Privacy Policy

1 Introduction

ironman666 is an online gaming and sports betting platform primarily serving players in Malaysia. The Platform provides live casino games, a comprehensive sportsbook covering Liga Super Malaysia, the English Premier League (EPL), UFC, and other markets, as well as a curated library of certified slot titles — all denominated in Malaysian Ringgit (MYR).

As part of providing these services, ironman666 necessarily processes certain personal data about registered players and website visitors. This Privacy Policy sets out our data practices in full, with the aim of giving you clear and honest visibility into how your information is handled at every stage of your interaction with the Platform.

This Policy applies to all personal data collected through the ironman666 website, any mobile-browser accessible version of the Platform, communications via email or live chat, and any other interaction between you and ironman666 that involves the processing of personal data. It does not apply to third-party websites or services that may be referenced on the Platform.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, email address, or online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means ironman666, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of ironman666 under a data processing agreement.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed — in the context of this Policy, this is primarily you, the registered player or website visitor.
• "Consent" means a freely given, specific, informed, and unambiguous indication by a data subject of their agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity verification procedures conducted by ironman666 in compliance with applicable regulatory requirements.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data in commercial transactions involving Malaysian data subjects.

3 Data Controller

ironman666 acts as the Data Controller in respect of all personal data collected and processed through the Platform. As Data Controller, ironman666 is responsible for ensuring that all personal data processing activities are conducted in accordance with applicable data protection legislation, including the Malaysian Personal Data Protection Act 2010 (PDPA) and any other applicable laws and regulations.

Where ironman666 engages third-party service providers to process personal data on its behalf, those providers act as Data Processors and are bound by contractual obligations to process data only on ironman666's documented instructions, to maintain appropriate security measures, and to not engage further sub-processors without ironman666's prior authorisation.

4 Personal Data We Collect

ironman666 collects the following categories of personal data in the course of providing its services:

4.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identity document;
• Date of birth (for age verification purposes —21+ requirement);
• Malaysian identity card number (MyKad) or passport number;
• Nationality and country of residence;
• Residential address, including city (e.g., Kuala Lumpur, Petaling Jaya, Johor Bahru, Penang, Shah Alam).

4.2 Contact Data

• Email address;
• Malaysian mobile phone number;
• Preferred language of communication.

4.3 Financial & Payment Data

• Bank account details (account name, account number, bank name) for withdrawal processing;
• E-wallet identifiers for Touch'n Go eWallet, Boost, GrabPay, and DuitNow accounts registered in your name;
• FPX transaction reference numbers;
• Partial card details (last four digits, card type) for Visa/Mastercard transactions — full card numbers are not stored by ironman666;
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment channels.

4.4 Gaming Activity Data

• Betting history, wager amounts, game selections, and outcomes;
• Session duration, login timestamps, and device usage patterns;
• Responsible gambling tool settings (deposit limits, loss limits, self-exclusion status).

4.5 Technical & Usage Data

• IP address and approximate geolocation;
• Browser type and version, operating system, device type;
• Pages visited, referring URLs, and click-stream data;
• Cookie identifiers and session tokens.

4.6 Communications Data

• Records of live chat conversations with ironman666 support staff;
• Email correspondence with ironman666;
• Records of complaints, disputes, and their resolutions.

5 How We Collect Personal Data

ironman666 collects personal data through the following means:

Collection Method	Examples
Direct provision by you	Account registration form, KYC document uploads, deposit/withdrawal requests, live chat and email communications, responsible gambling tool setup
Automated technical means	Browser cookies, server logs, session tracking, IP address recording, device fingerprinting for fraud prevention
Payment processors	Transaction confirmation data from DuitNow, FPX, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay
Identity verification providers	KYC verification outcomes and document authentication results from our third-party verification partners
Fraud prevention services	Device reputation scores and risk signals from fraud prevention providers

6 Purposes of Processing & Legal Basis

ironman666 processes personal data for the following purposes, each supported by an identified legal basis under the Malaysian PDPA and applicable data protection principles:

6.1 Account Creation and Management

Purpose: To register your account, verify your identity and age, manage your account settings, and provide access to Platform services.Legal Basis: Performance of a contract between you and ironman666; compliance with legal obligations (KYC/AML).

6.2 Processing of Gaming Transactions

Purpose: To process deposits via Malaysian payment channels (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay), process withdrawal requests, record betting activity, and calculate loyalty programme points. Legal Basis: Performance of a contract.

6.3 Regulatory Compliance and Anti-Money Laundering

Purpose: To fulfil legal obligations under applicable anti-money laundering regulations, including source-of-funds verification, transaction monitoring, and mandatory reporting to relevant authorities where required. Legal Basis: Compliance with legal obligations.

6.4 Responsible Gambling Obligations

Purpose: To implement and monitor responsible gambling tools including deposit limits, loss limits, session timers, and self-exclusion; to identify and respond to problem gambling indicators. Legal Basis: Compliance with legal obligations; legitimate interests of ironman666 and its players.

6.5 Customer Support

Purpose: To respond to account queries, technical issues, payment disputes, and complaints via live chat and email. Legal Basis: Performance of a contract; legitimate interests.

6.6 Security and Fraud Prevention

Purpose: To detect, investigate, and prevent fraudulent transactions, account takeovers, collusion, money laundering, and other prohibited activities on the Platform. Legal Basis: Legitimate interests of ironman666 and its players; compliance with legal obligations.

6.7 Platform Improvement and Analytics

Purpose: To analyse aggregated and anonymised usage data to improve Platform performance, game selection, user experience, and responsible gambling features. Legal Basis: Legitimate interests.

6.8 Marketing Communications

Purpose: To send promotional offers, loyalty programme updates, and relevant gaming news to registered players who have not opted out. Legal Basis: Consent (for electronic marketing); legitimate interests for existing customer communications.

7 Data Processing Principles

ironman666 is committed to processing personal data in accordance with the following core principles:

• Lawfulness, Fairness, and Transparency: Personal data is processed on a lawful basis, in a manner that is fair to data subjects, and with appropriate transparency as set out in this Policy.
• Purpose Limitation: Personal data collected for a specific purpose will not be used for an incompatible purpose without your prior consent.
• Data Minimisation: ironman666 collects and processes only the minimum personal data necessary for each identified purpose.
• Accuracy: ironman666 takes reasonable steps to ensure that personal data held is accurate and kept up to date. You may update your contact details via your account settings or by contacting support.
• Storage Limitation: Personal data is retained only for as long as necessary, as set out in Section 10of this Policy.
• Integrity and Confidentiality: Personal data is processed with appropriate technical and organisational security measures to protect against unauthorised access, loss, or destruction.

8 Disclosure to Third Parties

ironman666 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We may share your personal data with the following categories of third parties only to the extent necessary for the purposes described in this Policy:

8.1 Payment Service Providers

Processing deposits and withdrawals requires the sharing of necessary transaction data with payment processors including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX operators, and partner banks including Maybank, CIMB, Public Bank, and Hong Leong. These providers receive only the transaction data necessary to complete the payment.

8.2 Identity Verification Providers

KYC verification may involve sharing identity document images and verification requests with our contracted identity verification service providers. These providers act as Data Processors and are bound by data processing agreements.

8.3 Fraud Prevention and Security Providers

Device and behaviour data may be shared with contracted fraud detection and cybersecurity service providers to protect the Platform and its users from fraudulent activity and account takeovers.

8.4 Game and Technology Providers

Gaming session data (anonymised player identifiers and bet details) may be shared with certified game providers and platform technology partners solely for the purpose of game operation, RTP verification, and technical support.

8.5 Regulatory Authorities and Law Enforcement

ironman666 may disclose personal data to regulatory bodies, law enforcement agencies, or financial intelligence units where required to do so by applicable law, court order, or regulatory direction, without prior notice to the data subject where the law so requires.

