Privacy Policy

This Privacy Policy ("Policy") sets out the data processing practices of Ong24 ("we", "us", "our", "the Company", "the Platform") in relation to personal information collected from individuals who access or use the website located at https://ong24.cam and all associated services, features, tools, and content (collectively, the "Services").

Ong24 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. We recognise that members of our platform — predominantly Malaysian players accessing our online casino and sports betting services — entrust us with sensitive personal and financial information. This Policy explains in plain terms exactly how that information is handled throughout its lifecycle with us.

By registering an account, making a deposit, or otherwise accessing the Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein. If you do not agree to this Policy, you must not use the Services.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• Personal Data means any information relating to an identified or identifiable natural person ("Data Subject"), including but not limited to names, identification numbers, location data, online identifiers, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• Processing means any operation or set of operations performed upon Personal Data, whether by automated means or otherwise, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
• Data Controller means the entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, the Data Controller is Ong24.
• Data Processor means any natural or legal person, public authority, agency, or other body that processes Personal Data on behalf of the Data Controller.
• KYC Data means identity and address verification documentation submitted by Members as part of the Know Your Customer verification process, including but not limited to copies of identity documents, proof of address, and selfie verification images.
• Member means any individual who has registered an account with Ong24 and is therefore subject to both this Policy and the Terms & Conditions.
• Cookies means small text files placed on a user's device by a website for purposes of session management, analytics, personalisation, and security.
• Consent means any freely given, specific, informed, and unambiguous indication by the Data Subject by which they signify agreement to the processing of their Personal Data for one or more specific purposes.

Ong24 collects only the Personal Data that is necessary for the legitimate operation of our Services, compliance with applicable legal obligations, and the improvement of your experience on the Platform. We do not collect excessive or irrelevant data.

3.1 Registration Data

When you create an account, we collect: full legal name, date of birth, residential address, email address, phone number, username, and hashed password.

3.2 KYC and Identity Verification Data

As part of our mandatory KYC process, we collect: copies of government-issued identity documents (Malaysian MyKad, passport, or driver's licence), proof of address documents (utility bills, bank statements dated within 3 months), selfie verification images, and payment method verification screenshots.

3.3 Financial and Transaction Data

We collect records of all deposits, withdrawals, bonus claims, and transactions on your account. This includes payment method details sufficient to process transactions (e.g., bank account last four digits, e-wallet account reference), but we do not store full payment card numbers or full bank account numbers on our servers.

3.4 Gameplay and Betting Data

We collect records of all bets placed, games played, wagering amounts, game outcomes, session durations, and associated timestamps. This data is used for account integrity, dispute resolution, responsible gambling monitoring, and platform improvement.

3.5 Technical and Device Data

We automatically collect technical data when you access the Platform, including: IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, time spent on pages, and session data.

3.6 Communications Data

When you contact our customer support team via live chat or email, we retain records of those communications for quality assurance, training, and dispute resolution purposes. This includes the content of messages, timestamps, and any personal information shared within those communications.

Ong24 collects Personal Data through the following means:

• Direct provision by you: Information you voluntarily provide when registering, completing KYC verification, submitting support queries, or updating your account profile.
• Automated technical collection: Data collected automatically through cookies, server logs, and similar tracking technologies when you access or use the Platform.
• Transaction processing: Data generated as a result of deposits, withdrawals, or betting activity processed through the Platform.
• Third-party verification providers: Where we use third-party identity verification or fraud detection services to assist with KYC, we may receive verification outcomes and risk signals from those services. These providers act as Data Processors under our instruction.
• Payment processors: Limited transaction confirmation data received from Malaysian payment processors including FPX, DuitNow, and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay) to confirm successful payment events.

