ong918 Privacy Policy

1. Introduction

ong918 ("we", "us", "our", or "ong918") is committed to protecting the privacy and personal data of all individuals who access or use the ong918 platform available at ong918.app (the "Platform").

This Privacy Policy describes how ong918 collects, uses, processes, stores, and shares personal data in connection with your use of the Platform, including account registration, identity verification, financial transactions, gaming activity, and customer support interactions.

By accessing or using the ong918 Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue your use of the Platform.

This Privacy Policy should be read together with the ong918 Terms & Conditions, which are incorporated herein by reference.

2. Data Controller

For the purposes of applicable data protection legislation, ong918 acts as the data controller in respect of personal data collected from Platform users. As data controller, ong918 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully and transparently.

Where ong918 engages third-party service providers to process personal data on its behalf (for example, payment processors and identity verification providers), those parties act as data processors under contractual obligations consistent with applicable data protection requirements.

3. Personal Data We Collect

ong918 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

• Identity Data: Full legal name, date of birth, nationality, and copies of government-issued identification (such as Malaysian MyKad, passport, or driving licence) collected during the Know Your Customer (KYC) verification process.
• Contact Data: Email address, mobile phone number, and residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya).
• Account Credentials: Username and encrypted password. ong918 does not store passwords in plain text.
• Financial Data: Payment method details (e.g., e-wallet identifiers for Touch n Go eWallet and Boost, bank account numbers for Maybank, CIMB, and Public Bank transfers, and partial card numbers for Visa/Mastercard transactions). Full card numbers are not stored by ong918 and are handled exclusively by PCI-DSS compliant payment processors.
• Transaction Data: Records of deposits, withdrawals, bonuses, wagers, and game results associated with your ong918 account.
• Technical Data: IP address, device type, browser type and version, operating system, and session identifiers collected automatically when you access the Platform.
• Usage Data: Pages visited, games played, betting patterns, session durations, and feature interactions on the Platform.
• Communication Data: Records of correspondence between you and ong918's customer support team, including live chat transcripts and email exchanges.

4. How We Use Your Personal Data

ong918 uses your personal data for the following purposes:

• To create and manage your ong918 account and provide access to Platform services;
• To verify your identity and age in compliance with our licensing obligations (21+ age requirement is strictly enforced);
• To process deposits and withdrawals via your selected MYR payment methods;
• To detect, prevent, and investigate fraud, money laundering, and other illegal activity;
• To operate and improve Platform functionality, game performance, and user experience;
• To personalise your experience on ong918, including recommending relevant games and promotions based on usage history;
• To communicate important account information, security alerts, and service updates;
• To send promotional communications where you have provided consent, including information about new games, bonuses, and sportsbook events;
• To comply with our licensing authority requirements, including player transaction reporting and responsible gaming monitoring;
• To resolve customer support queries and disputes.

5. Legal Basis for Processing

ong918 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and ong918, including account administration, game access, and payment processing;
• Legal obligation: Processing required to comply with our licensing obligations, anti-money laundering (AML) requirements, and applicable law;
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing for direct marketing communications, where you have provided explicit consent. You may withdraw consent at any time by contacting ong918 support or using the unsubscribe mechanism in any marketing communication.

6. Data Sharing and Disclosure

ong918 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your personal data in the following limited circumstances:

• Payment processors: Financial data is shared with our authorised payment partners (including e-wallet operators and banking partners) to process transactions. These partners are contractually bound to process data only as instructed by ong918;
• Identity verification providers: Identity and document data is shared with KYC service providers to fulfil our age and identity verification obligations;
• Regulatory and licensing authorities: Transaction records and player data may be disclosed to our licensing authority in connection with regulatory reporting, audits, or investigations;
• Law enforcement: ong918 will disclose personal data to law enforcement or regulatory bodies where required by applicable law, court order, or where necessary to protect the safety of individuals or the integrity of the Platform;
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all ong918 assets, player data may be transferred to the successor entity, subject to equivalent privacy protections.

7. International Data Transfers

As an internationally licensed platform, ong918 may transfer personal data to servers and service providers located outside Malaysia. Where such transfers occur, ong918 ensures that appropriate safeguards are in place — including contractual data processing agreements with standard data protection clauses — to protect your personal data to a standard equivalent to that required under applicable law.

8. Data Retention

ong918 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data: Retained for the duration of the active account relationship plus a minimum of five (5) years following account closure, in compliance with anti-money laundering legislation;
• Transaction records: Retained for a minimum of seven (7) years in accordance with financial record-keeping requirements;
• Identity verification documents: Retained for the duration of the account relationship plus five (5) years post-closure;
• Customer support communications: Retained for three (3) years from the date of the relevant interaction.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

9. Cookies and Tracking Technologies

ong918 uses cookies and similar tracking technologies to operate the Platform and enhance your experience. The categories of cookies used are:

• Strictly necessary cookies: Required for core Platform functionality, including session authentication, security tokens, and load balancing. These cannot be disabled without disrupting Platform access;
• Analytics cookies: Used to collect aggregated, anonymised information about how users interact with the Platform, enabling ong918 to identify and fix issues and improve functionality. ong918 uses first-party analytics only — no third-party advertising analytics are deployed;
• Preference cookies: Store your language, display, and notification preferences to personalise your Platform experience across sessions.

You may manage and delete cookies through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the ong918 Platform.

10. Your Data Protection Rights

Subject to applicable data protection law and ong918's legal obligations, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data ong918 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ong918's legal retention obligations;
• Right to restriction: You may request that ong918 restrict processing of your personal data in certain circumstances;
• Right to data portability: You may request a copy of personal data you have provided to ong918 in a structured, machine-readable format;
• Right to object: You may object to processing based on legitimate interests, including profiling;
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact ong918 support at [email protected]. Requests will be handled within thirty (30) days, subject to identity verification.

11. Children's Privacy

The ong918 Platform is strictly intended for adults aged 21 and above. ong918 does not knowingly collect personal data from persons under the age of 21. If ong918 discovers that personal data has been collected from a person under 21, that account will be closed immediately, all associated funds forfeited, and the data deleted in accordance with our retention policy.

If you are a parent or guardian and believe that a minor has registered on ong918, please contact us immediately at [email protected].

12. Security Measures

ong918 implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and ong918 servers;
• AES-256 encryption for sensitive data stored at rest;
• Role-based access controls limiting internal staff access to personal data;
• Regular third-party security audits and penetration testing;
• Automated anomaly detection for login attempts and account activity.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. ong918 cannot guarantee absolute security, and players are encouraged to use strong, unique passwords and enable two-factor authentication on their accounts.

13. Third-Party Links

The ong918 Platform may contain links to third-party websites in limited contexts. ong918 is not responsible for the privacy practices or content of any third-party sites. This Privacy Policy applies solely to data processed by ong918 on the Platform. We encourage you to review the privacy policies of any third-party sites you visit.

14. Amendments to This Privacy Policy

ong918 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via email or Platform notification prior to the effective date. The "Last updated" date at the top of this page will reflect the most recent revision.

Continued use of the ong918 Platform following any amendment constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or ong918's data processing practices, please contact our Data Protection team:

Email: [email protected]

ong918 customer support is available 24/7, including Malaysian public holidays. We aim to respond to all privacy-related enquiries within five (5) business days and to resolve subject access requests within thirty (30) days of identity verification.