// DATA PROTECTION & PRIVACY

Privacy Policy

extrabonus is committed to protecting the privacy and personal data of every player who uses our platform. This Privacy Policy explains what data we collect, why we collect it, how we use it, and the rights available to you as a data subject.

Effective Date: 1 January 2026 Last Updated: 1 January 2026 Applies to: All registered players

// PRIVACY AT A GLANCE

How We Protect Your Data

Six core commitments govern how extrabonus handles your personal information. These are not aspirational statements — they are operational policies enforced across our platform, payment systems, and support teams.

Data Minimisation

We collect only the personal data that is strictly necessary for account management, KYC verification, fraud prevention, and service delivery. We do not collect data speculatively or for unrelated commercial purposes.

256-Bit Encryption

All data transmissions between your device and extrabonus servers are encrypted using industry-standard TLS/SSL protocols. Data at rest is encrypted using AES-256. Your credentials and payment details are never stored in plain text.

No Third-Party Data Sales

extrabonus does not sell, rent, or trade your personal data to any third party for commercial purposes. Data is shared only with essential service providers (payment processors, KYC verification services) under strict data processing agreements.

Purpose Limitation

Personal data collected for account registration is not repurposed for unrelated marketing. Data collected for KYC is used exclusively for identity verification and regulatory compliance, not for profiling.

Your Rights, Respected

You have the right to access, correct, export, or request deletion of your personal data at any time. Requests are handled by our Data Protection team within 30 days. See Section 8 for the full list of your data rights.

Defined Retention Periods

Personal data is not held indefinitely. Account data is retained for the duration of your active account plus a defined regulatory retention period. Data no longer required is securely deleted or anonymised.

// SECTION 01

1. Introduction

This Privacy Policy ("Policy") describes how extrabonus ("the Platform", "we", "us", "our"), accessible at https://extrabonus.cam, collects, processes, stores, and protects the personal data of individuals ("Player", "User", "you") who access or use our online sports betting and casino services.

extrabonus is operated by a company incorporated under an international jurisdiction and serving players across Malaysia, including those based in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and other locations throughout the country. We take the privacy of our players seriously and have designed our data practices to align with internationally recognised data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity.

Notice to Malaysian Users: Malaysia's Personal Data Protection Act 2010 (PDPA) applies to commercial data processors operating in Malaysia. While extrabonus operates under international jurisdiction, we have designed our data practices to be consistent with the principles of the PDPA and international data protection best practices. By using the Platform, you consent to the data practices described in this Policy.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. If there is any conflict between this Policy and another extrabonus document on the subject of personal data, this Policy prevails.

// SECTION 02

2. Definitions

Term	Meaning
"Personal Data"	Any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details, IP address, and device identifiers.
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or anonymisation.
"Data Controller"	extrabonus, which determines the purposes and means of processing your Personal Data.
"Data Processor"	A third-party service provider that processes Personal Data on behalf of extrabonus under a written data processing agreement (e.g., KYC verification providers, payment processors).
"KYC"	Know Your Customer — the identity verification process requiring Players to submit government-issued identification and proof of address before withdrawals are permitted.
"Cookies"	Small text files stored on your device by the Platform to enable core functionality, analytics, and a personalised experience.
"Consent"	A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.

// SECTION 03

3. Data We Collect

We collect personal data through the following channels and categories:

3.1 Data You Provide Directly

Registration data: Full legal name, date of birth, email address, residential address, phone number, and preferred currency (MYR).
KYC documents: Government-issued photo ID (e.g., Malaysian MyKad or passport), proof of address (utility bill, bank statement), and payment method ownership documentation.
Payment data: Transaction amounts, payment method identifiers (e.g., registered e-wallet account name for Touch 'n Go eWallet, Boost, or GrabPay; bank account name for Maybank, CIMB, Public Bank, RHB, or Hong Leong Bank transfers). We do not store full card numbers or e-wallet PINs.
Support communications: The content of messages you send to our customer support team via Live Chat, WhatsApp, or email.
Responsible gambling data: Deposit limit settings, loss limit configurations, self-exclusion requests, and cooling-off period activations.

3.2 Data Collected Automatically

Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
Usage data: Pages visited, games played, betting history, session duration, click-through patterns, and feature interactions within the Platform.
Geolocation data: Approximate geolocation derived from IP address, used for access control and regulatory compliance. We do not collect precise GPS location.
Cookies and similar technologies: As described in Section 7 of this Policy.

3.3 Data from Third Parties

Identity verification results from our licensed KYC/AML service providers.
Fraud screening signals from our payment processing partners.
Responsible gambling data from self-exclusion registers where applicable under the Platform's regulatory requirements.

Note on sensitive data: Where KYC documentation contains sensitive personal data (e.g., national identity number from MyKad), this data is processed solely for identity verification and anti-money laundering compliance, retained for the minimum required period, and protected with enhanced access controls.

