Privacy Policy

1 Introduction

This Privacy Policy (hereinafter "the Policy") is published by Sonbahis (hereinafter "Sonbahis", "the Company", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://sonbahis.cam. This Policy governs the collection, use, storage, and disclosure of personal data provided by or collected from users (hereinafter "the Player", "User", or "you") when accessing or using the Sonbahis platform.

Sonbahis is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection legislation. We serve players predominantly across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — and we design our data practices to reflect the expectations and rights of our player community.

By registering an Account on the Sonbahis platform, making a deposit, or otherwise accessing our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the platform.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

3 Data We Collect

Sonbahis collects Personal Data through several channels in the ordinary course of providing its Services. The categories of data collected are described in detail below:

3.1 Data You Provide Directly

• Registration Data: Full legal name, date of birth, nationality, gender, residential address, email address, and contact telephone number provided during Account creation.
• Identity Verification (KYC) Documents: Copies of government-issued identification (Malaysian MyKad, Passport, or Driving Licence), proof of residential address (utility bill or bank statement not older than three months), and selfie photographs submitted for identity verification.
• Payment Information: Details of the payment methods used for deposits and withdrawals, including bank account references associated with Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX transactions. Full card or account numbers are not stored by Sonbahis — these are handled by our regulated payment service providers.
• Communications Data: Records of correspondence between you and Sonbahis, including live chat transcripts, support ticket submissions, and email exchanges.

3.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone settings, and approximate geolocation data derived from your IP address.
• Usage Data: Pages visited, games played, session duration, betting and gaming history, win/loss records, and feature interaction data collected through standard web analytics mechanisms.
• Cookie Data: Data collected through first-party cookies and similar tracking technologies as described in Section 8 of this Policy.

4 How We Use Your Data

Sonbahis processes your Personal Data only for clearly defined, legitimate purposes. The table below sets out the primary purposes of processing and the corresponding categories of data involved:

Sonbahis does not use your Personal Data for automated decision-making that produces significant legal effects, except where required by regulatory obligations such as automated transaction screening for anti-money laundering compliance. Where such processing occurs, you retain the right to request human review of any automated decision that affects you.

5 Legal Basis for Processing

Sonbahis processes your Personal Data only where a valid legal basis exists. The primary legal bases relied upon are as follows:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms & Conditions, including Account management, payment processing, and provision of gaming services.
• Legal Obligation: Processing necessary to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, KYC verification requirements, and regulatory reporting duties.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and general business analytics, where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing and promotional communications, where you have provided clear opt-in consent. You may withdraw consent at any time by contacting our support team or managing your Account preferences.

6 Data Sharing & Disclosure

Sonbahis does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may, however, share your data with carefully selected third parties in the following limited and controlled circumstances:

1. Payment Service Providers: We share necessary transaction data with regulated payment processors — including those facilitating Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, and other Malaysian payment methods — solely for the purpose of processing your deposits and withdrawals. These providers are bound by contractual data protection obligations and applicable financial sector regulations.
2. Identity Verification Partners: KYC documents and identity data may be shared with regulated identity verification service providers engaged to process and authenticate your documentation on our behalf. These processors operate under strict data processing agreements with Sonbahis.
3. Gaming Platform Providers: Certain technical and gaming activity data may be shared with the technology providers that power specific games or betting markets on the Platform, to the extent necessary for the provision of those services.
4. Regulatory & Law Enforcement Authorities: Sonbahis will disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts of law where required by applicable law, court order, or mandatory regulatory reporting obligation. Where legally permissible, we will notify affected Players of such disclosures.
5. Professional Advisors: Legal counsel, auditors, and other professional advisors engaged by Sonbahis may have access to limited Personal Data on a need-to-know basis and are subject to professional confidentiality obligations.

7 Data Retention

Sonbahis retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, accounting, and reporting obligations. The general retention principles applied by Sonbahis are as follows:

• Active Account Data: Retained for the full duration of your Account's active status and for a minimum of five (5) years following Account closure, in compliance with applicable anti-money laundering record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with standard financial record-keeping obligations.
• KYC Documents: Retained for five (5) years following Account closure or the end of the business relationship, whichever is later.
• Support Communications: Retained for up to three (3) years from the date of the final communication, unless a related dispute or legal matter requires longer retention.
• Technical & Usage Data: Anonymised or aggregated usage data may be retained indefinitely for analytics and platform improvement purposes, provided it no longer identifies any individual.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

8 Cookies & Tracking Technologies

The Sonbahis Platform uses cookies and similar tracking technologies to enable core platform functionality, improve user experience, and analyse Platform usage. A "cookie" is a small text file placed on your device by a website. The categories of cookies used by Sonbahis are described below:

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies may impair the functionality of the Platform or prevent you from accessing certain features. Sonbahis does not use third-party advertising cookies or cross-site behavioural tracking technologies.

9 Data Security

Sonbahis implements comprehensive technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes, but is not limited to, the following measures:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Sonbahis Platform is encrypted using industry-standard 256-bit SSL/TLS protocols. This applies to all pages, transactions, and form submissions across the Platform.
• Secure Data Infrastructure: Personal Data is stored on secured servers with restricted access controls, firewalls, and intrusion detection systems. Access to production data is limited to authorised personnel with a documented business need.
• Access Controls: Multi-factor authentication and role-based access controls are enforced for all internal systems containing Personal Data. All staff with data access receive mandatory data protection training.
• Monitoring & Incident Response: Sonbahis operates continuous security monitoring and maintains a documented data breach response procedure. In the event of a breach affecting your rights and freedoms, we will notify you and the relevant authorities without undue delay.

10 International Data Transfers

In the course of providing our Services, Personal Data may be transferred to and processed in countries outside Malaysia. This may occur where our payment processors, technology infrastructure providers, or identity verification partners operate servers or personnel in other jurisdictions.

Sonbahis ensures that any international transfer of Personal Data is subject to appropriate safeguards, including contractual data protection clauses that impose obligations on the recipient equivalent to those applied within Malaysia. We conduct due diligence on all Data Processors to verify their compliance with applicable data protection standards before any data transfer is permitted.

If you have questions about the specific safeguards applied to any international transfer of your Personal Data, you are entitled to contact us using the details provided in Section 15 of this Policy.

11 Your Rights

As a data subject, you hold a number of rights in relation to your Personal Data processed by Sonbahis. These rights are set out below. To exercise any of these rights, please contact us using the details in Section 15. We will respond to all valid requests within thirty (30) days, though complex or multiple requests may require an extended timeframe, of which we will notify you.

12 Children's Privacy

The Sonbahis Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect, process, or store Personal Data from individuals under the age of 21. Our KYC verification process is specifically designed to detect and prevent underage access.

If Sonbahis becomes aware that Personal Data has been collected from an individual under the age of 21 without verified parental consent, we will take immediate steps to delete that data and suspend the associated Account. Parents and guardians who believe their child may have registered on the Platform are urged to contact us immediately at [email protected] so that the matter can be resolved promptly.

13 Third-Party Services

The Sonbahis Platform may incorporate or reference third-party services, including payment gateways, identity verification providers, and game technology platforms. When you interact with these third-party services, your data may be processed by those third parties in accordance with their own privacy policies, over which Sonbahis has no control.

Sonbahis does not control the content or privacy practices of third-party services and accepts no responsibility for the manner in which third parties collect, use, or store your Personal Data. We recommend that you review the relevant privacy policies of any third-party service before providing your personal information to that service.

14 Policy Amendments

Sonbahis reserves the right to update or amend this Privacy Policy periodically to reflect changes in applicable law, regulatory guidance, our data processing activities, or the features and services available on the Platform. The date of the most recent revision is indicated at the top of this page.

Material changes to this Policy will be communicated to registered Players via notification to the registered Account email address and/or a prominent notice on the Platform, with a minimum of seven (7) days advance notice prior to the changes taking effect. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how Sonbahis protects your Personal Data and how your rights may be affected by any updates.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by Sonbahis, please contact our Data Protection team using the details below. All privacy-related inquiries will be acknowledged within 72 hours and substantively responded to within 30 days.