PHDream Privacy Policy

PHDream ("we", "us", "our", "the Company", "the Platform") is committed to protecting the privacy and personal data of every individual who accesses or uses our online casino and sports betting platform at https://phdream.cam ("the Website"). This Privacy Policy sets out, in clear and transparent terms, how PHDream collects, processes, stores, uses, and safeguards personal information in connection with the provision of our services to members across Malaysia and in other jurisdictions where our platform is accessible.

PHDream operates as a data controller in respect of the personal information you provide to us or that we collect in the course of delivering our services. As a data controller, we determine the purposes and means by which your personal data is processed, and we accept the corresponding legal obligations to handle that data responsibly.

This Privacy Policy should be read alongside PHDream's Terms & Conditions, which govern the broader contractual relationship between you and PHDream. Both documents together form the complete framework of your membership agreement with us.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, device identifiers, and behavioural data.
• "Processing" — any operation or set of operations performed on personal data, whether by automated means or otherwise, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. PHDream acts as the data controller for personal data collected through its platform.
• "Data Processor" — a third party that processes personal data on behalf of the data controller, strictly in accordance with the controller's instructions and this Privacy Policy.
• "Member" / "User" — any registered individual who holds an active account on the PHDream platform.
• "Cookies" — small text files placed on your device by the PHDream platform for session management, analytics, and personalisation purposes.
• "KYC" — Know Your Customer verification, the process of confirming a Member's identity through documentary evidence.
• "Sensitive Personal Data" — a subset of personal data warranting heightened protection, including government-issued identification numbers, financial account credentials, and health-related information where applicable.

PHDream collects only the personal data that is necessary and proportionate for the purposes described in this Policy. The categories of personal data we collect include:

PHDream does not collect or store complete payment card numbers. Financial data relating to bank and e-wallet transactions is processed through our certified payment partners and is subject to their own data protection obligations.

PHDream collects personal data through the following primary channels:

• Direct Submission: Information you voluntarily provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, participating in surveys, or claiming promotions.
• Automated Technical Collection: Technical and usage data collected automatically when you access the platform, including via cookies, web beacons, server logs, and analytics software. This data is collected whether or not you are logged into your account.
• Third-Party Payment Providers: Transaction confirmation data and payment reference identifiers shared by our integrated Malaysian payment partners (including FPX, DuitNow, Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, Hong Leong Bank, and GrabPay) in connection with deposit and withdrawal processing.
• Identity Verification Services: Data returned from third-party KYC and anti-money laundering (AML) verification service providers in connection with the processing of your identity documents.
• Public Sources: Where permitted by applicable law, publicly available information that assists in identity verification or fraud prevention, such as public records or sanctions screening databases.

PHDream processes your personal data for the following specific and legitimate purposes:

• Account Administration: To create, maintain, and manage your PHDream member account, including account verification, password management, and preference settings.
• Service Delivery: To provide access to the full range of PHDream products and services, including live casino games, slot titles, sports betting markets, and promotional offers.
• Payment Processing: To process deposits made via Malaysian payment channels (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT TRC20) and to facilitate withdrawal requests to verified accounts.
• Identity Verification and KYC Compliance: To verify your identity, age, and eligibility to use the platform in accordance with our Terms & Conditions and applicable regulatory obligations.
• Anti-Money Laundering (AML) and Fraud Prevention: To monitor transactions and player activity for signs of money laundering, fraud, bonus abuse, or other prohibited conduct, and to comply with applicable AML obligations.
• Responsible Gambling Monitoring: To monitor player behaviour patterns for indicators of problem gambling, to administer self-exclusion requests, and to enforce deposit limits and other responsible gambling tools set by Members.
• Customer Support: To respond to and resolve queries, complaints, and support requests submitted via live chat, email, or other supported channels.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Members who have not opted out of marketing communications. Marketing emails include a clear unsubscribe option.
• Platform Improvement: To analyse usage patterns, conduct A/B testing, and make data-driven improvements to the platform's functionality, user experience, and game offering.
• Legal Compliance: To comply with applicable legal obligations, respond to lawful requests from regulatory or law enforcement authorities, and enforce our Terms & Conditions.

PHDream processes your personal data on the following legal bases, as applicable to each specific processing activity:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the PHDream Terms & Conditions — including account creation, service delivery, payment processing, and withdrawal handling.
• Legal Obligation: Processing necessary for compliance with applicable laws and regulatory requirements, including KYC and AML verification obligations, responsible gambling requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out for PHDream's legitimate business interests, where those interests are not overridden by your privacy rights — including fraud prevention, platform security, business analytics, and product improvement. We conduct a legitimate interests assessment for each such processing activity.
• Consent: Processing based on your freely given, specific, and informed consent — principally in relation to marketing communications and the placement of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

PHDream does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited and lawful circumstances:

• Payment Service Providers: Your financial and transaction data is shared with our integrated payment partners — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and USDT TRC20 processing services — solely to the extent necessary to execute your requested transactions.
• KYC and AML Verification Partners: Your identity documents and personal information may be shared with certified third-party identity verification and AML screening providers for the purposes of compliance and fraud prevention.
• Game Content Providers: Aggregated or anonymised gameplay data may be shared with licensed game studio partners for the purpose of game performance reporting and technical issue resolution. No personally identifiable information is shared in this context unless strictly necessary.
• Technology and Infrastructure Partners: Service providers who operate PHDream's hosting infrastructure, cybersecurity systems, analytics platforms, and customer support tools may have access to personal data in the course of providing those services, strictly under data processing agreements.
• Regulatory and Law Enforcement Authorities: PHDream will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law or by binding legal process, including in connection with AML investigations.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of PHDream's business operations, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

PHDream retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. Our standard retention periods are as follows:

• Active Member Data: Retained for the duration of the active membership and for a minimum period of five (5) years following account closure, to comply with AML regulatory record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with applicable financial record-keeping obligations.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later.
• Customer Support Communications: Retained for a period of three (3) years from the date of the support interaction, for quality assurance and dispute resolution purposes.
• Marketing Preferences and Consent Records: Retained for the duration of the Member's active marketing subscription and for one (1) year thereafter, as evidence of consent.
• Technical and Usage Data: Typically anonymised or aggregated within thirteen (13) months of collection for analytics purposes; raw technical logs are retained for up to twelve (12) months for security and fraud investigation purposes.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in accordance with PHDream's data deletion procedures.

PHDream uses cookies and similar tracking technologies on the platform to support essential functionality, improve user experience, and analyse platform performance. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without disrupting core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, game display preferences, and last visited sections. These enhance your experience but are not strictly required for the platform to operate.
• Analytics Cookies: Used to collect aggregated and anonymised data about how Members use the platform — pages visited, time on site, click paths, and similar metrics — to inform platform improvements. Analytics cookies require your consent.
• Marketing Cookies: Used to track the effectiveness of marketing campaigns and to serve relevant promotional content to Members based on their platform activity. Marketing cookies require your consent and may be managed via the cookie preferences panel.

You may manage your cookie preferences at any time via the cookie settings option available on the PHDream platform. Please note that disabling certain cookie categories may affect the functionality of parts of the platform. Strictly necessary cookies cannot be disabled.

PHDream implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and the PHDream platform is encrypted using 256-bit SSL/TLS encryption. Sensitive data at rest, including KYC documentation and financial records, is stored with encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. PHDream staff with access to Member data are subject to confidentiality obligations and regular security training.
• Multi-Factor Authentication: PHDream offers two-factor authentication (2FA) for Member accounts and mandates it for internal staff systems handling personal data.
• Intrusion Detection and Monitoring: PHDream operates continuous security monitoring, intrusion detection systems, and regular penetration testing to identify and remediate potential vulnerabilities.
• Incident Response: PHDream maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to Members' rights, PHDream will notify affected individuals and relevant authorities within the timeframes required by applicable law.

As a Member of PHDream, you hold the following rights in relation to your personal data, subject to applicable legal conditions and exceptions:

• Right of Access: You have the right to request a copy of the personal data that PHDream holds about you, together with information about how it is being used and the legal basis for processing.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data held about you. You may update certain account information directly via the account settings panel; for other corrections, please contact our support team.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. Please note that PHDream is required to retain certain data for AML and legal compliance purposes, and deletion requests may not be fully honoured where such obligations apply.
• Right to Restriction of Processing: You may request that PHDream restrict the processing of your personal data in certain circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: You may request a copy of personal data you have provided to PHDream in a structured, commonly used, and machine-readable format, where processing is based on consent or contract.
• Right to Object: You have the right to object to processing of your personal data carried out on the basis of PHDream's legitimate interests. You may also opt out of direct marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact PHDream's data protection team at [email protected]. We will respond to all verified data rights requests within the timeframe required by applicable law. PHDream may need to verify your identity before processing a data rights request.

PHDream's platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. The collection of personal data from minors is strictly prohibited by PHDream's policies and applicable laws governing online gambling.

PHDream implements technical and procedural age verification measures during the registration process to prevent underage access. Any account found to belong to a person under the age of 21 will be immediately suspended, and any personal data associated with that account will be deleted upon confirmation of the age violation.

If you are a parent or guardian and believe that a person under your care has provided personal data to PHDream without your consent, please contact us immediately at [email protected] and we will take prompt action to investigate and, where confirmed, delete the relevant data.

PHDream's primary operations and data storage infrastructure serve the Malaysian market. However, the nature of online platform operations means that personal data may, in limited circumstances, be processed by service providers or infrastructure partners located outside Malaysia.

Where personal data is transferred outside Malaysia to third-party service providers, PHDream takes appropriate contractual and technical safeguards to ensure that such data continues to be processed in a manner consistent with this Privacy Policy and applicable data protection principles. These safeguards may include the use of standard contractual clauses, binding corporate rules, or transfers to jurisdictions that offer an adequate level of data protection.

PHDream will not transfer personal data to jurisdictions or entities that do not provide an adequate level of data protection without first obtaining appropriate safeguards or, where applicable, your explicit consent.

PHDream reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. Any material changes to this Policy — meaning changes that significantly affect the way we process your personal data or that affect your rights — will be communicated to Members by email and by displaying a prominent notice on the platform prior to the changes taking effect.

Non-material amendments, such as clarifications to existing provisions or corrections of typographical errors, may be made without prior notice, and the "Last Updated" date at the top of this document will be updated accordingly to indicate the revision date.

We encourage you to review this Privacy Policy periodically to stay informed about how PHDream protects your personal data. The current version of this Policy, as identified by the "Last Updated" date, governs all data processing activities from that date forward.

If you have any questions, concerns, or requests relating to this Privacy Policy or PHDream's handling of your personal data, please contact our data protection team through the following channels:

• Email: [email protected] — Please include "Privacy Request" in the subject line.
• Live Chat: Available 24 hours a day, 7 days a week, via the live chat feature on the PHDream platform.
• Support Hours: 24/7 on Malaysia Standard Time (UTC+8), including Malaysian public holidays.

PHDream aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within the timeframe required by applicable law. Where your request relates to the exercise of a data subject right, PHDream will respond within 30 calendar days, with the possibility of a single 30-day extension in cases of complexity or high volume.