Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by 1bandar ("1bandar", "We", "Us", "Our") and governs the collection, use, storage, disclosure, and protection of personal data relating to individuals ("User", "Player", "You", "Your") who access or use the 1bandar platform, website, and associated services (collectively, "the Platform") accessible at 1bandar.cam and any associated domains.

1bandar is committed to processing personal data lawfully, fairly, and transparently in accordance with applicable international data protection standards. By registering an account on the Platform or otherwise submitting personal information, you acknowledge that you have read, understood, and consent to the data practices described in this Policy.

This Policy should be read in conjunction with our Terms and Conditions, which govern the broader legal relationship between you and 1bandar. Capitalised terms not defined in this Policy shall have the meaning attributed to them in the Terms and Conditions.

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, location data, online identifiers, and any factors specific to the physical, financial, or social identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, whether by automated means or otherwise — including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. 1bandar acts as the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller, subject to a data processing agreement.
• "Sensitive Data" means a special category of Personal Data including, but not limited to, financial information, government-issued identity numbers, and biometric data.
• "KYC Data" means identity and age verification documents submitted by a Player as part of the Know Your Customer process, including photographic identification and proof of address.
• "Cookies" means small text files placed on a User's device by a website to store session information, preferences, and tracking data.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by which a data subject signifies acceptance of the processing of their Personal Data.

Data We Collect

1bandar collects Personal Data from Users through a number of channels and in several categories. The data we collect is proportionate to the purposes for which it is processed.

When you register an account on 1bandar, we collect the following information:

• Full legal name as it appears on your government-issued identification;
• Date of birth (for age verification — you must be 21 years of age or older);
• Residential address, including city and postcode (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam);
• Email address and Malaysian mobile telephone number;
• Username and password (stored in hashed, non-reversible format).

As required by our anti-money laundering (AML) and responsible gambling obligations, we collect:

• Copies of government-issued photo identification (Malaysian MyKad, passport, or equivalent);
• Proof of residential address (utility bill, bank statement, or official correspondence dated within 90 days);
• Where applicable, documentation evidencing source of funds or source of wealth;
• Selfie or liveness verification images, where required for identity matching.

When you make deposits or withdrawals, we collect:

• Payment method details — e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), bank account information (Maybank, CIMB, Public Bank, Hong Leong), or cryptocurrency wallet addresses (BTC, ETH, USDT, BNB);
• Transaction amounts in MYR or cryptocurrency equivalent;
• Transaction timestamps and reference numbers;
• Payment processor transaction IDs for dispute resolution purposes.

We automatically collect technical and behavioural data when you use the Platform:

• IP address, device type, browser type and version, operating system;
• Pages visited, features used, time spent on each section of the Platform;
• Game session data — games played, bet amounts, outcomes, session duration;
• Login timestamps, logout events, and session identifiers;
• Referral source — how you arrived at the Platform (direct, search engine, referral link).

When you interact with our customer support or marketing channels, we collect:

• Live chat conversation transcripts;
• Email correspondence content and metadata;
• Complaint and dispute records;
• Feedback and survey responses you voluntarily submit.

How We Use Your Data

1bandar processes your Personal Data exclusively for the following clearly defined purposes:

Legal Basis for Processing

1bandar processes your Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between you and 1bandar — i.e., to provide you with access to the Platform and Services you have registered for. This includes account management, payment processing, and KYC verification.
• Legal obligation: Processing is necessary to comply with legal and regulatory obligations applicable to 1bandar under its international gaming licence, including AML/CFT (anti-money laundering and counter-financing of terrorism) requirements.
• Legitimate interests: Processing is necessary for the purposes of 1bandar's legitimate interests — specifically fraud prevention, platform security, responsible gambling monitoring, and improvement of Services — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we rely on your consent (e.g., for marketing communications or non-essential cookies), you have the right to withdraw that consent at any time without detriment to your use of the Platform.

Data Sharing & Disclosure

1bandar does not sell your Personal Data to third parties. We may share your Personal Data with the following categories of recipients, strictly as necessary for the purposes set out in this Policy:

• Payment processors and e-wallet providers: To facilitate deposits and withdrawals via Touch 'n Go eWallet, DuitNow, Boost, GrabPay, FPX, and cryptocurrency networks. These processors operate under strict data security obligations.
• KYC and identity verification services: Third-party identity verification providers used to confirm the authenticity of KYC documents submitted by Players.
• Fraud prevention and AML screening services: Providers of risk-scoring, fraud detection, and sanctions/watchlist screening tools used to comply with AML obligations.
• Game content providers: To the extent required for game delivery and RNG certification auditing — typically limited to session and game-round data without full player identity disclosure.
• Cloud infrastructure and hosting providers: Our Platform is hosted on secure cloud infrastructure. These providers operate as Data Processors under contractual data processing agreements that prohibit independent use of your data.
• Regulatory and licensing authorities: Where required by our international operating licence or applicable law, we may disclose Personal Data to licensing authorities, law enforcement agencies, or other competent regulatory bodies.

