Extra Bonus Privacy Policy – Data Protection for Malaysian Players

Extra Bonus ("we", "Platform") is an online casino platform operator dedicated to serving Malaysian players. We understand that trust is the foundation of our relationship with every member — and that trust begins with how we handle your personal information.

This Privacy Policy applies to all information collected by Extra Bonus through our website, mobile platform, email communications, customer support interactions, and all other channels through which you engage with us. It covers all registered players in Malaysia, including those accessing the platform from Kuala Lumpur, Johor Bahru, Penang, Kota Kinabalu, Kuching, Ipoh, and across the country.

This Policy also outlines the commitment of Extra Bonus under the Personal Data Protection Act 2010 (PDPA) of Malaysia, which governs how companies handle personal data in Malaysia. PDPA compliance is not merely a legal obligation for us – it reflects our core belief that players' personal data belongs to the players, and we are simply responsible custodians.

Extra Bonus only collects data that is genuinely necessary to provide a safe, compliant, and high-quality platform experience. We do not collect data that is excessive or irrelevant to the platform's operational purposes. The following are the categories of data we collect:

Extra Bonus does not collect any sensitive category data such as your medical information, political views, or religious beliefs. The financial information we collect is limited to what is necessary to process transactions and comply with anti-money laundering (AML) requirements.

Extra Bonus collects personal data through several channels — all with your knowledge and, where required, your explicit consent. We do not collect data from third-party sources without your knowledge, except where identity verification and fraud prevention are required by law.

• During account registration: When you register as a member Extra Bonus, you provide your identity and contact information directly. This information is used to create and verify your account.
• During financial transactions: When you make a deposit or withdrawal using Touch 'n Go eWallet, DuitNow, GrabPay, ShopeePay, Boost, Maybank2u, CIMB Clicks, or FPX, transaction-related information is recorded for security and compliance purposes.
• While using the platform: Technical and usage data is collected automatically when you access the platform – including games played, bet amounts, and session duration.
• When interacting with support: When you contact our support team Extra Bonus via live chat or email, conversation records are retained for service quality and historical reference purposes.
• Through cookies and tracking technologies: Platform Extra Bonus uses session cookies and preference cookies to ensure the platform functions correctly and to retain your personal settings.
• During the identity verification process: Where required by law or as a security measure, we may request a copy of identity documents such as your MyKad or passport for verification purposes.

Extra Bonus uses personal data collected solely for legitimate purposes related to platform operations. Every use of data has a clear justification — we do not use your data for unrelated purposes or for anything you have not consented to.

• Creating, verifying, and managing member accounts Extra Bonus your data securely.
• Processing deposits and withdrawals using your preferred Malaysian payment methods, quickly and securely.
• Providing effective customer support — including resolving complaints, answering enquiries, and processing account-related requests.
• Ensuring compliance with legal requirements, including Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).
• Detecting and preventing fraud, multi-account usage, bonus abuse, and other unauthorised activities that could compromise the integrity of the platform.
• Sending important account-related communications such as transaction confirmations, security notifications, and policy updates.
• Sending marketing communications about promotions and offers Extra Bonus – only if you have given your consent, and you may unsubscribe at any time.
• Improving the platform user experience based on aggregated, anonymised usage pattern analysis.
• Supporting responsible gaming programmes, including self-limit tools and self-exclusion features.

Extra Bonus does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. This is an unwavering policy that has never been compromised since the platform launched. However, to operate the platform effectively, there are limited situations in which data may be shared with certain parties.

• Operational service providers: Partners such as game providers (Evolution Gaming, Microgaming, Pragmatic Play), payment processors (FPX, TNG, DuitNow gateways), and cloud infrastructure providers that support the operation of our platform. All partners are bound by strict confidentiality agreements and are only permitted to use data for specified purposes.
• Regulatory bodies and law enforcement agencies: Extra Bonus will disclose data to the relevant Malaysian authorities when required by law, court order, or valid legal process. This includes cooperation with the Malaysian Anti-Corruption Commission (MACC) or Bank Negara Malaysia where necessary.
• Identity verification services: To meet KYC (Know Your Customer) requirements, identity data may be verified through recognised third-party verification services. This process is carried out with full encryption and no data is retained by the third party.
• Platform analytics (anonymised data): We may use third-party analytics services to understand platform usage patterns. Data shared for this purpose is aggregated and anonymised — no personally identifiable information is included.

