Privacy Policy –
How semar500 Protects Your Data

This Privacy Policy ("Policy") describes how semar500 ("we", "us", "our", "the Platform") collects, processes, stores, and protects the personal data of individuals ("you", "your", "the Member") who visit, register with, or use any service available athttps://semar500.cam and any associated subdomains or mobile interfaces operated by semar500.

semar500 is committed to handling all personal data in a responsible, transparent, and lawful manner. We understand that our Members — the majority of whom are based across Malaysia, in cities including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam — place significant trust in us when they share their personal information. This Policy sets out clearly how that trust is honoured.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the platform more broadly. In the event of any conflict between this Policy and our Terms & Conditions with respect to the handling of personal data, this Privacy Policy shall take precedence.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a natural person — including but not limited to name, identification number, email address, phone number, IP address, and financial account details.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means semar500, the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third-party service provider that processes personal data on behalf of semar500 under a formal data processing agreement.
• "KYC Data" means identity and age verification documentation submitted by Members as part of the semar500 Know Your Customer process.
• "Cookies" means small text files placed on your device by the platform to enable core functionality, session management, and analytics.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "Sensitive Data" means a subset of personal data that warants heightened protection, including government-issued identification numbers, financial data, and in some contexts health-related data.

semar500 collects personal data through several channels. The categories of data we collect, and the contexts in which they are gathered, are set out in the table below:

We do not collect data we do not need. semar500 applies data minimisation principles — collecting only the information that is necessary for the stated purpose. We do not collect sensitive personal data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, or biometric data except to the extent that a government-issued ID document inherently contains such information and is required for KYC compliance.

semar500 uses the personal data we collect for the following purposes:

• Account Administration: To create, manage, and maintain your Member account, including authentication, password reset, and account security notifications.
• Identity & Age Verification: To verify that all Members are at least 21 years of age and are who they claim to be, in compliance with our platform policies and licensing requirements.
• Transaction Processing: To process MYR deposits and withdrawals via supported payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency channels.
• Regulatory Compliance: To fulfil our anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations under applicable international gaming licensing requirements.
• Platform Operation & Improvement: To monitor platform performance, identify and fix technical issues, improve user interface design, and develop new features based on anonymised usage patterns.
• Responsible Gambling: To monitor betting patterns that may indicate problem gambling behaviour and, where appropriate, to deploy responsible gambling interventions such as deposit limit prompts, cooling-off suggestions, or self-exclusion in accordance with our Responsible Gambling policy.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, and other security incidents affecting the platform or its Members.
• Customer Support: To respond to your enquiries, resolve complaints, and maintain records of support interactions for quality assurance purposes.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Members who have consented to receive such communications. Marketing is always opt-in and may be withdrawn at any time.
• Legal Proceedings: To establish, exercise, or defend legal claims where necessary, and to comply with court orders, regulatory requests, or law enforcement directions.

semar500 processes personal data only where a lawful basis for doing so exists. The principal legal bases on which we rely are as follows:

• Contractual Necessity: Processing required to perform our obligations under the Member Agreement — including account creation, payment processing, and service delivery — is carried out on this basis.
• Legal Obligation: Processing required to comply with applicable laws, licensing conditions, AML/CTF regulations, and lawful orders from competent authorities is carried out on this basis.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and internal analytics is carried out on this basis, where our legitimate interests are not overridden by the rights and freedoms of the individual Member.
• Consent: Processing for marketing communications and non-essential cookies is carried out only where you have given explicit, informed, and freely withdrawable consent. You may withdraw consent at any time without detriment.

Where we rely on legitimate interests as a basis for processing, we conduct a balancing assessment to ensure that the relevant processing does not unduly prejudice the privacy rights or reasonable expectations of our Members.

semar500 does not sell, rent, or otherwise commercialise your personal data. We disclose personal data to third parties only in the following limited and controlled circumstances:

• Payment Processors: We share necessary financial and identity data with payment service providers — including e-wallet operators (Touch 'n Go, Boost, GrabPay), FPX-connected Malaysian banks (Maybank, CIMB, Public Bank, Hong Leong), DuitNow service operators, and cryptocurrency exchange partners — solely for the purpose of processing your transactions.
• Identity Verification Services: KYC documentation may be processed by third-party identity verification providers operating under formal data processing agreements with semar500. These providers are contractually prohibited from using your data for any purpose other than the verification service.
• Game Content Providers: Where game software is provided by third-party studios, limited technical and session data (such as player session tokens) may be shared to enable game functionality. No personally identifiable data beyond what is technically necessary is transmitted.
• Licensing & Regulatory Authorities: We are required to share certain data with our licensing authority and, where legally required, with regulatory bodies or law enforcement agencies in relevant jurisdictions. We do not disclose more than is required.
• Legal & Professional Advisers: We may share personal data with our legal counsel, auditors, or other professional advisers where necessary for the conduct of their professional services, subject to binding confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of the semar500 platform, Member data may be transferred to a successor entity. We will notify affected Members prior to any such transfer and ensure equivalent privacy protections are in place.

semar500 uses cookies and similar technologies to operate core platform functionality, maintain your login session, and gather anonymised analytics on how the platform is used. We do not use cookies for cross-site advertising or behavioural profiling for commercial purposes.

