Sm605 Privacy Policy – Personal Data Protection for Malaysia Players

Sm605 understands that privacy is more than a legal requirement — it is a fundamental right of every individual. As an online Sports Betting and casino platform serving Malaysia players, we carry a great responsibility when you entrust us with your personal information during registration and your daily use of the platform.

This Privacy Policy ("Policy") describes in detail the types of personal data we collect, the purposes for collection, how data is used and protected, who may receive it, how long it is retained, and your rights as a data subject under Malaysia's Personal Data Protection Act (PDPA) 2010.

This policy applies to all users who:

• Visiting or using the sm605 website, even without registering an account.
• Registering as a sm605 member and making a deposit or transaction.
• Contacting the sm605 customer support team through any available channel.
• Participating in any promotions, contests, or programmes run by sm605.

Sm605 collects various categories of personal data depending on how you interact with our platform. Below is a full breakdown of the data we collect:

A. Data You Provide Directly

• Registration Information: Full name, Malaysian mobile number, email address, date of birth, password (stored in encrypted hash format).
• Identity Verification (KYC) Information: MyKad number, copies of identification documents, verification selfie, residential address information.
• Financial Information: Bank name, bank account number for withdrawals, and e-wallet type used (TnG eWallet, GrabPay, Boost, ShopeePay, DuitNow). Please note: sm605 does not directly store credit or debit card information.
• Support Communications: Live chat conversation records, WhatsApp messages (where relevant to platform issues), and emails sent to support@sm605.best.

B. Automatically Collected Data

• Technical Data: IP address, device type, operating system, browser type and version, screen resolution.
• Usage Data: Pages visited, time spent, actions taken within the platform, and buttons clicked.
• Location Data: General geographic location based on IP address (state/city only – not precise GPS location).
• Session Data: Session tokens, login logs, access timestamp records.

C. Gaming Activity Data

• Sports betting history, including bet types, matches, amounts, and outcomes.
• Casino game history, including game type, bets placed, winnings, and round records.
• Complete deposit and withdrawal records.
• Bonus status and rollover progress.

The personal data we collect is used solely for legitimate and necessary purposes in operating the sm605 platform safely and effectively. The following are the primary purposes for which your data is used:

Sm605 will not use your data for any purpose not stated in this policy without first obtaining your fresh consent. Should a need arise to use your data for a new purpose that is incompatible with the original purpose of collection, we will notify you and seek your consent where required.

Under Malaysia's PDPA, sm605 requires a valid legal basis to process your personal data. We rely on the following bases depending on the type of processing involved:

• Consent: For direct marketing communications such as promotional emails and SMS notifications — you provide this consent during registration and may withdraw it at any time through your account settings.
• Performance of Contract: For processing necessary to provide sm605's services to you — including account management, processing deposits and withdrawals, and providing access to games.
• Legal Obligation: To meet Malaysian legal requirements, including KYC identity verification, anti-money laundering (AML) reporting, and compliance with regulatory directives.
• Legitimate Interests: For the purposes of fraud prevention, platform security, service improvement, and responsible gambling monitoring — where sm605's interests and the safety of other users are balanced against your privacy rights.

Sm605 does not sell or rent your personal data to any party for marketing purposes. That said, in the course of operating the platform, we may need to share data with the following limited and trusted categories of third parties:

• Game Providers: Companies such as Pragmatic Play, PG Soft, Evolution Gaming, and Playtech receive the game session data required to run their games within the sm605 platform. This data is limited to the necessary technical information and does not include your full financial details.
• Payment Processors: Payment gateways that process your deposit and withdrawal transactions via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and other Malaysian payment methods receive the data necessary to process those transactions. All of our payment processors are PCI DSS compliant.
• Cloud Computing Service Providers: The sm605 platform infrastructure is hosted by certified cloud computing providers. All data is stored in a secure environment with strict access controls.
• KYC Service Providers: For identity verification, we use accredited third-party services to verify the authenticity of your identity documents.
• Legal Authorities: sm605 will disclose personal data to the relevant Malaysian authorities when required by law, court order, or in the course of a financial crime investigation.

All third parties that receive sm605 users' personal data are bound by data processing agreements requiring them to use that data solely for the specified purposes and to protect it to a standard equivalent to or higher than sm605's own standards.

Sm605 makes serious investments in both technical and organisational security to protect your personal data from unauthorised access, alteration, disclosure, or destruction. Our key security measures include:

• Data Encryption in Transit: All communications between your browser and sm605's servers are protected by TLS 1.3 with 256-bit SSL encryption.
• Data-at-Rest Encryption: Sensitive data stored in sm605's databases — including identity information and financial records — is encrypted using AES-256 encryption.
• Hashed Password: Account passwords are stored using bcrypt hashing, which is irreversible — even sm605 staff cannot decrypt them.
• Internal Access Controls: Staff access to user data is restricted on a need-to-know basis. Only personnel who require access to fulfil their specific duties are able to view the relevant data.
• 24/7 Security Monitoring: A real-time threat monitoring system detects and responds to suspicious activity across the sm605 platform.
• Regular Penetration Testing: sm605 conducts regular security testing by independent third parties to identify and address vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): sm605 supports and encourages the use of two-factor authentication on all accounts as an additional layer of security.

While we take all reasonable steps to protect your data, no security system can be guaranteed to be 100% impenetrable. In the event of a data breach that affects your rights and freedoms, sm605 will notify you within 72 hours of becoming aware of the breach, in accordance with Malaysia's PDPA requirements.

Sm605 retains your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required under applicable Malaysian law. Below is a guide to retention periods for key data categories:

• Active Account Data: Retained for the lifetime of your active sm605 account plus 7 years after account closure, in accordance with Malaysian legal record-keeping requirements.
• Financial Records (Deposits & Withdrawals): Retained for a minimum of 7 years in accordance with Malaysia's Anti-Money Laundering Act requirements.
• KYC Records: Retained for the lifetime of the active account plus 7 years, or longer if required by authorities in connection with any ongoing investigation.
• Technical & Security Logs: Retained for 12 months for security investigation and technical troubleshooting purposes.
• Customer Support Records: Retained for 3 years from the date of last interaction.
• Marketing Data (Consent-Based): Retained until you withdraw consent or request deletion.

Once the retention period expires, your data will be securely deleted or anonymised in a manner that ensures it can no longer be linked back to you. Deletion is carried out using methods that guarantee the data cannot be recovered.

Sm605 uses cookies and similar tracking technologies to keep the platform running smoothly and to enhance your experience. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions — including maintaining your login session, remembering your language preference, and ensuring security features work properly. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting aggregated statistical information on how users interact with the sm605 platform — such as most-visited pages and load times — to help us improve. This data is collected in aggregate form and does not identify individual users.
• Functional Cookies: Remembering your preferences and settings — such as display preferences, last betting limits, and favourite games — to deliver a more personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, monitor suspicious login attempts, and protect your account.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect your ability to use sm605 fully. For more information on how to manage cookies in your browser, refer to your browser's help settings.

Under Malaysia's PDPA, you as a data subject have the following rights in relation to your personal data held at sm605:

• Right of Access: You have the right to request and receive a copy of the personal data we hold about you. Such requests will be processed within 21 days of receipt.
• Right to Rectification: If any of your personal data is inaccurate, incomplete, or outdated, you have the right to request a correction. Basic details such as your phone number and email address can be updated directly through your sm605 account settings.
• Right to Withdraw Consent: For processing based on your consent (in particular marketing communications), you may withdraw that consent at any time through your account settings or by contacting us.
• Right to Object to Processing: Under certain circumstances, you have the right to object to the processing of your personal data where it is carried out on the basis of our legitimate interests.
• Right to Restrict Processing: Under certain circumstances specified by the PDPA, you may request that the processing of your data be temporarily restricted.
• Right to Data Deletion: In certain circumstances – particularly when data is no longer needed for the purpose it was originally collected – you may request the deletion of your personal data. This right is subject to sm605's legal obligations to retain certain records.
• Right to Complain: If you are not satisfied with how sm605 handles your personal data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.

To exercise any of the above rights, send a written request to privacy@sm605.best including your sm605 account number, the type of request being made, and a copy of a valid identity document for verification purposes. sm605 will not charge a fee for reasonable requests.

Sm605 services are strictly for individuals aged 18 and above. sm605 does not knowingly collect or process personal data of children (individuals under 18 years of age).

If we discover that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that data and close the account in question. This is part of sm605's commitment to responsible gaming and the protection of young people.

If you are a parent or guardian and become aware that your underage child has registered for or used the sm605 platform, please contact us immediately at privacy@sm605.best or via live chat. We will act promptly to resolve the matter.

In the course of operating the sm605 platform, your personal data may be transferred to and stored on servers located outside Malaysia, particularly in connection with the cloud computing services and international game providers we use.

Sm605 ensures that any transfer of personal data outside Malaysia is carried out in accordance with Malaysia's PDPA requirements – that is, only to destinations with an equivalent or higher level of data protection, or with adequate contractual safeguards in place. We use standard data processing agreements with all data recipients outside Malaysia to ensure your data remains protected.

By using sm605's services, you consent to such data transfers as necessary for service delivery. If you do not agree to these transfers, we ask that you refrain from using the sm605 platform.

Sm605 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to the way we handle data.

For any material amendments — meaning changes that significantly affect how your data is used — we will:

• Publishing a prominent notice on sm605's homepage at least 14 days before the changes take effect.
• Sending email notifications to all registered members containing a summary of the key changes.
• Seeking your fresh consent where a change involves a new type of processing that requires it.

For minor amendments that do not materially affect your privacy rights (such as language corrections or additional clarifications), we will update the "Last updated" date at the top of this page.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how sm605 manages your personal data, please reach out to us through the following channels:

• Dedicated Privacy Email: privacy@sm605.best – dedicated to privacy-related enquiries and data rights requests
• General Support Email: support@sm605.best – for general account-related issues
• Live Chat: Available 24/7 directly through the sm605 platform — for general enquiries
• WhatsApp: Available for communication in Bahasa Melayu at any time

For formal data rights requests (access, correction, deletion), please email privacy@sm605.best and include the following information to help us process your request promptly:

• Full name and sm605 account number
• Type of request submitted
• A brief description of your enquiry or request
• A copy of your identity document for verification purposes

Sm605 is committed to responding to all privacy-related enquiries within 14 business days of receipt.