9 International Data Transfers

Some of the third-party service providers engaged by ironman666 may be located outside of Malaysia. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that offered under Malaysian law, ironman666 will take appropriate safeguards to ensure that such transfers comply with applicable data protection requirements. These safeguards may include contractual clauses, data processing agreements, or adequacy decisions where applicable.

By registering an account and using the Platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia where necessary for the provision of Platform services, subject to the safeguards described above.

10 Data Retention

ironman666 retains personal data for the following indicative periods, subject to applicable legal and regulatory requirements that may mandate longer retention:

Data Category	Retention Period	Basis
Account registration and KYC data	5 years from account closure	Anti-money laundering regulations
Transaction and betting history	5 years from transaction date	Financial and regulatory compliance
Customer support communications	3 years from last interaction	Legitimate interests; dispute resolution
Technical and usage data (logs)	12 months from collection	Security and fraud prevention
Marketing preferences and consents	Duration of account + 2 years	Evidence of consent; regulatory compliance
Self-exclusion records	Duration of exclusion + 5 years	Responsible gambling obligations

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

11 Cookies & Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device by a website server. They are widely used to make websites function correctly, to improve performance and usability, and to provide information to website operators. ironman666 uses cookies and similar tracking technologies (such as web beacons and session tokens) on the Platform.

11.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to operate. These include session authentication cookies that keep you logged in, security tokens, and cookies that remember your account preferences. These cannot be disabled.
• Performance Cookies: Collect anonymised data about how visitors use the Platform — pages visited, load times, error events — to help us improve Platform performance. No personally identifying information is collected.
• Functionality Cookies: Remember your preferences such as language settings and display preferences to improve your experience on return visits.
• Security Cookies: Used by our fraud prevention systems to analyse device behaviour and identify potentially fraudulent access patterns.

11.3 Managing Cookies

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform — in particular, disabling strictly necessary cookies will prevent you from logging in to your account. Instructions for managing cookies are available in the help documentation of all major browsers.

12 Your Data Subject Rights

Subject to applicable law and any overiding legal obligations, you have the following rights in respect of your personal data held by ironman666:

• Right of Access: You have the right to request a copy of the personal data ironman666 holds about you, together with information about how it is processed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data about you be corrected or completed. You may update certain account details directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to any overiding legal retention obligations (e.g., anti-money laundering recordkeeping requirements).
• Right to Restriction: You have the right to request that processing of your personal data be restricted in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: You have the right to receive a copy of the personal data you provided to ironman666 in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

13 Children's Privacy

The ironman666 Platform is strictly for persons aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not use the Platform or provide any personal information to ironman666.

If ironman666 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that information and close the associated account. If you are a parent or guardian and believe that a minor has provided personal data to ironman666, please contact our support team immediately.

14 Security Measures

ironman666 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and ironman666 servers;
• Encryption of sensitive data at rest, including financial account details;
• Role-based access controls limiting staff access to personal data on strict need-to-know basis;
• Two-factor authentication (2FA) for both player accounts and internal staff systems;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Incident response procedures for the detection, reporting, and remediation of personal data breaches;
• Staff training on data protection obligations and information security best practices.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is entirely impenetrable. While ironman666 takes all reasonable steps to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, ironman666 will notify you and, where required, relevant regulatory authorities, within the timeframes specified by applicable law.

15 Changes to This Privacy Policy

ironman666 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where changes are material, we will provide reasonable advance notice through the Platform and, where practicable, by email to registered account holders.

The date at the top of this Policy indicates when it was last reviewed and updated. We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of the Platform following publication of an updated Policy constitutes acceptance of the revised terms.

16 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which ironman666 processes your personal data, please contact our dedicated data protection support team:

• Email: [email protected] (plain text — not a clickable link)
• Subject line for privacy requests: "Privacy Request — [Your Account Username]"
• Live Chat: Available 24/7 via the Platform
• Response commitment: Acknowledgement within 24 hours; substantive response within 30 calendar days for data subject rights requests

We take data protection enquiries seriously and are committed to resolving any concerns you may have about the handling of your personal information in a timely, transparent, and fair manner.