Privacy Policy

mawar500 ("we", "us", "our" or "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with the website located at https://mawar500.cam. This Privacy Policy ("Policy") sets out in clear terms what personal data we collect, the purposes for which it is processed, how it is stored and protected, and the rights that individuals may exercise in relation to their data.

This Policy applies to all Users of the Platform, including registered account holders and visitors who browse without registering. By accessing the Platform or creating an Account, you acknowledge that you have read and understood this Policy. If you do not accept the terms set out here, you should discontinue use of the Platform immediately.

This Policy should be read in conjunction with the mawar500 Terms and Conditions, which govern the broader contractual relationship between the Platform and its Users. Where the Terms and Conditions and this Policy address the same subject matter, this Policy shall govern with respect to data protection matters.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, residential address, phone number, identity document details, financial information and IP address.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure or deletion.
• "Data Controller" means mawar500, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of and under the instruction of mawar500.
• "User" means any individual who accesses, browses or registers an Account on the Platform.
• "Account" means the registered user profile associated with a verified identity on the mawar500 Platform.
• "KYC" (Know Your Customer) means the identity verification process involving the submission and review of government-issued identification and proof of address documentation.
• "Cookies" means small text files stored on a User's device by the web browser when visiting the Platform, used to retain session preferences and analytical data.
• "Sensitive Data" means a specific category of Personal Data warranting heightened protection, including but not limited to financial account details and identity document numbers.

mawar500 collects Personal Data from Users through several channels, including the registration process, account activity, customer support interactions and automated technical systems. The categories of data collected include the following:

3.1 Registration and Identity Data

• Full legal name as it appears on government-issued identification.
• Date of birth, collected to verify compliance with the 21-year minimum age requirement.
• Residential address, including city and postcode. Malaysian cities such as Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru and Shah Alam are among the most commonly provided.
• Email address used as the primary Account communication channel.
• Phone number, where provided during registration or support contact.
• Username selected at the time of Account creation.

3.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents such as MyKad, passport or driving licence.
• Proof of residential address documents, including utility bills or bank statements.
• Selfie or liveness verification images where required for enhanced identity checks.

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates and payment method identifiers.
• Payment method references — for example, masked bank account details associated with Maybank, CIMB, Public Bank or Hong Leong, and wallet identifiers for Touch 'n Go eWallet, Boost or GrabPay transactions.
• Cryptocurrency wallet addresses used for eligible crypto deposits or withdrawals.

3.4 Technical and Usage Data

• IP address and approximate geolocation derived from connection data.
• Browser type, version and operating system.
• Device identifiers and screen resolution where relevant to session handling.
• Pages visited, navigation paths, session duration and clickstream data.
• Login timestamps and session activity logs.

3.5 Support and Communication Data

• Content of messages, support tickets, live chat transcripts and emails exchanged with the mawar500 support team.
• Records of responsible gambling tool requests, including deposit limit adjustments and self-exclusion requests.

mawar500 processes Personal Data only where a valid lawful basis exists. The primary bases relied upon are set out in the table below.

Personal Data collected through the Platform is used for the following specific purposes:

• Account Management: Creating, maintaining and administering registered Accounts, including processing login requests, password resets and profile updates.
• Identity Verification: Confirming that Account holders meet the minimum age requirement of 21 years and satisfy applicable KYC standards before enabling withdrawal functions.
• Payment Processing: Facilitating deposits through Malaysian payment methods — including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost and GrabPay — and processing withdrawal requests to eligible accounts.
• Fraud Prevention and Security: Monitoring transaction patterns and Account activity to detect and investigate suspicious behaviour, unauthorised access and potential financial crime.
• Responsible Gambling: Recording and enforcing deposit limits, session restrictions and self-exclusion requests submitted by Users. Monitoring activity patterns to identify potential problem gambling behaviour and applying protective measures where necessary.
• Customer Support: Responding to inquiries, resolving account issues, processing complaints and maintaining records of support interactions for quality and compliance purposes.
• Platform Improvement: Analysing aggregated usage data to understand how the Platform is used, identify technical issues and make improvements to content, navigation and service delivery.
• Legal Compliance: Fulfilling obligations under applicable laws and regulations, including responding to lawful requests from competent authorities.

mawar500 does not sell, rent or trade Personal Data to third parties for their independent commercial use. Personal Data may be shared in the following circumstances only:

• Payment Processors and Financial Institutions: Transaction data is shared with the payment providers necessary to execute a deposit or withdrawal, including Malaysian banks and e-wallet operators. These parties process data only to the extent required to complete the transaction.
• Identity Verification Providers: KYC documentation may be processed by specialist identity verification service providers operating under contractual data processing agreements with mawar500.
• Technology and Infrastructure Providers: Third-party service providers that host, maintain or support Platform infrastructure may have limited access to data as part of their contractual service delivery obligations.
• Regulatory and Law Enforcement Authorities: Personal Data may be disclosed to competent regulatory bodies, law enforcement agencies or courts where required by applicable law or in response to a lawful request.
• Fraud Prevention Networks: Where fraud or financial crime is suspected, relevant data may be shared with specialist fraud detection services or industry bodies operating in accordance with applicable law.
• Corporate Transactions: In the event of a merger, acquisition or restructuring, Personal Data may be transferred as part of the transaction subject to equivalent privacy protections being in place.

The mawar500 Platform uses cookies and similar technologies to support core functionality, maintain session state and collect aggregated usage analytics. The categories of cookies used include the following:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without preventing core Platform features from operating correctly.
• Functional Cookies: Store User preferences such as display settings and language options to improve consistency across sessions.
• Analytics Cookies: Collect aggregated and anonymised data about how Users navigate the Platform, which pages are most visited, and where technical issues occur. This data informs Platform improvements and does not identify individual Users.
• Security and Fraud Detection Cookies: Assist in identifying unusual session patterns or behaviours indicative of unauthorised access attempts or bot activity.

Users may control cookie preferences through their browser settings. Disabling certain categories of cookies may affect the functionality of portions of the Platform. Strictly necessary cookies cannot be disabled through browser settings without impacting the core service.

Personal Data is retained only for as long as necessary to fulfil the purpose for which it was collected, or for the minimum period required by applicable law or regulatory obligation. The following general retention principles apply:

• Account and identity data is retained for the duration of the active Account relationship and for a period following Account closure as required to satisfy anti-money laundering, fraud investigation and regulatory reporting obligations.
• Financial transaction records are retained for a minimum period in accordance with applicable financial record-keeping requirements.
• KYC documentation is retained for a period following Account closure as mandated by applicable compliance obligations.
• Support communication records are retained for a reasonable period sufficient to resolve any ongoing dispute or complaint and to maintain a service quality audit trail.
• Technical and usage data is retained in aggregated form for analytics purposes, with personally identifiable session data removed after an appropriate period.

When the retention period expires or the relevant purpose is no longer applicable, Personal Data is securely deleted or anonymised in a manner that prevents recovery.

mawar500 implements technical and organisational security measures appropriate to the nature and sensitivity of the Personal Data it processes. These measures include the following:

• Encryption of data in transit using industry-standard TLS protocols to protect communications between User devices and Platform servers.
• Encryption of sensitive data at rest, including KYC documentation and financial account references.
• Access controls limiting Personal Data access to authorised personnel on a need-to-know basis, with role-based permissions enforced at the system level.
• Regular security reviews and monitoring of systems and infrastructure for vulnerabilities or anomalous activity.
• Secure disposal procedures for data and physical media that has reached the end of its retention period.

In the event of a Personal Data breach that is likely to result in risk to Users' rights, mawar500 will take prompt action in accordance with applicable notification obligations.

Subject to applicable law, Users may exercise the following rights in relation to their Personal Data held by mawar500:

• Right of Access: You may request confirmation of whether mawar500 processes your Personal Data and, if so, obtain a copy of the data held about you.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data. For most Account fields, corrections can be made directly through Account settings or via the support team.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations.
• Right to Restriction: You may request that processing of your Personal Data be restricted in certain circumstances, such as while an accuracy dispute is being resolved.
• Right to Data Portability: Where technically feasible and legally applicable, you may request a copy of your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling. An objection will be assessed against the relevant interests and circumstances.
• Right to Withdraw Consent: Where processing is based on your consent, such as for promotional communications, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, contact the mawar500 support team using the details in the Contact Us section below. Requests will be assessed and responded to within a reasonable timeframe. Identity verification may be required before processing a data access or deletion request.

The mawar500 Platform is strictly intended for individuals aged 21 years and above. The collection or processing of Personal Data from minors is not permitted under any circumstances. If mawar500 becomes aware that Personal Data has been collected from an individual below the minimum age threshold, that data will be deleted promptly and the associated Account will be permanently closed.

Age verification is conducted as part of the Account registration and KYC processes. Users who misrepresent their age during registration are in breach of the Platform's Terms and Conditions, and any associated data may be retained for the purposes of fraud investigation and prevention.

If a parent or guardian becomes aware that a minor has accessed or registered on the Platform, they should contact the mawar500 support team immediately using the contact details provided in this Policy.

In the course of delivering its services, mawar500 may transfer Personal Data to systems or service providers located outside Malaysia. Where such transfers occur, mawar500 takes steps to ensure that appropriate safeguards are in place to protect the data in transit and at the destination.

Safeguards applied to cross-border transfers may include contractual data processing agreements with receiving parties, requiring them to observe data protection standards consistent with those applied by mawar500. Third-party processors located outside Malaysia are required to handle data only as instructed and in accordance with documented security standards.

mawar500 reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing practices, legal requirements, or Platform functionality. When material changes are made, the revised Policy will be published on this page with an updated review date.

Continued use of the Platform after the publication of a revised Policy constitutes acceptance of the updated terms. Users are encouraged to review this page periodically to remain informed of how their Personal Data is handled. If you do not agree with a revised version of this Policy, you should discontinue use of the Platform and contact the support team regarding Account closure.

If you have questions or concerns about this Privacy Policy, wish to exercise a data subject right, or need to report a data protection issue, please contact the mawar500 team using the details below. All contact information is presented as plain text and is not a clickable link.

Website email: [email protected]

When submitting a data-related request, please include your registered Account username and a clear description of your request or concern to help us process your inquiry efficiently. Responses to data subject access requests will be provided within a reasonable timeframe, which may extend where identity verification is required before the request can be fulfilled.

For responsible gambling enquiries, deposit limit requests, or self-exclusion submissions, please navigate to the Responsible Gambling page of this Platform, which contains dedicated guidance and relevant support references.