VR7 Privacy Policy – Personal Data Protection for Malaysian Members

VR7 ("we", "our platform") operates a digital entertainment platform accessible at vr7.run. We understand that privacy is a matter of great importance to Malaysians, and we take this responsibility seriously.

This Privacy Policy has been drawn up in accordance with the requirements of Personal Data Protection Act 2010 (PDPA) Malaysia and international data protection best practices. This Policy applies to all personal information collected through the VR7 platform, including the website, mobile applications, and any related services.

Every time you use vr7 – whether to play slots, live baccarat, e-sports, or simply browse the site – you are entrusting us with some of your personal information. We do not take that trust lightly, and this Privacy Policy is our commitment to you on how we handle that responsibility.

Vr7 collects various types of personal data depending on how you interact with our platform. Below are the categories of data we may collect:

2.1 Data You Provide Directly

• Registration Information: Full name, Malaysian mobile number, email address, date of birth, and the username you chose when registering your VR7 account.
• Identity Verification (KYC) Information: A copy of your MyKad or other identity document, bank statement, or any supporting documents you submitted during the identity verification process.
• Financial Information: Your e-wallet account details (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) or bank account information used for deposits and withdrawals. Full card numbers are not stored in our systems.
• Communications: Records of conversations with our customer support team via live chat, email or Telegram, including any complaints or feedback you have submitted.

2.2 Automatically Collected Data

• Usage Data: Games played, total wagers, winnings and losses, session duration, and usage patterns on the VR7 platform.
• Technical Data: IP address, device type (Android/iOS), operating system version, web browser type, screen resolution, and unique device identifier.
• Approximate Location Data: State and region within Malaysia based on your IP address, for the purposes of service eligibility verification and fraud prevention.
• Cookie Data: Session data, your preference settings, and analytics data collected through cookies and similar tracking technologies. See Section 9 for more details.

VR7 uses the personal data collected for the following purposes, all of which are directly related to providing you with a better service:

• Service Provision: Managing your account, processing deposits via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay and FPX Maybank2u or CIMB Clicks, and handling winnings withdrawals quickly and securely.
• Identity Verification: Conducting KYC (Know Your Customer) processes to verify your identity, prevent fraud, prevent money laundering and comply with applicable Malaysian legal requirements.
• Account Security: To detect and prevent unauthorised access, fraudulent activity, multi-account use, and any suspicious behaviour that could compromise your security or the integrity of the vr7 platform.
• Service Communications: Sending important account-related notices such as deposit confirmations, withdrawal confirmations, security alerts and material updates to our terms. These communications are necessary and cannot be opted out of while your account remains active.
• Customer Support: Responding to enquiries, resolving complaints and providing technical assistance via live chat, email or Telegram.
• Personalising Your Experience: Recommending games you may enjoy based on your play history, displaying relevant promotions, and tailoring the platform interface to your preferences.
• Marketing Communications (with consent): Sending promotional information, bonus offers and the latest VR7 news via email or SMS, only where you have given your consent. You may withdraw this consent at any time through your account settings or by contacting support.
• Analytics & Improvement: Understanding how members use the VR7 platform to continuously improve its design, performance, and overall experience over time.
• Legal Compliance: To fulfil applicable legal and regulatory obligations, including the retention of financial records as required under Malaysian law.

In accordance with Malaysia's Personal Data Protection Act 2010 and internationally recognised data protection principles, VR7 processes your personal data on the following lawful bases:

• Consent: For data processing that is not strictly necessary for contractual purposes — such as marketing communications and personalised game recommendations — we rely on consent that you provide voluntarily at registration or at a later stage. This consent may be withdrawn at any time.
• Contract Performance: Data processing directly required to provide VR7 services to you — such as processing deposits, withdrawals, and account management — is based on the service contract between you and VR7.
• Legitimate Interest: In certain circumstances, we process data based on VR7's legitimate interests — such as fraud prevention, system security and usage analytics — provided those interests do not override your rights and interests as a member.
• Legal Obligation: Data processing required to comply with applicable Malaysian laws, including financial reporting requirements, anti-money laundering obligations, and KYC requirements as mandated by the relevant authorities.

VR7 does not sell members' personal data. However, in the course of operating our services, we may share your personal information with select third parties in the following limited circumstances:

• Payment Service Providers: To process your deposits and withdrawals, the necessary transaction information is shared with e-wallet and banking providers such as Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay and banks supporting FPX. These providers maintain their own privacy policies and are bound by stringent security requirements.
• Game Software Providers: Third-party game providers (such as slots and Live Casino providers) may receive session information required to run the games. This information is strictly limited to what is technically necessary.
• Identity Verification Services: Third-party KYC service providers who assist us in verifying member identities and meeting anti-money laundering requirements. All such providers are bound by strict confidentiality agreements.
• Statutory Authority: vr7 will disclose personal information where required by Malaysian law, court order, or a valid request from a law enforcement agency. We will endeavour to notify you of any such disclosure unless prohibited from doing so.
• Professional Advisor: Lawyers, accountants and other professional advisors providing advice to VR7 may need to access certain information within the scope of their engagement. All such advisors are bound by professional confidentiality obligations.

