Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by oyes ("oyes", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at oyes.cam and its associated mobile applications. This Policy governs the collection, use, processing, storage, sharing, and protection of personal data submitted to or collected by oyes in connection with your use of the platform and associated services.

oyes takes the privacy and security of all users — including registered players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout Malaysia — with utmost seriousness. We are committed to handling your personal data in a manner that is transparent, lawful, and consistent with applicable data protection standards.

By accessing the oyes platform, creating an account, making a deposit, placing a wager, or otherwise engaging with our services, you acknowledge that you have read this Privacy Policy and consent to the data processing practices described herein. If you do not agree with the terms of this Policy, please do not use the oyes platform.

This Policy should be read in conjunction with oyes's Terms and Conditions and Responsible Gambling Policy, which collectively govern your relationship with the oyes platform.

Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" means oyes, which determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third-party entity that processes personal data on behalf of oyes pursuant to a written data processing agreement.
• "User" / "You" means any individual who accesses, registers on, or uses the oyes platform in any capacity.
• "KYC" means Know Your Customer — mandatory identity verification procedures carried out to confirm a user's identity, age, and address.
• "Cookies" means small text files placed on your device by the oyes platform or authorised third-party service providers for the purposes described in Section 10.
• "Sensitive Data" means a subset of personal data that warrants heightened protection under applicable law, including health-related information and financial account details.

Personal Data We Collect

oyes collects the following categories of personal data from users. The specific data collected in each category depends on how you interact with the platform:

Where payment processing is handled by third-party payment providers — including but not limited to Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — those providers process payment-specific data directly in accordance with their own privacy policies. oyes receives only the transaction reference and status information necessary to credit or debit your account.

How We Collect Your Data

4.1 Data You Provide Directly

We collect personal data that you voluntarily provide to us when you:

• Register an account on the oyes platform.
• Complete KYC identity verification.
• Make a deposit or request a withdrawal.
• Contact our customer support team via live chat or email.
• Claim a bonus, enter a promotion, or participate in a loyalty programme.
• Set responsible gambling limits or request self-exclusion.
• Submit any form, survey, or feedback request on the platform.

4.2 Data Collected Automatically

When you access and use the oyes platform, we automatically collect certain technical and usage data through cookies, web beacons, log files, and similar tracking technologies. This includes your IP address, device identifiers, browser characteristics, and behavioural data within the platform. See Section 10 for detailed cookie information.

4.3 Data from Third Parties

In certain circumstances, oyes may receive personal data about you from third parties, including:

• KYC verification providers — identity and address verification results.
• Payment processors — transaction status, fraud screening outcomes, and payment verification results.
• Fraud prevention services — risk scoring and flagging data.
• Responsible gambling registries — self-exclusion status, where applicable and legally authorised.

Purposes of Data Processing

oyes processes your personal data for the following specific purposes:

1. Account Creation and Management: To register your account, verify your identity, maintain your account profile, and administer your player relationship with oyes.
2. Service Delivery: To process deposits and withdrawals, settle bets and game outcomes, and provide the full range of sports betting, live casino, and slot gaming services available on the platform.
3. KYC and Age Verification: To verify that you meet the minimum age requirement of 21 years, confirm your identity, and comply with applicable regulatory obligations.
4. Anti-Money Laundering (AML) Compliance: To monitor transactions, detect suspicious activity, and fulfil obligations under applicable anti-money laundering and counter-terrorism financing laws.
5. Fraud Prevention and Platform Security: To detect and prevent fraudulent activity, account takeover attempts, bonus abuse, and other security threats to the platform and its users.
6. Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance.
7. Promotions and Loyalty Programmes: To administer bonus claims, referral programmes, VIP tier benefits, birthday bonuses, and other promotional activities for which you are eligible.
8. Responsible Gambling: To administer self-exclusion requests, deposit and loss limits, and other player protection tools in accordance with oyes's Responsible Gambling Policy.
9. Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the overall user experience on the oyes platform.
10. Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce oyes's Terms and Conditions.
11. Communications: To send you transactional notifications (account activity, deposit confirmations, withdrawal updates), and where you have opted in, promotional communications about oyes offers.

Legal Basis for Processing

oyes processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered oyes player — including account management, bet settlement, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC verification, AML obligations, and responses to lawful regulatory requests.
• Legitimate Interests: Processing conducted for oyes's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests do not override your fundamental privacy rights.
• Consent: Processing conducted on the basis of your explicit consent, including the receipt of optional marketing communications. You may withdraw consent at any time by updating your notification preferences in your account settings or contacting our support team.

Data Sharing & Disclosure

oyes does not sell, rent, or trade your personal data to any third party. We may share your personal data only in the specific circumstances described below:

7.1 Service Providers and Data Processors

oyes engages third-party service providers to perform functions on our behalf, including payment processing (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency payment gateways), identity verification and KYC services, fraud detection services, cloud hosting and infrastructure providers, and customer support tools. These providers are authorised to process your personal data only as necessary to provide the contracted services and are bound by data processing agreements that impose data protection obligations at least as stringent as those in this Policy.

7.2 Regulatory and Law Enforcement Authorities

oyes may disclose personal data to competent regulatory authorities, law enforcement agencies, or other governmental bodies where required to do so by applicable law, court order, or lawful regulatory directive. oyes will, where legally permissible, notify you of such a disclosure request before complying.

7.3 Responsible Gambling Registries

Where required by applicable regulatory frameworks, oyes may share self-exclusion data with authorised responsible gambling registries to ensure that exclusion requests are given effect across participating operators.