// SECTION 04

4. Legal Basis for Processing

extrabonus processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

Legal Basis	Processing Activities Covered
Contractual Necessity	Account registration, identity verification, transaction processing, withdrawal of funds, customer support. Processing is necessary to perform the services you have contracted for.
Legal Obligation	KYC/AML verification, age verification (21+), record-keeping for regulatory compliance, fraud reporting obligations.
Legitimate Interests	Fraud prevention, platform security, abuse detection, responsible gambling monitoring, and improving Platform performance — provided these interests are not overridden by your privacy rights.
Consent	Marketing communications (email, SMS, push notifications) — where you have opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

// SECTION 05

5. How We Use Your Data

extrabonus uses your personal data for the following specific purposes:

Account management: Creating and maintaining your Player account, authenticating your identity at login, and managing your account settings and preferences.
Identity verification: Conducting KYC and AML checks as required by our licensing and regulatory obligations, including age verification to enforce the 21+ minimum age requirement.
Transaction processing: Processing deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and major Malaysian banks (Maybank, CIMB, Public Bank, RHB, Hong Leong), and processing withdrawals to verified payment methods.
Customer support: Responding to support requests, resolving disputes, and providing account assistance via Live Chat, WhatsApp, and email in English, Bahasa Melayu, and Chinese.
Fraud and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, multi-accounting, and other Prohibited Activities as defined in our Terms & Conditions.
Responsible gambling: Monitoring gambling patterns for indicators of problem gambling, facilitating self-exclusion requests, enforcing deposit limits and loss limits, and communicating responsible gambling resources to players showing risk indicators.
Platform improvement: Analysing aggregated usage data to improve Platform features, game selection, and user experience. This analysis uses anonymised or pseudonymised data wherever possible.
Marketing (with consent only): Sending promotional communications about bonuses, new games, and Platform updates — only where you have provided explicit opt-in consent. You may withdraw this consent at any time.
Legal compliance: Complying with applicable laws, regulations, court orders, and lawful requests from regulatory or law enforcement authorities.

// SECTION 06

6. Data Sharing & Third Parties

extrabonus does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances, and only to the extent necessary for each specific purpose:

KYC and AML service providers: Licensed identity verification companies that process your identification documents for age and identity confirmation. These providers operate under strict data processing agreements and are prohibited from using your data for their own purposes.
Payment processors: Payment service providers facilitating deposits and withdrawals, including e-wallet operators and banking partners. Data shared is limited to the transaction-specific information required to process the payment.
Fraud prevention services: Third-party fraud screening and risk assessment providers that help protect our Platform from fraudulent activity.
Game providers: In order to facilitate your participation in games hosted by third-party providers on our Platform, limited account identifiers may be shared with those providers. These providers do not receive your full personal profile.
Regulatory and legal authorities: Where we are required by law, court order, or regulatory directive to disclose personal data to law enforcement, tax authorities, or gaming regulators, we will comply with such obligations.
Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

No marketing data sales: extrabonus strictly prohibits the sale of player personal data to data brokers, advertising networks, or any other third party for commercial exploitation. We have contractual safeguards in place to prevent our service providers from doing so.

// SECTION 07

7. Cookies & Tracking Technologies

extrabonus uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device. You may control cookie preferences through your browser settings; however, disabling certain cookies may affect Platform functionality.

We use the following categories of cookies:

Category	Type	Purpose	Can be Disabled?
Session & Authentication	Essential	Maintaining your logged-in session, securing your account, and enabling core Platform features such as the game lobby, balance display, and cashier.	No — Platform will not function without these.
Security & Fraud Detection	Essential	Detecting suspicious login activity, bot prevention, and enforcing geo-access controls.	No — required for platform security.
Analytics & Performance	Analytics	Measuring page load performance, feature engagement, and game popularity to improve Platform quality. Data is aggregated and anonymised.	Yes — via browser settings or cookie consent manager.
Personalisation	Functional	Remembering your language preference, display settings, and recently played games to personalise your experience.	Yes — disabling may reset preferences on each visit.

We do not use third-party advertising cookies or cross-site tracking technologies that build profiles across unrelated websites. All cookies used serve direct operational or analytical purposes related to the extrabonus Platform.

// SECTION 08

8. Your Data Rights

As a data subject, you hold a set of rights with respect to your personal data held by extrabonus. We are committed to honouring these rights promptly and transparently. All requests are handled by our Data Protection team within 30 calendar days of receipt.

Right of Access You may request a copy of all personal data we hold about you, along with information on how it is processed.

Right to Rectification You may request correction of any inaccurate or incomplete personal data. Account details can also be updated directly via your account settings.

Right to Erasure You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.

Right to Restrict Processing You may request that we restrict processing of your personal data in specific circumstances, such as while the accuracy of the data is contested.

Right to Data Portability You may request your personal data in a structured, machine-readable format for transfer to another service provider.

Right to Object You may object to processing based on legitimate interests, including profiling, and to the use of your data for direct marketing purposes.

Right to Withdraw Consent Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without penalty.

Right to Complain You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe your data rights have been infringed.

To exercise any of the above rights, please contact our Data Protection team at the contact details listed in Section 15. We may need to verify your identity before processing your request.

// SECTION 09

9. Data Retention

extrabonus retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account applicable legal, regulatory, and contractual retention obligations.

