Privacy Policy — yes365

This Privacy Policy ("Policy") is issued by yes365 ("Company", "we", "us", "our") and governs the collection, processing, storage, use, disclosure, and protection of personal data provided by or collected about users ("User", "Member", "you", "your") of the yes365 online platform located at https://yes365.cam and all associated services.

yes365 is committed to handling personal data responsibly and in accordance with applicable data protection legislation, including relevant provisions applicable to online service operators conducting business with Malaysian users. We collect only the data necessary to deliver a safe, compliant, and high-quality gaming and sports betting experience, and we process it only for clearly defined, legitimate purposes.

By accessing the yes365 Platform, creating an Account, or using any of our services, you acknowledge that you have read and understood this Privacy Policy in its entirety and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the Platform.

This Policy should be read alongside our Terms & Conditions, which govern the overall terms of your use of yes365. In the event of any conflict between this Policy and those Terms, this Policy shall prevail with respect to personal data matters.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably identify a living individual, either alone or in combination with other information. This includes your name, identification number, email address, IP address, device identifiers, and financial account details.
• "Processing" — any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For all data collected through yes365, the Data Controller is yes365.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a written contract and on documented instructions. This includes our licensed payment processors, identity verification providers, and security service vendors.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a specific purpose.
• "KYC Documents" — identity and address verification documents collected as part of the Know Your Customer compliance process, including Malaysian MyKad, passport, driver's licence, and proof of address documents.

yes365 acts as the Data Controller for all personal data collected through the Platform. As Data Controller, yes365 is responsible for determining the purposes for which your personal data is processed, ensuring that processing occurs only on a lawful basis, maintaining appropriate security measures, and honouring your rights as a data subject.

For data protection enquiries, subject access requests, or to raise a concern about how your data is handled, please contact our Data Privacy team using the contact details set out in Section 15 of this Policy. All data protection correspondence should be sent to [email protected] with the subject line "Data Privacy Request — [Your Account Username]".

yes365 collects personal data through several channels: information you actively provide during registration and account management; information generated automatically by your use of the Platform; and information received from authorised third-party sources as part of KYC and fraud prevention processes. The specific categories of personal data we collect are set out below.

yes365 uses the personal data we collect for the following specific, clearly defined purposes:

• Account Creation & Management: To register your yes365 account, verify your identity, maintain your account profile, and enable you to access the Platform's features and services.
• Transaction Processing: To process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC, USDT, and other supported payment methods. Transaction records are maintained for accounting and regulatory purposes.
• KYC & Age Verification: To verify that you are at least 21 years of age and to fulfil our anti-money laundering (AML) compliance obligations under applicable gaming and financial regulation.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and communicate account-related notifications via live chat, email, and WhatsApp.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, multi-accounting, bonus abuse, money laundering, and other prohibited activities on the Platform.
• Responsible Gambling: To monitor gameplay patterns for indicators of problem gambling behaviour and, where appropriate, contact affected users or apply account protections in accordance with our Responsible Gambling obligations.
• Platform Improvement: To analyse aggregate, anonymised usage data in order to improve Platform features, game selection, user interface design, and overall service quality.
• Legal & Regulatory Compliance: To fulfil legal obligations, respond to lawful requests from regulatory authorities, and maintain records as required by applicable gaming licence conditions and financial regulations.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided explicit consent or where we have a legitimate interest that does not override your privacy rights. You may opt out of marketing communications at any time.

yes365 processes personal data only where a lawful basis for processing exists. The principal lawful bases on which yes365 relies are:

• Contractual Necessity: Processing required to deliver the services you have contracted with us for through your yes365 account — including account management, transaction processing, and gameplay functionality.
• Legal Obligation: Processing required to comply with applicable AML legislation, gaming licence conditions, tax reporting obligations, and responses to lawful authority requests.
• Legitimate Interests: Processing for fraud detection, platform security, responsible gambling monitoring, and service improvement — where these interests are not overridden by your rights and interests as a data subject.
• Consent: Processing for marketing communications and non-essential cookies — which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal.

yes365 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data with third parties only in the following strictly limited circumstances:

• Licensed Payment Processors: Personal and financial data is shared with our authorised payment partners — including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong payment rails — solely for the purpose of processing your deposit and withdrawal transactions.
• Identity Verification Providers: KYC documents and identity data are shared with licensed third-party identity verification service providers who process this data solely on yes365's behalf to fulfil our AML compliance obligations.
• Fraud & Security Services: Technical and behavioural data may be shared with specialist fraud detection and cybersecurity service providers for the purpose of protecting yes365 and its members from fraudulent activity.
• Game Studio Partners: Session and gameplay data may be shared in anonymised or pseudonymised form with our licensed international game studio partners for the purpose of game performance analysis and regulatory reporting.
• Regulatory & Law Enforcement Authorities: yes365 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where legally compelled to do so by a valid court order, regulatory directive, or applicable law.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of yes365's business assets, personal data held by yes365 may form part of the transferred assets, subject to equivalent privacy protections being maintained by the acquiring entity.

All third parties with whom yes365 shares personal data are required to process that data only for the specified purpose, under a written data processing agreement, and subject to security obligations no less protective than those applied by yes365.

yes365 operates with the support of technology infrastructure and service providers located in multiple jurisdictions. As a result, your personal data may be transferred to, and processed in, countries outside Malaysia. Where such transfers occur, yes365 ensures that appropriate safeguards are in place to maintain a level of protection for your personal data equivalent to that which applies within Malaysia.

Safeguards for international data transfers employed by yes365 include contractual data processing agreements incorporating standard data protection clauses, and the selection of service providers that operate under recognised data protection frameworks. If you wish to obtain further information about the specific safeguards applied to cross-border data transfers involving your personal data, please contact our Data Privacy team.

yes365 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention obligations imposed by applicable law or regulatory requirements.

• Account data and transaction records are retained for a minimum period of five (5) years following the closure or termination of a Member's account, as required by applicable AML and gaming regulatory obligations.
• KYC documents are retained for a minimum period of five (5) years from the date of the last transaction associated with the verified account, in accordance with AML record-keeping requirements.
• Support communications (live chat transcripts, emails, dispute records) are retained for three (3) years from the date of the communication.
• Marketing preferences and consent records are retained until withdrawal of consent, plus one (1) year for compliance documentation purposes.
• Technical and log data are retained for up to twelve (12) months, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.

yes365 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our principal security measures include:

• 256-bit TLS/SSL Encryption: All data transmitted between your browser or device and yes365 servers is encrypted in transit using industry-standard TLS protocols. Our HTTPS configuration is audited regularly.
• Access Controls: Access to personal data held by yes365 is restricted on a strict need-to-know basis. Staff access is governed by role-based access control (RBAC) policies and is logged for audit purposes.
• Two-Factor Authentication (2FA): All member accounts support 2FA for login security. Administrative access to yes365 internal systems requires multi-factor authentication.
• KYC Document Isolation: Identity documents submitted for KYC verification are stored in encrypted, access-controlled document repositories entirely separate from general Platform databases.
• Regular Security Audits: yes365 conducts regular internal security reviews and commissions periodic third-party penetration testing to identify and address potential vulnerabilities.
• Incident Response: In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, yes365 will notify affected Members and, where required, the relevant regulatory authority, within the timeframes mandated by applicable law.

Subject to applicable law and certain exceptions, you hold the following rights in relation to the personal data yes365 holds about you. These rights may be exercised by submitting a written request to our Data Privacy team at [email protected].

yes365 will respond to all data rights requests within 14 business days of receipt of a complete, verified request. We may request identity verification before processing any data rights request to ensure we are responding to the correct individual.

yes365 uses cookies and similar tracking technologies (including local storage objects and session tokens) to maintain session security, remember your preferences, analyse Platform usage patterns, and deliver a personalised experience. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including authentication session management, security tokens, and fraud prevention signals. These cookies cannot be disabled without disrupting core Platform functionality.
• Functional Cookies: Remember your preferences, such as language selection, preferred game categories, and display settings, to enhance your experience on subsequent visits.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, time on site, error occurrences — to help us improve Platform performance and user experience. This data is aggregated and does not identify individual users.
• Marketing Cookies: Used to track whether you have viewed certain promotions or to measure the effectiveness of our marketing communications. These cookies are only placed where you have provided consent.

You may control cookie settings through your browser preferences. Most modern browsers allow you to refuse some or all cookies, or to alert you when a cookie is being placed. Please note that disabling strictly necessary cookies may affect your ability to log in to or use the yes365 Platform. Your cookie preferences can be updated at any time.

yes365 is an adult entertainment platform intended exclusively for users who are at least 21 years of age. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21.

If we become aware that personal data has been submitted by or collected about an individual under the age of 21 without appropriate parental consent, we will take immediate steps to delete that data and close the associated account. Any deposits made by an underage user will be returned in accordance with our Terms & Conditions.

Parents and guardians are encouraged to use parental control software to restrict access to online gambling platforms for minors. If you believe that a minor may have accessed or registered with yes365, please contact our support team immediately at [email protected].

yes365 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the services we offer. The "Last Updated" date at the top of this Policy will be revised to reflect the effective date of any changes.

Where changes to this Policy are material — meaning they significantly affect your rights or the way we process your data — yes365 will notify registered Members by email to the address held on file at least 14 days before the revised Policy takes effect. Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

Previous versions of this Privacy Policy are available on request by contacting our Data Privacy team. We recommend reviewing this Policy periodically to stay informed of how yes365 protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way yes365 handles your personal data, please contact our Data Privacy team through any of the following channels. We aim to acknowledge all data privacy correspondence within one business day and provide a substantive response within 14 business days.

For Subject Access Requests or Right to Erasure requests, please include your full name, account username, and the registered email address associated with your yes365 account to allow us to verify your identity before processing the request. We may request supporting documentation where required to confirm your identity.