RioStar Privacy Policy

Introduction

RioStar operates an online gaming and sports betting platform that is accessible to players in Malaysia and other supported locations. In the course of providing these services, RioStar collects and processes personal information about registered players, website visitors, and customer support contacts. This Privacy Policy describes what personal data is collected, why it is collected, how it is processed, with whom it may be shared, and the rights available to data subjects.

This policy is written in plain English to make it accessible to our players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout Malaysia, as well as users accessing from other countries. Where legal or technical terminology is required, it is explained in context.

Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, postal address, contact number, payment details, identity document references, device identifiers, and usage data. "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion. "Data Subject" means the individual whose personal data is processed — in most cases, the registered RioStar player. "Controller" means RioStar, as the entity that determines the purposes and means of processing. "Processor" means a third party that processes personal data on behalf of and under instruction from RioStar.

Personal Data We Collect

RioStar collects personal data through registration forms, KYC verification submissions, payment transactions, platform activity, customer support interactions, and technical device signals. The categories of data and their primary purposes are set out in the table below.

Legal Basis for Processing

RioStar processes personal data on the following legal grounds:

• Contractual necessity: Processing required to open an account, verify identity, process MYR deposits and withdrawals, settle wagers, and provide customer support under the RioStar Terms & Conditions.
• Legal obligation: Processing required to comply with anti-money laundering, counter-terrorism financing, and international gaming licensing requirements applicable to RioStar.
• Legitimate interests: Processing carried out to detect fraud, prevent prohibited conduct, maintain platform security, improve service quality, and conduct internal analysis, where these interests are not overridden by individual rights.
• Consent: Optional marketing communications, promotional profiling, and non-essential cookies, where you have provided clear and voluntary consent that may be withdrawn at any time.

How RioStar Uses Your Data

RioStar uses collected personal data for the following operational and compliance purposes:

• Creating, managing, and securing your RioStar account.
• Verifying your age and identity to enforce the 21+ player eligibility requirement.
• Processing deposits via Maybank2u, CIMB Clicks, Public Bank, Boost, Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and supported cryptocurrency channels.
• Settling withdrawals to verified payment methods registered in your name.
• Detecting and preventing fraud, money laundering, collusion, bonus abuse, and other prohibited conduct.
• Monitoring gameplay patterns to identify responsible gambling concerns and apply appropriate player protection measures.
• Responding to customer support enquiries, disputes, and complaints.
• Sending transactional communications about your account, including deposit confirmations, withdrawal updates, and security alerts.
• Sending promotional communications where you have provided consent or where a legitimate interest applies, and where you have not objected.
• Fulfilling obligations under applicable international licensing conditions and reporting requirements.

Data Sharing and Disclosure

RioStar does not sell personal data. Data may be disclosed to the following categories of recipients, strictly on a need-to-know basis and subject to binding confidentiality and data processing agreements:

• Payment processors and e-wallet providers: To execute deposits and withdrawals via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and other supported channels. These providers process data under their own licensed frameworks.
• Identity verification services: To conduct KYC checks, age verification, and document authentication as required under international licensing conditions.
• Fraud prevention and AML services: To screen transactions, verify sanctions compliance, and identify suspicious activity patterns.
• Game content providers and platform infrastructure suppliers: Service providers who operate under contractual data processing obligations and are not permitted to use RioStar player data for their own independent purposes.
• Licensing and regulatory bodies: Where disclosure is required by law, licensing conditions, or a lawful order from a competent authority.

Where data is transferred to a service provider located outside Malaysia or your country of access, RioStar takes steps to ensure adequate protections are in place, consistent with the applicable transfer mechanism required by relevant data protection frameworks.

Cookies and Tracking Technologies

RioStar uses cookies and similar technologies to operate the platform, maintain session state, prevent fraud, measure performance, and — where you have consented — personalise your experience and deliver relevant promotional communications.

• Essential cookies: Necessary for the platform to function. Login sessions, security tokens, and fraud-detection signals fall into this category. These cannot be disabled without preventing core functionality.
• Analytics cookies: Used to understand how players interact with RioStar, which pages are visited, and where errors occur. Data is aggregated and anonymised where practicable.
• Preference cookies: Remember your language settings, display preferences, and session configurations to improve consistency across visits.
• Marketing cookies: Used only where you have given consent to receive personalised promotional offers. You may withdraw consent at any time through your account settings or by contacting support.

