Ombak126 Privacy Policy – Personal Data Protection for Malaysian Members Under PDPA 2010

This Privacy Policy is issued by ombak126 and applies to all registered members and users browsing the ombak126.biz platform. Within this document, the following terms carry the meanings stated:

• "Personal Data" — any information that can be used to identify an individual, whether directly or indirectly, including name, identification number, email address, phone number, financial data, and online behavioural data.
• "Processing" — any operation carried out on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — ombak126, as the entity that determines the purposes and means of processing members' personal data.
• "Data Processor" — third parties that process data on behalf of ombak126 under ombak126's instructions, subject to strict confidentiality agreements.
• "PDPA" — the Personal Data Protection Act 2010 of Malaysia, the primary legislation governing the processing of personal data in Malaysia.

This Privacy Policy covers all data collected through the ombak126 platform, including the website, mobile app (where applicable), email communications, and interactions with customer support.

Ombak126 collects two main categories of data: information you provide directly, and data collected automatically as you use the platform.

Personal data collected by ombak126 is used solely for the following legitimate purposes, each with a clear legal basis under the PDPA 2010:

• Account Management & Identity Verification — to create, manage, and maintain your member account at ombak126, including the Know Your Customer (KYC) process required by law.
• Financial Transaction Processing — to process your deposits and withdrawals via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, Maybank2u (FPX), CIMB Clicks (FPX), and other Malaysian payment methods.
• Service Provision & Improvement — to operate, maintain, and improve the ombak126 gaming platform, including slots, baccarat, poker, Live Casino, and sportsbook.
• Fraud Prevention & Security — to identify, investigate, and prevent fraudulent activity, money laundering, multi-account usage, and other security threats.
• Legal Compliance — to fulfil obligations under applicable laws, including PDPA 2010, financial regulations, and directives from lawful authorities.
• Communication & Customer Support — to send important account-related notifications, respond to enquiries, and provide technical support.
• Marketing (with consent) — to send promotional information, exclusive offers, and VIP programme updates to members who have given consent to receive marketing communications.
• Analytics & Research — to understand aggregate usage patterns for product improvement purposes. This data does not contain information that directly identifies any individual.

Ombak126 does not sell, rent, or commercialise member personal data to any third party. However, in the course of legitimate operations, data may be shared with the following limited categories of parties:

• Payment Providers — such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and Malaysian banks (Maybank, CIMB) to process financial transactions. Data sharing is limited strictly to what is necessary to process each transaction.
• Game Providers — gaming software providers that supply slots, live baccarat, poker, and other games on the ombak126 platform. Data sharing is limited and governed by strict confidentiality agreements.
• Technology Service Providers — including server service providers (cloud hosting), cybersecurity vendors, and analytics systems operating under the direction of ombak126.
• Regulatory Bodies & Authorities — when required by law, court order, or official investigation by a legitimate authority.
• Professional Advisors — lawyers, accountants, and auditors bound by professional confidentiality obligations.

Ombak126 implements comprehensive technical and organisational measures to protect member personal data from unauthorised access, alteration, disclosure, or destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption — all data transmitted between your device and ombak126's servers is encrypted using the highest industry standards.
• Data-at-Rest Encryption — sensitive data such as financial information and identity documents is encrypted within the database using AES-256 encryption.
• Strict Access Controls — only ombak126 staff with a legitimate business need may access member personal data. All access is logged and monitored.
• Two-Factor Authentication (2FA) — available and strongly encouraged for all member accounts to provide an additional layer of protection.
• 24/7 Security Monitoring — a real-time monitoring system that automatically detects and responds to any security threats.
• Regular Penetration Testing — the ombak126 platform undergoes regular penetration testing by independent security experts.
• Secure Data Backup — member data is backed up regularly to a secure location that is physically separate from the main servers.

While ombak126 takes all reasonable steps to protect your data, no system for transmitting data over the internet can be guaranteed 100% secure. We encourage you to play your part in keeping your account safe by using a strong password and not sharing your login credentials.

As an ombak126 member and data subject under Malaysia's PDPA 2010, you have the following rights regarding your personal data. All requests relating to these rights may be submitted to us via email or live chat:

To exercise any of the above rights, please contact ombak126 by email at support@ombak126.biz with the subject line "Personal Data Rights Request – [Username]". We will respond within 21 business days of receiving a complete request.

The ombak126 platform uses cookies and similar tracking technologies to enhance the user experience and collect analytical data. The types of cookies we use are as follows:

You can manage your cookie settings through your web browser settings. However, disabling essential cookies may affect the functionality of the ombak126 platform. ombak126 does not use third-party cookies for third-party advertising purposes.

Ombak126 retains personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required by applicable law:

• Active Account Data — retained for the duration your account is active and for 7 years after account closure, in compliance with financial regulations and anti-money laundering requirements.
• Financial Transaction Records — retained for 7 years from the date of transaction, in accordance with the Anti-Money Laundering, Anti-Terrorism Financing & Proceeds of Unlawful Activities Act 2001.
• Customer Support Communication Logs — retained for 3 years from the date of the last interaction.
• Technical Data & Security Logs — retained for 90 days for security monitoring purposes.
• Marketing Data — retained until you withdraw your consent, after which it will be deleted within 30 days.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. Accounts inactive for more than 36 months may be subject to data deletion after notice has been sent to the member.

The ombak126 platform is strictly for individuals aged 18 and above. ombak126 does not knowingly collect or process personal data of individuals under the age of 18.

If you are under 18 years of age, please cease using the ombak126 platform immediately. If you are a parent or guardian who believes that a child in your care has registered an account with ombak126, please contact us immediately at support@ombak126.biz and we will take immediate action to delete the account and all associated data.

In the course of operating the ombak126 platform, member personal data may be transferred to and processed outside Malaysia — for example, by technology infrastructure providers or international game providers. Such transfers are carried out with the following safeguards in place:

• The recipient country or entity must provide a level of data protection equivalent to Malaysia's PDPA 2010, or
• Transfers are protected by binding contractual agreements requiring the recipient to uphold an equivalent standard of data protection, or
• The transfer is necessary for the performance of a contract between you and ombak126 (e.g., processing payments through international payment networks).

Ombak126 ensures that all cross-border data transfers comply with Section 129 of the PDPA 2010 and do not expose member data to undue risk.

Ombak126 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or technological developments. When material changes are made:

• We will update the "Last Updated" date at the top of this page.
• We will send a notification to your registered email address at least 14 days before any material changes take effect.
• An in-platform notice will be displayed the first time you log in after any changes.
• Your continued use of the ombak126 platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

Previous versions of the Privacy Policy will be archived and made available upon request. This Privacy Policy is effective as of 1 January 2026.

For any enquiries, concerns, or requests relating to this Privacy Policy or the handling of your personal data by ombak126, please contact our Data Protection Officer (DPO) through the following channels:

• Email: support@ombak126.biz (subject: "Privacy Policy Enquiry")
• Live Chat: Available 24/7 within the ombak126 platform — click the chat icon in the bottom corner of your screen
• Response Time: We aim to respond to all privacy enquiries within 2 business days, and to process data rights requests within 21 business days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia under the Personal Data Protection Act 2010.