Apatu Privacy
Policy

Introduction

This Privacy Policy ("Policy") is issued by Apatu ("Apatu", "we", "us", "our") and applies to all personal data collected, processed, stored, and used by Apatu in connection with the operation of the online casino and sports betting platform accessible at apatu.cam (the "Platform").

Apatu is committed to handling your personal information with care, transparency, and in accordance with internationally recognised data protection principles. This Policy is designed to align with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards, including those mandated by Apatu's international gaming licensing authority.

We encourage you to read this Policy in full before creating an account. If you have questions about any aspect of how your data is handled, please contact our support team via the details in Section 14.

Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — any information that identifies or could reasonably be used to identify an individual, whether directly or in combination with other data. This includes, but is not limited to, full legal name, date of birth, identity document number, email address, phone number, and financial account details.
• "Processing" — any operation performed on personal data, whether automated or manual, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Subject" — the individual whose personal data is being processed; in the context of this Policy, typically a registered or prospective Apatu player.
• "Data Controller" — Apatu, which determines the purposes and means of processing personal data collected through the Platform.
• "Third Party" — any individual, organisation, or entity other than the Data Subject and Apatu, including service providers, payment processors, and regulatory authorities.
• "KYC Data" — identity and address verification documents collected as part of Apatu's Know Your Customer process, including copies of identity cards, passports, utility bills, and selfie photographs.
• "Cookies" — small text files placed on a user's device by a website that store information about browsing activity and preferences.
• "PDPA" — Malaysia's Personal Data Protection Act 2010, which governs the processing of personal data in commercial transactions in Malaysia.

Data We Collect

Apatu collects personal data from you in several ways: directly when you register and use the Platform, automatically through technical systems when you browse, and from third-party providers in specific circumstances. The categories of personal data we collect are described below.

3.1 Registration Data

When you create an Apatu account, we collect: full legal name, date of birth, email address, phone number, residential address, and your chosen username and password (stored in encrypted form).

3.2 KYC and Verification Data

Prior to processing any withdrawal, Apatu requires identity verification. This involves the collection of: a copy of a valid government-issued identity document (Malaysian NRIC/MyKad, passport, or driver's licence); proof of address (utility bill, bank statement, or Telco bill not older than three months); and a selfie photograph holding your identity document.

3.3 Financial Data

We collect data relating to your financial transactions on the Platform, including deposit and withdrawal amounts, transaction dates, payment method identifiers (e-wallet account names, bank account last four digits), and transaction reference numbers. Full payment card or bank account numbers are never stored by Apatu — payment processing is handled by certified third-party payment processors including those supporting Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank.

3.4 Technical and Usage Data

Our systems automatically collect technical data when you use the Platform, including: IP address and approximate geographic location; device type, operating system, and browser type; pages visited, time on page, and navigation paths; session duration and login timestamps; and game history and betting activity logs.

3.5 Communication Data

When you contact Apatu's support team via live chat, WhatsApp, or email, we retain records of those communications for quality assurance, dispute resolution, and regulatory compliance purposes.

How We Use Your Data

Apatu processes your personal data for the following specific purposes. We do not process personal data beyond what is reasonably necessary for these stated purposes.

• Account Management: Creating, maintaining, and administering your Apatu account, including password resets and account preference management.
• Identity Verification (KYC): Verifying your identity and age (21+) before processing withdrawals, in compliance with our licensing obligations and anti-money laundering requirements.
• Payment Processing: Facilitating MYR deposits and withdrawals via your chosen payment method, including Touch 'n Go eWallet, DuitNow, FPX, and other supported channels.
• Service Delivery: Providing access to casino games, sports betting markets (including EPL, Liga Super Malaysia, UFC), live dealer tables, and all other Platform features.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, bonus abuse, money laundering, and unauthorised account access.
• Regulatory Compliance: Meeting obligations imposed by Apatu's international gaming licence, including record-keeping, AML/CFT reporting, and responsible gambling requirements.
• Customer Support: Responding to queries, resolving disputes, and maintaining a record of support interactions.
• Responsible Gambling: Monitoring gaming behaviour to identify indicators of problem gambling and applying player protection measures where appropriate.
• Platform Improvement: Analysing aggregated usage data to improve platform performance, user experience, and product offering.
• Marketing Communications: Sending you information about promotions, bonuses, and platform updates — where you have provided consent to receive such communications. You may withdraw consent at any time.

Legal Basis for Processing

Apatu processes your personal data on the following legal bases, consistent with the principles of Malaysia's Personal Data Protection Act 2010 and international data protection standards:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and Apatu — specifically, for operating your account, processing transactions, and delivering the gaming services you have subscribed to.
• Legal Obligation: Processing is necessary for Apatu to comply with legal and regulatory obligations, including KYC identity verification, anti-money laundering (AML) reporting, and responsible gambling mandates under our international gaming licence.
• Legitimate Interest: Processing for fraud prevention, platform security, and abuse detection, where these interests are not overridden by your rights and freedoms.
• Consent: Where Apatu relies on consent as the legal basis — specifically for direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

Apatu does not sell your personal data to third parties. We do not share your personal data with third parties for their own marketing or commercial purposes. Personal data is shared with third parties only in the circumstances described below, and strictly on a need-to-know basis with appropriate data processing safeguards in place.

6.1 Payment Service Providers

To facilitate MYR deposits and withdrawals, Apatu shares limited transaction data with certified payment processors supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and USDT TRC20 channels. These providers are bound by strict data confidentiality obligations.

