Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") describes how Scrplay (the "Company", "we", "us", or "our") collects, processes, stores, and discloses personal data relating to individuals ("Players", "you", or "your") who access or use the Scrplay online gambling platform at scrplay.cam (the "Platform").

Scrplay takes the privacy of its players seriously. This Policy is intended to be transparent, readable, and compliant with internationally recognised data protection principles. By registering an Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference.

2. Definitions

"Personal Data"

Any information that identifies or can reasonably identify a natural person, directly or indirectly — including name, identification number, contact details, IP address, or device identifiers.

"Data Controller"

Scrplay, the entity that determines the purposes and means of processing personal data collected through the Platform.

"Data Processor"

A third party that processes personal data on behalf of Scrplay, under a written data-processing agreement that restricts the processor to the Company's instructions.

"Processing"

Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.

"Consent"

A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose. Consent may be withdrawn at any time.

"KYC"

Know Your Customer — the identity, age, and source-of-funds verification process required before certain Platform activities (e.g., withdrawals) are permitted.

"Cookies"

Small text files placed on your device by the Platform to store session information, preferences, and analytics data.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register an Account, complete KYC, contact support, or use Platform features, you may provide the following categories of personal data:

• Identity data: Full legal name, date of birth, gender, nationality, MyKad (Malaysian identity card) or passport number and copy.
• Contact data: Residential address (including city — Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, etc.), email address, and mobile number.
• Financial data: Bank account details (Maybank, CIMB, Public Bank, Hong Leong), eWallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), FPX / DuitNow references, and cryptocurrency wallet addresses (BTC, ETH, USDT).
• KYC documentation: Copies of identity documents, proof of address (e.g., utility bill, bank statement), and any additional documents requested to satisfy regulatory due diligence obligations.
• Support communications: Records of correspondence between you and our support team via live chat, WhatsApp, email, or WeChat.

3.2 Data Collected Automatically

When you access the Platform, we automatically collect:

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
• Usage data: Pages visited, games played, bets placed (including selections, stakes, and outcomes), session duration, clickstream data, and feature usage patterns.
• Transaction data: Deposit and withdrawal amounts, dates, methods, and processing statuses — all denominated in MYR.
• Geolocation data: Approximate geographic location derived from your IP address, used for fraud detection and jurisdiction compliance.
• Cookie data: As described in Section 10 of this Policy.

3.3 Data from Third Parties

We may receive personal data about you from third-party sources, including identity verification services, fraud-prevention databases, payment processors, and publicly available sources — where such receipt is permitted by applicable law and necessary for a legitimate operational purpose.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Purpose	Legal Basis
Account registration and management	Performance of a contract
Processing deposits and withdrawals in MYR	Performance of a contract
Identity verification (KYC)	Legal obligation; legitimate interests
Fraud prevention and security monitoring	Legitimate interests
Responsible gambling monitoring and intervention	Legal obligation; legitimate interests
Customer support communications	Performance of a contract; legitimate interests
Sending promotional offers and personalised recommendations	Consent (withdrawable at any time)
Platform analytics and product improvement	Legitimate interests
Compliance with regulatory and legal obligations	Legal obligation

5. How We Use Your Personal Data

Scrplay uses the personal data we collect for the following specific purposes:

• To create, verify, and maintain your Account, including performing KYC checks;
• To process MYR-denominated financial transactions, including deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels;
• To detect, investigate, and prevent fraud, money laundering, collusion, bonus abuse, and other prohibited activity;
• To operate responsible gambling tools — including monitoring for problem gambling indicators and reaching out where our systems flag a concern;
• To respond to customer support enquiries via live chat, email ([email protected]), WhatsApp, and WeChat;
• To enforce compliance with our Terms & Conditions, including suspension or closure of Accounts that breach the Agreement;
• To send service-related communications (e.g., withdrawal confirmations, security alerts, policy updates) — these are non-optional as they form part of the service;
• To send marketing communications and personalised bonus offers — only where you have provided explicit consent;
• To conduct internal analytics to improve the Platform's performance, game selection, and user experience;
• To comply with applicable laws, respond to lawful requests from authorities, and defend legal claims.

6. Sharing of Personal Data

6.1 Third-Party Data Processors

We share your personal data with carefully selected third-party processors only to the extent necessary for them to perform their services on our behalf. All processors operate under written data-processing agreements that restrict them to processing data solely on our instructions. Current categories of processor include:

• Payment processors and banking partners — including providers supporting DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks;
• Identity and KYC verification providers — to authenticate identity documents and confirm your age and address;
• Fraud detection and AML screening services — to identify and investigate suspicious financial activity;
• Cloud infrastructure and hosting providers — who store Platform data on secure, access-controlled servers;
• Customer communication platforms — supporting live chat, email delivery, and WhatsApp / WeChat integration;
• Analytics platforms — to process aggregated, pseudonymised usage data for product improvement.

6.2 Legal Disclosure

We may disclose personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where we are required to do so by law, or where we have a good-faith belief that disclosure is necessary to protect the rights, safety, or property of the Company, our players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the Company's assets, personal data held by the Company may be transferred to the acquiring entity. We will notify registered Players of any such transfer via the Platform or by email before it takes effect, where reasonably practicable.

7. International Data Transfers

As an internationally operating platform, Scrplay may transfer personal data to countries outside Malaysia. Where such transfers occur, we ensure that adequate safeguards are in place — such as standard contractual clauses, binding corporate rules, or transfers to jurisdictions recognised as providing an adequate level of data protection.

By using the Platform, you acknowledge and consent to transfers of your personal data outside Malaysia where necessary for the operation of the services described in this Policy.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your Account plus a minimum of five (5) years following Account closure, to comply with anti-money laundering obligations.
• Transaction records: Retained for a minimum of seven (7) years from the date of the transaction, as required by applicable financial record-keeping standards.
• KYC documentation: Retained for a minimum of five (5) years following the completion of the relevant verification, or longer where required by applicable law.
• Support communications: Retained for three (3) years from the date of the last communication, unless a live dispute requires longer retention.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of the consent.
• Technical and usage logs: Typically retained for twelve (12) months on a rolling basis.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

9. Security of Personal Data

Scrplay implements a layered security framework designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key technical and organisational measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• AES-256 encryption for sensitive data stored at rest, including financial details and identity documents;
• Role-based access controls ensuring that only authorised personnel can access personal data, restricted to their specific job functions;
• Multi-factor authentication for all internal systems holding personal data;
• Regular security penetration testing and vulnerability assessments carried out by qualified third-party specialists;
• Comprehensive audit logging of all access to personal data, enabling full forensic investigation of any suspected breach;
• Documented data breach response procedures, including regulatory notification obligations where a reportable breach occurs.

While we take all reasonable precautions to protect your data, no security system is impenetrable. You are responsible for keeping your login credentials confidential. The Company will never ask you to share your password by any channel.

10. Cookies & Similar Technologies

The Platform uses cookies and similar tracking technologies to operate essential Platform functions, remember your preferences, and analyse usage patterns. The categories of cookies we use are as follows:

Category	Purpose	Can Be Disabled?
Essential	Session management, authentication, security tokens — required for the Platform to function.	No
Functional	Storing your language preferences, game settings, and last-visited sections.	Yes
Analytics	Aggregate, pseudonymised data on how players navigate and use the Platform — used for product improvement.	Yes
Preference	Remembering your opted-in promotional preferences and notification settings.	Yes

You can manage your cookie preferences through your browser settings or through the cookie preference centre available on the Platform. Disabling essential cookies will impair your ability to use certain features, including logging in and placing bets.

11. Your Data Subject Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by Scrplay:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: In certain circumstances, you may request that we limit how we use your personal data while a dispute or accuracy challenge is under review.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. Once an objection to direct marketing is received, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Data Protection contact via the support channels listed in Section 16. We will acknowledge your request within five (5) calendar days and provide a substantive response within thirty (30) calendar days. We may request proof of identity before processing your request.

12. Marketing Communications

Where you have provided explicit consent, Scrplay may send you personalised marketing communications about bonuses, promotions, new game releases, VIP programme updates, and special events relevant to your preferences and play history on the Platform.

You may withdraw your marketing consent at any time by: (a) updating your notification preferences in your Account dashboard; (b) clicking the unsubscribe link in any marketing email; or (c) contacting our support team directly via live chat or email.

Please note that withdrawal of marketing consent does not affect service-related communications (such as withdrawal confirmations, security alerts, or Terms & Conditions updates), which are sent on the basis of contractual necessity and cannot be unsubscribed from while your Account remains active.

13. Minors

The Platform is strictly intended for individuals aged 21 years and above. Scrplay does not knowingly collect, process, or retain personal data from persons under this age. If we become aware that an Account has been created by or that personal data has been collected from a person under 21, we will immediately close the Account, void any associated bets or balances, and securely delete all personal data attributable to that individual.

If you have reason to believe that a minor has created an Account or provided personal data on the Platform, please contact our support team immediately. We take age enforcement seriously and verify the age of all account holders as part of our KYC process.

14. Third-Party Links

The Platform may, from time to time, contain references to third-party services or platforms (for example, payment processor interfaces). This Privacy Policy applies only to the Scrplay Platform. We have no control over, and accept no responsibility for, the privacy practices or content of third-party websites or services accessed via links from the Platform. We encourage you to review the privacy policies of any third-party service you interact with.

15. Changes to This Privacy Policy

Scrplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. When material changes are made, we will notify registered Players by email or via a prominent notice on the Platform, providing at least seven (7) calendar days' notice before the revised Policy takes effect, where reasonably practicable.

The "Effective Date" at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Scrplay support and data team through the following channels:

• Live Chat: Available 24/7 on the Platform — average response time 3–5 minutes. Supported in English, Bahasa Melayu, and Chinese.
• Email: [email protected] (plain text — not a clickable link). Responses within 24 hours on business days.

When submitting a data subject rights request, please include your full registered name, Account email address, and a brief description of the right you wish to exercise. We may request additional identity verification before processing your request.