Privacy Policy

This Privacy Policy ("Policy") is issued by Posjitu ("Posjitu", "we", "us", "our") and governs the collection, storage, processing, and disclosure of personal data of all individuals ("Player", "User", "you") who access or use the Posjitu online gaming and sports betting platform at https://posjitu.cam.

Posjitu takes data protection seriously. We are committed to processing your personal data lawfully, fairly, and transparently — in accordance with applicable data protection legislation and our own internal data governance standards. This Policy sets out your rights and our obligations with respect to personal data collected through our website, mobile platform, live chat, and customer support channels.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By registering an account with Posjitu, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, date of birth, IP address, device identifiers, financial information, and betting activity.
• "Data Controller" means Posjitu, which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of Posjitu, under binding data processing agreements.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a specified purpose.
• "KYC Data" means identity verification documents and supporting information collected for Know Your Customer compliance purposes, including passport copies, national identity cards, and proof of address.
• "Cookies" means small text files placed on your device by the Posjitu platform to facilitate functionality, performance analysis, and personalisation.

Posjitu collects personal data through several channels: account registration, KYC verification, payment processing, platform usage, customer support interactions, and automatic technical data collection. The categories of data we collect are detailed below.

• Full legal name as per government-issued identification
• Date of birth (to verify minimum age requirement of 21 years)
• Email address and account username
• Residential address, including city and postcode (e.g., Kuala Lumpur, Petaling Jaya)
• Phone number (where provided)
• Nationality and country of residence

• Copies of government-issued photo identification (e.g., MyKad, passport)
• Proof of address documents (e.g., utility bills, bank statements)
• Source of funds documentation, where required for enhanced due diligence
• Selfie or liveness verification images, where applicable

• Payment method identifiers (e.g., masked e-wallet account references for Touch 'n Go, Boost, GrabPay; bank account last digits for Maybank, CIMB, Public Bank)
• Deposit and withdrawal transaction history in MYR
• Cryptocurrency wallet addresses (where USDT TRC20 is used)

• Betting and gaming history, including wager amounts, game types, and outcomes
• Login timestamps, session duration, and platform navigation patterns
• Bonus usage and promotional participation records
• Responsible gambling tool activations (e.g., deposit limits, self-exclusion requests)

• IP address and geolocation data at the time of access
• Device type, operating system, and browser type
• Cookie identifiers and session tokens
• Referral URL and marketing attribution data

• Live chat transcripts and email correspondence
• Complaint and dispute records
• Voluntary feedback and survey responses

Posjitu processes your personal data for the following clearly defined purposes. We do not process personal data for purposes incompatible with those stated below without providing prior notice and obtaining fresh consent where required.

Posjitu processes your personal data on one or more of the following legal bases, as referenced in the processing table above:

• Contract Performance: Processing is necessary to fulfil our contractual obligations to you — including account management, payment processing, and delivery of gaming services.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering legislation, KYC requirements, and age verification mandates.
• Legitimate Interests: Processing is necessary for purposes of fraud prevention, security monitoring, platform improvement, and responsible gambling enforcement — where these interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on consent — particularly for direct marketing communications — you have the right to withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

Posjitu does not sell your personal data. We may share personal data with the following categories of third parties, strictly as necessary and under appropriate data protection safeguards:

We share financial data with our payment processing partners — including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and participating Malaysian banks (Maybank, CIMB, Public Bank) — to the extent necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are contractually bound to process your data only for payment execution purposes.

KYC data may be shared with third-party identity verification service providers for the purpose of confirming your identity and age. These providers are bound by strict confidentiality obligations and process data only under our instruction.

We may disclose personal data to regulatory bodies, licensing authorities, financial intelligence units, or law enforcement agencies where we are legally required to do so — for example, pursuant to anti-money laundering reporting obligations or a valid court order.

We engage third-party providers for services including cloud hosting, cybersecurity monitoring, analytics, and customer support tooling. All such providers are engaged under binding data processing agreements that prohibit the use of your data for any purpose beyond delivering the contracted service to Posjitu.

Posjitu uses cookies and similar tracking technologies to enhance your experience, maintain session security, and understand how players interact with our platform.

• Strictly Necessary Cookies: Essential for the platform to function. They maintain your login session, remember your preferences, and protect the security of your account. These cannot be disabled without severely impairing your use of the site.
• Performance & Analytics Cookies: Help us understand how players navigate the platform, which features are used most, and where technical issues arise. Data is aggregated and anonymised where possible.
• Functional Cookies: Remember your language preference, display settings, and personalisation choices to deliver a more consistent experience across sessions.
• Marketing & Attribution Cookies: Track the source of your visit and may be used to assess the effectiveness of our promotional campaigns. These are only set with your consent.

Posjitu retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years following the closure of your account or the end of the business relationship, as required by applicable AML regulations.
• Transaction Records: Financial transaction data is retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping obligations.
• Support Communications: Customer support records are retained for three (3) years from the date of the final communication in a support interaction.
• Marketing Data: Where processing is based on consent, data used for marketing purposes will be deleted or anonymised within 12 months of consent withdrawal or the last meaningful interaction, whichever is later.
• Technical Logs: Server and access logs are retained for up to 12 months for security and forensic analysis purposes.

At the end of applicable retention periods, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to you as an identified individual.

Posjitu implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit Transport Layer Security (TLS) encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive personal and financial data stored in our databases.
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by qualified cybersecurity professionals.
• Multi-factor authentication requirements for all staff with access to player data systems.
• Ongoing security monitoring and intrusion detection across our infrastructure.
• Data breach response procedures, including notification protocols consistent with applicable regulatory requirements.

Notwithstanding the above, no digital transmission or storage system is entirely impervious to security threats. Posjitu cannot guarantee the absolute security of your data. You are responsible for maintaining the security of your own account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

Subject to applicable law and certain exceptions (including where processing is required for legal compliance or fraud prevention), you have the following rights in relation to your personal data held by Posjitu:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond to verified data access requests within 30 calendar days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor updates (such as changes to contact details) can be made directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that certain data must be retained to comply with our legal obligations and cannot be erased on request.
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict the processing of your personal data — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a structured, commonly used, machine-readable copy of your personal data.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for marketing purposes. You may also unsubscribe from marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

The Posjitu platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step during the account registration and KYC process.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe a minor has created an account on our platform, please contact us immediately at [email protected].

Posjitu operates internationally and may transfer your personal data to, and process it in, countries other than Malaysia — including the jurisdiction in which Posjitu holds its gaming licence and countries where our third-party service providers maintain infrastructure.

Where such transfers take place, Posjitu ensures that appropriate safeguards are in place to protect your personal data — including contractual data transfer agreements with receiving parties, adequacy assessments, and equivalent organisational security measures. We will not transfer your data to jurisdictions that do not offer adequate protections without implementing appropriate safeguards and notifying you where required.

Posjitu may update this Privacy Policy from time to time to reflect changes in our data practices, operational requirements, or applicable legal obligations. Any material changes to this Policy will be communicated to registered players via email notification and/or a prominent notice on the platform no less than 14 days prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the Posjitu platform following the effective date of any updated Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you may close your account as described in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Posjitu Data Protection team through the following channels:

• Live Chat: Available 24/7 directly from the platform in English, Bahasa Melayu, and Mandarin — average response time 3–5 minutes.
• Email: [email protected] — for data rights requests, privacy concerns, or any enquiry relating to this Policy.

Please include "Privacy Request" in the subject line of any email relating to data protection matters so that it reaches our compliance team promptly. We will acknowledge all privacy-related enquiries within 5 business days and aim to resolve them fully within 30 calendar days.