates to an unresolved dispute.
• Technical and device data: typically retained for up to twelve (12) months, unless required for fraud or security investigations.

At the end of the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be attributed to you.

9 Data Security

OvoSlot implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest, including stored KYC documents and financial records.
• Role-based access controls ensuring that only authorised personnel can access personal data, limited to their specific operational responsibilities.
• Multi-factor authentication requirements for all staff accounts with access to player data.
• Regular third-party security audits and penetration testing of our platform infrastructure.
• Incident response procedures designed to detect, contain, and notify affected users of any data breach within 72 hours of becoming aware of a confirmed incident.

While we take all reasonable precautions, no online system can guarantee absolute security. You are encouraged to use a strong, unique password for your OvoSlot account and to enable two-factor authentication (2FA) from your account settings.

10 Your Data Rights

Depending on the laws applicable in your jurisdiction, you may hold some or all of the following rights in respect of your personal data held by OvoSlot:

To exercise any of the above rights, please contact our Data Protection team via the details in Section 16. We will respond to all valid requests within 30 calendar days. We may ask you to verify your identity before processing certain requests to prevent unauthorised access to another person's data.

11 Cookies & Tracking Technologies

OvoSlot uses cookies and similar technologies (including local storage objects and session tokens) to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential to the functioning of the Platform. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without disrupting core Platform functionality.
• Functional Cookies: Used to remember your preferences such as language, display settings, and last-visited game categories. Disabling these will not prevent Platform access but may reduce your experience.
• Analytics Cookies: Used to collect aggregated, anonymised data on how users navigate the Platform, which pages are visited most frequently, and where drop-off points occur. This data helps us improve layout, performance, and content.
• Security Cookies: Used to detect and prevent fraud, bot activity, and unauthorised access attempts. These include device fingerprinting and behavioural anomaly detection tools.

On your first visit to OvoSlot, you will be presented with a cookie notice. You may manage non-essential cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may prevent you from logging in or using key platform features.

12 Minors & Age Policy

OvoSlot's services are intended exclusively for individuals who are 21 years of age or older. We do not knowingly collect personal data from anyone under the age of 21. Age verification is conducted as a mandatory component of the KYC process for every registered account.

If we become aware that personal data has been collected from an individual under 21, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered on our platform, please contact us immediately via the details in Section 16.

13 International Data Transfers

As an internationally operated platform, some of the personal data we collect may be processed or stored on servers located outside Malaysia. Where such transfers occur, OvoSlot ensures that appropriate safeguards are in place to protect your data to the standard described in this Policy.

These safeguards may include standard contractual clauses approved by relevant data protection authorities, binding corporate rules, or transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside your country of residence, including jurisdictions that may not provide the same level of statutory data protection as Malaysia. We take all reasonable steps to ensure your data remains protected regardless of where it is processed.

14 Marketing Communications

With your consent, OvoSlot may send you promotional communications by email or push notification regarding bonuses, new game launches, seasonal promotions, and VIP program updates. We will only send marketing communications where you have opted in during registration or have separately provided your consent.

You may withdraw your consent and unsubscribe from marketing communications at any time by:

• Clicking the "Unsubscribe" link included in any marketing email we send you.
• Adjusting your communication preferences from within your account settings.
• Contacting our support team directly via live chat or email and requesting removal from marketing lists.

Opting out of marketing communications will not affect our ability to send you essential account-related or transactional notifications, such as deposit confirmations, withdrawal updates, security alerts, or changes to these Terms and this Policy.

15 Changes to This Privacy Policy

OvoSlot reserves the right to update or amend this Privacy Policy at any time. When we make material changes — particularly those that affect how your personal data is collected or used — we will notify you by email to the address registered on your account and by displaying a prominent notice on the Platform prior to the change taking effect.

For minor or administrative changes, we will update the "Last Updated" date at the top of this Policy's Table of Contents. We encourage you to review this Policy periodically to stay informed about how we protect your data.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you object to any change, you must discontinue use of the Platform and may close your account by contacting our support team.

16 Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, please contact our team through the following channels: