Official Data Protection Document

Privacy Policy Phtaya – Our Commitment to Protecting Malaysian Players' Data

At Phtaya, your privacy is not merely a legal obligation — it is a core value we have upheld from day one. This document clearly and transparently explains how we collect, use, store, and protect your personal information.

Updated: 1 January 2026 256-bit SSL ISO 27001:2022
What Is Covered
Information We Collect
How we use your data
Sharing Information with Third Parties
Data security & encryption
Your rights as a data subject
Cookie & Tracking Policy
Contact our privacy officer
256-bit SSL
Full Encryption
ISO 27001
International standards
Zero Disclosure
Data Not Sold
PDPA 2010
Local compliance

Six Privacy Principles Phtaya

We don't just say it — these are real practices we carry out every day

Bank-Grade Data Encryption

All personal and financial data belonging to Phtaya players is encrypted using 256-bit SSL/TLS protocols — the same level of encryption used by leading Malaysian banks such as Maybank and CIMB.

Data Not Sold to Third Parties

Phtaya has never and will never sell, rent, or trade players' personal information to any third party for marketing or commercial purposes. Your data belongs to you.

Malaysia PDPA Compliance

Phtaya is fully compliant with Malaysia's Personal Data Protection Act 2010 (PDPA). All aspects of our data handling have been reviewed and approved in accordance with local legal requirements.

Secure Data Storage

Player data is stored on servers protected by multi-layered firewalls and monitored 24/7. Access to data is granted only to authorised personnel through a rigorous verification process.

Right to Data Erasure

Phtaya players have the right to request deletion of their personal data at any time. Deletion requests will be processed within 30 working days, subject to legal record-keeping requirements.

Immediate Breach Notification

In the event of any data security breach involving player information, Phtaya is committed to notifying affected players within 72 hours of the breach being identified.

1Introduction

Welcome to Phtaya's Privacy Policy page. This document outlines our commitment to protecting the privacy and personal data security of every player who uses the Phtaya platform at phtaya-khelo.com.

Phtaya takes privacy protection extremely seriously. Since the platform first launched in 2018, we have consistently invested in data security infrastructure and privacy policies that meet international standards. We understand that Malaysian players' trust in Phtaya depends largely on their confidence that their personal information is in safe and responsible hands.

This Privacy Policy applies to all information collected through the Phtaya platform, including the website, mobile application (where applicable), and all communication channels associated with Phtaya. By using the Phtaya platform, you agree to the information collection and usage practices described in this document.

Phtaya complies with Malaysia's Personal Data Protection Act 2010 (PDPA) and all related regulations in force in Malaysia. In the event of any conflict between this policy and local legal requirements, the legal requirements shall take precedence.

2Information We Collect

Phtaya only collects information that is strictly necessary to provide a safe, efficient, and responsible service to our players. We do not collect excessive or irrelevant data beyond what is required to operate the platform.

Data Category Type of Information Purpose of Collection
Personal Identity Full name, date of birth, ID card number, gender Identity VerificationKYC
Contact Information Email address, phone number, mailing address CommunicationsSecurity Notice
Financial Data Payment methods (TNG, GrabPay, DuitNow, FPX), transaction records Payment ProcessingAML
Technical Data IP address, device type, browser, access logs SecurityFraud Prevention
Gaming Data Betting records, game preferences, activity history Responsible GamingServices

We may also collect information you voluntarily provide when contacting Phtaya's customer support team, completing feedback forms, or participating in promotional campaigns. In all cases, we only request information that is necessary for the stated purpose.

3How Your Data Is Used

Phtaya uses the information collected for legitimate and necessary purposes in order to operate the platform safely and efficiently. We do not use your data for purposes unrelated to Phtaya's services without your consent.

  • Identity Verification (KYC): To ensure that all players meet the minimum age requirement and satisfy legal compliance obligations.
  • Transaction Processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, and to securely manage withdrawal requests.
  • Account Security: To detect and prevent unauthorised access, fraud, and any illegal activity that may involve player accounts.
  • Responsible Gaming: To monitor gameplay patterns and identify players who may need responsible gaming support.
  • Service Communications: To send important notices relating to your account, transactions, terms updates, and security alerts.
  • Service Improvement: To analyse platform usage on an aggregate basis (not individually) in order to improve the player experience.
  • Legal Compliance: To fulfil the reporting and record-keeping obligations prescribed by applicable Malaysian law.

Marketing: Phtaya may use your information to send you relevant promotional offers and bonuses. You can opt out of marketing communications at any time through your account settings or by contacting our support team. Your preferences will be fully respected.

4Sharing Information with Third Parties

Phtaya does not sell, rent, or disclose players' personal information to third parties for their own commercial purposes. However, there are limited circumstances where sharing information is necessary to operate the platform safely.

  • Payment Processors: Authorised payment service providers such as Touch 'n Go, GrabPay, Boost, and FPX partner banks receive the transaction information necessary to process your deposits and withdrawals.
  • Technical Service Providers: Selected hosting, cybersecurity, and technical infrastructure providers may have limited access to data for technical purposes only, subject to strict confidentiality agreements.
  • Legal Authorities: Phtaya will disclose information to the relevant authorities when required by law, court order, or in the context of a legitimate criminal investigation.
  • Regulatory Body: Information required for compliance purposes may be shared with the relevant regulatory authorities as mandated by law.

All third parties working with Phtaya are required to sign strict data protection agreements and comply with our privacy policy. They are only permitted to process Phtaya player data for specified purposes and may not use it for any other reason.

5Data Security

Phtaya implements comprehensive technical and organisational security measures to protect players' personal data against unauthorised access, loss, destruction, or inadvertent disclosure.

SSL/TLS 256-bitEncryption of all data in transit
2FATwo-factor authentication available
FirewallMulti-layered Protection
24/7 MonitoringReal-time threat detection system
Secure BackupRegular encrypted data backups
ISO 27001Security Management Certification

While Phtaya takes all reasonable precautions, no system is 100% secure. We therefore encourage players to take an active role in protecting their own accounts — use a strong password, enable 2FA, and never share your login credentials with anyone.

6Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by Phtaya:

Right of Access
You have the right to request a copy of all personal data we hold about you. Requests will be processed within 21 business days.
Right to Rectification
You may request corrections to any inaccurate or incomplete data. Updates will be made within 14 business days.
Right to Erasure
You may request the deletion of your personal data, subject to statutory record-keeping requirements.
Right to Restrict Processing
You may ask us to restrict the processing of your data under certain circumstances permitted by law.
Right to Object
You have the right to object to the processing of your data for direct marketing purposes at any time.
Right to Data Portability
You may request your data in a machine-readable format for transfer to another service provider.

To exercise any of the rights above, contact Phtaya's Data Protection Officer by email at privacy@phtaya-khelo.com. All requests will be acknowledged within 5 business days and resolved within the timeframe stipulated by law.

7Cookie Policy

The Phtaya platform uses cookies and similar tracking technologies to enhance the user experience, ensure security, and analyse platform usage. The following types of cookies are used:

You can manage your cookie settings through your internet browser at any time. Please note that disabling certain cookies may affect the functionality of some Phtaya platform features.

8Data Storage & Retention

Phtaya retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under applicable Malaysian law.

  • Active Account Records: Retained for the duration that your Phtaya account remains active.
  • Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysian financial regulatory requirements.
  • KYC / Identity Verification Records: Retained for 5 years after account closure.
  • Support Communication Logs: Retained for 3 years for reference and dispute resolution purposes.
  • Marketing Data: Deleted immediately upon withdrawal of your consent.

Once the retention period expires, data will be securely deleted in accordance with approved data disposal procedures. Data that is no longer required will not be kept beyond the designated period.

9Children's Privacy

The Phtaya platform is intended exclusively for individuals aged 21 and above. We do not knowingly collect or process the personal data of anyone under the age of 21.

Important: If we determine that a person under the age of 21 has registered an account on Phtaya, we will immediately close the account and delete all associated data. If you become aware that a child or underage individual has used our platform, please contact us immediately at privacy@phtaya-khelo.com.

10Third-Party Links

The Phtaya platform may contain links to third-party websites or services in certain contexts. Please note that Phtaya's Privacy Policy does not apply to those third-party websites or services.

Phtaya is not responsible for the privacy practices or content of third-party websites. We encourage players to read the privacy policy of every website they visit. Links to other websites are provided for convenience only and do not constitute an endorsement or recommendation by Phtaya.

11Changes to the Privacy Policy

Phtaya reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Players will be notified of any material changes through:

  • A prominent notice on the Phtaya platform homepage at least 14 days before the changes take effect.
  • A notification email will be sent to all registered members outlining the key changes made.
  • An update to the "Last Updated" date at the top of this document.

Your continued use of the Phtaya platform after notice of any privacy policy changes has been given will be deemed as your acceptance of the updated policy. We encourage you to review this page periodically.

12Contact Our Privacy Officer

If you have any questions, concerns, or wish to exercise any of your data protection rights, please contact Phtaya's Data Protection Officer (DPO) through the following channels:

Email
privacy@phtaya-khelo.com
Live Chat
Available 24/7 on the platform
Response Time
Within 5 business days

All privacy-related requests will be handled in strict confidence and within the timeframes prescribed by Malaysia's PDPA 2010. We take every privacy complaint seriously and are committed to resolving each one fairly and transparently.

Last Updated Date of this Privacy Policy: 1 January 2026. This version supersedes all previous versions of the Phtaya Privacy Policy. For further enquiries, please reach out to the Phtaya support team, available to assist you in Bahasa Melayu 24 hours a day.

Your Data Is Safe with Phtaya

Play with Peace of Mind at Phtaya — Your Privacy Is Guaranteed

Register today and enjoy over 1,000 games of your choice, with full assurance that your personal data is always protected by the highest security standards.

256-bit SSL PDPA Compliant Data Not Sold ISO 27001:2022
Bahasa Melayu