Privacy Policy

This Privacy Policy ("Policy") describes how oribet ("oribet", "we", "us", "our") — the operator of the online sports betting and live casino platform accessible at https://oribet.lat — collects, processes, stores, uses, discloses, and protects the personal data of individuals ("Player", "User", "you") who register for an account, access, or otherwise interact with the oribet platform and its associated services.

oribet serves players across Malaysia, including in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities and states throughout the country. We are committed to handling personal data responsibly and in compliance with applicable data protection legislation.

By registering an account with oribet or by continuing to use our platform, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. This Policy forms part of our Terms and Conditions, which you accepted upon registration.

In this Policy, the following terms carry the meanings assigned below:

oribet collects only the personal data that is necessary and proportionate to the purposes described in this Policy. The categories of personal data we collect include:

oribet collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or responding to a survey or promotional offer;
• Automated technical collection: Data collected automatically when you access the platform — including IP address, device identifiers, browser data, and behavioural analytics (pages visited, session duration, click patterns) via cookies and similar tracking technologies;
• Third-party sources: Identity verification data from KYC service providers; fraud screening data from anti-fraud partners; payment confirmation data from payment processors (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong);
• Publicly available sources: Where permitted by applicable law, oribet may supplement records with data from public registers or official databases for AML compliance purposes.

oribet processes personal data only where a valid legal basis exists. The table below sets out the primary processing purposes and their corresponding legal bases:

oribet does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: To facilitate deposits and withdrawals, oribet shares necessary financial data with payment processors including DuitNow, FPX-linked banks (Maybank, CIMB, Public Bank, Hong Leong, and others), Touch 'n Go eWallet, Boost, and GrabPay. These processors act as data processors under contractual agreements and are prohibited from using your data for their own purposes;
• Identity Verification Providers: KYC and liveness verification services process identity documents and images strictly for verification purposes under data processing agreements with oribet;
• Fraud Prevention & Security Partners: Transaction monitoring and anti-fraud systems may receive anonymised or pseudonymised data for risk scoring purposes;
• Regulatory Authorities: oribet may be required to disclose personal data to relevant governmental authorities, financial intelligence units, or law enforcement agencies where required or permitted by applicable law — for example, in connection with anti-money laundering investigations;
• Professional Advisers: Legal counsel, auditors, and compliance consultants may access personal data on a strictly confidential and need-to-know basis;
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity subject to equivalent data protection commitments.

All third parties with whom personal data is shared are required to maintain appropriate technical and organisational security measures and to process such data only for the purposes authorised by oribet.

oribet retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. The following retention periods apply:

• Account and transaction records: Retained for a minimum of 5 (five) years following account closure, in compliance with anti-money laundering record-keeping requirements;
• KYC documentation: Retained for a minimum of 5 (five) years following account closure or the date of the last transaction, whichever is later;
• Customer support communications: Retained for 3 (three) years following the date of last interaction;
• Marketing preferences and consent records: Retained for the duration of account membership and for 2 (two) years following account closure;
• Technical and log data: Retained for 12 (twelve) months from the date of collection, unless retained for longer in connection with a security investigation or legal proceeding.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Where data cannot be immediately deleted due to ongoing legal, regulatory, or dispute obligations, access to such data is restricted until deletion is possible.

oribet implements a comprehensive range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS): All data transmitted between your device and the oribet platform is encrypted using 256-bit SSL/TLS encryption;
• Access Controls: Access to systems containing personal data is restricted to authorised oribet personnel on a role-based, need-to-know basis, with multi-factor authentication enforced for internal system access;
• Password Security: Account passwords are stored in hashed form using industry-standard one-way encryption. oribet personnel cannot view your password and will never ask for it;
• Infrastructure Security: oribet's servers are hosted in access-controlled data centres with industry-standard physical and network security controls;
• Incident Response: oribet maintains a data breach detection and response procedure. In the event of a personal data breach that poses a risk to your rights, oribet will notify affected individuals promptly in accordance with applicable legal requirements.

oribet uses cookies and similar tracking technologies (including pixel tags and local storage) to operate the platform, remember your preferences, maintain session security, and analyse platform usage. The following categories of cookies are used:

🔒 Essential 📊 Analytics ⚙️ Functional

You can manage or delete cookies through your browser's privacy settings. Most modern browsers allow you to block or selectively accept cookies. Please note that disabling essential cookies may prevent certain platform features from functioning correctly.

oribet may send you promotional communications by email or SMS, including information about new games, seasonal promotions, bonus offers, and platform updates. We will only send direct marketing communications where:

• You have provided explicit consent during registration or via your account preferences; or
• You are an existing account holder and the communication relates to services similar to those you have previously used (legitimate interests basis), where you have not objected to receiving such communications.

You may withdraw your consent or object to marketing communications at any time by updating your communication preferences in your account settings, or by clicking the unsubscribe link included in any marketing email. Opting out of marketing communications will not affect the delivery of essential account-related communications (such as withdrawal confirmations, security alerts, or KYC requests).

Subject to applicable law, you have the following rights in relation to your personal data held by oribet. Requests to exercise any of these rights should be submitted to our support team at [email protected]. oribet will respond to all valid requests within 30 (thirty) calendar days.

oribet's platform is strictly intended for use by individuals aged 21 (twenty-one) years and above. We do not knowingly collect personal data from any person under this age. Age verification is a mandatory step in our KYC process, and accounts that cannot be verified as belonging to a person aged 21 or over will be suspended and closed.

If oribet becomes aware that personal data has been collected from an individual under the age of 21 without appropriate consent, we will take immediate steps to delete that data and close the associated account. Any outstanding balance will be returned to the relevant payment method.

Parents and guardians who believe that a person under 21 has accessed oribet without consent are encouraged to contact us immediately at [email protected] so that we can investigate and take appropriate action.

oribet's primary operations and data storage are centred in the Asia-Pacific region. In certain circumstances — such as where we engage third-party KYC providers, fraud prevention systems, or cloud infrastructure providers — your personal data may be transferred to, stored in, or processed in countries outside Malaysia.

Where such international transfers occur, oribet ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that which it would receive under Malaysian data protection law. These safeguards may include contractual data processing agreements incorporating standard data protection clauses, or transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

The oribet platform may contain references to third-party payment services (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-linked banking portals). When you are redirected to a third-party payment environment to complete a transaction, you are interacting with that third party's platform, which operates under its own privacy policy and terms.

oribet is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of oribet.

oribet reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal or regulatory requirements, or platform features. The "Last Updated" date at the top of this page will be revised accordingly upon any such change.

Material changes to this Policy — particularly those that affect how we process personal data or reduce your rights — will be communicated to registered account holders via the email address on file at least 14 days prior to the change taking effect. Continued use of the oribet platform following notification of a material change constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically to stay informed of how oribet protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by oribet, please contact our Data Privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line and provide your registered username for faster processing.
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the oribet website. Our support team will escalate privacy-related queries to the appropriate team within 1 business day.
• Response Time: oribet will acknowledge receipt of your privacy request within 3 business days and will provide a substantive response within 30 calendar days of receipt of a valid, verified request.