Privacy Policy — How rmmari Protects Your Data

Section 1

Introduction

rmmari ("Company", "we", "us", "our") operates the online gaming platform accessible at https://rmmari.cam ("Platform"). We are committed to protecting the privacy and personal data of all users ("User", "you", "your") who access or use our Platform.

This Privacy Policy ("Policy") describes how rmmari collects, processes, stores, shares, and protects personal data in connection with your use of the Platform, in accordance with applicable data protection principles and our licensing obligations under the Curacao online gaming licence framework.

By registering an Account on the Platform or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

Section 2

Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, rmmari.
• "Data Processor" means a third party that processes personal data on behalf of rmmari in accordance with our instructions.
• "KYC" means Know Your Customer — the regulatory identity and age verification process applied to all registered Users.
• "Cookies" means small text files placed on your device by the Platform to enable certain functionality and analytics.
• "MYR" means Malaysian Ringgit — the primary transaction currency of the Platform.

Section 3

Data Controller

rmmari is the Data Controller for all personal data collected through the Platform. We are responsible for determining the purposes for which your personal data is processed, and for ensuring that such processing is conducted lawfully, fairly, and transparently.

For all data protection enquiries, subject access requests, or complaints, please contact us using the details provided in Section 15 (Contact Us) of this Policy.

Section 4

Personal Data We Collect

rmmari collects personal data through several channels — directly from you during registration and Account use, automatically through your interaction with the Platform, and from third-party service providers where applicable.

4.1 Data You Provide Directly

• Full legal name, date of birth, and nationality
• Email address and mobile phone number
• Residential address (including city — such as Kuala Lumpur, Petaling Jaya, Penang, Shah Alam, or Johor Bahru)
• Government-issued identification documents (Malaysian MyKad, Driver's Licence, or Passport) submitted during KYC verification
• Proof of address documents (utility bills, bank statements, or equivalent dated within 3 months)
• Payment method details — e-wallet identifiers (Touch 'n Go, Boost, GrabPay), bank account details for DuitNow and FPX transfers, or cryptocurrency wallet addresses
• Communications submitted to our support team via live chat or email

4.2 Data Collected Automatically

• IP address and approximate geolocation data
• Device type, operating system, and browser information
• Session duration, pages visited, and navigation patterns within the Platform
• Transaction history — deposits, withdrawals, wagers placed, game activity, and bonus usage
• Login timestamps and authentication logs
• Cookie identifiers and preference data (see Section 10)

4.3 Data from Third Parties

• Identity verification results from KYC service providers
• Fraud and anti-money laundering (AML) screening outcomes from compliance service providers
• Payment confirmation data from payment processors (Touch 'n Go, DuitNow, FPX, and others)

Section 5

Purposes of Processing & Legal Bases

The table below sets out the purposes for which rmmari processes your personal data and the legal basis relied upon for each processing activity.

Section 6

Sharing of Personal Data

rmmari does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited circumstances:

6.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf and strictly in accordance with our instructions. These include:

• Payment processors: Touch 'n Go eWallet, Boost, GrabPay, DuitNow network banks (Maybank, CIMB, Public Bank, Hong Leong, and others), FPX, and cryptocurrency processing partners — for the purpose of executing deposit and withdrawal transactions.
• KYC and identity verification providers: for processing identity documents and confirming User eligibility.
• Fraud prevention and AML compliance providers: for screening transactions and account activity against relevant risk indicators.
• Cloud hosting and IT infrastructure providers: for secure data storage and platform operations.
• Customer support platforms: used to manage and respond to live chat and email enquiries.

All service providers are bound by contractual data processing agreements that restrict them from using your data for any purpose beyond the specific service they provide to rmmari.

6.2 Legal and Regulatory Disclosure

rmmari may disclose personal data to regulators, law enforcement authorities, or other public bodies where required to do so by applicable law, court order, or our licensing obligations — including obligations under our Curacao gaming licence related to anti-money laundering and counter-terrorism financing.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of substantially all assets, personal data held by rmmari may be transferred to the relevant successor entity, subject to equivalent data protection commitments being maintained by that entity.

Section 7

International Data Transfers

rmmari operates on an internationally hosted infrastructure. Your personal data may therefore be transferred to and processed in countries outside Malaysia. Where such transfers occur, we take appropriate steps to ensure that your data receives a level of protection consistent with applicable data protection standards — including the use of contractual safeguards with our data processors.

By using the Platform and accepting this Privacy Policy, you acknowledge and consent to such international transfers of your personal data as described above.

Section 8

Data Retention

rmmari retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The following general retention guidelines apply:

• Account data and transaction records: retained for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping requirements.
• KYC documents: retained for the duration of the Account relationship and for a minimum of five (5) years thereafter.
• Customer support communications: retained for up to three (3) years from the date of the communication.
• Marketing consent records: retained for as long as consent remains active, plus a reasonable period thereafter for compliance audit purposes.
• Analytical and technical data: typically retained in aggregated or anonymised form after a period of twenty-four (24) months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Section 9

Security Measures

rmmari implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• At-rest encryption for sensitive personal and financial data stored on our servers;
• Role-based access controls ensuring that staff can only access personal data necessary for their specific function;
• Multi-factor authentication (2FA) available for all User Accounts;
• Regular security assessments and penetration testing of the Platform infrastructure;
• Staff training on data protection and information security practices.

While we take all reasonable steps to protect your data, no online transmission or electronic storage system is completely immune to security risks. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected Users in accordance with our obligations under applicable law.

Section 10

Cookies & Tracking Technologies

The rmmari Platform uses cookies and similar tracking technologies to enable core functionality, maintain session security, and analyse how users interact with the site. The types of cookies we use are as follows:

rmmari does not use third-party advertising or retargeting cookies that track your activity across external websites. You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect the functionality of the Platform.

Section 11

Your Data Rights

Subject to applicable law and our legal and regulatory obligations, you hold the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you, including information about how it is processed.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected. You can update most Account information directly through your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected — subject to overriding legal or regulatory retention obligations (see Section 8).
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a correction request is being assessed.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request that we provide your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including direct marketing communications.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Data Protection team using the details in Section 15. We will respond to all verified requests within thirty (30) calendar days. Where a request is complex or numerous, we reserve the right to extend this period by a further sixty (60) days with prior notice.

Section 12

Minors

The rmmari Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process applied to all registered Accounts.

If we become aware that personal data has been collected from a person under the age of 21, we will promptly delete all such data and close the relevant Account. If you believe a minor may have accessed the Platform or submitted personal data, please contact us immediately using the details in Section 15.

Section 13

Third-Party Links & External Services

The Platform may contain references to or integrations with third-party services — such as payment gateways (including the Touch 'n Go eWallet, Boost, and GrabPay platforms) and game content providers. When you interact with these third-party services, their own privacy policies and terms apply.

rmmari is not responsible for the privacy practices or content of any third-party service. We encourage you to review the privacy policies of any external services you interact with in connection with your use of the Platform.

Section 14

Amendments to This Privacy Policy

rmmari reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered Users via email notification to the address registered with your Account and/or by a prominent notice posted on the Platform, with a minimum of fourteen (14) days' advance notice before the changes take effect.

The "Last Updated" date at the top of this Policy will be revised with each amendment. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

Section 15

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by rmmari, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform, in English, Bahasa Melayu, and Chinese. This is the fastest channel for general enquiries.
• Email: [email protected] (plain text — not a clickable link). For data rights requests and privacy complaints, please include "Privacy Request" in the subject line of your email.

We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full response within 30 calendar days. For urgent account security matters, please use the 24/7 live chat channel.

For responsible gambling queries or support resources, please visit our Responsible Gambling page.