Privacy Policy yyrr — We Protect Your Data the Same Way We Protect Your Trust

This Privacy Policy describes how yyrr ("we", "Platform") collects, uses, stores and protects the personal information you provide when using yyrr services — whether through our official website or mobile app.

We understand that the trust of Malaysian users is our most valuable asset. That is why we invest in best-in-class security infrastructure and draft this policy in plain language — not legal jargon that is hard to understand. We want you to know exactly what happens with your information.

Yyrr collects various types of personal data depending on how you interact with the platform. Below is a detailed breakdown of the data types collected:

We only collect data necessary for clearly stated purposes. This data minimisation principle ensures we do not gather excessive information that is irrelevant to the services we provide.

The personal data we collect is used for the following purposes:

• Identity Verification (KYC): Ensuring all users meet the minimum age requirement and verifying identity to prevent fraud.
• Transaction Processing: Processing deposits, withdrawals, and all financial transactions accurately and securely.
• Account Security: Detecting suspicious login activity and fraud, and ensuring your account is not accessed without authorization.
• Legal Compliance: Meeting reporting requirements to the relevant authorities, including anti-money laundering (AML) obligations.
• Service Improvements: Analyzing usage patterns to improve the user experience and develop new features.
• Communications: Sending important account-related information, promotions (if you have opted in), and platform updates.
• Customer Support: Resolving complaints, inquiries, and support requests more effectively.

Yyrr does not sell your personal data to any party. However, in the course of operating the platform, we share data with certain parties in the following limited situations:

• Payment Providers: Information that must be shared with payment processors such as FPX, Touch'n Go, and banks to complete your transactions.
• Technical Service Providers: Companies that help us operate the platform — including cloud services, data analytics, and cybersecurity providers — are all bound by strict confidentiality agreements.
• Authority: Information required by law enforcement agencies, courts, or regulatory bodies through valid legal processes.
• Game Providers: Limited data required to ensure the integrity and security of the games you play.

All third parties we work with have signed data protection agreements and are regularly audited to ensure they maintain the security standards we require.

Protecting your data goes beyond putting a digital lock in place — it involves a layered system designed to withstand multiple types of threats. The security measures we implement at yyrr include:

• Transit Encryption: All data transmitted between your device and our servers is protected by TLS 1.3 protocol and 256-bit SSL encryption.
• Storage Encryption: Sensitive data such as passwords are stored in an irreversible hashed form, while financial information is encrypted using AES-256.
• Two-Factor Authentication: 2FA is available for all user accounts as an additional security layer.
• Internal Access Controls: yyrr staff may only access user data on a strictly need-to-know basis — adhering to a rigorous least-privilege principle.
• Security Audit: Penetration testing and security audits are conducted periodically by independent third parties.
• 24/7 Monitoring: Our anomaly detection systems and security team monitor for any unusual activity around the clock.

Yyrr retains your personal data only for as long as necessary for the purposes stated in this Policy, or as required by applicable law. General retention periods are as follows:

• Active Account Data: Retained for as long as your account is active and for 5 years after account closure for legal compliance purposes.
• Transaction Records: Retained for 7 years in accordance with Malaysian financial and anti-money laundering legal requirements.
• KYC Records: Retained for 5 years after the end of the business relationship.
• Technical Logs: Retained for 90 days for debugging and security purposes.
• Support Communications: Retained for 2 years for service quality and reference purposes.

Once the retention period expires, data is securely deleted or anonymised in accordance with yyrr's internal procedures.

Under Malaysia's PDPA and international best privacy practices, you have the following rights regarding your personal data:

Yyrr uses cookies and similar technologies to enhance your experience on the platform. There are three types of cookies we use:

• Necessary Cookies (Required): These cookies are required for the platform to function properly — including login sessions, language preferences, and CSRF security. They cannot be disabled.
• Performance Cookies: Helping us understand how users interact with the platform so we can make improvements. Data is collected anonymously.
• Functional Cookies: Remembering your personal preferences and settings, such as display theme and notification settings.

You can manage cookies through your browser settings. However, disabling certain cookies may affect the functionality of some parts of the platform.

In managing technical infrastructure, your data may be stored or processed on servers located outside Malaysia. When this occurs, yyrr ensures that:

• Data transfers are only carried out to countries or platforms that maintain an adequate level of data protection.
• Recognized standard data transfer agreements are used to protect your data during transfers.
• All overseas data recipients are bound by the same confidentiality and security obligations we enforce in Malaysia.

The yyrr platform is strictly for individuals aged 18 and above. We do not knowingly collect personal data from minors. Our KYC process is specifically designed to verify the age of every user.

If we find that a child's data has been collected without consent, we will delete it immediately and close the account in question. If you suspect that a child under your care has a yyrr account, please contact our support team immediately.

Yyrr reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the technologies we use. When significant changes occur, we will:

• Updating the "Last Updated" date at the top of this page.
• Sending notifications via email or in-app alerts at least 7 days before changes take effect.
• Maintaining an archive of previous versions of the Privacy Policy that users may request.

Continued use of the yyrr platform after amendments take effect will be considered acceptance of the updated Privacy Policy.

For any enquiries, requests, or complaints regarding your privacy and personal data protection, you may contact our Data Protection Officer (DPO) through the following channels:

You can also get help via the FAQ where we address the most frequently asked privacy questions from Malaysian users.