Privacy Policy

We collect, and only collect:

• Account identifiers — email, password hash, Easy Gaming ID.
• KYC data when required — legal name, IC / passport number, bank account holder name, country, ID photo; for a Company: company name, SSM number, registered address and representative details (required for referral payout, marketplace selling, or tax-invoice issuance).
• Order data — every top-up: game, denomination, UID, server, character name, amount, wallet used.
• Wallet transactions — every credit / debit, including refunds and cashback.
• Technical data — IP address, browser fingerprint, device user-agent (used for fraud signals and rate-limiting).

We do not collect game passwords for any title where login isn't strictly required for fulfilment. Where passwords are collected (account-login top-up flows), they are stored encrypted at rest and purged after the order is delivered.

• Deliver the service (process orders, run wallets, send notifications).
• Comply with Malaysian AML / KYC obligations.
• Detect and prevent fraud (account takeovers, chargeback abuse, sanctions screening).
• Improve the product (anonymised analytics — never individual-level profiling for advertising).

Your data is never sold. We share the minimum data necessary with payment providers (the Malaysian payment methods we support, to process your top-ups) and with Malaysian government / law-enforcement bodies in response to a valid court order. KYC is reviewed manually by our own team from the ID photo you provide — we do not send your documents to any third-party identity-verification or liveness service. All processors we use are bound by data-processing agreements that mirror these obligations.

Cross-border transfer. Transactional emails are processed by Resend, Inc. (servers in Japan). Japan is recognised as providing an adequate level of data protection. By using our service you consent to this cross-border transfer of the data needed to send you transactional email.

Order records, wallet transactions, and invoices are retained for 7 years per Malaysian tax law. KYC ID photos and IC numbers are retained for six (6) years from the date of the last transaction or account closure, in compliance with the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA). Game account passwords (where collected) are purged within 24 hours of the order being marked Completed.

Under PDPA 2010 you have the right to:

• Access your data — request a copy of everything we hold.
• Correct your data — fix anything that's wrong (most fields are also editable in /account).
• Withdraw consent — close your account at any time; non-tax-mandated data is then deleted.
• Object to direct marketing — you can opt out of promotional emails any time.

Direct any of these requests to [email protected].

Promotional emails are sent only with your explicit opt-in consent, which you can withdraw at any time from Email Preferences. Transactional emails (order, security, KYC, invoices) are not promotional and are sent as part of the service.

Passwords are stored as bcrypt hashes; we never see the plaintext. Sensitive fields — your two-factor secret and KYC identity fields — are encrypted at rest with AES-256-GCM, and ID photos are kept in access-gated private storage that is never shown publicly. Every privileged action by Easy Gaming Portal staff is written to an append-only audit log with actor + timestamp. We do our best, but no system is unbreakable — keep your password strong, use a password manager, and enable 2FA.

Data breach notification. In the event of a confirmed personal data breach that poses a risk of significant harm, we will notify affected users within 72 hours and report to the Personal Data Protection Commissioner as required by the PDPA 2010 (as amended 2024).

We may update these terms. Material changes (anything that affects pricing, refund rights, or data sharing) will be announced 14 days in advance via email and an on-site notice. Continued use after the effective date constitutes acceptance.