Introduction
Indibet ("we", "us", "our") operates the online casino and sports betting platform accessible at https://indibet.cam. We are committed to handling the personal data of our registered players and website visitors with the highest standards of care, transparency, and security.
This Privacy Policy ("Policy") sets out in clear terms what personal data Indibet collects from you, the lawful basis on which it is processed, how it is used, with whom it may be shared, and the rights you hold in relation to that data. This Policy applies to all users of the Indibet platform, including players registered from Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and all other locations.
This Policy should be read together with our Terms and Conditions and our Responsible Gambling Policy, both of which form part of your agreement with Indibet. By registering an account or continuing to use our platform, you acknowledge that you have read and understood this Policy.
Definitions
The following definitions apply throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, or deletion. |
| "Data Subject" | The individual to whom personal data relates — in the context of this Policy, primarily the registered Indibet player. |
| "Data Controller" | Indibet, as the entity that determines the purposes and means of processing personal data collected via the platform. |
| "Third-Party Processor" | Any external service provider engaged by Indibet to process personal data on its behalf, under binding data processing agreements. |
| "Cookies" | Small data files placed on your device by the Indibet platform, used to maintain session state, remember preferences, and support analytics. |
| "KYC" | Know Your Customer — the identity verification process conducted by Indibet to comply with anti-money laundering obligations and confirm player eligibility. |
Data We Collect
Indibet collects personal data through several channels: directly from you when you register or use our services, automatically through your interaction with the platform, and in some cases from third-party verification and payment service providers.
3.1 Data You Provide Directly
- Registration data: Full name, date of birth, nationality, email address, mobile number, and residential address (including city and postcode)
- Identity verification (KYC) documents: Malaysian National Identity Card (MyKad) or passport copy, proof of address, and payment method verification documents
- Financial data: Payment method details including e-wallet account identifiers (Touch 'n Go eWallet, Boost, GrabPay), bank account information (Maybank, CIMB, Public Bank, Hong Leong), DuitNow registered contact details, and cryptocurrency wallet addresses
- Support communications: Content of live chat conversations, email correspondence, and any information you voluntarily provide when contacting our support team
- Responsible gambling declarations: Self-exclusion requests, deposit limit settings, and cooling-off period instructions
3.2 Data Collected Automatically
- Device and access data: IP address, device type, operating system, browser type and version, and screen resolution
- Session and behavioural data: Login timestamps, pages visited, game sessions played, bet history, deposit and withdrawal activity, and session duration
- Cookie and tracking data: As described in Section 7 of this Policy
- Geolocation data: Approximate geographic location derived from your IP address, used for jurisdiction compliance checks
3.3 Data from Third Parties
- Identity verification results from KYC service providers
- Transaction status confirmations from payment processors and e-wallet operators
- Fraud and risk scoring data from anti-fraud service providers
Data Processing & Legal Basis
Indibet processes your personal data only where a valid legal basis exists. The applicable legal bases for each category of processing activity are set out below:
| Processing Activity | Legal Basis |
|---|---|
| Account registration and management | Performance of contract — necessary to create and maintain your Indibet account |
| Identity verification (KYC) | Legal obligation — required to comply with anti-money laundering and age verification obligations |
| Processing deposits and withdrawals | Performance of contract — necessary to fulfil financial transactions on your behalf |
| Fraud prevention and risk management | Legitimate interests — protecting the platform, its users, and the integrity of our services |
| Customer support communications | Performance of contract and legitimate interests |
| Responsible gambling monitoring | Legal obligation and legitimate interests — player protection obligations |
| Platform analytics and improvement | Legitimate interests — improving our services for all Malaysian players |
| Promotional communications (opt-in) | Consent — only where you have expressly opted in to receive marketing |
How We Use Your Data
Indibet uses your personal data for the following specific purposes:
5.1 Account and Service Operations
- Creating, verifying, and maintaining your registered Indibet account
- Processing MYR and cryptocurrency deposits and withdrawals through your chosen payment methods
- Providing access to casino games, live dealer tables, sports betting markets, and all other platform features
- Communicating with you regarding your account, transactions, and support queries
5.2 Compliance and Security
- Verifying your identity and age (21+ requirement) in accordance with our KYC obligations
- Detecting, investigating, and preventing fraudulent activity, money laundering, and other prohibited conduct
- Monitoring platform access to identify and block connections from Prohibited Jurisdictions
- Maintaining records required for regulatory and operational audit purposes
5.3 Responsible Gambling
- Monitoring account activity to identify patterns that may indicate problem gambling behaviour
- Enforcing deposit limits, session time restrictions, cooling-off periods, and self-exclusion requests that you have set on your account
- Contacting you with welfare information where our responsible gambling systems flag a concern
5.4 Platform Improvement
- Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user interface design
- Personalising your platform experience, including surfacing relevant game recommendations and promotions based on your activity history
5.5 Marketing Communications (Opt-In Only)
Where you have given explicit consent during registration or subsequently through your account settings, Indibet may contact you with promotional offers, bonus announcements, and platform updates via email or in-platform notification. You may withdraw consent to marketing communications at any time by updating your account preferences or contacting our support team.
Data Sharing & Disclosure
Indibet does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following limited circumstances:
6.1 Third-Party Service Providers
We engage carefully selected third-party processors to assist with specific operational functions. These include:
- Payment processors: To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, and cryptocurrency networks
- KYC and identity verification providers: To verify your identity documents and confirm your eligibility to use the platform
- Fraud prevention and anti-money laundering service providers: To screen transactions and account activity against known risk indicators
- Game software providers: Game providers may receive anonymised session identifiers to operate their games on our platform; they do not receive your full personal profile
- Customer support platform providers: To operate our live chat and email support infrastructure
- Analytics providers: To process aggregated, anonymised platform usage data for performance improvement purposes
All third-party processors are bound by written data processing agreements that require them to process your data only as instructed by Indibet, to implement appropriate security measures, and not to use your data for their own purposes.
6.2 Legal and Regulatory Disclosure
Indibet may disclose personal data to competent authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or in connection with the investigation of fraud, money laundering, or other criminal activity. In such cases, we will disclose the minimum data necessary to comply with the legal obligation.
6.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of Indibet's business, personal data held by Indibet may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the privacy implications prior to it taking effect, to the extent that applicable law permits.
Cookies & Tracking
The Indibet platform uses cookies and similar tracking technologies to operate correctly, remember your preferences, and support platform analytics. The categories of cookies we use are as follows:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Essential for platform functionality — session management, login authentication, and security tokens. The platform cannot function without these cookies. | No |
| Functional | Remember your preferences such as language settings, display options, and last visited game categories. | Yes |
| Analytics | Collect anonymised data on how users navigate the platform, which pages are most visited, and where errors occur — used solely to improve the Indibet experience. | Yes |
| Responsible Gambling | Track session duration to support time-limit tools and reality check notifications you have enabled on your account. | No |
You can manage cookie preferences through your browser settings. Note that disabling functional or analytics cookies will not affect your ability to use the core platform, but may affect certain personalisation features. Disabling strictly necessary cookies will prevent the platform from functioning correctly.
Data Retention
Indibet retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or operational obligations. The following general retention periods apply:
- Active account data: Retained for the full duration of your account registration with Indibet
- Transaction and financial records: Retained for a minimum of seven (7) years following the transaction date, in accordance with standard financial record-keeping obligations
- KYC and identity verification documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant verification process
- Customer support communications: Retained for up to three (3) years from the date of the communication
- Marketing consent records: Retained for the duration of consent and for one (1) year following withdrawal of consent, as evidence of compliance
- Self-exclusion records: Retained indefinitely to prevent re-registration during and after an exclusion period
At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.
Your Rights
As a Data Subject, you hold the following rights in relation to your personal data held by Indibet. These rights are subject to applicable legal limitations and may in certain cases be balanced against Indibet's legal obligations or legitimate interests:
9.1 Right of Access
You have the right to request a copy of the personal data Indibet holds about you, together with information about how it is processed. We will respond to subject access requests within thirty (30) days of receipt.
9.2 Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Where data is incorrect, we will correct it promptly and, where applicable, notify third-party processors of the correction.
9.3 Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing was unlawful. This right is subject to overriding retention obligations, particularly in relation to financial records and KYC documentation.
9.4 Right to Restrict Processing
You may request that Indibet restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate interests.
9.5 Right to Data Portability
Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
9.6 Right to Object
You have the right to object to processing based on Indibet's legitimate interests, including profiling for direct marketing purposes. Where you object to marketing processing, we will cease that processing immediately.
9.7 Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent can be effected by updating your account settings or contacting our support team.
Data Security
Indibet implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The measures in place include:
- Encryption in transit: All data transmitted between your device and the Indibet platform is encrypted using TLS 1.2 or higher (256-bit SSL)
- Encryption at rest: Sensitive personal data and financial records stored on Indibet infrastructure are encrypted at rest
- Access controls: Internal access to personal data is restricted on a strict need-to-know basis, with role-based access controls and audit logging
- Two-factor authentication: Available and strongly recommended for all registered Indibet accounts
- Penetration testing: Regular independent security testing of platform infrastructure and application layers
- Incident response: A documented data breach response procedure is in place, including protocols for notifying affected individuals where required by law
While Indibet takes all reasonable steps to protect your data, no system is completely immune to security risks. You also play a role in protecting your account — please use a strong, unique password and enable two-factor authentication on your Indibet account.
Minors & Age Restriction
The Indibet platform is strictly intended for use by individuals who are 21 years of age or older. Indibet does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in our KYC process and is enforced before any withdrawal is processed.
If Indibet becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void any pending transactions, delete the collected data to the extent permissible under applicable law, and take appropriate protective action.
Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. For more information on our age restriction enforcement and responsible gambling obligations, please visit our Responsible Gambling page.
Cross-Border Transfers
In the course of providing our services to players across Malaysia — including those in Kuala Lumpur, Penang, Johor Bahru, and other locations — some of your personal data may be transferred to and processed by our third-party service providers in jurisdictions outside Malaysia. This may include providers located in jurisdictions with different data protection regimes.
Where such transfers occur, Indibet takes appropriate measures to ensure that your personal data continues to be protected to a standard consistent with this Policy, including through:
- Engaging only third-party processors whose jurisdictions provide an adequate level of data protection, or
- Implementing appropriate contractual safeguards, including data processing agreements that impose equivalent data protection obligations on the receiving party
You may request further information about specific cross-border transfers affecting your data by contacting our support team.
Policy Amendments
Indibet reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. Where amendments are material — meaning they meaningfully affect how we collect or use your personal data — we will provide advance notice via email to your registered address and/or via a prominent notice on the Indibet platform before the revised Policy takes effect.
The "Last Updated" date at the top of this document will always reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Indibet platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how Indibet handles your personal data, please contact our support team through the following channels: