Privacy Policy
How Nagabola Handles Your Data

Nagabola is committed to handling personal data responsibly and in accordance with internationally recognised data protection principles. We process personal data only for purposes that are clearly defined, lawfully grounded, and proportionate to our operational requirements as an online sports betting and live casino platform serving users primarily in Malaysia.

Nagabola is committed to handling personal data responsibly and in accordance with internationally recognised data protection principles. We process personal data only for purposes that are clearly defined, lawfully grounded, and proportionate to our operational requirements as an online sports betting and live casino platform serving users primarily in Malaysia.

This Policy applies to all personal data collected from the point of your first visit to the nagabola website, through account registration, ongoing platform use, and any correspondence you initiate with our support team. By creating an account, making a deposit, or continuing to use our platform, you acknowledge that you have read and understood this Policy.

The following terms shall have the meanings given below throughout this Policy:

Nagabola collects personal data across several categories, depending on your level of engagement with the platform. The following table provides a comprehensive overview of data collected and the context in which it arises:

Nagabola collects personal data through the following channels and methods:

• Direct submission — when you complete registration forms, submit KYC documents, contact support, or complete deposit and withdrawal requests, you provide personal data directly to us.
• Automated technical collection — when you access or browse the nagabola platform, our servers and analytics systems automatically collect technical and usage data including your IP address, session data, device type, and interaction logs. This occurs regardless of whether you are logged in.
• Cookie and tracking technologies — nagabola uses cookies and similar technologies on the platform. Full details are set out in Section 10 of this Policy.
• Third-party verification providers — during the KYC process, we may engage licensed identity verification services to cross-check documents you provide against official government records. These providers act as data processors under contract with nagabola.
• Payment processors — when you initiate a deposit or withdrawal, data relating to the transaction is processed by the relevant payment service provider (for example, Touch 'n Go eWallet, DuitNow, FPX-connected banks, or Boost). We receive confirmation data and reference numbers from these processors.

Nagabola processes personal data for the following clearly defined purposes:

• Account creation and management — to establish, maintain, and administer your nagabola account, including authentication and session management.
• Age and identity verification — to enforce the mandatory21+ age requirement and prevent underage gambling, and to comply with KYC and anti-money laundering obligations.
• Transaction processing — to facilitate deposits and withdrawals via local Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank transfer.
• Platform operation and improvement — to monitor platform performance, diagnose technical issues, conduct A/B testing, and improve user experience based on aggregated usage analysis.
• Customer support — to respond to and resolve queries, complaints, and disputes submitted by Members through live chat, email, or WhatsApp in English, Bahasa Melayu, or Chinese.
• Regulatory compliance — to meet legal obligations under anti-money laundering regulations, responsible gambling requirements, and the directives of nagabola's licensing jurisdiction.
• Responsible gambling management — to administer self-exclusion requests, deposit limit settings, and other responsible gambling tools activated by Members.
• Fraud prevention and security — to detect, investigate, and prevent fraudulent account activity, multi-accounting, money laundering, and unauthorised access.
• Marketing communications — with your consent, to send promotional offers, bonus notifications, and platform updates relevant to your account. You may withdraw consent to marketing communications at any time.

All personal data processing conducted by nagabola is grounded in one or more of the following lawful bases:

• Contractual necessity — processing required to perform our contract with you as a registered Member, including account management, transaction processing, and dispute resolution.
• Legal obligation — processing required to comply with anti-money laundering legislation, licensing conditions, age verification requirements, and other applicable legal obligations.
• Legitimate interests — processing conducted for fraud prevention, platform security, system performance monitoring, and internal analytics, where these interests are not overridden by your privacy rights.
• Consent — processing for marketing and promotional communications, and certain non-essential cookie placement, where you have provided clear, specific, and revocable consent.

Nagabola does not sell your personal data to third parties. We may share personal data with the following categories of recipients under strictly controlled circumstances:

• Payment service providers — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow operators, FPX-connected banking institutions (Maybank, CIMB, Public Bank, Hong Leong, RHB), and wire transfer processors — for the sole purpose of processing deposits and withdrawals you initiate.
• KYC and identity verification providers — licensed third-party verification services engaged to validate identity documents submitted by Members as part of the KYC process.
• Game studio technology providers — platform operators and game engine providers who power the casino and betting products available on nagabola. These parties may process limited usage and session data in the course of delivering their services.
• IT infrastructure and hosting providers — cloud hosting and data centre operators who store platform data in secure, contractually governed environments.
• Regulatory and law enforcement authorities — where nagabola is legally obligated ordered by a competent authority to disclose personal data, we will comply with such requirements and will, where permitted, notify the affected Member.
• Fraud prevention and security services — third-party fraud detection and risk management tools that assist in identifying suspicious account behaviour and transaction anomalies.

All third-party data processors engaged by nagabola are required to maintain appropriate technical and organisational data security measures and to process personal data only for the purposes specified in their data processing agreements with us.

Nagabola retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law or our licensing obligations. The following retention periods apply as general guidelines:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle procedures. Anonymised, aggregated data (which cannot be used to identify you) may be retained indefinitely for statistical and analytical purposes.

As a data subject, you have the following rights in relation to your personal data processed by nagabola. These rights are described in Section 2 of this page (User Rights at a Glance) and are elaborated upon below:

• Right of Access (Data Subject Access Request): You may request a copy of all personal data nagabola holds about you, together with information about how it is processed. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: If you believe any personal data we hold is inaccurate or incomplete, you may request correction. Where we are satisfied the correction is appropriate, we will update the data promptly.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where you object to processing and no overiding legitimate grounds exist. Please note that erasure requests may be limited where retention is required by law — for example, financial and KYC records subject to anti-money laundering legislation.
• Right to Restrict Processing: In certain circumstances, you may request that we limit processing of your data — for example, where you contest its accuracy pending verification, or where you have objected to processing pending our assessment of legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including direct marketing. Where we process data for direct marketing, we will honour objection requests without requiring justification.
• Right to Withdraw Consent: Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, please contact our Data Privacy team via email at [email protected] (plain text — not a clickable link) with the subject line "Data Rights Request". We will verify your identity before processing any request and will respond within 30 calendar days. We do not charge a fee for standard requests.

Nagabola uses cookies and similar tracking technologies on our platform to ensure proper functionality, enhance your user experience, and support internal analytics. A "cookie" is a small data file placed on your device when you visit a website.

We use the following categories of cookies:

• Strictly necessary cookies — essential for the platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing your ability to use the platform.
• Functional cookies — used to remember your preferences such as language settings, login status, and display configurations. These enhance your experience without tracking you across other sites.
• Analytics cookies — used to collect aggregated, anonymised data about how visitors use the platform, including page views, session duration, and navigation paths. This information is used to improve platform design and performance. We do not share raw analytics data with third parties.
• Marketing cookies (with consent) — where you have provided consent, these cookies may be used to deliver promotional messaging relevant to your betting and gaming interests. You may withdraw this consent at any time via your account settings or by contacting support.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional cookies may affect certain features of the nagabola platform.

Nagabola implements a multi-layered security framework to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encrypted storage of sensitive personal and financial data at rest
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis
• Two-factor authentication available to all Members for account login security
• Regular penetration testing and vulnerability assessments by independent security specialists
• Automated anomaly detection systems monitoring for unusual account or transaction behaviour
• Staff training on data protection obligations and incident response procedures

In the event of a personal data breach that poses a risk to your rights and freedoms, nagabola will notify affected Members and, where legally required, the relevant supervisory authority within the timeframes prescribed by applicable law.

Nagabola is a gambling platform strictly intended for individuals aged21 years and above. We do not knowingly collect, process, or store personal data belonging to persons under the age of 21. If we become aware that personal data has been collected from an individual below this age threshold, we will immediately close the associated account, delete all related data, and return any deposited funds where practicable.

If you are a parent or guardian and you believe your child has accessed or registered on the nagabola platform, please contact us immediately at [email protected] so that we can take prompt remedial action.

As an internationally licensed platform, nagabola may transfer personal data to and process it in countries outside Malaysia, including the jurisdiction in which our licensing authority is located, and the territories where our technology infrastructure partners and game studio providers operate.

Where personal data is transferred internationally, nagabola ensures that appropriate safeguards are in place in accordance with applicable data protection standards. These safeguards may include contractual data processing agreements, standard contractual clauses, or transfers to jurisdictions recognised as providing an adequate level of data protection.

Malaysian users should note that data protection legislation in Malaysia (the Personal Data Protection Act 2010— PDPA) may apply to the extent that nagabola processes personal data of Malaysian residents in connection with commercial transactions. Nagabola takes reasonable steps to handle Malaysian user data in a manner consistent with PDPA principles, though this platform is not regulated by the Personal Data Protection Commissioner of Malaysia.

Nagabola reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform operations. Where changes are material — meaning they affect the nature of data we collect, the purposes for which we use it, or the rights available to you — we will provide advance notice via email to your registered address or through a prominent in-platform notification, less than 14 days before the changes take effect.

Minor updates — including typographical corrections or clarification of existing provisions — may take effect immediately and will be reflected in the "last updated" date at the top of this page. We encourage you to review this Policy periodically to stay informed of how your data is handled.

Your continued use of the nagabola platform after any update to this Policy constitutes acceptance of the revised version. If you do not accept the changes, you should cease use of the platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your personal data, please contact nagabola through the following channels:

• Email: [email protected] — please include "Privacy Policy Enquiry" or "Data Rights Request" in your subject line (plain text — not a clickable link)
• Live Chat: Available24/7 through the nagabola platform interface — average response time 3–5 minutes
• Languages: Support is available in English, Bahasa Melayu, and Chinese

We will respond to all privacy-related enquiries within 30 calendar days of receipt. For complex requests — such as comprehensive data subject access requests — we may require up to an additional 30 days, in which case we will notify you of the extension within the initial 30-day window.

For concerns specifically relating to responsible gambling, self-exclusion requests, or underage gambling reports, please refer to our Responsible Gambling page for dedicated contact information and external support resources.