All processing of Personal Data by Ong24 is carried out on one or more of the following lawful bases:

• Contractual necessity: Processing required to provide the Services to you under our Terms & Conditions — including account management, payment processing, and withdrawal fulfilment.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, KYC requirements, and other legal obligations including reporting to regulatory authorities where mandated.
• Legitimate interests: Processing carried out for fraud detection, platform security, responsible gambling monitoring, and platform improvement, where such processing does not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications, optional analytics participation, and any other purpose for which we have explicitly obtained your informed consent. You may withdraw consent at any time by contacting us at [email protected].

Ong24 uses the Personal Data we collect for the following purposes:

6.1 Account Operations

To create and manage your Member account, process deposits and withdrawals, maintain accurate account records, and provide you with access to all Platform features including sports betting on EPL, Liga Super Malaysia, and UFC markets, live casino games, and slots.

6.2 Identity Verification & Compliance

To fulfil our KYC obligations, verify your identity and age (21+ requirement), comply with anti-money laundering regulations, and detect and prevent fraud or other unlawful activity on the Platform.

6.3 Customer Support

To respond to your enquiries, resolve disputes, investigate complaints, and provide assistance to Malaysian players accessing our 24/7 live chat and email support channels.

6.4 Responsible Gambling

To monitor gameplay patterns for indicators of problematic gambling behaviour, enforce self-imposed limits and exclusion requests, and proactively contact Members where we have genuine concern for their wellbeing.

6.5 Platform Security

To detect, investigate, and prevent unauthorised account access, multi-accounting, bonus abuse, bot activity, money laundering, and other security threats to the Platform and its Members.

6.6 Service Improvement

To analyse usage patterns, identify bugs and performance issues, test new features, and continuously improve the Platform experience for all Members.

6.7 Marketing Communications

Subject to your consent, to send promotional emails, bonus notifications, and personalised offers. You may opt out of marketing communications at any time by contacting [email protected] or using the unsubscribe function in any marketing email.

Ong24 does not sell, rent, or otherwise commercially exploit your Personal Data to any third party. We share data only in the following limited and controlled circumstances:

• Payment processors and financial institutions: Transaction data is shared with relevant payment processors (FPX, DuitNow, e-wallet providers including Touch 'n Go eWallet, Boost, GrabPay, and banking partners including Maybank, CIMB, Public Bank, Hong Leong) strictly to facilitate deposit and withdrawal processing.
• Identity verification providers: KYC data may be submitted to third-party identity verification providers who act as Data Processors under binding data processing agreements. These providers are contractually obligated to maintain the confidentiality and security of all data shared.
• Game software providers: Anonymised gameplay session data may be shared with our game studio partners for technical support and game performance monitoring purposes. No personally identifiable information is included in such transfers.
• Regulatory and law enforcement authorities: We will disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where we are legally required to do so, or where we believe disclosure is necessary to prevent fraud, money laundering, or other criminal activity.
• Professional advisers: We may share data with our legal advisers, auditors, and other professional service providers where necessary in connection with their services, subject to strict confidentiality obligations.

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following general retention periods apply:

Following expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where anonymised data is retained for analytical purposes, it can no longer be linked to any individual.

Ong24 implements a comprehensive suite of technical and organisational security measures to protect Personal Data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). HTTPS is enforced across the entire Platform.
• Encryption at rest: Sensitive data stored on our servers, including KYC documents and financial records, is encrypted at rest using AES-256 encryption.
• Access controls: Access to Personal Data is restricted on a strict need-to-know basis. Internal access is controlled through role-based permissions, multi-factor authentication, and regular access review audits.
• KYC document security: Identity verification documents are stored in isolated, access-controlled storage with comprehensive audit logging. Document access is limited exclusively to our compliance team.
• Vulnerability management: Our platform undergoes regular security assessments and penetration testing. Critical security patches are applied as a matter of priority.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Members without undue delay.

While we implement industry-standard security measures, no method of data transmission or storage is 100% secure. You are encouraged to use strong, unique passwords for your Ong24 account and to enable two-factor authentication where available.

