Privacy Policy irace – Your Personal Data Protection

Irace ("we", "our platform") takes user privacy protection very seriously. This Privacy Policy explains how irace collects, uses, stores, discloses and protects your personal information when you use our services through the website https://irace.pro or the irace mobile app.

By registering an account or using any irace service, you consent to the collection and use of your personal data as described in this Privacy Policy. Please read this document carefully before using our platform.

This Privacy Policy applies to all irace users in Malaysia and is to be read in conjunction with Terms and Conditions irace. Should any conflict arise between these documents regarding data protection, this Privacy Policy shall take precedence.

Irace collects various types of personal information depending on how you interact with our platform. Below is a summary of the data categories we collect:

Irace collects your personal data through various channels throughout your interactions with the platform:

• Account registration form — Information you provide when opening a new account.
• KYC Process — Identity documents and photos you upload for identity verification.
• Financial transactions — Payment information collected during deposits and withdrawals.
• Platform activity — Data automatically generated while you use the platform, including game logs and activity records.
• Support communications — Information you share when interacting with the irace customer support team.
• Cookies and similar technologies — Data collected via cookies, pixels, and server logs for analytics and user experience improvement purposes.
• Authorised third parties — In certain cases, payment service providers or identity verification providers may share data related to your transactions.

Your personal data is processed by irace for the following lawful purposes:

• Identity verification and compliance with KYC (Know Your Customer) requirements.
• Processing deposits, withdrawals, and other financial transactions.
• Management and maintenance of user accounts.
• Delivery of entertainment and gaming services.
• Prevention of fraud, money laundering, and illegal activities.
• Compliance with legal and regulatory obligations.
• Communications related to your account, transactions, and platform updates.
• Delivery of promotional offers and bonuses (with your consent).
• Analysis and improvement of user experience and platform performance.
• Customer support and complaint resolution.

Irace does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, in the course of providing our services, your data may be shared with the following parties under limited and controlled circumstances:

• Payment providers — FPX, DuitNow, Touch 'n Go, GrabPay, and other providers that process your financial transactions.
• KYC verification services — Third-party identity service providers that help us securely verify user documents.
• Cloud infrastructure providers — Cloud storage and computing providers that support the operation of the irace platform.
• Statutory authorities — If required by Malaysian law or by a valid court order.
• Analytics providers — Analytics services that help us understand platform usage (in anonymised or aggregated data form).

All third parties receiving irace user data are bound by strict data protection agreements and are audited regularly to ensure compliance with established privacy standards.

Irace implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, damage, or accidental disclosure:

• 256-bit SSL encryption for all data transmissions between users and servers.
• At-rest encryption for all sensitive data stored in databases.
• Role-based access control (RBAC) — only authorised staff can access user data.
• Round-the-clock security monitoring using real-time threat detection systems.
• Regular security audits by independent third parties at least twice a year.
• Automatic data backups to redundant locations to prevent data loss.
• Mandatory privacy awareness training for all irace staff.

Irace uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance, and maintain your login session. The types of cookies used include:

• Session cookies — Required to maintain your login session while using the platform.
• Preference cookies — Stores your preferences such as language and display settings.
• Analytics cookies — Collects information about how you use the platform to help us improve the user experience.
• Security cookies — Helps detect suspicious activity and protect your account.

You can manage cookie settings through your internet browser. However, disabling certain cookies may affect the functionality of the irace platform. Cookies required for security and session authentication cannot be disabled without affecting your ability to log in to your account.

Under Malaysia's PDPA 2010 and the irace privacy policy, you have the following rights regarding your personal data:

To exercise any of the rights above, please contact the irace support team via live chat or email. We will process your request within 14 working days. In more complex cases, this period may be extended to 30 working days, with prior notification to you.

Irace services are intended for individuals aged 18 and above only. irace does not knowingly collect or process personal data from minors. If we determine that a minor's data has been collected without proper age verification, that data will be deleted immediately and the associated account will be closed.

If you are a parent or guardian and become aware that your child has registered an irace account or provided us with personal data, please contact us immediately so that appropriate action can be taken.

In operating the irace platform, your personal data may be transferred to and processed in countries other than Malaysia — particularly in connection with our cloud infrastructure and technical service providers.

All cross-border data transfers are carried out with appropriate safeguards, including standard data transfer agreements and assessments of data protection adequacy in the destination country. irace ensures that all such data transfers comply with the requirements of Malaysia's PDPA 2010.

Irace retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by law. In general:

• Active account data — Retained for the duration your account remains active.
• Financial transaction records — Retained for a minimum of 7 years in accordance with anti-money laundering legal requirements.
• KYC Documents — Retained for a minimum of 5 years after account closure.
• Support communication logs — Retained for 2 years for service quality purposes.
• Closed account data — Minimum data is retained for the period prescribed by law, then deleted or anonymised.

Irace reserves the right to update or amend this Privacy Policy from time to time to reflect changes in business practices, legal requirements, or the technologies we use. When significant amendments are made, we will notify you via:

• In-app or on-site notifications from irace.
• Email sent to the registered email address on your account.
• Update the "Updated" date at the top of this document.

Your continued use of the irace platform after any amendments take effect will be considered your acceptance of the revised Privacy Policy. You are encouraged to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how irace handles your personal data, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat 24/7 within the irace platform — select the "Privacy & Data" category.
• Target response time: within 5 business days for privacy inquiries.

If you are not satisfied with our response, you have the right to file a complaint with the Personal Data Protection Commissioner of Malaysia.