Privacy Policy

This Privacy Policy (the "Policy") is published by Sora89 (referred to herein as "Sora89", "we", "us", or "our") and applies to all users of the Sora89 online gaming platform, accessible at https://sora89.click (the "Platform"), including players located in Malaysia and other eligible jurisdictions.

Sora89 takes the privacy of its users seriously. We recognise that when you create an account, deposit funds, or engage with our sports betting, live casino, or slots services, you are entrusting us with personal information. This Policy describes in transparent, plain-language terms how we handle that information — what we collect, why we collect it, who we may share it with, how long we retain it, and what rights you hold as a data subject.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform. In the event of any conflict between this Policy and the Terms & Conditions regarding data privacy matters, this Policy shall prevail.

For the purposes of this Policy, the following terms carry the meanings set out below:

Sora89 collects Personal Data across several categories, depending on your level of interaction with the Platform. The categories of data and their examples are set out in the table below:

We do not collect or store full payment card numbers. Card transactions are processed by certified third-party payment processors who are independently compliant with applicable payment security standards.

Sora89 collects Personal Data through the following channels and mechanisms:

• Direct Interaction: Data you provide voluntarily when registering an account, completing KYC verification, submitting support requests, participating in promotions, or communicating with our team via live chat or email.
• Automated Technologies: Technical and Usage Data collected automatically when you access and navigate the Platform, including through cookies, web beacons, server logs, and similar tracking technologies.
• Third-Party Sources: Identity and fraud-verification data received from KYC service providers, payment processors (such as Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX), and anti-money laundering screening services, where such providers are authorised to share data with us.
• Publicly Available Sources: In limited circumstances, and only where relevant to fraud prevention or compliance obligations, we may reference publicly accessible records to verify identity information.

Sora89 processes your Personal Data for the following specific and legitimate purposes:

To create and maintain your Sora89 account; to authenticate your identity at login; to process deposits and withdrawals in MYR via your chosen payment method; to deliver gaming services including sports betting on EPL, Liga Super Malaysia, and UFC markets; and to provide customer support.

To verify that you are aged 21 or above, as required by our responsible gaming obligations and applicable regulations; to confirm your identity prior to processing withdrawal requests; and to fulfil our anti-money laundering (AML) and counter-terrorism financing (CTF) obligations.

To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, cheating, collusion, and other prohibited conduct; to maintain the integrity and security of the Platform; and to protect the legitimate interests of Sora89 and its users.

To comply with applicable laws, regulations, court orders, and requests from authorised law enforcement or regulatory bodies; to maintain transaction records as required by financial regulations; and to respond to legal proceedings.

To monitor gaming patterns and flag indicators of problem gambling; to enforce self-exclusion orders and deposit limits elected by users; to support age-restriction enforcement; and to communicate responsible gaming information and resources to players who may need them.

To analyse aggregated and anonymised usage data in order to improve Platform performance, user experience, game selection, and promotional offerings. Individual user data is not used for profiling in a manner that would have significant effects on the user without their explicit consent.

To send you promotional offers, bonus notifications, and platform updates — but only where you have provided explicit consent to receive marketing communications. You may withdraw consent and opt out of marketing communications at any time by contacting our support team.

Sora89 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions — including operating your account, processing payments, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML obligations, age verification requirements, financial record-keeping requirements, and responses to lawful regulatory requests.
• Legitimate Interests: Processing conducted for our legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service analytics — where those interests are not overridden by your rights and interests.
• Consent: Processing conducted on the basis of your freely given, informed, and specific consent — primarily for direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Sora89 does not sell, lease, or trade your Personal Data to any third party for commercial or marketing purposes. We may share your Personal Data with the following categories of recipients, strictly as necessary and under appropriate data protection safeguards:

• Payment Service Providers: Banks and e-wallet operators including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency transaction processors — solely to facilitate your deposit and withdrawal transactions.
• KYC & Identity Verification Services: Third-party identity verification and age-check providers engaged by Sora89 to fulfil our compliance obligations. These providers operate under strict data processing agreements and are prohibited from using your data for any other purpose.
• AML & Fraud Prevention Services: Screening and monitoring service providers used to detect money laundering, terrorist financing, and fraudulent activity. Data shared is limited to what is strictly necessary for these checks.
• Technology & Infrastructure Providers: Cloud hosting, content delivery, and platform infrastructure providers engaged by Sora89 who may process Personal Data as part of service delivery. All such providers are contractually bound to process data only on Sora89's instructions.
• Regulatory Authorities & Law Enforcement: Where we are legally required to do so by applicable law, court order, or lawful request from a governmental or regulatory authority. Sora89 will notify affected users of any such disclosure where legally permissible.
• Group Companies: Affiliated entities within the Sora89 corporate group, where necessary for internal administrative purposes, always subject to the protections described in this Policy.

Sora89 uses cookies and similar tracking technologies to operate the Platform, improve your user experience, maintain session security, and analyse Platform performance. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable core features such as login session management, security checks, and load balancing. They cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data on how users interact with the Platform — including pages visited, session duration, and game categories accessed — to help us improve the user experience.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and previously visited game categories, to provide a more personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, multi-accounting, and other prohibited behaviour by analysing session patterns and device fingerprinting data.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Sora89 Platform. Sora89 does not use third-party advertising cookies or cookies that track your browsing activity across unaffiliated websites.

Sora89 retains Personal Data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Account Data & KYC Records: Retained for the duration of your account's active status and for a minimum of five (5) years following account closure, as required by anti-money laundering regulations.
• Transaction Records: Financial transaction data, including deposit and withdrawal records in MYR, is retained for a minimum of seven (7) years to comply with applicable financial record-keeping requirements.
• Gaming History: Bet and game session records are retained for five (5) years following account closure, or longer where required for the resolution of disputes.
• Support Communications: Customer support correspondence is retained for three (3) years following the conclusion of the relevant support matter.
• Marketing Consent Records: Consent records for marketing communications are retained for the duration of the marketing relationship and for a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data is securely and permanently deleted or anonymised in a manner that prevents re-identification.

Sora89 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Sora89 Platform;
• Encryption at rest for all stored Personal Data, with sensitive fields additionally hashed using industry-standard cryptographic algorithms;
• Role-based access controls limiting access to Personal Data to authorised Sora89 personnel on a strict need-to-know basis;
• Regular penetration testing, vulnerability assessments, and security audits conducted by qualified third-party security specialists;
• Multi-factor authentication options for account access;
• Continuous automated monitoring for suspicious login activity, unusual account behaviour, and potential security incidents;
• Documented incident response procedures to ensure prompt detection, containment, and notification in the event of a data security breach.

While Sora89 takes all reasonable measures to secure your Personal Data, no security system is impenetrable. You are responsible for maintaining the security of your own account credentials. If you suspect that your Sora89 account has been accessed without your authorisation, please contact our support team immediately.

Subject to applicable data protection legislation and certain legal limitations, you have the following rights with respect to your Personal Data held by Sora89. To exercise any of these rights, please contact our Data Privacy team at the details provided in Section 16.

Sora89 will respond to all valid data subject requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further two months, and will notify you accordingly. There is no charge for submitting a data subject request, unless requests are manifestly unfounded or excessive.

The Sora89 Platform is strictly intended for individuals aged 21 years and above. Sora89 does not knowingly collect, process, or retain Personal Data from any person below this age. Age verification is a mandatory step in the account registration process, and KYC documentation confirming age is required before withdrawal requests are processed.

If Sora89 becomes aware that Personal Data has been collected from an individual who is under the age of 21, that data will be deleted immediately, the associated account will be closed, and any funds deposited will be returned to the relevant payment method following identity verification. If you are a parent or guardian and believe that a minor may have created an account on the Sora89 Platform, please contact us immediately at [email protected].

In the course of operating the Platform and delivering services to users in Malaysia and other jurisdictions, Personal Data may be transferred to, and processed in, countries outside of Malaysia. Such transfers may occur in connection with our use of cloud hosting infrastructure, KYC verification services, and payment processing networks.

Wherever Personal Data is transferred internationally, Sora89 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections afforded under applicable Malaysian data protection law and international best practice. These safeguards may include contractual clauses with data processors, adequacy assessments of destination jurisdictions, and technical security measures.

The Sora89 Platform may contain references to or integrations with third-party services, particularly in the context of payment processing (e.g., Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX). Sora89 is not responsible for the privacy practices of third-party services or websites. We strongly encourage you to review the privacy policies of any third-party service you access in connection with your use of the Sora89 Platform.

Sora89 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Any material changes to this Policy will be communicated to registered users via the email address associated with their account or through a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the Sora89 Platform following the publication of a revised Policy constitutes your acknowledgement of the changes and, where applicable, your consent to the updated processing practices.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact Sora89 using the details below. Our Data Privacy team will respond to all enquiries within the timeframes specified in Section 11.