7.4 Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring involving oyes or its parent entities, your personal data may be transferred to the successor entity as part of the transaction, subject to the same privacy protections described in this Policy. You will be notified of any such transfer that materially affects the handling of your personal data.

International Data Transfers

oyes operates infrastructure that may involve the transfer of personal data to servers or service providers located outside of Malaysia. Where such transfers occur, oyes ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable Malaysian data protection law.

Safeguards for international transfers include, where applicable: contractual clauses with service providers that impose binding data protection obligations; use of service providers located in jurisdictions with adequate data protection frameworks; and technical and organisational security measures appropriate to the nature of the data being transferred.

Data Retention

oyes retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of your active account relationship with oyes, and for a period of at least 7 years following account closure, in accordance with applicable AML and financial record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years following account closure or the last transaction, as required by applicable regulatory frameworks.
• Transaction and Betting Records: Retained for a minimum of 7 years for regulatory compliance and dispute resolution purposes.
• Customer Support Records: Retained for 3 years following the resolution of the relevant support interaction, unless a longer period is required for ongoing dispute or legal proceedings.
• Technical and Usage Data: Retained for up to 2 years for security monitoring and platform analytics purposes.
• Marketing Consent Records: Retained for the duration of your consent and for 2 years following withdrawal of consent, as an audit record.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with oyes's data destruction procedures.

Cookies & Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the oyes platform. They serve a range of purposes, from essential platform functionality to performance analytics and security monitoring.

10.2 Types of Cookies Used by oyes

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session management cookies, authentication tokens, and security cookies. They cannot be disabled without impairing platform functionality.
• Functional Cookies: Enable personalisation features such as language preferences, regional settings, and remembered login states. These cookies enhance your experience but are not strictly required.
• Analytics Cookies: Used by oyes and authorised analytics tools to collect aggregated, anonymised data about how users interact with the platform — pages visited, time spent, and navigation paths. This data helps oyes improve platform design and performance.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts.

10.3 Managing Cookies

You may configure your browser to block or delete cookies. Please note that disabling strictly necessary cookies will impair your ability to use the oyes platform, including logging in and processing transactions. Instructions for managing cookies are available in your browser's help documentation.

Your Rights Over Your Personal Data

Subject to applicable law and certain exceptions, you hold the following rights with respect to your personal data processed by oyes:

• Right of Access: You have the right to request a copy of the personal data oyes holds about you, together with information about how it is processed.
• Right of Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. For basic account details, you may update these directly within your account settings.
• Right of Erasure: You have the right to request deletion of your personal data where it is no longer required for the purposes for which it was collected, or where you withdraw consent. Please note that this right is subject to oyes's legal obligations to retain certain data for regulatory compliance purposes.
• Right to Restriction of Processing: You have the right to request that processing of your personal data be restricted in certain circumstances, such as where the accuracy of the data is contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data that is based on oyes's legitimate interests, where you have grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights set out above, please contact our Data Protection team via live chat or at [email protected]. We will respond to all verified requests within 30 calendar days. In certain complex cases, this period may be extended by a further 30 days, and you will be informed accordingly.

We may need to verify your identity before processing your request. This is to ensure that we do not disclose or modify data belonging to another individual.

Data Security

oyes implements and maintains a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, and accidental loss. These measures include:

• Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Sensitive data at rest, including KYC documents and financial records, is stored using strong encryption at the database and file system level.
• Access Controls: Access to personal data is restricted to authorised oyes personnel on a strict need-to-know basis, with role-based access controls and audit logging of all data access events.
• Two-Factor Authentication (2FA): Available for all user accounts and mandatory for internal administrative access.
• Penetration Testing: oyes conducts regular security assessments and penetration tests of platform infrastructure to identify and remediate vulnerabilities.
• Incident Response: oyes maintains a documented data breach response plan. In the event of a data breach that poses a risk to your rights and freedoms, oyes will notify affected users without undue delay.
• Vendor Security: All third-party service providers with access to personal data are subject to security due diligence and contractual security obligations.

Minors & Age Restriction

The oyes platform is strictly intended for use by individuals who are at least 21 years of age. oyes does not knowingly collect personal data from persons under the age of 21. If oyes becomes aware that personal data has been collected from a person under 21, that data will be promptly deleted and the associated account will be permanently closed.

If you have reason to believe that a person under 21 has provided personal data to oyes or is using the platform, please notify us immediately at [email protected] so that we may take appropriate action.

oyes employs age verification as part of its KYC process to enforce the 21+ requirement. For responsible gambling tools and resources relevant to underage gambling prevention, please visit our Responsible Gambling page.

Changes to This Privacy Policy

oyes reserves the right to update or amend this Privacy Policy at any time. When we make changes, we will revise the "Last Updated" date at the top of this document. Material changes — that is, changes that meaningfully alter how we process your personal data or affect your rights — will be communicated to registered users via email or via a prominent notice on the platform, with a minimum of 14 days' advance notice where practicable.

We encourage you to review this Privacy Policy periodically to remain informed about how oyes protects your data. Your continued use of the platform following any amendment to this Policy constitutes acceptance of the revised terms.

If you have concerns about any changes to this Policy, please contact our support team before the changes take effect. If you do not agree with the revised Policy, you may close your account by contacting support.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by oyes, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the oyes platform.
• Email: [email protected] — we aim to respond within 2–4 hours during peak Malaysian time (MYT). Data protection requests will be acknowledged within 3 business days and fully resolved within 30 calendar days.

When contacting us about a data protection matter, please include your registered email address and a description of your request so that we can verify your identity and process your request as efficiently as possible.