Given that 1bandar operates under an international licensing framework, your Personal Data may be transferred to and processed in jurisdictions outside Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place — including contractual clauses that require receiving parties to protect your data to an equivalent standard as set out in this Policy.

In the event of a merger, acquisition, restructuring, or sale of all or part of 1bandar's business, Personal Data held by 1bandar may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy. Users will be notified of any such transfer via a prominent notice on the Platform.

Cookies & Tracking Technologies

1bandar uses cookies and similar tracking technologies to enhance your user experience, maintain session security, and gather aggregated analytics. We use the following categories of cookies:

• Strictly necessary cookies: Essential for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and display options. These enhance your experience but are not essential.
• Analytics cookies: Collect anonymised information about how Users interact with the Platform — pages visited, time spent, errors encountered. Used to improve Platform performance. No personally identifiable information is included in analytics reports.
• Marketing cookies: Used only with your explicit consent to deliver relevant promotional content on and off the Platform. You may decline these without affecting Platform access.

You may manage your cookie preferences through your browser settings at any time. Disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled as they are required for basic Platform operation and security.

Some browsers support a "Do Not Track" (DNT) signal. 1bandar currently does not alter its data collection practices in response to DNT signals, as no universally accepted technical standard for responding to such signals has been established. We remain committed to the data minimisation principles described in this Policy regardless of DNT status.

Data Retention

1bandar retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting obligations.

Our standard retention periods are as follows:

• Account and registration data: Retained for the duration of your account relationship with 1bandar, plus a further period of up to 7 years following account closure to meet regulatory record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of 5 years following the end of the customer relationship, in accordance with standard AML regulatory requirements.
• Financial transaction records: Retained for a minimum of 6 years following the transaction date for accounting, audit, and regulatory compliance purposes.
• Customer support communications: Retained for 3 years from the date of the last communication, unless the subject matter is related to an unresolved dispute or legal proceeding.
• Analytics and usage data: Retained in anonymised or aggregated form for up to 3 years for platform improvement purposes.
• Self-exclusion records: Retained for the duration of the self-exclusion period and for 7 years thereafter, to prevent re-registration in violation of the exclusion.

When your Personal Data is no longer required, it will be securely deleted or anonymised in accordance with our internal data destruction procedures.

Security Measures

1bandar implements comprehensive technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the 1bandar platform;
• Encrypted storage of sensitive personal and financial data at rest using industry-standard encryption algorithms;
• Hashed password storage using one-way cryptographic hashing — your actual password is never stored or accessible;
• Role-based access controls restricting access to Personal Data to authorised personnel on a strict need-to-know basis;
• Regular security audits and penetration testing conducted by independent third-party security specialists;
• PCI-compliant payment processing for all card and e-wallet transactions;
• Intrusion detection systems and real-time monitoring for suspicious access patterns and anomalous activity;
• Incident response procedures — in the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals promptly and in accordance with our licensing obligations.

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We encourage you to protect your account by using a strong, unique password and enabling any available two-factor authentication.

Your Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your Personal Data held by 1bandar:

To exercise any of the rights listed above, please contact our support team via live chat or email at [email protected]. We may require you to verify your identity before processing a data rights request to prevent unauthorised access to another person's data.

We will respond to all verifiable data rights requests within 30 calendar days. In cases of complexity or high volume, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it.

Third-Party Services

The 1bandar platform may contain integrations with third-party services, including game content providers, payment processors, and customer support tools. Each of these third parties operates under its own privacy policy and data processing practices. 1bandar is not responsible for the privacy practices of third parties and recommends that you review the privacy policies of any third-party services you interact with.

Where third parties process Personal Data on 1bandar's behalf, they do so only under written data processing agreements that prohibit them from using your data for any purpose other than that for which it was shared, and require them to maintain appropriate security standards.

Minors & Age Protection

The 1bandar platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of the registration and KYC process, and we take all reasonable steps to enforce this requirement.

If we become aware that Personal Data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered on the Platform, please contact our support team immediately.

Parents and guardians concerned about minors accessing online gambling content are encouraged to use family internet filtering tools and to engage with resources available through our Responsible Gambling page.

Policy Amendments

1bandar reserves the right to amend this Privacy Policy at any time. Where amendments are material — meaning they significantly affect how we collect, use, or share your Personal Data — we will provide advance notice via email or a prominent notice on the Platform at least 14 days prior to the changes taking effect.

Non-material updates (such as corrections to typographical errors, clarifications of existing practices, or additions to the definitions section that do not alter the substance of the Policy) may be made without prior notice, with the updated "Last Updated" date reflecting the revision.

Your continued use of the Platform following the effective date of any amended Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically. The current version is always accessible on this page.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by 1bandar, please contact us through the following channels:

• Live Chat: Available 24/7 on the Platform — average first response under 90 seconds.
• Email: [email protected] — responses within 2–4 hours during normal operating hours.
• FAQ: Visit our FAQ page for answers to common privacy and account questions.

When submitting a privacy-related enquiry or data rights request, please include your registered email address and account username so that we can identify you and process your request efficiently. We may require additional identity verification before fulfilling any data subject rights request.