Privacy Policy

This Privacy Policy ("Policy") sets out the basis on which indo350 ("we", "us", "our", "the Platform") collects, processes, stores, and shares personal data provided by or relating to players ("you", "your") who register or interact with our online casino, sports betting, and related gaming services accessible at https://indo350.cam.

indo350 is committed to handling your personal information responsibly and in a manner consistent with applicable data protection principles. This Policy is designed to give you a clear and honest picture of our data practices so that you can make informed decisions about your personal information.

By registering an account, depositing funds, placing wagers, or otherwise using the indo350 platform and its Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should refrain from using our Services and contact our support team to close your account.

This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy, which together constitute the full agreement governing your use of the indo350 platform.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers such as IP addresses and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, dissemination, erasure, or destruction.
• "Data Controller" means indo350, which determines the purposes and means of processing Personal Data relating to registered players.
• "Data Processor" means any third party that processes Personal Data on behalf of indo350 in accordance with our written instructions, such as payment processors and fraud detection providers.
• "KYC Data" means identity and age verification documentation submitted by players in connection with the Know Your Customer process, including but not limited to copies of national identity cards (MyKad), passports, and proof of payment method.
• "Sensitive Personal Data" means a subset of Personal Data that warrants heightened protection, including financial account details, identity document numbers, and data relating to health or personal circumstances disclosed in the context of a responsible gambling self-exclusion request.
• "Services" means the full range of online casino, sports betting, live dealer, lottery, and related gaming products offered by indo350 at https://indo350.cam.
• "Third Party" means any entity other than you and indo350.

We collect personal data from you in several categories, depending on how you interact with the indo350 platform. The following table summarises the categories of data we collect and the circumstances in which they are gathered:

We collect only the minimum data necessary for the stated purpose. We do not collect data that is excessive, irrelevant, or disproportionate to the Services we provide.

Personal data is collected through the following channels and mechanisms:

4.1 Direct Collection

• Registration forms — when you create an indo350 account;
• KYC submission forms — when you upload identity documentation;
• Payment forms — when you initiate a deposit or withdrawal using Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, or any other supported payment method;
• Customer support interactions — via live chat, email at [email protected], or WhatsApp;
• Account settings updates — when you modify your profile, communication preferences, or responsible gambling limits.

4.2 Automated Collection

• Cookies and similar tracking technologies, as further described in Section 10 of this Policy;
• Server logs that automatically record your IP address, browser type, pages accessed, and timestamps whenever you visit the indo350 platform;
• Fraud detection and security monitoring systems that analyse access patterns and transaction behaviour in real time.

4.3 Third-Party Sources

• Payment processors and banking partners (e.g., verification of DuitNow account holder name against your registered name);
• Identity verification service providers used to perform automated KYC checks;
• Fraud prevention databases and sanctions screening services.

Indo350 processes your personal data for the following specific and legitimate purposes only:

• Account Administration: Creating, maintaining, and managing your registered Account, including processing login authentication and account security measures.
• Service Delivery: Processing deposits, withdrawals, wager settlements, bonus credits, and all other transactional elements of the Services.
• Identity and Age Verification (KYC): Confirming that you are who you say you are, that you are at least 21 years of age, and that your payment methods are legitimately registered in your name.
• Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) regulations, counter-terrorism financing (CTF) requirements, and the terms of our operating licence, including mandatory record-keeping and suspicious activity reporting.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, multi-account abuse, bonus exploitation, and any other prohibited conduct under our Terms & Conditions.
• Responsible Gambling: Monitoring your gaming activity to identify patterns that may indicate problematic gambling behaviour, and facilitating your use of responsible gambling tools including deposit limits, session reminders, cool-off periods, and self-exclusion.
• Customer Support: Responding to your enquiries, resolving disputes, and providing assistance through our multilingual support team (English, Bahasa Melayu, Chinese).
• Platform Improvement: Analysing anonymised usage data and gameplay patterns to improve the functionality, performance, and user experience of the indo350 platform.
• Marketing Communications (where consented): Sending you information about promotions, bonuses, new game launches, and other offers relevant to your interests — only where you have provided explicit consent and only through channels you have opted into.

Our processing of your personal data is grounded in one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and indo350 — specifically, operating your Account, processing transactions, and delivering the Services you have requested.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/CTF obligations, KYC regulatory requirements, and lawful requests from competent regulatory authorities.
• Legitimate Interests: Processing carried out for indo350's legitimate business interests, including fraud prevention, platform security, and internal analytics, where those interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — most commonly in the context of optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Indo350 does not sell, rent, or commercially exploit your personal data. We may share your data with third parties only in the following circumstances and only to the extent necessary:

• Payment Service Providers: Malaysian banking partners and payment processors — including those facilitating transactions via DuitNow, FPX, Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, and Public Bank — receive the transactional data necessary to process your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and identity verification service providers process identity document data on our behalf under strict data processing agreements.
• Fraud Prevention Services: We share indicators of suspicious activity with fraud screening and sanctions checking services to protect the platform and its legitimate users.
• Game Studio Content Providers: Licensed international game studios that provide games to indo350 may receive anonymised or pseudonymised gameplay session data for technical performance purposes, but do not receive personally identifiable information.
• Regulatory Authorities: We are required by law to disclose certain information to regulatory, law enforcement, or taxation authorities upon receipt of a lawful request, court order, or under mandatory reporting obligations.
• Professional Advisers: Our legal counsel, auditors, and compliance consultants may access personal data where strictly necessary in the course of providing professional advice, subject to confidentiality obligations.

All third-party Data Processors are required to process personal data only in accordance with our documented instructions and are subject to contractual data protection obligations at least equivalent to those described in this Policy.

As an international online gaming platform, indo350 may transfer or store your personal data outside of Malaysia, including to jurisdictions where our servers, Data Processors, or licensed game studio partners are located. Such transfers may include regions across Southeast Asia, Europe, and other international jurisdictions.

Where personal data is transferred outside of Malaysia, indo350 will ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to that provided under this Policy, including:

• Contractual data protection clauses incorporated into agreements with overseas Data Processors;
• Transfer only to jurisdictions or organisations that maintain adequate data protection standards;
• Minimisation of transferred data to only what is strictly necessary for the stated purpose.

Indo350 retains personal data only for as long as is necessary for the purposes for which it was collected, subject to any applicable legal retention obligations. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

indo350 uses cookies and similar technologies to ensure the Platform functions correctly, to maintain session security, and to understand how players use our Services. A "cookie" is a small text file stored on your device when you visit a website.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to operate. These include session management cookies, login authentication tokens, and security cookies. You cannot opt out of these without affecting Platform functionality.
• Functional Cookies: Remember your preferences such as language selection, preferred login method, and responsible gambling settings. These improve your experience but are not essential.
• Analytics Cookies: Allow us to measure and analyse how players navigate and use the Platform, so we can identify areas for improvement. Data collected through analytics cookies is aggregated and anonymised wherever possible.
• Security Cookies: Used by our fraud detection systems to identify unusual access patterns and protect your Account from unauthorised activity.

Indo350 does not use third-party advertising cookies or tracking pixels for the purposes of delivering targeted advertising on external platforms. You can manage or delete cookies via your browser settings at any time. Please note that disabling certain cookies may affect your ability to use some features of the Platform.

As a registered player on indo350 and as an individual whose personal data we process, you hold the following rights with respect to your information. To exercise any of these rights, please contact our support team via live chat or at [email protected]:

• Right of Access: You have the right to request a copy of the personal data we hold about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to Rectification: You may request correction of any personal data we hold that is inaccurate, incomplete, or out of date.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected and where no legal obligation requires its retention. Please note that regulatory retention obligations (Section 9) may limit our ability to comply fully with deletion requests.
• Right to Restrict Processing: You may request that we restrict processing of your personal data in certain circumstances — for example, where you contest its accuracy or where you object to a particular processing activity.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You may also withdraw consent for marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

We will respond to verified data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and its reason within the initial 30-day period.

The indo350 Services are strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store personal data belonging to persons under the age of 21.

All registration attempts are subject to age verification. Where indo350 becomes aware that personal data belonging to a person under 21 has been collected — whether through KYC review, third-party flagging, or any other means — we will immediately suspend the associated Account, void any outstanding wagers, return any deposited funds to the source payment method, and permanently delete all personal data associated with that account.

If you believe that a person under the age of 21 has registered an account or submitted personal data to indo350, please contact us immediately at [email protected].

Indo350 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS 1.3 / 256-bit SSL encryption on all data in transit between your device and our servers;
• Encryption of sensitive data at rest, including identity document images and financial account references;
• Role-based access controls that restrict staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication required for all administrative access to production systems;
• Regular third-party penetration testing and vulnerability scanning of our platform infrastructure;
• Real-time intrusion detection and security monitoring systems;
• Formal data breach response procedures, including notification processes where a breach poses a risk to individual rights.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. We strongly encourage you to use a strong, unique password for your indo350 account and to enable two-factor authentication in your account security settings.

Indo350 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the scope of our Services. All amendments will be published on this page, with the "Last Updated" date at the top of the Policy revised accordingly.

Where a change is material — meaning it significantly affects how we collect or use your personal data, or the rights available to you — we will provide advance notice via email to the address registered on your Account, at least 14 days prior to the effective date of the change where practicable.

Your continued use of the indo350 platform following the publication or notification of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you should cease using the Services and contact our support team to close your account and request erasure of your personal data, subject to any mandatory retention obligations under applicable law.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data we hold about you, please contact our Data Privacy team through any of the following channels. All data rights requests and privacy enquiries receive priority handling by our compliance team.