The cookies used by semar500 fall into the following categories:

• Essential Cookies: Required for the platform to function. These include session management cookies, security tokens, and load-balancing identifiers. They cannot be disabled without impairing core functionality. No consent is required for these cookies.
• Performance & Analytics Cookies: Used to collect anonymised data on how Members navigate and use the platform — such as which games are most played, page load times, and error rates. This data informs platform improvements. These cookies are deployed only where you have provided consent.
• Functional Cookies: Used to remember your preferences such as display settings or language selection. These improve your experience but are not strictly necessary. They require your consent.

You may manage your cookie preferences via your browser settings. Most modern browsers allow you to block or delete cookies; however, doing so may affect the functionality of the semar500 platform. Specific instructions for managing cookies are available in the help documentation of your browser.

semar500 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to exercise or defend legal claims. The following general retention guidelines apply:

• Active Account Data: Retained for the lifetime of your account and for minimum period of five (5) years following permanent account closure, in compliance with AML and gaming licence record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or the date of account closure, whichever is later, as required by anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, in line with standard financial record-keeping obligations.
• Support Communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for three (3) years from the date of consent withdrawal, to demonstrate compliance with consent obligations.
• Technical & Log Data: Retained for up to twelve (12) months for security monitoring and fraud prevention purposes, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymisation is used, the resulting data no longer constitutes personal data and is retained indefinitely for platform analytics purposes only.

semar500 implements technical and organisational security measures proportionate to the sensitivity of the data we hold and the risks associated with its processing. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the semar500 platform;
• AES-256 encryption for sensitive personal data and KYC documents stored at rest;
• Role-based access controls that restrict access to personal data to authorised personnel only, on a strict need-to-know basis;
• Multi-factor authentication requirements for internal staff accessing Member data;
• Regular penetration testing and vulnerability assessments of platform infrastructure;
• Automated monitoring for unusual account activity patterns that may indicate data breach or account compromise;
• Formal data breach response procedures, including Member notification obligations where required.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is entirely free from the risk of interception or unauthorised access. In the unlikely event of a personal data breach that poses a risk to your rights or freedoms, semar500 will notify affected Members promptly and take all reasonable steps to mitigate the impact of the breach.

As a Member of semar500, you have the following rights with respect to your personal data. These rights may be exercised by contacting our support team using the details provided in Section15 of this Policy.

• Right of Access: You may request a copy of the personal data we hold about you. We will provide this within 30 calendar days of a valid request, free of charge for the first request in any 12-month period.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you. Where such a correction is made, we will notify any third-party processors who have been provided the incorrect data.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the processing is unlawful. Note that this right is subject to our legal obligations to retain certain data (see Section 8).
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances — for example, while you contest the accuracy of the data or while an objection to processing is being considered.
• Right to Portability: Where processing is based on your consent or on contractual necessity, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling. You may also object at any time to the processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

semar500 will respond to all data rights requests within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

Age verification is a mandatory step in the semar500 registration and KYC process. Where we discover or have reasonable grounds to believe that an account is held by an individual below the age of 21, the account will be immediately suspended, all personal data associated with the account will be securely deleted within a reasonable period, and any deposited funds will be returned to the source payment method pending investigation.

If you believe that a minor has registered an account with semar500, please contact us immediately via the support details in Section 15. We take underage gambling extremely seriously and will investigate all such reports without delay.

semar500 works with a limited number of third-party service providers to deliver certain platform functions. Where these providers process personal data on our behalf, they do so only as Data Processors under formal data processing agreements that bind them to confidentiality, security, and data minimisation obligations consistent with this Policy.

Categories of third-party processors engaged by semar500 include:

• Payment gateway and e-wallet providers (for processing MYR transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks);
• Identity verification service providers (for KYC document review and validation);
• Cloud infrastructure and hosting providers (for secure server hosting and data storage);
• Platform analytics providers (for aggregated, anonymised usage data);
• Live chat software providers (for customer support functionality).

semar500 does not permit third-party processors to use Member personal data for their own purposes. All processors are veted before engagement and are subject to periodic review. If a processor arrangement ends, we ensure that data held by the former processor is either returned to us or securely deleted.

semar500's primary servers are located in jurisdictions with established data protection frameworks. In the course of operating the platform, personal data may be transferred to, and processed in, countries other than Malaysia — for example, where our cloud infrastructure providers or third-party game studios are based.

Where personal data is transferred outside of Malaysia or the jurisdiction of our primary operations, we ensure appropriate safeguards are in place to protect that data to a standard equivalent to, or exceding, the protections described in this Policy. Such safeguards may include:

• Standard contractual clauses between semar500 and the receiving entity;
• Transfers to countries recognised as providing an adequate level of data protection;
• Binding corporate rules where applicable within corporate group structures.

If you have questions about the safeguards applied to any specific international transfer of your personal data, please contact us using the details in Section 15.

semar500 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The "Effective Date" and "Last Reviewed" dates at the top of this page will be updated accordingly each time a new version is published.

Where changes to this Policy are material — meaning they represent a substantive change to how we collect, use, or share your personal data — we will notify registered Members via their registered email address at least seven (7) days before the changes take effect.

Your continued use of the semar500 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept a revised Policy, you must cease use of the platform and request account closure before the new Policy takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by semar500, please contact our support team through one of the following channels:

We are committed to responding to all privacy-related enquiries and data rights requests within 30 calendar days. Support is available in English. Our peak coverage hours are 10:00 AM to 2:00 AM MYT (GMT+8), daily including Malaysian public holidays.