Most modern browsers allow you to control cookie settings. Disabling non-essential cookies may affect the quality of your experience but will not prevent access to the core RioStar gaming platform.

Data Retention

RioStar retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal, licensing, regulatory, or audit requirements. General retention principles are as follows:

• Account records are retained for a minimum period required under the international licensing framework governing RioStar — typically five to seven years from account closure.
• Financial and payment transaction records are retained for the period required by applicable anti-money laundering and record-keeping obligations.
• Customer support communications are retained for a period sufficient to resolve disputes and fulfil quality assurance purposes.
• Marketing consent records are retained for as long as necessary to demonstrate consent and to honour withdrawal requests.

Upon expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual.

Your Data Rights

Depending on the legal framework applicable to your location, you may have the following rights in relation to your personal data held by RioStar:

• Right of access: To request a copy of the personal data RioStar holds about you.
• Right of rectification: To request correction of inaccurate or incomplete personal data.
• Right of erasure: To request deletion of personal data where it is no longer required for a legitimate purpose and no legal retention obligation applies.
• Right to restrict processing: To request that RioStar limits how your data is used in certain circumstances.
• Right to data portability: To receive your personal data in a structured, machine-readable format where processing is based on consent or contractual necessity.
• Right to object: To object to processing based on legitimate interests, including direct marketing. Such objections must be considered and resolved on the specific facts.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, contact RioStar support. Requests will be reviewed, and a substantive response will be provided within a reasonable period. Identity verification may be required before a request is processed.

Data Security

RioStar implements technical and organisational security measures commensurate with the sensitivity of the personal data processed. These include 256-bit TLS/SSL encryption for data in transit, access controls limiting internal data access to authorised personnel on a need-to-know basis, two-factor authentication for account access, regular security assessments, and incident response procedures.

No method of electronic transmission or storage is completely secure. Players must also take responsibility for protecting their own credentials, devices, and network connections. Any suspected unauthorised access to a RioStar account should be reported to support immediately.

Minors and Age Verification

RioStar is available only to individuals aged 21 and above. RioStar does not knowingly collect personal data from anyone under 21 years old. If RioStar becomes aware that a minor has registered an account or submitted personal data, that account will be closed, the data will be deleted, and any associated funds will be returned subject to verification and applicable terms.

Age verification is conducted through the KYC process. Providing false age information or identity documents during registration constitutes a material breach of the RioStar Terms & Conditions and may result in permanent account closure and forfeiture of balances in accordance with applicable rules.

Responsible Gambling and Data

RioStar processes gameplay and transaction data for the purpose of monitoring responsible gambling indicators, including unusual bet sizes, escalating deposit frequency, extended session duration, and patterns associated with problem gambling. This processing serves a protective purpose and is carried out in the interests of player welfare.

Self-exclusion requests, cooling-off periods, deposit limits, and responsible gambling tool activations are recorded and honoured. Where a self-exclusion is in place, RioStar retains sufficient data to enforce the exclusion and prevent circumvention. Players who need support are encouraged to visit the Responsible Gambling page.

Policy Amendments

RioStar may update this Privacy Policy to reflect changes in law, licensing requirements, business operations, or data processing practices. The effective date at the top of this document will be updated whenever a substantive change is made. Where a change materially affects your rights or the way your data is used, RioStar will provide notice through the platform or via your registered contact details where practicable. Continued use of RioStar after an update constitutes acceptance of the revised policy.

Contact Us

Questions, access requests, rectification requests, or complaints regarding this Privacy Policy and RioStar's personal data practices may be directed to our support team. Contact details are provided as plain text only in accordance with RioStar's communication policy.

Support email (plain text — not a clickable link): [email protected]

Live chat support on the RioStar platform is available around the clock and is the fastest channel for data-related enquiries. RioStar provides English-language support as the primary channel for Malaysian players, alongside Bahasa Melayu and Chinese assistance.