Does Waja Online share my information with advertising companies or unrelated third parties?

No. waja online does not sell, rent, or share member personal data with advertising companies, data brokers, or any third party unrelated to our platform's operations. Your data is only shared within the limited scope described in this privacy policy — namely, Malaysian local payment providers (Touch 'n Go, GrabPay, DuitNow, FPX, etc.) that require minimum information to process your transactions, and law enforcement authorities when there is a valid legal directive. All third-party service providers are bound by strict confidentiality agreements and are regularly audited for compliance.

How do I request a copy of my personal data held by waja online?

To request a copy of your personal data, send an email to privacy@wajaonline.net with the subject line "Data Access Request – [Your Account Number]". Include your full name and registered phone number for identity verification purposes. waja online will process your request within 30 business days and deliver the data in a readable format such as PDF or CSV. Your first request within any 12-month period is free of charge. As an added security measure, we may request OTP verification to your registered phone number before processing the request to confirm it genuinely comes from you.

Can I request that Waja Online delete all my data?

Yes, you may request the deletion of your personal data by contacting the waja online privacy team. However, please note that some data cannot be fully deleted, as waja online has legal retention obligations — for example, financial transaction records must be retained for 7 years under anti-money laundering regulations. Such data will be anonymised to the greatest extent possible but cannot be deleted entirely. waja online will provide you with a detailed breakdown of which data can be deleted immediately and which is subject to legal limitations in response to your request.

What does waja online do in the event of a data breach?

In the event of a security incident involving waja online member data, we have established incident response procedures in place. The first step is to identify and contain the incident to prevent further damage. waja online will then assess the scope of the incident to determine which members may be affected and what types of data are involved. Affected members will be notified within 72 hours via email and in-platform notification, with details on what occurred, what data may have been compromised, and the steps you should take to protect yourself. waja online will also report to the relevant authorities as required by law.

Does waja online use my betting data to send targeted advertisements?

waja online uses your in-platform activity data to offer more relevant promotions — for example, if you frequently bet on Malaysia Super League matches, we may prioritize sending you sports odds offers. However, this is done exclusively within the waja online platform and only where you have given consent to receive marketing communications. We do not use third-party advertising platforms such as Google Ads or social media to target you based on your betting activity outside of waja online. If you wish to opt out of all marketing communications, you can do so through your account settings or by contacting support.

waja online | Privacy Policy and Data Protection for Members

This privacy policy explains how waja online collects, uses, stores, and protects your personal data as a member of our platform. By registering for or using waja online services, you agree to this privacy policy. If you do not agree, please discontinue use of the platform and contact us to initiate the account deletion process.

Personal Data Collected by Waja Online

Waja online collects member personal data through two main channels — information you provide directly during registration and platform use, and data collected automatically through standard tracking technologies.

Data You Provide Directly

Registration Information: Full name, Malaysian phone number, email address, date of birth, and account password.
Identity Verification (KYC) Information: A copy of your identity card (MyKad), identity card number, and other supporting documents when required for account verification or withdrawals exceeding certain limits.
Payment Information: Registered payment method details include the phone number linked to your Touch 'n Go eWallet, GrabPay, Boost, or ShopeePay account, your bank account number for FPX (Maybank2u, CIMB Clicks), or your DuitNow number. waja online does not store full credit card numbers — all payment data is processed through verified third-party payment providers.
Support Communications: Records of live chat conversations, emails, and any information you share when contacting the waja online support team.

Automatically Collected Data

Platform Activity Data: Records of games played, bets placed (including sports markets such as Liga Super Malaysia, EPL, and BWF badminton), wager amounts, and game outcomes.
Device & Technical Data: IP address, device type, operating system, web browser type, screen resolution, and login session data.
Cookie Data: Session information, language preferences, login status, and platform usage analytics. See Section 6 for more details on cookies.

            Important Note: waja online does not collect biometric data, health data, or any other sensitive information unrelated to the operation of the betting platform. We practise privacy by design principles.
          

Purpose of Data Collection & Use

Waja online uses member personal data solely for legitimate purposes related to platform operations. We do not use your data for any purpose not stated in this privacy policy without first obtaining your explicit consent.

Purpose of Use	Types of Data Used	Legal Basis
Account management & verification	Name, email, phone number, KYC	Contractual necessity
MYR deposit & withdrawal processing	Payment details, transaction records	Contractual necessity
Age verification (18+)	Date of birth, KYC documents	Legal obligation
Fraud prevention & security	IP address, activity data, log records	Legitimate interest
Customer support	Communication records, account details	Contractual necessity
Marketing & promotions (with consent)	Email, phone number	Member consent
Platform improvement	Anonymised usage data	Legitimate interest

For marketing and promotional communications, waja online will only send promotional notifications to members who have given their consent during registration or through their account settings. You may withdraw your marketing consent at any time via account settings or by contacting waja online support.

Waja online does not use your betting activity data to build psychological profiles or exploit betting habits for commercial purposes. If our systems identify patterns that may indicate problem gambling, that data is used solely for member protection — not for marketing.

Data Sharing with Third Parties

Waja online does not sell members' personal data to any third party. However, in the course of operating the platform, waja online may need to share certain data with carefully selected service providers. All third-party providers are bound by strict confidentiality agreements and are only permitted to use the shared data for the specified purposes.

Categories of Third Parties That Receive Data

Local Payment Providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX providers receive only the minimum transaction data required to process payments in MYR. This data is not used by them for any other purpose.
Game Providers: slots and live casino software companies receive anonymized user identifiers for game operation purposes only. Your full name and payment details are not shared with game providers.
KYC Verification Provider: Third-party identity verification services used to verify member documents are bound by strict data processing agreements.
Legal Authorities: waja online will disclose required data to Malaysian legal authorities (such as PDRM or BNM) upon receipt of a valid legal order, or where necessary to prevent fraud, money laundering, or other criminal activity.

            International Data Transfers: Where any waja online service provider operates outside Malaysia, we ensure that data transfers are carried out with adequate protective measures in place, including standard data processing agreements that meet international data protection requirements.
          

Data Security – How Waja Online Protects Your Information

Waja online continually invests in security infrastructure to ensure members' data is protected to the highest standard. The following are the key security measures we have in place:

256-bit SSL Encryption: All communications between your device and waja online servers are encrypted using TLS 1.3 protocol with 256-bit encryption keys — the same security standard used by Malaysia's major banks.
Data Encryption at Rest: Personal data stored in the waja online database is also encrypted — meaning your data remains secure even in the event of unauthorized physical access to the servers.
Two-Factor Authentication (2FA): Members are encouraged to enable 2FA through their account settings. With 2FA active, logging in requires an OTP code sent to your registered phone number in addition to your password.
24/7 Monitoring: The waja online security team continuously monitors platform activity to identify and respond to security threats in real time.
Internal Access Controls: Only waja online staff who require data access for their specific roles are permitted to do so. All internal access to member data is logged and audited on a regular basis.
Regular Penetration Testing: waja online conducts regular security testing, including penetration testing by independent security experts, to identify and address vulnerabilities before they can be exploited.

While waja online takes all reasonable security measures, no online system can guarantee 100% absolute security. You are also responsible for keeping your account password safe and not sharing it with anyone. If you suspect your account has been compromised, contact waja online support immediately.

Your Rights as a Waja Online Member

As a waja online member, you have specific rights regarding your personal data. These rights can be exercised at any time by contacting our support team or reaching us at our privacy email.

Right of Access

You may request a copy of all personal data we hold about you, to be fulfilled within 30 days.

Right to Rectification

If your data is inaccurate or out of date, you may request a correction via your account settings or through support.

Right to Erasure

You may request the deletion of your personal data, subject to legal retention obligations.

Right to Object

You may object to the processing of your data for marketing purposes at any time without needing to provide a reason.

Right to Portability

You may request your data in a machine-readable format for transfer to another platform.

Right to Restrict Processing

Under certain circumstances, you may request that waja online temporarily restrict the processing of your data while an issue is being resolved.

            How to Exercise Your Rights: Submit a written request to privacy@wajaonline.net with the subject line "Data Rights Request – [Your Account Number]". waja online will verify your identity and process the request within 30 business days. No charge applies to your first request within any 12-month period. Repeated or manifestly unfounded requests may be subject to a reasonable administrative fee.
          

Please note that some data may not be fully deletable if it is tied to legal obligations — for example, financial transaction records that waja online is required to retain under anti-money laundering regulations. In such cases, we will inform you of which data cannot be deleted and the reason why.

Cookies, Tracking Technologies & Analytics

Waja online uses cookies and similar tracking technologies to enhance the user experience, ensure the platform functions correctly, and analyse usage patterns for improvement purposes. Cookies are small text files stored in your web browser when you visit the waja online platform.

Types of Cookies Used

Essential Cookies (Required): Required for core platform functions such as maintaining your login session, storing your betting slip balance, and securing transactions. These cookies cannot be disabled as they are critical to the operation of the waja online platform.
Preference Cookies: Saves your preferences such as your chosen language, preferred payment method, and game display settings — making your waja online experience more personalised and convenient.
Analytics Cookies: Aggregated, anonymised data is collected on how members use the waja online platform — including the most frequently visited pages, time spent in each section, and navigation paths. This information is used solely to improve the platform.
Security Cookies: Helps waja online's security systems detect suspicious activity, logins from unrecognised locations, and potential fraud attempts.

You can manage your cookie settings through your web browser preferences. Disabling essential cookies may affect the functionality of the waja online platform. For guidance on managing cookies in Chrome, Firefox, Safari, or Edge, please refer to the respective browser's support documentation.

Data Retention Period

Waja online retains members' personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. waja online's data retention schedule is as follows:

Data Category	Retention Period	Reason
Active account information	Throughout the active account period	Operational requirements
Financial transaction records	7 years after transaction	Legal obligation
KYC Documents	5 years after account closure	AML/KYC Compliance
Betting activity records	3 years after last activity	Fraud prevention
Support communication logs	2 years after the case is closed	Service references
Analytics cookie data	13 months	Industry-standard analytics
Security logs	12 months	Threat monitoring

Once the retention period expires, data will be securely deleted or anonymized so that it can no longer be linked to any specific individual. The deletion process uses methods that ensure data cannot be recovered.

            After Account Closure: When you close your waja online account, your personal data will be anonymized within 90 days, except for data that must be retained under applicable laws such as financial transaction records. You will not receive any marketing communications after your account has been closed.
          

Contact the waja online Privacy Team

For any enquiries, concerns, or requests relating to your privacy and personal data at waja online, you may reach us through the following channels:

            Privacy Email: privacy@wajaonline.net

            General Support Email: support@wajaonline.net

            Live Chat: Available 24/7 on the waja online platform

            Privacy Request Response Time: Within 30 business days from the date of receipt

When contacting us regarding privacy matters, please include your account number (if applicable) and the type of request you are making (data access, correction, deletion, objection, etc.). This helps our team process your request more efficiently and accurately.

Waja online is committed to responding to all privacy enquiries seriously and within the stipulated timeframe. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in Malaysia.

Privacy Policy Waja Online – Our Commitment to Protecting Your Data

waja online's Six Privacy Commitments to Members