Data Category	Retention Period	Basis
Account registration data	Duration of active account + 5 years after account closure	AML regulatory requirements
KYC documents	5 years from date of verification	AML/KYC regulatory obligations
Transaction records	7 years from date of transaction	Financial record-keeping obligations
Support correspondence	3 years from date of interaction	Dispute resolution and quality assurance
Betting and gaming history	5 years from date of activity	Regulatory compliance and responsible gambling monitoring
Marketing consent records	Until withdrawal of consent + 1 year	Demonstrating lawful basis for marketing
Website analytics (anonymised)	26 months rolling	Platform improvement — anonymised, no re-identification possible

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised such that it can no longer be attributed to any individual.

// SECTION 10

10. Data Security

extrabonus implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction:

Encryption in transit: All data transmitted between your device and our servers is protected by TLS 1.2 or higher. We enforce HTTPS across the entire Platform with HSTS (HTTP Strict Transport Security).
Encryption at rest: Sensitive personal data stored in our databases is encrypted using AES-256. Backup copies are also encrypted.
Access controls: Personal data is accessible only to authorised personnel who require it for their specific job function. Role-based access control and multi-factor authentication are enforced for all staff accounts.
Penetration testing: Regular third-party security assessments, including penetration testing and vulnerability scanning, are conducted to identify and remediate security weaknesses.
Incident response: In the event of a personal data breach, extrabonus has an incident response procedure in place that includes prompt notification to affected players and relevant regulatory authorities where required by applicable law.
Employee training: All staff with access to personal data receive data protection training and are bound by confidentiality obligations.

Your responsibility: While we take extensive measures to secure our systems, you are also responsible for maintaining the security of your Account credentials. Never share your password with anyone, including extrabonus support staff who will never request your password.

// SECTION 11

11. International Data Transfers

extrabonus operates internationally and may transfer personal data to servers, service providers, or affiliated entities located in jurisdictions outside Malaysia. Where such transfers occur, we take steps to ensure that your personal data receives an equivalent level of protection as it would within Malaysia.

International data transfers are governed by one or more of the following safeguards:

Contractual clauses that bind the recipient to data protection standards consistent with this Policy and applicable international data protection frameworks.
Transfers to jurisdictions recognised as providing an adequate level of data protection by relevant international regulatory bodies.
Explicit consent from the data subject, where appropriate and where no other adequate safeguard is available.

For further information about the safeguards in place for international data transfers, please contact our Data Protection team using the details in Section 15.

// SECTION 12

12. Children & Minors

extrabonus is strictly an adult gambling platform. We do not knowingly collect personal data from any person under the age of 21. Our age verification process is designed to prevent underage access at the point of registration and throughout the KYC verification process.

If we become aware that we have inadvertently collected personal data from a person under 21, we will immediately suspend the relevant Account, void all activity associated with it, and securely delete the data in accordance with our deletion procedures.

Parents and guardians: If you believe a minor in your care has accessed or registered on this Platform, please contact our support team immediately at [email protected]. We will treat such reports as urgent and take immediate action.

// SECTION 13

13. Marketing Communications

extrabonus may send marketing communications — including information about bonuses, promotions, new games, and Platform updates — to Players who have given explicit opt-in consent to receive such communications.

Opting in: You may opt in to marketing communications during registration or at any subsequent time through your Account settings.

Opting out: You may withdraw your marketing consent at any time by:

Updating your communication preferences in your Account settings under "Notifications".
Clicking the "unsubscribe" link in any marketing email you receive from us.
Contacting our support team via Live Chat or email and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to use the Platform or the lawfulness of marketing communications sent prior to withdrawal. You will continue to receive essential transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC requests) regardless of your marketing preferences.

// SECTION 14

14. Changes to This Privacy Policy

extrabonus reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Post the revised Policy at https://extrabonus.cam/privacy-policy.
Where the changes are significant, notify registered Players via email or an in-platform notification.

Your continued use of the Platform after the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with material changes to this Policy, you may close your Account by contacting our support team.

We recommend reviewing this Policy periodically. The current version is always available at https://extrabonus.cam/privacy-policy.

// SECTION 15

15. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us through the following channels:

Live Chat: Available 24/7 on the Platform. For data rights requests, please state "Data Rights Request" at the start of your message. Average response time: 3–5 minutes.
Email: [email protected] (displayed as plain text — not a clickable link). Please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" for prioritised routing. Allow up to 30 days for formal data rights requests.
WhatsApp: WhatsApp Support is available 24/7 for general privacy queries. Contact details are available within the Platform after login.

For formal data rights requests (access, rectification, erasure, portability, objection), please provide your full registered name, account username, and a clear description of the data right you wish to exercise. We may require identity verification before processing your request to protect your data security.

Data Protection contact: [email protected] — Support is available in English, Bahasa Melayu, and Chinese. Response to formal data rights requests within 30 calendar days.

Questions About Your Privacy?

Our support team is available 24/7 in English, Bahasa Melayu, and Chinese to address any privacy queries. You can also visit our FAQ for quick answers to common questions about your account and data.

Return to Homepage Read Our FAQ

21+ Only — Gamble Responsibly