Privacy Policy — Dragon222

Dragon222 ("we", "us", "our", "the Platform") operates the online casino and sports betting services available atdragon222.cam. We are committed to protecting the privacy and personal data of all registered players, visitors, and users who interact with our platform, including Malaysian players accessing our services from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

This Privacy Policy ("Policy") explains in clear and transparent terms: what categories of personal data we collect; the specific purposes for which we process that data; the legal bases upon which processing is conducted; with whom your data may be shared; how long we retain your data; and the rights you hold as a data subject.

By registering an account, making a deposit, or otherwise using the dragon222 platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy. This Policy is to be read alongside our Terms & Conditions.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person (the "data subject"), including name, contact details, identification documents, financial data, and digital identifiers such as IP address or device ID.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — Dragon222, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — any third party that processes Personal Data on behalf of Dragon222 under a documented data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" (Know Your Customer) — the mandatory identity and address verification process required under anti-money laundering regulations and our operating licence conditions.
• "Cookie" — a small text file placed on your device by a website to store information about your browsing session or preferences.

Dragon222 collects the following categories of Personal Data from players and platform visitors:

3.1 Identity Data

Full legal name, date of birth, nationality, gender (where provided), and copies of government-issued identification documents — including Malaysian MyKad, Driving Licence, or Passport — submitted as part of the KYC verification process.

3.2 Contact Data

Email address, telephone number, and current residential address. For Malaysian players, this typically includes street address, city (e.g., Kuala Lumpur, Petaling Jaya, Shah Alam), state, and postcode.

3.3 Financial Data

Bank account details (for withdrawal processing via Maybank, CIMB, Public Bank, Hong Leong, or other Malaysian financial institutions), e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), FPX transaction references, DuitNow QR identifiers, and USDT wallet addresses where applicable. We do not store full card numbers or CVV codes.

3.4 Transaction Data

Records of all deposits, withdrawals, wagers, game outcomes, bonus redemptions, and promotional participations associated with your Account, including timestamps, amounts in MYR, and the relevant payment method used.

3.5 Technical Data

IP address, browser type and version, operating system, device type and identifier, time zone, language settings, referring URL, session duration, pages visited, and other standard web analytics data collected automatically when you access the Platform.

3.6 Behavioural Data

Game preferences, betting patterns, session frequency, average session duration, preferred sports markets (e.g., Liga Super Malaysia, EPL, UFC), preferred game types, and other usage analytics generated through your interaction with the Platform.

3.7 Communications Data

Records of all communications between you and dragon222's support team, including live chat transcripts, email correspondence, and complaint records. These are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

3.8 Responsible Gambling Data

Self-imposed limits (deposit caps, loss limits, session limits), self-exclusion requests, and any responsible gambling assessments or interventions recorded in connection with your Account.

Dragon222 collects Personal Data through the following mechanisms:

• Direct Submission: Data you provide when completing the account registration form, submitting KYC documents, making a deposit, submitting a withdrawal request, or contacting support.
• Automated Technologies: Technical and behavioural data collected automatically via cookies, web beacons, server logs, and similar tracking technologies when you visit or use the Platform.
• Third-Party Payment Providers: Transaction confirmation data received from payment processors and financial institutions (e.g., DuitNow, FPX, Maybank, CIMB) when you conduct a deposit or withdrawal.
• Identity Verification Services: Verification outcomes and risk signals from third-party KYC and AML screening providers engaged by Dragon222 to meet regulatory obligations.
• Fraud Detection Systems: Data generated by automated fraud detection tools that analyse login patterns, IP addresses, device fingerprints, and transaction behaviour for security purposes.

Dragon222 processes your Personal Data for the following clearly defined purposes. The table below maps each purpose to its lawful basis and the categories of data used:

Dragon222 relies on one or more of the following lawful bases when processing your Personal Data:

• Contract Performance: Processing is necessary for the performance of the agreement between you and Dragon222 — specifically, to operate your Account, process transactions, and deliver the gaming and betting services you have requested.
• Legal Obligation: Processing is required in order for Dragon222 to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and reporting obligations under our operating licence.
• Legitimate Interest: Processing is necessary for the purposes of Dragon222's legitimate business interests — including fraud prevention, platform security, responsible gambling monitoring, and improving the quality of our services — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is not covered by the bases above — for example, for personalised marketing communications — Dragon222 will seek and rely upon your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Dragon222 does not sell, rent, or trade your Personal Data to any third party. We may, however, share your data with carefully selected third parties in the following circumstances:

7.1 Payment Service Providers

We share the minimum necessary financial data with payment processors and financial institutions — including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, and GrabPay — for the sole purpose of processing your deposit and withdrawal transactions.

7.2 KYC and AML Service Providers

We engage licensed third-party identity verification and AML screening providers. These providers process your identity documents and cross-reference your details against regulatory watchlists and sanction databases. These services are conducted under strict data processing agreements.

7.3 Technology and Infrastructure Partners

Dragon222 uses third-party cloud hosting, content delivery, and cybersecurity services to operate the Platform. These providers are contractually prohibited from using your data for any purpose other than providing the agreed services to Dragon222.

7.4 Game Studios

Certain game studios that supply games to the Platform may receive anonymised session data (such as game type played and session duration) for licensing compliance and game performance auditing. No directly identifiable Personal Data — such as your name, address, or financial details — is shared with game studios.

7.5 Regulatory and Law Enforcement Authorities

Dragon222 will disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so by applicable law or pursuant to a valid court order, subpoena, or regulatory directive. We will notify affected users of such disclosure where permitted by law.

Some of the third-party service providers engaged by Dragon222 may be located in, or operate servers from, jurisdictions outside Malaysia. Where your Personal Data is transferred to a third country, Dragon222 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Malaysian data protection principles.

Such safeguards may include contractual clauses in our data processing agreements that require overseas processors to handle your data securely and only for the agreed purposes. Dragon222 does not transfer your data to jurisdictions that do not offer an adequate level of data protection without ensuring that compensating measures are in place.

Dragon222 retains Personal Data only for as long as is reasonably necessary for the purposes described in this Policy, or as required by law, regulation, or our operating licence. The following general retention principles apply:

• Active Account Data: Personal Data associated with an active Account is retained throughout the active life of the Account.
• Closed Account Data: Following closure of an Account, identity and transaction records are retained for a minimum of five (5) years in accordance with standard AML and regulatory record-keeping requirements.
• KYC Documents: Identity verification documents are retained for the duration of the Account relationship plus five years post-closure, or longer where required by applicable law.
• Support Communications: Customer support records are retained for a minimum of three years from the date of the communication, or longer where a dispute remains unresolved.
• Technical Logs: Server logs and access records are retained for up to 12 months for security and fraud detection purposes, after which they are anonymised or deleted.
• Marketing Consent Records: Records of consent and opt-out preferences are retained for as long as necessary to demonstrate compliance with applicable marketing regulations.

When Personal Data is no longer required for its original purpose and no overiding legal retention obligation exists, Dragon222 will securely delete, destroy, or anonymise that data in a manner that prevents recovery or reconstruction.

Dragon222 uses cookies and similar tracking technologies to operate and improve the Platform, maintain session continuity, and analyse usage patterns. By accessing the Platform without adjusting your browser's cookie settings, you consent to the use of cookies as described in this section.

10.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens, and shopping cart-equivalent session state. These cannot be disabled without rendering the Platform inoperable.
• Functional Cookies: Remember your preferences such as language settings, preferred display options, and time zone. These enhance your experience but are not strictly necessary.
• Analytics Cookies: Collect anonymised data about how users navigate the Platform — which pages are visited most frequently, session duration, error rates, and similar performance metrics. This data helps us improve the Platform.
• Security Cookies: Used by our fraud detection systems to identify unusual access patterns, bot activity, and potential account takeover attempts.

10.2 Managing Cookies

You may manage or delete cookies through your browser's settings at any time. Most modern browsers allow you to view, block, or delete cookies. Please be aware that disabling certain categories of cookies — particularly strictly necessary cookies — may affect the functionality of the Platform and your ability to access your Account.

Dragon222 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using industry-standard Transport Layer Security protocols.
• Data Encryption at Rest: Sensitive data stored in our databases — including identity documents and financial records — is encrypted at rest using strong encryption standards.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Employees who access player data are bound by confidentiality obligations and receive regular data protection training.
• Intrusion Detection Systems: Our infrastructure is continuously monitored by automated intrusion detection and threat intelligence systems that identify and alert on anomalous activity in real time.
• Regular Security Audits: Dragon222 conducts periodic security assessments, vulnerability scans, and penetration testing to identify and remediate potential weaknesses in our systems.
• Incident Response: In the event of a data security incident that is likely to result in a risk to your rights and freedoms, Dragon222 will notify affected individuals and relevant authorities within the timeframes required by applicable law.

While Dragon222 takes all reasonable measures to protect your data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the security of your Account credentials and should notify us immediately if you suspect any unauthorised access to your Account.

Subject to applicable law and certain exemptions (including our regulatory obligations to retain data), you hold the following rights in relation to your Personal Data held by Dragon222: