Privacy Policy — istana777

This Privacy Policy ("Policy") is issued by istana777 ("Company", "we", "us", "our") and applies to all personal data collected from individuals ("User", "you") who access or use the istana777 platform at https://istana777.cam ("Platform"), including all associated services, features, games, and communications channels.

We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy describes the categories of personal data we collect, the purposes for which we process it, the legal bases upon which we rely, the parties with whom we may share it, and the rights available to you as a data subject.

This Policy should be read in conjunction with our Terms and Conditions and our Responsible Gambling Policy, which together govern your relationship with istana777. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

The following terms have the meanings assigned below throughout this Policy:

istana777 collects personal data across several categories depending on how you interact with the Platform. The table below sets out these categories and provides examples of the specific data points collected within each:

istana777 collects personal data through the following channels and mechanisms:

• Direct Provision: Data you actively provide when registering an account, completing your profile, submitting KYC documents, making a deposit or withdrawal request, or contacting our customer support team.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, browser fingerprints, session identifiers, device information, and behavioural activity logs.
• Payment Processors: Transaction confirmation data received from Malaysian payment service providers including but not limited to Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank, as well as cryptocurrency network confirmations for BTC, ETH, USDT, and BNB transactions.
• Third-Party KYC Providers: Identity verification data returned by our contracted KYC service providers following document submission.
• Cookies and Tracking Technologies: Behavioural and preference data collected through cookies and similar tracking technologies as further described in Section 8.
• Publicly Available Sources: In limited circumstances, we may supplement data on file with information obtained from publicly available registries or records for anti-fraud or AML compliance purposes.

istana777 processes personal data on one or more of the following lawful bases, depending on the nature of the processing activity:

istana777 processes your personal data for the following specific purposes:

• Account Creation and Management: To establish, maintain, and administer your registered account on the Platform.
• Identity and Age Verification (KYC): To verify that you are at least 21 years of age and meet the eligibility criteria for Platform access as required by applicable regulations.
• Payment Processing: To process deposits via Malaysian payment methods (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, and others) and to process withdrawal requests back to your designated payment method.
• Provision of Gaming Services: To deliver the Platform's gaming products including live casino, slots, sportsbook (Liga Super Malaysia, EPL, UFC), and instant games.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, collusion, money laundering, and other prohibited conduct.
• Regulatory Compliance: To fulfil obligations imposed by applicable gaming regulations and anti-money laundering frameworks.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance through live chat, email, and WhatsApp channels in English, Bahasa Melayu, and Mandarin.
• Responsible Gambling: To monitor gaming activity and apply responsible gambling controls including deposit limits, session reminders, and self-exclusion tools where relevant.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may opt out at any time.
• Platform Improvement: To analyse usage patterns and technical performance data for the purpose of improving the Platform's features, stability, and user experience.

istana777 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share personal data with third parties only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: Transaction data is shared with the relevant payment processor (e.g., Touch 'n Go, DuitNow, FPX, Maybank, CIMB) solely to facilitate the processing of your deposit or withdrawal request.
• KYC and Identity Verification Providers: Identity documents and related personal data are shared with contracted third-party KYC verification services to confirm your eligibility as required by applicable regulations.
• Fraud Prevention and AML Services: Relevant personal and transactional data may be shared with specialist anti-fraud and anti-money laundering service providers for screening and risk assessment purposes.
• Technology and Infrastructure Providers: Technical service providers including cloud hosting, database management, and platform security vendors who process data on our behalf under binding data processing agreements.
• Regulatory Authorities and Law Enforcement: We may disclose personal data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or enforceable legal process.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of istana777's business, personal data held by the Company may be transferred to the acquiring entity, subject to equivalent data protection commitments.

The istana777 Platform uses cookies and similar tracking technologies to provide and improve the user experience. The following categories of cookies are used:

You can manage non-essential cookie preferences through your browser settings. Note that disabling certain categories of cookies may impair the functionality of some Platform features. Strictly necessary cookies cannot be disabled without preventing access to the Platform entirely.

istana777 retains personal data only for as long as is necessary for the purposes set out in this Policy, or as required by applicable law or regulatory mandate. The following general retention periods apply:

• Active Account Data: Retained for the duration of the account relationship and updated periodically as required for accuracy and compliance.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with anti-money laundering record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of account closure or the completion of the relevant transaction, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, to support dispute resolution and service improvement.
• Technical Logs: Generally retained for ninety (90) days, unless extended retention is required for an ongoing security investigation or legal matter.
• Marketing Consent Records: Retained for the duration of the consent period and for three (3) years following withdrawal of consent to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

As a User of the istana777 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team through live chat or by email as described in Section 15. We will acknowledge your request within 5 business days and aim to provide a substantive response within 30 calendar days.

istana777 implements and maintains a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encryption of sensitive personal data and financial records at rest in our database infrastructure
• Role-based access control (RBAC) ensuring that personal data is accessible only to authorised personnel with a legitimate operational need
• Automated fraud detection and intrusion detection systems monitoring platform activity in real time
• Regular penetration testing and security audits conducted by qualified independent parties
• Incident response procedures covering detection, containment, notification, and remediation of data security incidents
• Employee training on data handling obligations and information security best practices

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Users without undue delay and provide guidance on protective steps you can take.

The istana777 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person below this age threshold. Age verification is a mandatory component of our account registration and KYC processes.

If istana777 discovers or is notified that an account has been registered by a person under the age of 21, the account will be suspended immediately. Any deposits made to that account will be reviewed and the account closed in accordance with our Terms and Conditions and applicable regulatory requirements.

If you are a parent or guardian and believe that a minor in your care has registered an account on the Platform, please contact our support team immediately so that we can investigate and take appropriate action without delay.

The Platform may contain references to third-party payment services and other external systems that you interact with as part of your use of istana777, such as Touch 'n Go eWallet, Boost, DuitNow, or cryptocurrency wallet interfaces. Your interaction with these third-party services is governed by their own privacy policies and terms of service, which are independent of istana777.

istana777 is not responsible for the data practices, security measures, or content of any third-party service provider accessed via links or integrations on the Platform. We encourage you to review the privacy policies of any third-party services you use in connection with your account before providing them with personal data.

istana777 reserves the right to modify or update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or Platform features. The "Last Updated" date at the top of this Policy will be revised accordingly whenever material changes are made.

Where a change to this Policy is material — meaning it substantively affects the way in which we process your personal data or the rights available to you — we will endeavour to provide advance notice via email to your registered address or through a prominent notice on the Platform prior to the change taking effect.

Your continued use of the Platform following notification of any changes to this Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you should discontinue use of the Platform and contact our support team to close your account and exercise any applicable data deletion rights.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by istana777, please contact us through the channels listed below. All contact details are for informational display only.