VR7 continually invests in security infrastructure to protect members' personal data against unauthorised access, disclosure, alteration, or destruction. The security measures we have in place include:

• Data Encryption in Transit: All data transmitted between your device and VR7's servers is encrypted using TLS 1.3 with 256-bit SSL encryption — the same industry standard used by Malaysia's leading financial institutions.
• Stored Data Encryption: Sensitive data such as financial information and identity documents are stored in encrypted form within our databases. Even in the event of a server breach, your data remains unreadable without the appropriate encryption key.
• Strict Access Controls: Only vr7 staff with specifically granted permissions based on their job responsibilities (the "principle of least privilege") may access member personal data. All access is logged and monitored.
• Two-Factor Authentication (2FA): vr7's internal systems require two-factor authentication for all staff access to sensitive data. Members are also encouraged to enable 2FA on their accounts for an additional layer of protection.
• 24/7 Security Monitoring: VR7's cybersecurity team continuously monitors its systems to detect suspicious activity, intrusion attempts and any anomalies that may indicate a security threat.
• Regular Penetration Testing: vr7 conducts regular security testing by independent experts to identify and address any system vulnerabilities before they can be exploited by malicious parties.

VR7 retains your personal data for as long as necessary to fulfil the original purpose of collection and to meet our legal obligations. The following are general guidelines on retention periods:

• Active Account Data: For as long as your vr7 account remains active, we retain all relevant personal data to provide you with uninterrupted service.
• Financial Records Data: Financial transaction records — deposits, withdrawals and betting history — are retained for a minimum of 7 years following account closure, as required under Malaysian financial and tax laws.
• KYC Documents: Identity verification documents (MyKad copy, bank statements) are retained for a minimum of 5 years after account closure to comply with anti-money laundering requirements.
• Communication Records: Customer support chat logs and complaint-related correspondence are retained for 3 years for reference and dispute resolution purposes.
• Cookie & Analytics Data: Anonymised usage and analytics data is retained for a maximum of 2 years for trend analysis and platform improvement purposes.

Once a retention period expires or data is no longer needed for any legitimate purpose, VR7 will delete or destroy that personal data in a secure and irreversible manner.

Under Malaysia's Personal Data Protection Act 2010 and applicable data protection principles, you have the following rights regarding your personal data held by vr7:

VR7 uses cookies and similar tracking technologies to enhance your experience on our platform. Below are the types of cookies we use and their purposes:

• Essential Cookies (Required): These cookies are required for the vr7 platform to function correctly – including login session cookies, security cookies, and cookies that store your basic settings. They cannot be disabled as they are core components of the platform's functionality.
• Performance & Analytics Cookies: We use analytical cookies to understand how members interact with the VR7 platform — which pages are visited most, time spent on the platform, and common navigation paths. This information is collected in aggregate and anonymised form for platform improvement purposes.
• Functional Cookies: These cookies store your preferences – such as your chosen language, frequently used betting limits, and display settings – to provide a more personalised experience when you return to the vr7 platform.
• Security Cookies: Used to detect suspicious login attempts, identify trusted devices, and protect your account from unauthorised access. These cookies are part of vr7's security system.

You can manage cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the vr7 platform and prevent you from logging in or using certain features.

The vr7 platform is a service designed exclusively for adults aged 18 years of age and above. We do not knowingly collect or process personal data of individuals under the age of 18.

Should we discover that personal data belonging to someone under the age of 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the associated account. Registration by underage individuals is a serious violation of VR7's Terms & Conditions.

If you have reason to believe that a minor has registered an account on vr7, please contact us immediately at support@vr7.run so that we can take the appropriate action.

Vr7 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable legal requirements, or new platform features introduced.

For material amendments — that is, changes that significantly alter the way we use or protect your personal data — VR7 will provide clear notice through:

• Email sent to the address registered on your account, at least 14 days before the amendment takes effect.
• A prominent notice on the VR7 platform the next time you log in.
• Updates the "Last updated" date at the top of this page.

For minor amendments that do not materially affect your privacy rights, we may update this policy without specific notice. We recommend reviewing this Privacy Policy periodically. Your continued use of the VR7 platform after any amendments are published will be considered your acceptance of the revised policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how VR7 handles your personal data, please contact our privacy team through the following channels:

• Privacy Email: support@vr7.run – use the subject line "Privacy Enquiry" to help us respond faster. We aim to reply to all privacy-related emails within 3 business days.
• Live Chat: Available 24/7 directly within the VR7 platform for general privacy enquiries. Average response time is under 2 minutes.
• Telegram: Reach a VR7 support agent via our official Telegram channel for faster, more interactive assistance.

For formal privacy complaints that cannot be resolved through the channels above, you also have the right to submit a complaint to Department of Personal Data Protection Malaysia which is the statutory authority overseeing compliance with PDPA 2010 in Malaysia.