Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by irm1 (hereinafter referred to as "irm1", "we", "us", or "the Platform"), the operator of the online sports betting and casino gaming platform accessible at irm1.cam. irm1 serves registered players across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout the country.

irm1 takes the privacy and security of your personal data seriously. We understand that, as a Malaysian user, you entrust us with sensitive personal and financial information when you register an account, make a deposit, or use any of the features on our platform. This Policy sets out a transparent, comprehensive account of how that data is handled at every stage of its lifecycle — from initial collection to ultimate deletion or anonymisation.

This Policy applies to all personal data collected through the irm1 website at irm1.cam, any associated mobile-optimised interfaces, customer support channels (including live chat and email correspondence), and any other interactions you have with irm1 in the course of your membership.

This Policy should be read in conjunction with irm1's Terms & Conditions and Responsible Gambling Policy, which together govern the full scope of your relationship with the irm1 platform.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Data We Collect

irm1 collects Personal Data from Players through several channels and at multiple points throughout the player lifecycle. The categories of data we collect are described below.

3.1 Registration Data

When you create an Account on the irm1 Platform, we collect the following information:

• Full legal name;
• Date of birth (used to verify the 21+ age requirement);
• Email address;
• Mobile phone number;
• Residential address (Malaysian players are asked to provide the address registered on their MyKad where applicable);
• Username and password (password stored in hashed, non-reversible form);
• Preferred currency (MYR / RM is the default for Malaysian players).

3.2 KYC Verification Data

As part of our mandatory identity verification process, we may collect:

• A copy of a government-issued photo identification document (Malaysian MyKad, Passport, or Driver's Licence);
• Proof of current residential address (utility bill, bank statement, or official correspondence);
• A live selfie photograph for liveness and identity matching purposes;
• Proof of payment method ownership (e.g., a screenshot of a registered e-wallet or bank account statement showing the player's name).

3.3 Financial and Transaction Data

We collect financial data related to deposits, withdrawals, and wagering activity, including:

• Payment method details (e-wallet account identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow; bank account details for Maybank, CIMB, Public Bank, RHB, Hong Leong, and FPX; cryptocurrency wallet addresses for BTC/USDT transactions);
• Deposit amounts and timestamps;
• Withdrawal request history and processing outcomes;
• Full transaction and wagering history on the Platform.

3.4 Technical and Usage Data

When you access the irm1 Platform, we automatically collect certain technical data, including:

• IP address and approximate geolocation (used to verify jurisdiction eligibility);
• Device type, operating system, and browser version;
• Session duration, pages visited, and navigation patterns;
• Game history, betting patterns, and session frequency (used for responsible gambling monitoring).

3.5 Communications Data

If you contact the irm1 customer support team via live chat or email, we retain records of those communications, including the content of messages and any attachments submitted, for the purposes of resolving your enquiry and maintaining a quality assurance audit trail.

Data Processing

irm1 processes your Personal Data for the following specific purposes. We will not process your data for any purpose incompatible with those listed below without seeking your explicit consent or where otherwise permitted by law.

Legal Basis for Processing

irm1 processes your Personal Data on the following legal bases, as applicable to each processing activity:

5.1 Contractual Necessity

The majority of processing activities carried out by irm1 are necessary for the performance of the contractual relationship established when you create an Account and accept our Terms & Conditions. This includes account creation, payment processing, withdrawal execution, and the provision of sports betting and casino gaming services.

5.2 Legal Obligation

Certain processing activities are required to fulfil irm1's legal and regulatory obligations, including Know Your Customer (KYC) identity verification, anti-money laundering (AML) monitoring and record-keeping, responsible gambling compliance, and responding to lawful requests from competent regulatory or law enforcement authorities.

5.3 Legitimate Interests

irm1 processes certain categories of data on the basis of legitimate interests pursued by irm1 or by third parties, where those interests are not overridden by your fundamental rights and freedoms. This includes fraud prevention and detection, platform security monitoring, and anonymised analytics used to improve the Platform.

5.4 Consent

Where irm1 processes your Personal Data for purposes not covered by contractual necessity, legal obligation, or legitimate interests — such as sending you promotional communications about irm1 bonuses, new game launches, Liga Super Malaysia odds updates, or EPL special markets — we will do so only on the basis of your explicit prior consent. You may withdraw your consent for marketing communications at any time by contacting our support team.

Data Sharing

irm1 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the relevant purpose.

6.1 Payment Processing Partners

To facilitate deposits and withdrawals, irm1 shares necessary transaction data with Malaysian payment service providers including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the relevant financial institutions including Maybank, CIMB, Public Bank, RHB, and Hong Leong. This data sharing is strictly limited to what is required to process your transaction and is governed by each provider's own data protection obligations.

6.2 Identity Verification Providers

irm1 may engage specialist KYC and identity verification service providers to assist with the processing and validation of identity documents submitted by Players. Such providers act as Data Processors under contract with irm1 and are prohibited from using your KYC Data for any purpose other than fulfilling their service to irm1.

6.3 Regulatory and Law Enforcement Authorities

irm1 may disclose Personal Data to competent regulatory, governmental, or law enforcement authorities where required to do so by applicable law, court order, or regulatory direction. irm1 will, where legally permissible, notify the affected Player of any such disclosure.

6.4 Fraud Prevention and AML Agencies

irm1 may share data with third-party fraud prevention and anti-money laundering screening services for the purpose of detecting and preventing financial crime, identity fraud, and unauthorised Account access. Information shared for these purposes may be retained by those agencies and used to inform risk assessments on other platforms.

6.5 Professional Advisers

irm1 may share Personal Data with legal counsel, auditors, and other professional advisers engaged by irm1 for compliance, legal defence, or business operations purposes. Such advisers are bound by professional confidentiality obligations.

Cookies & Tracking Technologies

The irm1 Platform uses cookies and similar tracking technologies to support platform functionality, analyse usage patterns, and deliver a personalised experience to Players. By continuing to use the Platform, you consent to the use of cookies in accordance with this section.

7.1 Types of Cookies Used

7.2 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the irm1 Platform. Instructions for managing cookies are available in the help documentation of all major browsers. irm1 does not currently respond to browser "Do Not Track" signals, as there is no industry-standard specification for such responses.

Data Retention

irm1 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Specific retention periods for each category of data are set out in the Data Processing table in Section 04 of this Policy.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with irm1's internal data lifecycle management procedures. Anonymised data, which can no longer be linked to an identified individual, may be retained indefinitely for statistical and analytical purposes.

Where a Player submits a data erasure request (see User Rights, Section 10), irm1 will assess the request against its legal retention obligations before processing. Data subject to mandatory financial record-keeping obligations (typically 7 years under AML regulations) cannot be erased prior to the expiry of that period, even if an erasure request is submitted.

Data Security

irm1 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the irm1 Platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive personal data fields — including identity document images, payment details, and authentication credentials — are stored in encrypted form at rest.
• Password Hashing: Account passwords are never stored in plain text. All passwords are hashed using modern, computationally expensive hashing algorithms that are resistant to brute-force attacks.
• Access Controls: Access to Personal Data within irm1's internal systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls and subject to regular audit.
• Intrusion Detection: irm1 operates continuous network monitoring and intrusion detection systems to identify and respond to security incidents in real time.
• Penetration Testing: The Platform undergoes periodic third-party penetration testing to identify and remediate security vulnerabilities before they can be exploited.

In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of affected Players, irm1 will notify those Players without undue delay and take all necessary steps to contain and remediate the breach.

User Rights

As a Data Subject, you hold a number of rights in relation to the Personal Data that irm1 holds about you. irm1 is committed to upholding those rights and responding to all valid requests within a reasonable timeframe.

10.1 Right of Access

You have the right to request a copy of the Personal Data that irm1 holds about you, along with information about how that data is being processed. Requests will be fulfilled within 30 days of receipt.

10.2 Right to Rectification

If the Personal Data irm1 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections such as updating your email address or phone number can typically be made directly through your Account settings.

10.3 Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing on legitimate interest grounds. This right is subject to irm1's legal retention obligations, as described in Section 08 above.

10.4 Right to Data Portability

Where processing is carried out by automated means on the basis of your consent or contractual necessity, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.

10.5 Right to Object

You have the right to object to the processing of your Personal Data where that processing is carried out on the basis of legitimate interests, including profiling for direct marketing purposes. Upon receipt of a valid objection, irm1 will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.

10.6 Right to Withdraw Consent

Where processing is based on your consent (for example, receipt of promotional communications), you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.

Minors & Age Policy

The irm1 Platform is strictly intended for use by individuals aged 21 years or older. irm1 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of the account registration and KYC process.

If irm1 becomes aware that Personal Data has been collected from an individual who does not meet the minimum age requirement, that Account will be immediately suspended, all associated funds will be held pending investigation, and the data will be deleted to the extent permitted by applicable legal obligations. irm1 may report underage gambling attempts to relevant authorities where required by law.

Parents and guardians who believe a minor may have accessed the irm1 Platform and provided personal information are encouraged to contact our support team immediately so that we may take appropriate remedial action.

Cross-Border Data Transfers

As an international online gaming platform serving Malaysian players, irm1 may process and store Personal Data on servers located outside of Malaysia. In such cases, irm1 ensures that appropriate safeguards are in place to protect the security and integrity of your Personal Data, and that any cross-border transfer is carried out in compliance with applicable data protection laws.

Safeguards applicable to cross-border transfers may include:

• Contractual clauses in data processing agreements with third-party processors that impose data protection obligations equivalent to those applicable in Malaysia;
• Transfer to jurisdictions that maintain adequate data protection standards as assessed by relevant supervisory authorities;
• Technical and organisational security measures that protect transferred data to the same standard as data held within Malaysia.

For information about the specific safeguards applicable to any cross-border transfer of your data, please contact our support team.

Policy Amendments

irm1 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last Updated" date at the top of this page will be revised each time a material change is made.

Where changes are material — for example, where we introduce new processing purposes, share data with new categories of third parties, or materially alter retention periods — irm1 will notify registered Players via the Platform or by email to the registered address on file, giving reasonable advance notice of the change.

We encourage all Players to review this Policy periodically. Continued use of the Platform following the publication of a revised Policy constitutes acceptance of the updated terms. If you do not agree with any changes to this Policy, you should cease using the Platform and contact us to request Account closure.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the handling of your Personal Data by irm1, please contact our Data Privacy team through the following channels: