Privacy Policy

This Privacy Policy (hereinafter referred to as "this Policy" or "the Policy") is issued by vipph (hereinafter referred to as "vipph", "the Company", "we", "our", or "us") and applies to all personal data collected, processed, stored, and used by vipph in connection with the operation of the online gaming platform accessible at vipph.casa (hereinafter referred to as "the Platform") and all associated services.

vipph is committed to handling your personal data with transparency, integrity, and in full compliance with applicable data protection legislation, including but not limited to the Personal Data Protection Act 2010 (Malaysia) ("PDPA") and any successor or supplementary legislation.

By registering an Account on the Platform, accessing any feature of the Platform, or otherwise providing your personal data to vipph, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must refrain from using the Platform.

The following definitions apply throughout this Policy:

• Personal Data — any information that identifies or can identify you as a natural person, whether directly (e.g., your full name, national identity card number) or indirectly (e.g., your device IP address, Account identifier).
• Processing — any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, alteration, retrieval, use, disclosure, erasure, or destruction.
• Data Controller — vipph, which determines the purposes and means of processing Personal Data collected through the Platform.
• Data Processor — any third party engaged by vipph to process Personal Data on vipph's behalf, acting under vipph's instructions and this Policy.
• Account — the personal gaming account registered by a Player on the Platform.
• KYC Documentation — identity and address verification documents submitted by a Player in connection with vipph's Know Your Customer (KYC) obligations.
• Cookies — small text files stored on your device by your web browser that enable the Platform to recognise your device and remember your preferences.
• AML — Anti-Money Laundering — regulatory obligations that require vipph to monitor, record, and report certain financial transactions and player activity.

vipph collects Personal Data from you in the course of operating the Platform. The categories of data we collect, and the context in which each category is collected, are set out in the table below:

We do not intentionally collect any special categories of Personal Data (e.g., health data, racial or ethnic origin, political opinions, religious beliefs, biometric data) except where expressly required by applicable law or where you have provided such data voluntarily and with explicit consent.

vipph collects Personal Data through the following channels:

1. Direct Provision by You: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, participating in promotions, or submitting feedback through the Platform.
2. Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, session data, device identifiers, browser information, and clickstream data, collected via server logs, cookies, and similar tracking technologies.
3. Payment Processors: Confirmation and reference data received from Malaysian payment processors including FPX-linked banks (Maybank, CIMB, Public Bank, Hong Leong), e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), and international card networks (Visa, Mastercard).
4. Identity Verification Partners: Data returned by third-party KYC and identity verification service providers engaged by vipph to verify the accuracy of documentation you submit.
5. Fraud Prevention and AML Systems: Risk signals and transaction pattern data generated by vipph's internal and third-party fraud monitoring and AML compliance systems.

vipph processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and managing your Account; authenticating your identity on login; processing Account settings changes and closure requests.
• Service Delivery: Enabling you to access and use the Platform's gaming products, including live dealer casino, sports betting (covering markets such as EPL, Liga Super Malaysia, and UFC), slots, crash games, and lottery.
• Payment Processing: Processing deposits and withdrawals via your chosen Malaysian payment method, reconciling transactions, and resolving payment disputes.
• KYC & AML Compliance: Verifying your identity and age (21+ requirement strictly enforced), screening against sanctions lists, monitoring transactions for suspicious activity, and fulfilling mandatory regulatory reporting obligations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, bonus abuse, unauthorised access, and other prohibited conduct on the Platform.
• Responsible Gambling: Monitoring gaming patterns to identify potential problem gambling indicators; administering deposit limits, loss limits, session timers, and self-exclusion arrangements at your request; proactively reaching out to Players who show signs of gambling harm.
• Customer Support: Responding to enquiries, managing disputes, providing technical assistance, and maintaining records of support interactions for quality assurance purposes.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Players who have opted in to receive such communications. You may opt out at any time via Account settings or by contacting support.
• Platform Improvement: Analysing aggregated usage data to improve Platform performance, game selection, payment infrastructure, and user experience.
• Legal Compliance: Meeting vipph's obligations under applicable Malaysian law, including but not limited to the PDPA, AML/CFT regulations, and any regulatory directives.

vipph processes your Personal Data on the following legal bases, in accordance with the Personal Data Protection Act 2010 (Malaysia) and applicable international data protection standards:

1. Consent: Where you have given your express consent to the processing, including consent given at Account registration, consent to marketing communications, and consent provided during the submission of KYC documentation.
2. Contractual Necessity: Where processing is necessary for the performance of the contract between you and vipph (i.e., our Terms & Conditions), including Account management, payment processing, and service delivery.
3. Legal Obligation: Where processing is required to comply with a legal obligation imposed on vipph, including AML/CFT reporting, regulatory record-keeping, and responding to lawful requests from competent authorities.
4. Legitimate Interests: Where processing is necessary for the purposes of vipph's legitimate business interests, including fraud prevention, Platform security, responsible gambling monitoring, and internal analytics — provided that such interests do not override your fundamental data protection rights.

vipph does not sell, rent, or trade your Personal Data. We may disclose your data to the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Service Providers: Malaysian e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), FPX-participating banks (Maybank, CIMB, Public Bank, Hong Leong, and others), international card networks (Visa, Mastercard), and cryptocurrency processing partners — to facilitate your deposit and withdrawal transactions.
• Identity Verification Partners: Third-party KYC service providers engaged to verify identity documents and perform age verification in accordance with our 21+ policy and AML obligations.
• Fraud Prevention & AML Compliance Partners: Service providers that assist vipph in detecting fraud, screening transactions, and meeting anti-money laundering and counter-terrorism financing obligations.
• Game Content Providers: Licensed international game studios and content aggregators whose games are made available on the Platform. These parties may receive technical session data necessary to operate their games. No personally identifiable data beyond a non-identifiable session token is shared for this purpose.
• IT Infrastructure & Security Providers: Cloud hosting, content delivery, cybersecurity, and DDoS protection providers that underpin the Platform's technical operations.
• Legal, Regulatory & Law Enforcement Authorities: Where vipph is required by law, court order, or regulatory direction to disclose data to a competent authority. vipph will notify you of any such disclosure to the extent permitted by law.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by vipph in connection with its business operations, subject to professional confidentiality obligations.

All third-party processors engaged by vipph are required to process your data only for the stated purpose, under vipph's instructions, and in accordance with data protection standards no less stringent than those set out in this Policy.

vipph retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

1. Active Account Data: Personal Data associated with an active Account is retained for the duration of your Account's existence on the Platform, plus any mandatory post-closure retention period.
2. Transaction & Financial Records: Financial transaction data, including deposit and withdrawal records in MYR, is retained for a minimum of seven (7) years following the date of the transaction in accordance with Malaysian financial record-keeping requirements.
3. KYC Documentation: Identity and address verification documents are retained for a minimum of five (5) years following Account closure, in accordance with AML/CFT regulatory obligations.
4. Support & Communications Records: Customer support interactions, including live chat transcripts and email correspondence, are retained for a minimum of two (2) years for quality assurance and dispute resolution purposes.
5. Gaming Records: Bet history, game session records, and wagering data are retained for a minimum of five (5) years for regulatory compliance and dispute resolution.
6. Marketing Preferences: Opt-in and opt-out records for marketing communications are retained indefinitely to evidence your consent status and ensure compliance with your preferences.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised such that it can no longer be used to identify you.

vipph implements industry-standard technical and organisational measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

• TLS 1.3 Encryption: All data transmitted between your device and the Platform is encrypted using Transport Layer Security (TLS) 1.3, providing the highest currently available standard of in-transit data protection.
• Encryption at Rest: Sensitive Personal Data stored on vipph's servers, including KYC documentation and financial records, is encrypted using AES-256 encryption.
• Two-Factor Authentication (2FA): Optional two-factor authentication is available to all Players and is strongly recommended. vipph staff accounts with access to Player data are required to use 2FA.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. All staff with access to Personal Data undergo data protection training and are bound by confidentiality obligations.
• Intrusion Detection & Monitoring: vipph's infrastructure is monitored 24/7 by automated intrusion detection systems. Anomalous activity triggers immediate investigation by our security team.
• Penetration Testing: The Platform undergoes regular third-party security assessments and penetration testing to identify and remediate vulnerabilities proactively.
• Data Breach Response: In the event of a data breach that poses a risk to your rights and freedoms, vipph will notify affected Players and relevant regulatory authorities in accordance with applicable legal obligations.

vipph uses cookies and similar tracking technologies on the Platform to deliver and improve the service, authenticate users, prevent fraud, and understand how the Platform is used. The categories of cookies we use are as follows:

You can manage cookie preferences through your browser's settings at any time. Please note that disabling non-essential cookies may affect the functionality of certain Platform features. vipph does not use cookies to collect sensitive Personal Data or to track your activity on third-party websites.

Under the Personal Data Protection Act 2010 (Malaysia) and applicable data protection principles, you hold the following rights in relation to your Personal Data held by vipph. To exercise any of these rights, please contact our support team via live chat or email at support@vipph.casa, and we will respond within 30 calendar days.

Please note that certain rights are subject to limitations under applicable law — for example, vipph cannot delete data that it is legally required to retain for AML or regulatory purposes. Where a right cannot be exercised in full, vipph will explain the reasons in writing.

The Platform is strictly intended for use by individuals aged 21 years and above. vipph does not knowingly collect Personal Data from any person under the age of 21. Age verification is a mandatory component of the Account registration and KYC process.

If vipph becomes aware that Personal Data has been collected from an individual who is under the age of 21, the relevant Account will be immediately suspended, all balances will be held pending investigation, and the data will be processed solely for the purposes of closing the Account and complying with any applicable legal obligations arising from the underage use.

If you believe that a person under the age of 21 has registered an Account on the Platform, please notify us immediately at support@vipph.casa so that we can take prompt action.

In the course of operating the Platform, vipph may transfer your Personal Data to third-party processors located outside of Malaysia — for example, cloud infrastructure providers or international game content studios. Any such transfer is conducted subject to the following safeguards:

1. All international transfers are made only to jurisdictions or recipients that provide an adequate level of Personal Data protection, whether by reason of applicable law or binding contractual commitments equivalent to Malaysian PDPA standards.
2. Data processing agreements are in place with all international processors, contractually requiring them to process Personal Data in accordance with vipph's instructions and data protection standards.
3. Where required by applicable law, vipph will obtain your prior consent before transferring your Personal Data internationally.
4. vipph does not transfer your Personal Data to jurisdictions known to have inadequate data protection frameworks without additional contractual safeguards in place.

vipph reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform operations. The "Effective Date" at the top of this page will be updated upon any revision.

Where amendments are material — such as changes to the categories of data collected, new third-party sharing arrangements, or changes to your rights — vipph will notify registered Players via Platform notification or email at least 14 days prior to the effective date of such changes.

Your continued use of the Platform following any update to this Policy constitutes acceptance of the revised terms. If you do not accept the updated Policy, please cease using the Platform and contact us to close your Account.

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data protection rights, please contact the vipph data team through the following channels:

• Live Chat: Available 24/7 directly on the Platform. Supported in English, Bahasa Melayu, and Mandarin Chinese. Average response time: 3–5 minutes.
• Email: support@vipph.casa (plain text — not a clickable link). Please allow up to 5 business days for data rights requests to be processed.

For data access, correction, or deletion requests, please include your Account username, the email address registered to your Account, and a description of your request. We may require identity verification before processing certain requests.