Cardgames Privacy Policy – Data Protection for Malaysian Users

1. Introduction

Welcome to the Privacy Policy of CardGames. This document clearly and transparently explains how CardGames ("we", "platform") collects, uses, protects, and handles your personal data when you use the cardgames.wine website and all related services.

CardGames takes user privacy seriously. We believe every Malaysian player who entrusts us with their personal information deserves a clear, honest explanation of what happens to that data – not lengthy, confusing terms deliberately written to obscure the facts.

This policy applies to all individuals who register an account, browse the platform, make deposits using Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX, or any other supported payment method, play casino games, or place sports bets on CardGames. By using our platform, you agree to the data handling practices described in this document.

2. Data We Collect

CardGames only collects data that is genuinely necessary to provide a secure, fair, and fully functional service. We do not collect excessive data or data with no direct relevance to the platform's purpose. The following are the categories of data we collect:

CardGames never collects credit or debit card numbers directly – all financial transactions are processed through PCI-DSS certified third-party payment operators. This means your sensitive financial information never passes through or is stored on CardGames directly.

3. How We Use Your Data

Data collected by CardGames used solely for the purposes stated below. We do not use your data for purposes unrelated to the provision of platform services without obtaining your separate consent:

• Identity and credential verification: Verifying that every user meets the minimum age requirement of 18 years and that the information provided is accurate before granting full access to the platform.
• Financial transaction processing: Handles deposits via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX, and other payment methods, and processes withdrawal of winnings accurately and securely.
• Service delivery and improvement: Enables you to play slots, live casino, table games, place sports bets on Malaysia Super League football, badminton and cricket, and enjoy all platform features without interruption.
• Account security and fraud prevention: Detecting and preventing unauthorised access, fraud, money laundering, and any activity that violates our Terms & Conditions CardGames.
• Service-related communications: Sending notifications about your account activity, transaction confirmations, security updates, and important platform-related information.
• Legal compliance: Meets reporting and record-keeping requirements prescribed by applicable laws and regulatory bodies, including anti-money laundering (AML) obligations.
• Platform analytics and improvement: Understanding aggregate usage patterns to improve design, performance, and content CardGames to better suit the needs of Malaysian players.
• Customer support: Handling enquiries, complaints, and assistance requests submitted to our support team CardGames via email.

4. Legal Basis for Data Processing

All personal data processing carried out by CardGames has a valid legal basis under Malaysia's Personal Data Protection Act 2010 (PDPA). These bases are as follows:

• Contract performance: Most data processing is carried out to enable CardGames fulfil its obligations to you as a user – including transaction processing, identity verification, and the provision of gaming services.
• Legitimate interests: We process technical and usage data based on our legitimate interest in detecting fraud, maintaining platform security, and improving service quality.
• Legal obligations: Some data processing is mandatory to fulfil legal requirements, including AML (Anti-Money Laundering) and KYC (Know Your Customer) obligations.
• Consent: For purposes such as marketing communications, we rely on the explicit consent you provided during registration or through your account settings.

5. Data Sharing & Disclosure

CardGames does not sell, rent, or trade your personal data to any third party for their own marketing purposes. This is an absolute commitment we have never compromised on. However, there are certain circumstances where we need to share your data with specific parties in order for the platform to operate securely and in accordance with the law:

• Payment processors: Data required to process deposit transactions (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX including Maybank2u and CIMB Clicks) is shared with the respective operators solely for the purpose of processing those transactions. All operators are bound by strict confidentiality agreements.
• Technical service providers: Hosting infrastructure, CDN, and analytics services used by CardGames may process some of your technical data. All such providers are selected based on strict security standards and are bound by data processing agreements.
• Game providers: Minimal session data (such as session IDs and bet amounts) is shared with game providers including Evolution Gaming, Pragmatic Play, and PG Soft to enable gameplay. These providers do not receive your full personal identity information.
• Legal authorities: CardGames will disclose data to authorities, courts, or regulatory bodies when required to do so by law or a valid court order. We will not disclose more than what is required by the relevant legal obligation.

6. Data Security

Protecting your personal data from unauthorised access, loss, misuse, or alteration is one of the highest technical priorities at CardGames. We continually invest in our security infrastructure to ensure our data protection standards keep pace with the latest threats. Key security measures we employ include:

• 256-bit SSL Encryption: All communications between your browser and the CardGames is encrypted using TLS 1.3 with 256-bit encryption – the same standard used by Malaysia's major banks such as Maybank and CIMB.
• Encrypted database: Sensitive personal data stored in the CardGames encrypted at rest using robust encryption algorithms. Even if someone were to gain unauthorised access to the database, the data obtained would be unreadable without the decryption key.
• Strict access controls: Access to user data within internal systems CardGames strictly limited to employees who genuinely require access to perform their duties, based on the principle of least privilege. All access is logged and audited on a regular basis.
• 24/7 security monitoring: A cyber threat monitoring system operates around the clock to detect and respond to any suspicious activity before it can compromise user data.
• Regular penetration testing: CardGames conducts periodic independent security testing to identify and address any vulnerabilities in the platform's infrastructure before they can be exploited.

While we take all reasonable steps to protect your data, no system can guarantee absolute 100% security at all times. You also play an important role in keeping your account secure – use a strong, unique password, never share your login credentials with anyone, and contact our support team CardGames immediately if you suspect your account has been accessed without your authorisation.

7. Data Retention Period

CardGames retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal requirements. The following are retention period guidelines for key data categories:

• Active account data: For as long as your account remains active with CardGames and for a reasonable period following account closure to allow for the resolution of any outstanding disputes or claims.
• Financial transaction records: Minimum 7 years from the date of the transaction, in accordance with applicable financial reporting and AML legal requirements in Malaysia.
• KYC records and identity verification: Minimum 5 years after the business relationship with the user ends, in accordance with applicable legal requirements.
• Technical log data: Typically 12 months from the date of creation, or longer if the log is related to an ongoing security investigation.
• Support communication records: 3 years from the date of last interaction, except for records related to complaints or disputes that require a longer retention period.

When data is no longer needed and there is no legal obligation to retain it, CardGames will securely delete or anonymise that data in accordance with established procedures.

8. User Rights

As a user CardGames and as a data subject under Malaysia's PDPA, you have the following rights with respect to your personal data. CardGames respecting and facilitating the exercise of these rights:

To exercise any of the above rights, please contact the CardGames via email at support@cardgames.wine, stating the right you wish to exercise and providing the information needed to verify your identity. We will process your request within 30 business days of receiving a complete and verified submission.

Please note that certain rights may not be fully enforceable where they conflict with our legal obligations, including financial record-keeping and AML requirements. In such cases, CardGames will inform you of the reasons why the request cannot be fulfilled in full.

9. Cookie Policy

CardGames uses cookies and similar tracking technologies to ensure the platform functions properly and to understand how Malaysian players interact with our platform. Cookies are small text files stored on your device when you browse our platform.

You can manage cookie settings through your browser settings. However, disabling essential cookies will affect your ability to use the CardGames entirely. For more information on how to manage cookies in your browser, please refer to the documentation for your browser of choice (Chrome, Firefox, Safari, Edge, or others).

10. Changes to This Privacy Policy

CardGames reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements. We are committed to notifying users of significant changes in an appropriate manner.

When material changes are made to this Privacy Policy, CardGames will notify you via your registered email or an in-platform notification at least 14 days before the changes take effect. For minor changes that do not materially affect your fundamental rights, we may simply update the "Last updated" date at the top of this page.

Continued use of the platform CardGames after the effective date of any amendment to the Privacy Policy will be considered your acceptance of the revised policy. If you do not agree with the changes made, you may close your account CardGames before the changes take effect by contacting our support team.

11. Contact Us About Privacy

If you have any questions, concerns, or complaints regarding how CardGames handles your personal data, or if you wish to exercise any of your privacy rights, our team is ready to help. Please contact us via:

When contacting us regarding your privacy rights, please include the following information so we can process your request promptly: full registered name, account number CardGames, a brief description of your request or concern, and any relevant supporting information. Please do not send full identification documents via regular email – our team will provide a secure channel for sharing sensitive documents if required.

We take all privacy complaints seriously and will thoroughly investigate every complaint received. If you are unsatisfied with our response, you have the right to refer your complaint to Malaysia's Department of Personal Data Protection or the relevant regulatory body under applicable local law.