Extra Bonus continuously invests in comprehensive cybersecurity infrastructure to protect players' personal data. Our security systems are built on a "defence in depth" approach — multiple complementary layers of security controls working together.

• Encryption of data in transit and at rest: All communication between your browser and the Extra Bonus is encrypted using TLS 1.3 with SSL 256-bit certificates. Data stored on our servers is also encrypted for additional protection.
• Secure server infrastructure: Data is stored in data centres that meet the highest physical and digital security standards, with multi-layered access controls, 24/7 CCTV monitoring, and strict security procedures.
• Continuous threat monitoring: Security system Extra Bonus monitors suspicious activity in real time. Any unauthorised access attempts, cyberattacks, or unusual patterns will be detected and addressed promptly.
• Employee access controls: Access to players' personal data is restricted to staff who genuinely need it to perform their duties. All access is logged and audited on a regular basis.
• Independent security audits: Extra Bonus undergoes regular independent cybersecurity audits to identify and address vulnerabilities before they can be exploited.
• Incident response procedure: In the event of a confirmed data breach, Extra Bonus will notify affected players within 72 hours and take immediate remedial action. Relevant authorities will be informed as required by law.

Under Malaysia's PDPA and the privacy commitments of Extra Bonus, you have the following rights regarding your personal data. All privacy rights requests will be processed within 14 business days.

To exercise any of the above rights, contact the Extra Bonus via live chat or email at support@extrabonus.click, clearly stating your request. We do not charge any fees for reasonable privacy rights requests.

Cookies are small text files stored on your device when you visit a website Extra Bonus. Cookies allow the platform to remember your preferences, maintain your login session, and ensure certain functions work correctly. Extra Bonus uses three types of cookies.

• Strictly necessary cookies: These cookies are required for core platform functionality, such as maintaining your login session, saving language preferences, and ensuring financial transactions are processed correctly. Disabling these cookies will affect the platform's ability to function.
• Platform analytics cookies: These cookies help us understand how players use the platform — which pages are visited most, where players encounter issues, and how to improve the overall experience. Data collected is aggregated and is not used to identify individuals.
• Preference cookies: These cookies store your personal settings such as game preferences, display settings, and notification preferences so you do not have to reconfigure them each time you log in.

Extra Bonus does not use third-party cookies for advertising or cross-site tracking purposes. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may significantly affect platform functionality.

Extra Bonus retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal requirements. We maintain a clear data retention schedule for each data category.

• Active account data: Retained for as long as your account remains active on the platform Extra Bonus. If an account is terminated, core data is retained for 7 years to comply with financial and audit legal requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• Support communication records: Retained for 2 years for service quality purposes and historical reference in resolving disputes.
• Technical and security logs: Retained for 90 days for security threat detection and incident investigation purposes.
• Marketing data (if consented): Retained until you withdraw consent or unsubscribe from marketing communications Extra Bonus.

Once the retention period has ended, personal data will be permanently deleted or fully anonymised so it can no longer be linked to any individual. The deletion process is carried out using methods that ensure the data cannot be recovered.

Platform Extra Bonus may include integrations with third-party payment services such as Touch 'n Go eWallet, DuitNow, GrabPay, ShopeePay, Boost, Maybank2u, CIMB Clicks, and the FPX gateway. When you use these services for deposits or withdrawals, you are also subject to the respective privacy policies of those service providers.

Extra Bonus is not responsible for the privacy practices of any third-party services you may access through our platform. We encourage you to read the privacy policies of all services you use, including the payment services you choose for deposits and withdrawals.

Extra Bonus reserves the right to update this Privacy Policy from time to time to reflect changes in how we handle data, updates to applicable laws, or improvements to our privacy practices. Any updates will be published on this page with a clear effective date.

For any material changes — meaning changes that significantly affect how we use your data or your rights — we will notify you via an in-platform notification or email at least 14 days before the changes take effect. This gives you sufficient time to review the changes and make an informed decision about your continued use of the platform Extra Bonus your account.

If you have any questions, concerns, or wish to exercise your privacy rights, you may contact us Extra Bonus through the following channels:

• In-platform live chat — available 24/7, with response times under 5 minutes for urgent enquiries.
• Email: support@extrabonus.click – for written requests related to privacy rights that require official documentation.