6.2 Identity Verification Partners

KYC document verification may be processed by certified third-party identity verification providers. These partners operate under contractual data processing agreements that prohibit any use of your data beyond the scope of the verification task.

6.3 Regulatory and Licensing Authorities

Apatu may be required to disclose personal data to the licensing authority under which it operates, and to law enforcement or regulatory bodies where required by applicable law — including in connection with AML/CFT investigations or court orders.

6.4 Technology and Infrastructure Providers

Apatu uses third-party cloud hosting, game aggregation, and security service providers who may process limited data as part of delivering platform infrastructure. All such providers are subject to appropriate contractual data protection terms.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Apatu's business, personal data held by Apatu may be transferred to the acquiring entity, subject to equivalent data protection obligations. Players will be notified of any such transfer where practicable.

Cookies & Tracking Technologies

Apatu uses cookies and similar tracking technologies to operate the Platform, maintain session security, and improve the user experience. The categories of cookies used on the Apatu Platform are as follows:

Apatu does not use third-party advertising cookies or share behavioural data with external advertising networks. Essential cookies cannot be disabled as they are required for the Platform to function. You may configure your browser to block non-essential cookies, although doing so may affect certain Platform features.

Data Retention

Apatu retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, and licensing obligations.

• Active Account Data: Retained for the duration of your account's active status and for a period of 5 years following account closure, in accordance with standard AML record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years following the date of verification, or such longer period as may be required by Apatu's licensing authority or applicable law.
• Transaction Records: Retained for a minimum of 5 years following the date of each transaction.
• Support Communications: Retained for a period of 3 years following the close of each support interaction.
• Marketing Consent Records: Retained until consent is withdrawn, plus an additional 3 years for audit purposes.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Apatu's data disposal procedures.

Data Security

Apatu employs a layered security framework to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures in place include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Apatu Platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted Password Storage: Passwords are never stored in plain text. We use bcrypt or equivalent adaptive hashing with unique salts per user.
• Two-Factor Authentication (2FA): Available to all account holders as an additional layer of account access security.
• Access Controls: Personal data is accessible only to authorised Apatu personnel on a strict need-to-know basis, governed by role-based access control policies.
• Segregated Data Storage: Player personal data and financial records are held in physically and logically segregated environments.
• Fraud Detection Systems: Automated monitoring systems detect and flag unusual account activity, login anomalies, and suspicious transaction patterns in real time.
• Regular Security Audits: The Platform and underlying infrastructure are subject to periodic penetration testing and security reviews by qualified third-party security professionals.

Your Rights as a Data Subject

As a Data Subject, you hold specific rights in relation to your personal data processed by Apatu. These rights are consistent with the protections afforded under Malaysia's PDPA and applicable international data protection principles. To exercise any of the rights described below, please contact Apatu's data team via the details in Section 14.

• Right of Access: You have the right to request a copy of the personal data Apatu holds about you, including information about how it is being processed.
• Right to Correction: You have the right to request correction of any inaccurate or incomplete personal data held in your account.
• Right to Withdraw Consent: Where Apatu relies on your consent as the basis for processing (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Object to Processing: You may object to the processing of your personal data for direct marketing purposes at any time, without needing to provide justification.
• Right to Data Portability: Where technically feasible and legally permissible, you may request that personal data you have provided to Apatu be transferred to you or to another organisation in a structured, commonly used format.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to Apatu's overriding legal obligations to retain data for regulatory and AML compliance purposes.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the relevant data protection authority if you believe your data has been processed unlawfully. In Malaysia, the relevant authority is the Department of Personal Data Protection (JPDP).

Apatu will respond to all data rights requests within 30 days of receipt. We may require identity verification before actioning any request to safeguard against unauthorised data access.

Protection of Minors

The Apatu Platform is strictly for persons aged 21 and above. We do not knowingly collect, process, or store personal data belonging to any individual under the age of 21.

Mandatory KYC identity verification is applied to all account holders prior to withdrawal authorisation. Any account found to belong to a person under 21 will be immediately suspended, all associated data reviewed, and any funds forfeited in accordance with Apatu's Terms and Conditions.

If you believe that a minor has accessed or registered with the Apatu Platform, please notify us immediately via the contact details in Section 14.

International Data Transfers

As an internationally licensed online gaming platform, Apatu's infrastructure and service providers may be located in jurisdictions outside Malaysia. Personal data processed in connection with your use of the Platform may therefore be transferred to, stored in, and processed in countries other than your country of residence.

Apatu ensures that all international transfers of personal data are subject to appropriate safeguards, including: contractual data processing agreements with third-party service providers imposing equivalent data protection standards; and transfers to jurisdictions with an adequate level of data protection as assessed by the applicable supervisory authority.

By using the Apatu Platform, you acknowledge and consent to the international transfer of your personal data in accordance with this Policy.

Policy Amendments

Apatu reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform operations. Material changes will be communicated to registered players via email or in-platform notification prior to taking effect.

The effective date of the most recent revision is displayed at the top of this page. We recommend that you review this Policy periodically. Your continued use of the Platform following the publication of any amendment constitutes acceptance of the revised Policy.

Contact Us

If you wish to exercise any of your data rights, have questions about this Privacy Policy, or wish to raise a data protection concern, please contact Apatu's Data Protection team through the following channels:

All correspondence will be handled in English. Our team also supports enquiries in Bahasa Melayu and Chinese upon request.