Privacy Policy — ironman888

This Privacy Policy ("Policy") is published by ironman888, the online casino and sports betting platform accessible at ironman888.cam ("we", "us", "our", "the Platform"). ironman888 serves registered players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions.

We understand that privacy is important to our players. This Policy sets out in clear, structured terms how ironman888 collects, uses, stores, and protects personal data obtained through the Platform. It also explains the rights players hold with respect to their own personal data and how to exercise those rights.

This Policy forms part of the contractual relationship between ironman888 and each registered user, alongside our Terms & Conditions. By using the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a natural person, including but not limited to name, identification number, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" refers to the individual whose personal data is being processed — in most cases, a registered Player on the Platform.
• "Data Controller" refers to ironman888 as the entity that determines the purposes and means of processing personal data.
• "Third Party" means any entity other than ironman888 and the Data Subject, including payment processors, KYC verification providers, and analytics services.
• "KYC" means Know Your Customer — the process of verifying a player's identity and address to comply with applicable regulations and prevent fraud.
• "Cookies" refers to small text files placed on a user's device to facilitate Platform functionality, session management, and analytics.

ironman888 collects personal data through several channels. The categories of data we collect are as follows:

ironman888 collects personal data through the following means:

ironman888 processes personal data strictly for the following defined purposes. We do not process personal data for any purpose inconsistent with those listed below:

• Account Management: Creating and maintaining your ironman888 account, including authentication and profile updates.
• Transaction Processing: Facilitating deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and Malaysian bank transfers, as well as processing withdrawal requests.
• Identity Verification (KYC): Verifying your identity and residential address in accordance with applicable anti-money laundering obligations.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, unauthorised access, and misuse of Platform services.
• Customer Support: Responding to support enquiries, resolving disputes, and processing account-related requests via live chat, WhatsApp, and email.
• Regulatory Compliance: Meeting applicable legal, regulatory, and reporting obligations, including data retention requirements.
• Platform Improvement: Analysing usage patterns and technical data in aggregated, anonymised form to improve Platform performance and user experience.
• Responsible Gambling: Monitoring gaming activity to identify potential signs of problem gambling and enabling access to self-exclusion and limit-setting tools.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications.

If ironman888 intends to process your personal data for a new purpose not listed above, we will provide advance notice and, where required, seek your consent before proceeding.

ironman888 relies on the following legal bases to process personal data, in accordance with applicable data protection principles:

ironman888 does not sell, rent, or commercially transfer your personal data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Processors: Malaysian e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), FPX, DuitNow, and partnered banks (Maybank, CIMB, Public Bank, RHB, Hong Leong) receive financial data necessary to process your transactions.
• KYC Verification Providers: Regulated third-party identity verification services receive identification documents for the purpose of conducting KYC checks.
• Fraud Prevention Services: Risk management and anti-fraud platforms may receive transaction and technical data to assess and prevent fraudulent activity.
• Legal & Regulatory Authorities: ironman888 may disclose personal data to relevant authorities where required by law, court order, or applicable regulatory obligation.
• IT & Infrastructure Providers: Hosting, database, and cybersecurity service providers that support Platform operations may process personal data on ironman888's behalf under strict data processing agreements.

ironman888 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Active Account Data: Retained for the duration of your account relationship with ironman888 plus a post-closure period of five (5) years, to comply with financial and anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following account closure, in accordance with applicable identity verification and compliance obligations.
• Transaction Records: Financial transaction data is retained for a minimum of seven (7) years to meet accounting and regulatory requirements.
• Technical & Log Data: Server and access logs are retained for up to twelve (12) months for security monitoring purposes.
• Marketing Consent Records: Records of your marketing preferences and consent status are retained for the duration of your account relationship.

At the conclusion of any applicable retention period, personal data is securely deleted or anonymised. Anonymised data may be retained indefinitely for analytical purposes, as it can no longer be attributed to an identifiable individual.

ironman888 uses cookies and similar tracking technologies to operate the Platform, maintain session security, and analyse usage patterns. The following categories of cookies are deployed:

ironman888 does not deploy third-party advertising cookies or retargeting pixels. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect Platform functionality.

As a Data Subject, you hold the following rights with respect to your personal data held by ironman888. To exercise any of these rights, contact us via live chat or at [email protected]:

ironman888 will respond to all data rights requests within thirty (30) days of receipt. Where a request is complex or numerous, this period may be extended by a further sixty (60) days, in which case we will notify you in advance.

ironman888 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your device and ironman888 servers;
• Encryption of sensitive data at rest, including financial information and KYC documents;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security audits, vulnerability assessments, and penetration testing of Platform infrastructure;
• Automated monitoring for anomalous login activity and suspected account compromise;
• Incident response procedures for managing data breaches, including notification obligations.

In the event of a data breach that poses a risk to your rights and freedoms, ironman888 will notify affected players within a reasonable timeframe and take immediate steps to contain and remediate the breach.

ironman888 strictly prohibits use of the Platform by individuals under the age of 21. We do not knowingly collect personal data from persons under 21 years of age. Age verification is conducted as part of the account registration and KYC process.

If ironman888 discovers or has reason to believe that personal data has been collected from an individual under 21 without verifiable parental or guardian consent, we will take immediate steps to delete that data, close the associated account, and — where applicable — notify relevant authorities.

If you are a parent or guardian and believe your child has registered an account on ironman888, please contact us immediately via live chat or at [email protected] so we can investigate and take appropriate action.

ironman888 primarily stores and processes personal data within infrastructure serving the Malaysian market. In limited circumstances, data may be transferred to or processed by service providers located in other jurisdictions — for example, for KYC verification or fraud detection purposes.

Where such transfers occur, ironman888 ensures appropriate safeguards are in place to protect your personal data, including contractual obligations that require third-party processors to maintain data protection standards equivalent to those described in this Policy.

ironman888 does not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate contractual or technical safeguards.

ironman888 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform services. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page;
• Display a prominent notice on the Platform for a reasonable period following the change;
• Where required by law or where the change is significant, notify registered players by email to the address on file.

Minor or administrative updates — such as formatting corrections or clarification of existing provisions — may take effect without advance notice. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy.

We encourage all players to review this Privacy Policy periodically to remain informed of how ironman888 handles their personal data.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact ironman888 through the following channels:

When submitting a data subject request — such as a right of access or erasure request — please provide your registered username and, where applicable, your registered email address so we can verify your identity before processing the request. We will respond within thirty (30) days.