Op16 Privacy Policy – Protection of Your Personal Data in Malaysia

Op16 is an online casino and gaming platform serving the needs of Malaysian players. We offer our members across Malaysia a wide range of premium games, including slots such as Golden Colosseum, Pyramid Ramesses, Spartan Warrior, 3 Genie Wishes, Alien Hunting, Extra Stars, and American Roulette.

In providing these services, op16 needs to collect and process certain personal data from our members. We fully recognise that your personal data — your name, phone number, financial information, and activity records — is a valuable asset that must be handled with responsibility and transparency.

This Privacy Policy is designed to clearly set out op16's commitment to protecting your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). We believe that your trust in our platform begins with the confidence that your data is in safe and responsible hands. Without that trust, no amount of premium gaming features or attractive bonuses holds any meaning for us at op16.

This Policy applies to all information collected through the op16 website, mobile applications, email communications, and all other channels of interaction between you and the op16 platform. It also applies to all individuals who visit our website, even if they have not registered as members.

Op16 only collects personal data that is strictly necessary to provide our services safely and efficiently. We do not collect data that is excessive or irrelevant to the operation of our platform. The following are the categories of data we collect:

• op16 not store credit or debit card numbers directly. All payments are processed through licensed and approved third-party payment providers in Malaysia, such as DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay.
• Biometric data such as fingerprints or facial recognition not collected by op16 at any stage of registration or platform use.
• Data relating to a member's religious beliefs, health, or political views not collected or processed by op16 under any circumstances.

Op16 uses collected personal data solely for legitimate, necessary purposes that have been clearly disclosed to you. We do not use your data for any purpose unrelated to the services you signed up for.

• Account Management: Registering your op16 account, verifying your identity, managing logins, and maintaining the security of your account at all times.
• Financial Transaction Processing: Processing deposits via DuitNow, FPX, Maybank2u, CIMB Clicks, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, as well as processing withdrawal of winnings to your Malaysian bank account.
• KYC Verification & Legal Compliance: Fulfilling Know Your Customer (KYC) requirements and legal obligations related to anti-money laundering (AML) as required under Malaysian regulations.
• Customer Support: Providing technical assistance, answering enquiries, resolving complaints, and ensuring every experience you have at op16 runs smoothly.
• Fraud Detection & Security: Monitoring account activity to detect and prevent unauthorised access, fraud, multi-account usage, and any activity that violates op16's terms.
• Service Communications: Sending important account-related notifications, terms updates, security alerts, and promotional communications that you have consented to receive.
• Platform Improvements: Analysing anonymised usage patterns to help us better understand Malaysian players' needs and continuously improve the overall experience on op16.
• Loyalty Programme & Bonuses: Managing the op16 VIP programme, calculating reward points, and ensuring all bonuses and promotions are awarded accurately and fairly to eligible members.

Op16 only processes your personal data where there is a valid legal basis for doing so. In accordance with Malaysia's PDPA, the following are the legal grounds we rely upon:

• Consent: For specific situations such as marketing communications, op16 obtains your explicit consent before processing your data. You may withdraw this consent at any time through your op16 account settings.
• Contract Performance: Processing required to deliver the op16 services you have registered for — including account management, deposit processing, and withdrawal of winnings.
• Legitimate Interest: Processing for the purposes of platform security, fraud prevention, and service improvement that does not prejudice your privacy rights.
• Legal Obligation: Processing required by Malaysian law, including AML, KYC, and financial regulations applicable to op16's operations.

Op16 does not sell or disclose members' personal data to third parties for commercial or marketing purposes. However, in the course of operating our platform, it may be necessary to share certain data with the following selected parties:

• Malaysian Payment Providers: To process your deposits and withdrawals, the required transaction details are shared with approved payment providers such as DuitNow, FPX providers (including Maybank2u and CIMB Clicks), Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay. All these providers are bound by strict confidentiality agreements and their own PDPA compliance obligations.
• Technology Service Providers: Cloud, cybersecurity, and information technology service providers that assist op16 in operating the platform — all bound by strict data processing agreements and not permitted to use your data for their own purposes.
• Malaysian Authorities: op16 will disclose personal data to the relevant Malaysian authorities when required by law, court order, or for legitimate criminal investigation purposes. This includes Bank Negara Malaysia, the Malaysian Anti-Corruption Commission (MACC), and other law enforcement agencies.
• Game Content Providers: Third-party game providers that supply slot and casino game content for the op16 platform may receive certain technical data necessary to ensure games function correctly. This data is shared on a minimal basis and is subject to strict confidentiality agreements.

Op16 continuously invests in robust data security infrastructure to keep your personal information protected against all threats. The following are the security layers we maintain:

• Data Encryption in Transit: All communication between your browser or app and op16's servers is encrypted using TLS 1.3 protocol with a 256-bit SSL certificate, ensuring your data cannot be intercepted in transit.
• Data-at-Rest Encryption: Sensitive data stored in op16's databases — including passwords and financial information — is encrypted using strong encryption algorithms prior to storage. Your password is stored in a hashed format that cannot be decrypted by anyone, including op16 staff.
• Strict Access Controls: Only op16 staff who require access to specific data in order to carry out their job functions are permitted to do so — in accordance with the principle of least privilege. All access to sensitive data is automatically logged and monitored.
• 24/7 Security Monitoring: op16's automated monitoring system operates 24 hours a day, 7 days a week to detect any suspicious activity, intrusion attempts, or anomalies in data access patterns.
• Regular Penetration Testing: op16 conducts regular penetration testing carried out by independent cybersecurity experts to identify and address vulnerabilities in our systems before they can be exploited.
• Secure Data Backups: op16 member data is regularly backed up to geographically separate server locations to ensure service continuity and data recovery in the event of any unforeseen incident.

While op16 takes all reasonable steps to protect your data, it is important to remember that no security system can guarantee absolute 100% protection. You also play a vital role in your own data security by keeping your op16 account password safe and not sharing your login credentials with anyone.

The op16 website uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions correctly. Below is a clear explanation of the types of cookies we use:

• Strictly Necessary Cookies: These cookies are essential for the core functions of the op16 platform — such as maintaining your login session, remembering your language preference, and ensuring transactions in slots and casino games run securely. These cookies cannot be disabled as they are critical to the platform's operation.
• Performance & Analytics Cookies: op16 uses anonymised analytics data to understand how Malaysian players interact with our platform — which pages are most visited, how long gaming sessions last, and which features are used most frequently. This helps us make better-informed decisions when improving the op16 platform.
• Preference Cookies: These cookies allow op16 to remember your preferences and settings — such as display language, currency denomination (MYR), and gaming preferences — so you do not need to reconfigure your settings each time you log in.

You can manage your cookie settings through your internet browser. However, disabling certain cookies may affect the functionality of some parts of the op16 platform. For the best experience, we recommend accepting op16's essential and performance cookies.

As an op16 member residing in Malaysia, you have the following rights under the Personal Data Protection Act 2010 (PDPA) of Malaysia, which op16 is fully committed to upholding:

Op16 does not retain your personal data for longer than is necessary for the original purpose of processing, or as required by Malaysian law. The following are the general data retention guidelines we follow:

• Active Account Data: For as long as your op16 account remains active and you continue using the platform, your account data will be retained to enable the continued delivery of our services.
• Financial Transaction Records: In accordance with Malaysian legal requirements on financial records and AML compliance, deposit and withdrawal transaction records are retained for a minimum of 7 years from the date of each transaction.
• Closed Account Data: Following account closure, op16 will retain the minimum information necessary for legal compliance purposes and the resolution of any claims that may arise, typically for no longer than 5 years.
• Security Logs: Access and security logs used to detect and investigate fraudulent or unauthorised activity are retained for 2 years before being securely deleted.
• Support Communication Data: Live chat conversation records and customer support emails are retained for 2 years for quality control purposes and for reference in the event of a dispute.

When personal data is no longer required and there is no legal obligation to retain it, op16 will securely delete or anonymise that data using approved, irreversible data deletion procedures.

Op16 has a zero-tolerance policy towards the use of the platform by individuals under the age of 18. op16's services are exclusively available to adults aged 18 and above, in accordance with applicable Malaysian gambling laws.

Op16 not intentionally collect or process personal data of children under the age of 18. Should op16 discover that a child's personal information has been collected without our knowledge, we will take immediate steps to delete that data and close the relevant account without delay.

If you are a parent or guardian and suspect that your child who is under age has registered for or used the op16 platform, please contact us immediately at [email protected] and we will treat the matter with the utmost urgency.

Op16 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or changes in the technologies we use. Any amendments will take effect immediately upon being published on the op16 website.

For significant and material amendments, op16 will endeavour to notify affected members via their registered email address or through an in-platform notification before the changes take effect. We recommend reviewing this Privacy Policy page periodically to stay informed of how op16 handles your personal data.

Your continued use of the op16 platform following any amendments to this Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you have the right to close your op16 account and request deletion of your personal data in accordance with the procedure described in Section 8 above.

If you have any questions, concerns, or requests regarding this Privacy Policy or how op16 handles your personal data, we are always here to help. The op16 privacy team can be reached through the following channels:

• Privacy Email: [email protected] — For official enquiries relating to data privacy, subject access requests, or reporting any data security concerns. We respond within 2–4 business hours.
• 24/7 Live Chat: Available directly through the op16 platform for general privacy enquiries. Average response time is under 2 minutes at all times.
• WhatsApp Support: op16's Bahasa Malaysia-proficient support team is also reachable via WhatsApp for any assistance relating to your privacy and personal data.

If you are dissatisfied with how op16 has handled your privacy complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia, who oversees PDPA compliance in Malaysia. That said, we encourage you to contact op16 first, as we are committed to resolving any privacy concerns promptly and to your satisfaction.