yyrr Privacy Policy

1. Introduction

yyrr ("yyrr", "we", "us", "our") operates the website located at yyrr.casa and associated digital interfaces (collectively, the "Platform"). We are committed to processing personal data in a transparent, lawful and fair manner and to protecting the privacy of all users who access the Platform from Malaysia or elsewhere.

This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which that data is processed, the lawful bases on which processing rests, how long data is retained, how it may be shared, and the rights available to data subjects. By using the Platform, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside our Terms and Conditions, which govern the overall relationship between yyrr and its users. Where any conflict arises between this Policy and a separate written data-processing agreement, the terms of that agreement shall prevail.

2. Definitions

• "Account" means a registered user profile on the yyrr Platform.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, yyrr.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under written instruction.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed — in this context, you, the user.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure or destruction.
• "Sensitive Data" means personal data warranting heightened protection under applicable law, such as identity document numbers and financial account details.
• "Services" means the sports betting, casino gaming, payment and related services accessible through the Platform.

3. Data Controller

yyrr acts as the Data Controller in respect of personal data collected through the Platform. The controller is responsible for ensuring that processing activities comply with applicable data protection law and that appropriate safeguards are in place.

Where third-party Data Processors — such as payment service providers, KYC verification partners, analytics services and customer support platforms — process data on our behalf, they do so under contractual obligations that restrict processing to authorised purposes and require implementation of adequate security measures.

4. Data We Collect

4.1 Data You Provide Directly

When you register an Account, use the Services or contact us, you may provide:

• Full legal name and date of birth;
• Malaysian identity document details (MyKad number, passport or driving licence);
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya or Shah Alam);
• Contact email address and phone number;
• Payment method details (e-wallet identifiers, bank account reference — not full card or account numbers);
• Identity verification documents uploaded for KYC purposes;
• Communications with our support team.

4.2 Data Collected Automatically

When you access the Platform, we may automatically collect:

• IP address and approximate geolocation;
• Device type, operating system and browser version;
• Pages visited, session duration and click-path data;
• Game activity logs, bet placement records and wagering history;
• Deposit and withdrawal transaction metadata;
• Cookie identifiers and similar tracking data (see Section 10).

4.3 Data from Third Parties

We may receive supplementary personal data from authorised third-party sources such as identity verification providers, fraud-prevention services and payment partners, solely for the purposes outlined in this Policy.

5. Purposes of Processing

yyrr processes personal data for the following purposes:

6. Legal Basis for Processing

Processing of personal data by yyrr rests on one or more of the following lawful bases:

• Contractual necessity: Processing required to enter into or perform a contract with you, including Account registration, payment processing and game delivery.
• Legal obligation: Processing required to comply with applicable legal requirements, including anti-money-laundering regulations, age verification obligations and tax reporting duties.
• Legitimate interests: Processing necessary for the legitimate interests of yyrr, including fraud prevention, platform security, responsible gambling monitoring and service analytics, where those interests are not overridden by your rights and freedoms.
• Consent: Where processing rests on consent — for example, optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

7.1 Authorised Third-Party Processors

yyrr may share personal data with authorised Data Processors who assist in delivering the Services. These include payment service providers (such as operators of DuitNow, FPX, Boost, GrabPay and Touch 'n Go eWallet infrastructure, and banking partners including Maybank, CIMB, Public Bank, RHB and Hong Leong channels), identity verification providers, customer support platforms, IT hosting services and analytics providers. All processors operate under contractual data protection obligations.

7.2 Regulatory and Law Enforcement Authorities

yyrr may disclose personal data to a competent regulatory authority, government body, law enforcement agency or court where required or permitted by applicable law. Such disclosures will be limited to the data strictly necessary for the lawful purpose.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring or sale of assets, personal data held by yyrr may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations applying to the transferred data.

7.4 No Sale of Personal Data

yyrr does not sell, rent, exchange or otherwise transfer personal data to third parties for independent marketing or commercial purposes.

8. Retention Periods

yyrr retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account and identity data: Retained for the duration of the Account and for a minimum of five years after closure, to satisfy anti-money-laundering and regulatory obligations.
• Transaction records: Retained for a minimum of five years from the date of the transaction in accordance with financial record-keeping requirements.
• KYC documentation: Retained for the period required by the licensing jurisdiction's verification obligations, ordinarily not less than five years post-Account closure.
• Customer support records: Retained for up to three years from resolution of the relevant support interaction, unless a longer period is required by ongoing legal proceedings.
• Usage and analytics data: Typically retained in aggregated or anonymised form following a rolling period of up to twenty-four months.

Upon expiry of applicable retention periods, data is securely deleted or irreversibly anonymised.

9. Security Measures

yyrr implements technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• HTTPS encryption for all data in transit between user devices and the Platform;
• Encryption or hashing of sensitive account credentials at rest;
• Access controls limiting staff access to personal data on a need-to-know basis;
• Regular review of security procedures and incident response protocols;
• Contractual security obligations imposed on all authorised Data Processors.

While yyrr takes data security seriously, no digital transmission or storage system can be guaranteed to be completely secure. Users are encouraged to use strong, unique passwords, to keep login credentials confidential and to contact support immediately upon suspecting any unauthorised access to their Account.

10. Cookies and Similar Technologies

10.1 What Cookies Do

Cookies are small text files placed on your device when you visit the Platform. yyrr uses cookies and similar technologies for the following purposes: maintaining your authenticated session, storing your language and display preferences, supporting anti-fraud checks, and collecting aggregated usage statistics to improve the Platform experience.

10.2 Categories of Cookies

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled without impacting core features such as login, account access and payment flows.
• Functional cookies: Store your preferences (such as currency display in MYR) to personalise your session.
• Analytics cookies: Collect aggregate, anonymised data about how users navigate the Platform to enable service improvements.

10.3 Managing Cookies

Most browsers allow you to review, block or delete cookies through their settings menu. Blocking strictly necessary cookies will affect the functionality of the Platform. You can typically find cookie management options under your browser's Privacy or Security settings.

11. International Data Transfers

yyrr and its authorised Data Processors may store or process personal data in countries other than Malaysia. Where personal data is transferred outside of Malaysia to a jurisdiction that does not provide an equivalent level of data protection, yyrr will implement appropriate safeguards, such as standard contractual clauses or equivalent binding data transfer mechanisms, to ensure that your data receives a level of protection consistent with this Policy.

You may request further information about the specific safeguards in place for international transfers by contacting us as described in Section 15.

12. Your Rights as a Data Subject

Subject to applicable law and limited exceptions, you have the following rights in respect of your personal data held by yyrr:

• Right of access: Request a copy of the personal data yyrr holds about you and information about how it is processed.
• Right to rectification: Request correction of any personal data that is inaccurate or incomplete.
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to restriction: Request that processing of your personal data be temporarily restricted in certain circumstances, such as while a correction request is under review.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, request that your data be provided in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests where your particular circumstances warrant it.
• Right to withdraw consent: Where processing is based solely on consent, withdraw that consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us as described in Section 15. yyrr will acknowledge your request within 10 business days and provide a substantive response within 30 calendar days, or notify you if a longer period is required for complex requests.

13. Minors

The yyrr Platform is strictly intended for adults aged 21 and above. yyrr does not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been submitted by a minor, that data will be deleted and the associated Account closed without delay.

If you believe that a minor has provided personal data to yyrr, please contact us immediately using the details in Section 15 so that appropriate action can be taken.

14. Amendments to This Policy

yyrr reserves the right to update this Privacy Policy at any time to reflect changes in legal requirements, Platform functionality or processing activities. The effective date at the top of this page will be revised whenever material changes are made.

Where changes are significant, we will endeavour to notify registered users via on-platform notification or email prior to the changes taking effect. Continued use of the Platform following publication of an updated Policy constitutes your acknowledgement of the revised terms.

15. Contact Us

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data, please contact the yyrr Privacy team. Our website email address is displayed in the footer section of this page. Please include your registered Account username and a clear description of your enquiry so that we can respond efficiently.

Support communications are handled in English. We aim to acknowledge privacy-related queries within 10 business days and to resolve them within 30 calendar days. For general platform support or responsible-gambling enquiries, additional information is available through our other policy pages.