Privacy Policy

This Privacy Policy ("Policy") is issued by ruay ("we", "us", "our", or "the Platform"), the operator of the online casino and sports betting platform accessible at ruay.cam. This Policy applies to all personal data collected from individuals ("you", "the User", "the Player") who access, register on, or otherwise interact with the ruay platform, including all associated services, features, and functionality.

Ruay operates as a data controller in respect of the personal data you provide to us or that we collect about you through your use of the Platform. We take our data protection obligations seriously and are committed to handling your personal data with care, transparency, and in compliance with all applicable privacy and data protection laws.

By registering an account on ruay, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. Ruay is the Data Controller in respect of data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller pursuant to a contractual arrangement.
• "KYC" means Know Your Customer — the identity and age verification process mandatory for all ruay account holders prior to their first withdrawal.
• "Cookies" means small text files placed on your device by the Platform to collect standard internet log information and visitor behaviour information.
• "Third-Party Services" means external service providers engaged by ruay for specific operational functions, including payment processors, identity verification providers, fraud detection systems, and analytics platforms.

Ruay collects Personal Data from you through a variety of means: directly from information you provide during registration and account management, automatically through your use of the Platform, and from third parties involved in identity verification and payment processing. The categories of data we collect include the following:

Registration & Identity Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification — players must be 21 or above)
• Email address and mobile phone number
• Residential address, including postcode and state within Malaysia
• Government-issued identification number (Malaysian IC / MyKad number or passport number)
• Copy of government-issued identity document and, where required, a selfie or proof-of-address document submitted for KYC purposes

Financial & Transaction Data

• Payment method details (e-wallet account identifiers, bank account numbers associated with DuitNow or FPX transfers, cryptocurrency wallet addresses)
• Transaction history including deposit amounts, withdrawal requests, and processed payouts in MYR or cryptocurrency equivalent
• Bonus redemption history and wagering activity

Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session data including login timestamps, pages visited, games played, and time spent on the Platform
• Clickstream and interaction data collected via cookies and similar technologies

Communications Data

• Records of correspondence with our support team via live chat, email, or any other communication channel
• Feedback, complaints, and dispute records

Ruay processes your Personal Data for the following purposes:

Ruay processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our obligations under the account agreement between ruay and you — including account creation, payment processing, and the delivery of gambling services.
• Legal Obligation: Processing required to comply with applicable law, including AML/CTF regulations, KYC requirements imposed by our licensing authority, and any lawful order from a competent regulatory or law enforcement authority.
• Legitimate Interests: Processing undertaken for our legitimate business interests — including fraud detection, platform security, abuse prevention, and improving our services — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing undertaken on the basis of your freely given, specific, and informed consent — primarily in the context of direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

Ruay does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your Personal Data only in the following limited and clearly defined circumstances:

Payment Service Providers

We share transaction-related data with payment processors and financial institutions to facilitate deposits and withdrawals. This includes providers supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and Malaysian bank transfers (Maybank, CIMB, Public Bank, RHB, Hong Leong), as well as cryptocurrency processing partners for BTC, ETH, USDT, and LTC transactions. These processors act as Data Processors under contractual arrangements that require them to maintain equivalent data protection standards.

Identity Verification Providers

We engage third-party KYC and identity verification service providers to assist in verifying the identity, age, and eligibility of account holders. Data shared for this purpose is limited to what is strictly necessary for the verification process.

Fraud Prevention & Compliance

We may share Personal Data with fraud detection agencies, anti-money laundering databases, and regulatory or law enforcement authorities where we are required to do so by law or by our licensing obligations, or where we have a genuine suspicion of fraudulent, criminal, or harmful activity.

Service Providers & Technology Partners

We engage third-party service providers for hosting, analytics, customer support infrastructure, and communications technology. All such providers are engaged under data processing agreements that restrict their use of your data to the specific services they provide to ruay.

Ruay uses cookies and similar tracking technologies to operate and improve the Platform, analyse usage patterns, maintain session integrity, and deliver a consistent experience across visits. The categories of cookies used on the ruay platform are as follows:

• Strictly Necessary Cookies: Essential for the operation of the Platform. These cookies enable core functions such as account login session management, security checks, and load balancing. They cannot be disabled without significantly impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences — such as preferred payment method, language settings, and game display options — to improve your user experience across visits.
• Analytical Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform, including which pages are visited most frequently and how long users spend on each section. This data is used solely to improve platform performance.
• Session Cookies: Temporary cookies that expire when you close your browser. These are used to maintain your login session and track in-game activity during a single browsing session.

You may adjust your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. Ruay does not use third-party advertising cookies or cross-site tracking technologies that would expose your browsing behaviour to external advertisers.

Ruay retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal and regulatory obligations. The following general retention principles apply:

• Account Data: Retained for the duration of your active account relationship with ruay, and for a minimum period of five (5) years following account closure, in accordance with standard AML and licensing record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, or for such longer period as required by applicable law or regulatory direction.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, consistent with financial record-keeping obligations.
• Support Communications: Retained for a period of three (3) years from the date of the last communication, or for the duration of any unresolved dispute.
• Marketing Consent Records: Retained for as long as you remain opted in, and for a period of three (3) years following withdrawal of consent, to demonstrate compliance.

Upon expiry of the applicable retention period, your Personal Data will be securely deleted or anonymised so that it can no longer be linked back to you as an individual.

Ruay implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the ruay platform is encrypted using industry-standard SSL/TLS protocols, preventing interception by unauthorised parties.
• Secure Data Storage: Personal Data and financial records are stored on hardened servers with restricted physical and logical access controls. Access is limited to authorised personnel on a strict need-to-know basis.
• Payment Security: Ruay is PCI-DSS compliant in respect of payment card data handling. Payment data associated with Touch 'n Go eWallet, DuitNow, FPX, and bank transfers is processed via tokenised, encrypted channels.
• Access Controls: Role-based access controls are applied to all internal systems. Staff access to player data is logged, monitored, and regularly audited.
• Incident Response: Ruay maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities without undue delay.

As a data subject, you have a number of rights in relation to the Personal Data that ruay holds about you. These rights are described below. To exercise any of these rights, please contact us at support@ruay.cam with the subject line "Data Rights Request" and include your account username and the specific right you wish to exercise.

Ruay will respond to all valid data rights requests within thirty (30) days of receipt. Where requests are complex or numerous, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reason for it. We will not charge a fee for handling data rights requests unless requests are manifestly unfounded or excessive.

The ruay platform is strictly intended for individuals who are aged 21 years or older. Ruay does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of the KYC process, and all accounts must be verified before any withdrawal can be processed.

If ruay becomes aware that Personal Data has been collected from a person under the age of 21, that account will be immediately suspended, all associated data will be deleted, and any funds held in the account will be returned via the original deposit method where lawfully possible.

In the course of operating the Platform and engaging with the Third-Party Services described in this Policy, your Personal Data may be transferred to and processed in countries outside of Malaysia. Such transfers may involve jurisdictions that maintain data protection standards different from those applicable in Malaysia.

Where Personal Data is transferred internationally, ruay ensures that appropriate safeguards are in place to protect your data. These safeguards include the use of contractual clauses that impose equivalent data protection obligations on the recipient, ensuring that your rights as a data subject are maintained regardless of where your data is processed.

The ruay platform may include integrations with, or links to, third-party service providers whose privacy practices are independent of ours. This includes game providers, payment gateway operators, and fraud detection systems. This Privacy Policy does not apply to the data practices of any third-party service provider.

Ruay is not responsible for the privacy practices or content of any third-party service. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of the Platform. All third-party Data Processors engaged by ruay are subject to contractual data processing agreements that require them to maintain appropriate data protection standards.

Ruay reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

Material amendments — those that significantly affect your rights or the way we process your Personal Data — will be communicated to registered users via the email address associated with their account at least fourteen (14) days before the changes take effect where practicable. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

If you do not agree with any amendment to this Policy, you should cease using the Platform and contact our support team to request account closure and the deletion of your data, subject to our regulatory retention obligations.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way ruay processes your Personal Data, please contact our Data Protection team through the following channels:

• Email: support@ruay.cam — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate. Responses are provided within 30 days.
• Live Chat: Available 24/7 via the ruay platform. Our agents can log your enquiry and escalate data-related matters to the appropriate internal team.

All data-related enquiries and formal complaints are handled by our internal compliance team. If you are not satisfied with our response to a data rights request or privacy complaint, you have the right to refer the matter to the relevant supervisory or regulatory authority in your jurisdiction.