The Ong24 Platform uses cookies and similar tracking technologies to operate core platform functionality, maintain your session, improve your experience, and collect analytics data to help us improve the Services.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential to the operation of the Platform. These enable basic functions such as account login sessions, security features, and navigation. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Enable the Platform to remember your preferences and settings, such as preferred language and display options, to provide a personalised experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform — including pages visited, time spent, and navigation paths — to help us improve performance and content.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised access attempts, and bot traffic, contributing to the overall security of the Platform and Member accounts.

10.2 Cookie Management

You may configure your browser settings to refuse some or all cookies, or to alert you when cookies are being set. Please note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Most browsers provide cookie management options in their Settings or Privacy menus.

As a Data Subject, you hold the following rights in relation to your Personal Data held by Ong24. These rights may be exercised by contacting us at [email protected]. We will respond to all valid requests within 30 days. Where a request is complex or high in volume, we may extend this period by a further 30 days, in which case we will notify you of the extension.

Please note that some rights are subject to limitations where we are required to retain data by law (for example, transaction records retained for AML compliance cannot be erased on request before the legally mandated retention period expires). We will inform you of any such limitations when processing your request.

Where you believe your data rights have not been respected, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

Ong24 provides gambling and entertainment services strictly to individuals aged 21 years and above. We do not knowingly collect, process, or retain the Personal Data of any individual under the age of 21.

We actively enforce age verification through our mandatory KYC process. Any account found to belong to an individual under 21 years of age will be immediately suspended, all data associated with that account will be deleted in accordance with applicable law, and any funds deposited will be returned to the source payment method following verification of ownership.

The Ong24 Platform may interact with certain third-party service providers as part of its operations. These third parties are engaged as Data Processors under binding contracts that require them to process Personal Data only in accordance with our documented instructions and to maintain appropriate security standards.

Key categories of third-party processors include:

• Payment processors: Malaysian payment infrastructure providers including FPX network operators, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and partnered banking institutions (Maybank, CIMB, Public Bank, Hong Leong). These processors receive only the data necessary to execute your requested transactions.
• Identity verification providers: Third-party KYC and identity verification platforms that assist in validating identity documents and age verification. These providers are contractually prohibited from using your data for any purpose other than providing verification services to Ong24.
• Cloud infrastructure providers: Secure cloud hosting and storage providers on whose infrastructure our Platform operates. All stored data is encrypted and access is contractually restricted.
• Customer communications platforms: Live chat and email support infrastructure providers. These platforms process communications data solely to facilitate support delivery.

Ong24 does not permit any third-party processor to use Member Personal Data for their own commercial purposes, to share it with other third parties, or to retain it beyond the period necessary for service delivery.

In the course of operating the Platform and engaging with third-party service providers, Personal Data may be transferred to and processed in countries other than Malaysia. Where such transfers occur, Ong24 ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that required in Malaysia.

Appropriate safeguards for international transfers include: transfer to jurisdictions with recognised adequate levels of data protection; use of binding contractual clauses in agreements with Data Processors in other jurisdictions; and internal data transfer policies that apply consistent standards regardless of the geographic location of processing.

If you have questions about the specific countries to which your data may be transferred, or the safeguards applicable to such transfers, please contact us at [email protected].

Ong24 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the Services we provide. Where changes are material — for example, changes to the categories of data collected or the purposes for which data is used — we will notify registered Members via email or in-platform notification at least seven (7) days before the changes take effect.

For minor or non-material amendments (for example, clarifications to existing provisions or corrections to typographical errors), the updated Policy will be posted on this page with a revised "Last Updated" date, and your continued use of the Services following the update will constitute acceptance of the revised Policy.

If you wish to exercise any of your data rights, submit a privacy complaint, request clarification on any aspect of this Policy, or report a suspected data security incident, please contact our Data Protection team using the details below. Our team is available 24 hours a day, 7 days a week including Malaysian public holidays.