Privacy Policy

d2fun ("we", "us", "our", or "the Platform") is committed to protecting and respecting the privacy of all individuals who interact with our online gaming and sports betting services at https://d2fun.cam. This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

This Policy applies to all users of the d2fun Platform, including registered players accessing the site from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia, as well as any individual who visits the Platform without completing a registration.

By accessing d2fun, registering an account, or otherwise engaging with our services, you acknowledge that you have read, understood, and consented to the data practices described in this Policy. If you do not agree with any part of this Policy, you should cease using the Platform immediately.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

d2fun collects personal data in the categories described below. The specific data points collected depend on how you interact with the Platform and at what stage of the account lifecycle you are at.

3.1 Registration and Identity Data

When you create an account, we collect: full legal name, date of birth, nationality, residential address, email address, mobile phone number, and username. This data is required to establish your identity and verify your eligibility to use the Platform.

3.2 KYC and Verification Documents

To fulfil our anti-money laundering (AML) and age verification obligations, we collect copies of: government-issued identification (e.g., Malaysian MyKad, passport), proof of address (e.g., utility bill, bank statement), and payment method ownership documentation where required. All KYC documents are treated as sensitive data and subject to heightened security controls.

3.3 Financial and Transaction Data

We collect information relating to your deposits, withdrawals, wagers, and bonus activity, including: MYR transaction amounts, payment method identifiers (e.g., Touch 'n Go eWallet reference, Boost account reference, Maybank account last four digits, CIMB transfer reference), transaction timestamps, and balance history.

3.4 Gaming Activity Data

We record your gameplay behaviour, including: games played, bet amounts, win/loss outcomes, session duration, bonus usage, and responsible gambling tool activations (e.g., deposit limit changes, self-exclusion requests).

3.5 Technical and Device Data

We automatically collect: IP address, browser type and version, operating system, device type, screen resolution, referring URL, and session activity logs when you access the Platform.

3.6 Communications Data

Records of communications you initiate with d2fun, including live chat transcripts, email correspondence, and support ticket histories, are retained for quality assurance, training, and dispute resolution purposes.

d2fun collects personal data through the following primary channels:

• Direct provision: Information you actively provide during registration, KYC submission, support contact, or promotional participation.
• Automated technical collection: Data collected automatically by our platform infrastructure as you browse and interact with the site, including via server logs and session tracking systems.
• Cookies and similar technologies: Behavioural and preference data gathered via cookies, pixels, and local storage as described in Section 8 of this Policy.
• Payment providers: Confirmation data from Malaysian payment partners (including DuitNow, FPX, GrabPay, Boost, and bank transfer references from Maybank, CIMB, Public Bank, Hong Leong, and RHB) relayed to us upon completion of deposit and withdrawal transactions.
• Third-party fraud and identity verification services: Risk signals and identity verification outcomes provided by third-party AML compliance and KYC verification vendors.
• Publicly available sources: In limited circumstances, d2fun may supplement account information with data obtained from publicly accessible sources for fraud prevention and AML screening purposes.

The table below sets out the primary purposes for which d2fun processes your personal data:

d2fun processes your personal data on the following legal bases, as applicable to the specific processing activity:

• Performance of a contract: Processing that is necessary for the provision of our gaming and payment services to you as a registered account holder.
• Compliance with a legal obligation: Processing required by our international licensing conditions, anti-money laundering legislation, age verification mandates, and data retention requirements.
• Legitimate interests: Processing necessary for d2fun's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement, where these interests are not overridden by your fundamental rights.
• Consent: Where required and where no other legal basis applies, d2fun will seek your explicit consent before processing personal data — for example, for the sending of promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

d2fun does not sell, rent, or otherwise commercially trade your personal data with any third party. We share personal data with the categories of recipient described below, strictly as necessary and subject to appropriate data protection safeguards:

• Payment service providers: Your financial and identity data is shared with Malaysian payment partners — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners — to process deposits and withdrawals in MYR. These providers are bound by their own privacy frameworks and our data processing agreements.
• KYC and identity verification vendors: Identity documents and related data are transmitted to certified third-party KYC verification service providers for the purpose of age and identity confirmation. These vendors operate under strict confidentiality obligations.
• Fraud prevention and AML compliance services: Transaction data and risk indicators may be shared with specialist fraud and AML screening providers to fulfil our compliance obligations.
• Cloud infrastructure and technology providers: Platform data is hosted on secure cloud infrastructure subject to industry-standard security certifications. Infrastructure providers do not access personal data beyond what is technically incidental to service delivery.
• Game content providers: Certain game session data (e.g., bet amounts, game ID, session tokens) may be transmitted to our certified game studio partners solely for the purpose of game delivery and integrity verification.
• Regulatory and law enforcement authorities: d2fun may disclose personal data to competent authorities where required to do so by applicable law, court order, or valid regulatory demand. We will, to the extent permissible, notify affected players of such disclosures.

d2fun uses cookies and similar client-side storage technologies to operate the Platform effectively and to improve the player experience. The categories of cookies we deploy are as follows:

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences — such as language settings and responsible gambling tool configurations — across sessions.
• Analytics Cookies: Aggregate, anonymised usage data to help us understand how the Platform is used, identify performance issues, and prioritise feature improvements. Data collected via analytics cookies does not identify you individually.
• Security and Fraud Detection Cookies: Device fingerprinting and behavioural signals used to detect suspicious activity, multiple account creation, and bot-driven interactions.

d2fun does not deploy cross-site behavioural advertising cookies or share cookie data with advertising networks. You may manage cookie preferences through your browser settings; however, disabling essential cookies will impair Platform functionality.

d2fun implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. Our security framework includes:

• Encryption in transit: All data transmitted between your device and d2fun servers is protected by TLS 1.2 or higher (256-bit SSL encryption).
• Encryption at rest: Sensitive personal data — including identity documents and financial records — is encrypted in storage using industry-standard symmetric encryption.
• Access controls: Personal data access is restricted to authorised d2fun personnel on a strict need-to-know basis. Role-based access controls and multi-factor authentication are enforced for all internal systems.
• Regular security assessments: The Platform undergoes periodic penetration testing, vulnerability scanning, and independent security audits.
• Incident response: d2fun maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected players in accordance with applicable regulatory timeframes.

d2fun retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following applicable retention periods:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

Subject to applicable data protection law and our legal retention obligations, you hold the following rights in relation to your personal data held by d2fun:

To exercise any of the above rights, please contact our Data Privacy team at [email protected], quoting your registered account username. We will respond to verified requests within 30 calendar days. We may require identity verification before processing data subject access or deletion requests.

d2fun is an adults-only platform. Access to, and registration on, d2fun is strictly prohibited for individuals under 21 years of age. We do not knowingly collect personal data from individuals below this age threshold.

All registrations are subject to mandatory KYC verification to confirm that the account holder meets the minimum age requirement of 21 years. Where d2fun discovers that personal data has been collected from an individual under 21, the account will be immediately closed, all data securely deleted, and any balance held in the account will be handled in accordance with our responsible gambling and underage access procedures.

As an internationally licensed online gaming platform, d2fun may transfer personal data to servers and service providers located in jurisdictions outside Malaysia. Such transfers occur in the following circumstances:

• Hosting and cloud infrastructure services operating in secure international data centres.
• KYC and identity verification vendors operating across multiple jurisdictions.
• Game content providers delivering live dealer and slots content from international studio locations.

Where personal data is transferred internationally, d2fun ensures that appropriate safeguards are in place. These may include: contractual data processing agreements incorporating standard data protection clauses, transfers to jurisdictions recognised as providing adequate data protection, or binding corporate rules where applicable.

By using d2fun, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards described above.

d2fun reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. When material changes are made, we will:

• Update the "Last Updated" date at the top of this Policy.
• Where practicable, notify registered players of significant changes via email or in-platform notification prior to the effective date.
• Maintain the current version of this Policy at https://d2fun.cam/privacy-policy.

Your continued use of the Platform following publication of an amended Policy constitutes your acknowledgement of the changes. If you do not agree with material amendments to this Policy, you should discontinue your use of the Platform and contact support to request account closure.

We recommend reviewing this Policy periodically to remain informed of how your data is handled.

If you have any questions, concerns, or requests relating to this Privacy Policy, wish to exercise your data subject rights, or wish to report a suspected data protection issue, please contact the d2fun Data Privacy team through the channels below: