Privacy Policy

This Privacy Policy (the "Policy") is published by hmis2 (the "Company", "we", "us", or "our"), the operator of the online gaming platform at https://hmis2.cam and all associated services. It describes how we process the personal data of individuals who visit, register on, or otherwise interact with the Platform (each, a "User", "Player", or "you").

We are committed to handling personal data responsibly, transparently, and in full accordance with applicable data-protection standards. By accessing the Platform or creating an Account, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

This Policy applies to all personal data we collect — whether provided directly by you during registration or KYC, generated automatically through your use of the Platform, or received from authorised third parties such as payment processors.

The following definitions apply throughout this Policy:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data held by the Company.
• "Processing" — Any operation or set of operations performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of Processing Personal Data. For the purposes of this Policy, the Data Controller is hmis2.
• "Data Processor" — A third party that processes Personal Data on behalf of the Data Controller under a written data-processing agreement.
• "Consent" — A freely given, specific, informed, and unambiguous indication of a User's wishes by which they signify agreement to the processing of their Personal Data for one or more specified purposes.
• "Cookies" — Small text files stored on a User's device by a web browser, used to record session information, preferences, and analytics data.
• "KYC" — Know Your Customer: the identity verification process required prior to withdrawal processing or as mandated by the Company's compliance obligations.
• "Platform" — The hmis2 website, any associated mobile interface, and all services accessible through https://hmis2.cam.

The following categories of Personal Data are collected and processed by hmis2:

3.1 Identity & Registration Data

This data is collected at registration and during KYC verification. It is used to create and manage your Account, verify your identity, and comply with age-verification obligations. We require all Malaysian players to be 21 years of age or older.

3.2 Financial & Transaction Data

This includes details of deposits made via Touch 'n Go eWallet, Boost, GrabPay, DuitNow QR, FPX (Maybank, CIMB, Public Bank, Hong Leong Bank), 7-Eleven CLiQQ, and USDT TRC20. We record the payment method type and reference numbers, but do not store full payment credentials such as card numbers or e-wallet PINs.

3.3 Gameplay & Behavioural Data

Gameplay data is recorded to facilitate dispute resolution, ensure the integrity of game outcomes, support responsible gambling monitoring, and deliver personalised promotional content where you have consented to marketing.

3.4 Technical & Device Data

Technical data is automatically collected via server logs and analytics tools when you access the Platform. It is used for security monitoring, fraud detection, platform performance optimisation, and jurisdictional compliance checks.

3.5 Communications Data

Records of your communications with our customer support team — including live chat transcripts and email exchanges — are retained for quality assurance, dispute resolution, and training purposes. We may also retain records of marketing communications sent to you and your preferences regarding such communications.

hmis2 collects Personal Data through the following means:

• Direct Provision: Data you provide when registering an Account, completing the KYC process, submitting a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Data gathered automatically as you use the Platform, including via server-side logging, session tracking, cookies, and analytics tools embedded in the Platform.
• Payment Processors: Transaction confirmation data and payment reference numbers received from authorised payment service providers, including Touch 'n Go eWallet, Boost, GrabPay, and banking partners operating through DuitNow and FPX.
• Identity Verification Partners: Where you use a third-party identity verification service integrated into our KYC workflow, we receive the verification outcome and associated identity data from that service.
• Fraud Prevention Services: Risk-scoring data received from fraud-detection and anti-money-laundering screening services that process data on our behalf under data-processing agreements.

We process your Personal Data strictly for the following purposes:

1. Account Management: Creating and maintaining your Account, verifying your identity at registration and during KYC, and providing you with access to Platform services.
2. Payment Processing: Facilitating your deposit and withdrawal transactions in Malaysian Ringgit (MYR) via your chosen payment method.
3. Regulatory & Compliance Obligations: Fulfilling age-verification requirements (21+), anti-money-laundering (AML) checks, Know Your Customer (KYC) obligations, and any other legal or regulatory duty imposed on the Company.
4. Responsible Gambling: Monitoring gameplay patterns to identify signs of problem gambling, applying deposit limits or account restrictions where warranted, and facilitating self-exclusion requests.
5. Customer Support: Responding to your enquiries, resolving account disputes, and providing technical assistance.
6. Security & Fraud Prevention: Detecting, investigating, and preventing fraud, unauthorised account access, money laundering, and other prohibited activities.
7. Platform Improvement: Analysing aggregated, anonymised usage data to improve the Platform's performance, features, and user experience.
8. Marketing Communications (with consent): Sending you promotional emails, bonus notifications, and personalised offers where you have explicitly opted in to receive such communications. You may withdraw consent at any time.
9. Legal Proceedings: Establishing, exercising, or defending legal claims in any court or regulatory body.

Each processing activity we undertake is supported by at least one of the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and the Company — for example, processing your deposits, maintaining your Account, and paying out your winnings.
• Legal Obligation: Processing required to comply with applicable law — for example, KYC/AML obligations, age verification, and record-keeping requirements imposed by the Company's operating licence conditions.
• Legitimate Interests: Processing necessary for the Company's legitimate interests, where those interests are not overridden by your data-protection rights — for example, fraud prevention, platform security, and aggregate analytics for product improvement.
• Consent: Processing based on your freely given and revocable consent — for example, sending you marketing emails and promotions. You may withdraw consent at any time by contacting our support team or using the opt-out mechanism in any marketing communication.

hmis2 does not sell your Personal Data. We share your data only in the following limited circumstances and with the following categories of recipients:

• Payment Processors: We share transaction data necessary to process your deposits and withdrawals with authorised payment service providers, including operators of Touch 'n Go eWallet, Boost, GrabPay, and Malaysian banking institutions participating in DuitNow and FPX. These providers process data as Data Processors under binding data-processing agreements.
• KYC & Identity Verification Partners: Identity documents and verification data are shared with licensed identity verification service providers for the sole purpose of completing KYC checks.
• Fraud & AML Screening Services: Transaction data may be shared with fraud detection and anti-money-laundering screening providers to assess risk levels and fulfil our compliance obligations.
• Game Studios & Technology Partners: Certain non-sensitive gameplay and session data is shared with our licensed game studio partners and platform infrastructure providers to deliver games and maintain service stability.
• Regulatory Authorities & Law Enforcement: We are obligated to disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts when required by applicable law, court order, or our operating licence conditions. We will notify affected Users of such disclosures where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of the Company's assets, Personal Data may be transferred to the acquiring entity subject to equivalent data-protection obligations.

All third parties with whom we share Personal Data are required to handle it in a manner consistent with this Policy and applicable data-protection standards. We do not permit third-party processors to use your data for their own marketing or commercial purposes.

The hmis2 Platform uses cookies and similar tracking technologies to enhance your user experience, maintain session continuity, and collect analytics data. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as language settings and display preferences, to provide a more personalised experience across sessions.
• Analytics Cookies: Used to collect aggregate, anonymised data about how Users interact with the Platform — including pages visited, session duration, and error events — to help us improve functionality and performance.
• Marketing Cookies (with consent): Where you have consented, these cookies record your interaction with promotional content and help us deliver relevant offers. You may withdraw consent for marketing cookies at any time.

Most web browsers permit you to control cookie settings through the browser's privacy preferences. Disabling non-essential cookies will not affect your ability to access the Platform's core features, though some personalisation features may be limited.

We retain Personal Data for no longer than is necessary for the stated processing purpose or as required by applicable legal, regulatory, or licence obligations. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of your Account membership and for a minimum of five (5) years following Account closure, in accordance with standard AML record-keeping obligations.
• Transaction and Financial Data: Retained for a minimum of seven (7) years following the date of the relevant transaction, in compliance with applicable financial record-keeping requirements.
• KYC Documentation: Retained for the period prescribed by the applicable anti-money-laundering regulatory framework — typically five (5) years from the date of verification or Account closure, whichever is later.
• Gameplay Logs: Retained for a minimum of two (2) years to facilitate dispute resolution and responsible gambling monitoring.
• Customer Support Communications: Retained for two (2) years following the resolution of the relevant enquiry or dispute.
• Marketing Consent Records: Retained until consent is withdrawn, plus a further one (1) year as evidence of prior consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be linked to any individual.

hmis2 implements a multi-layered security framework to protect Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

• Transport Encryption: All data in transit between your device and our servers is protected by 256-bit TLS/SSL encryption.
• Data at Rest: Sensitive stored data — including identity information and financial records — is encrypted at rest using AES-256 or equivalent standards.
• Password Security: Account passwords are stored exclusively as salted cryptographic hashes. No member of staff has access to your plaintext password.
• Access Controls: Access to Personal Data within our organisation is restricted to staff who require it for their specific role, governed by a strict role-based access control policy.
• Intrusion Detection: Our infrastructure is monitored 24/7 by automated intrusion detection and prevention systems, with security incident response procedures in place.
• Vendor Security: All third-party processors with whom we share Personal Data are subject to contractual security obligations and periodic security assessments.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected Users and, where required, relevant regulatory authorities without undue delay and in accordance with applicable law.

Subject to applicable law and any overriding regulatory or legal obligation, you have the following rights in respect of your Personal Data held by hmis2:

Right	What It Means
Right of Access	You may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
Right to Rectification	You may request correction of inaccurate or incomplete Personal Data. You can update most information directly through your Account settings.
Right to Erasure	You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, subject to overriding retention obligations (e.g., AML record-keeping).
Right to Restriction	You may request that we limit processing of your Personal Data in certain circumstances, for example while the accuracy of data is being contested.
Right to Data Portability	Where processing is based on your consent or contractual necessity, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
Right to Object	You may object to processing based on the Company's legitimate interests, including for direct marketing purposes. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent	Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please submit a request to our support team via live chat or email at [email protected]. We will acknowledge your request within five (5) working days and provide a substantive response within thirty (30) calendar days. For complex requests, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it.

The hmis2 Platform is strictly restricted to individuals aged twenty-one (21) years and above. We do not knowingly collect Personal Data from any person under the age of 21. Our registration process includes age declaration and is reinforced by KYC identity verification for all withdrawing accounts.

If we become aware that Personal Data has been collected from a person under the age of 21 without appropriate consent or in contravention of our eligibility rules, we will take immediate steps to delete that data and close the associated Account. Any winnings accumulated in the Account of an underage player will be voided.

If you are a parent or guardian and believe that a minor in your care has created an Account on the Platform, please contact us immediately at [email protected]. We will respond and act without delay.

In the course of operating the Platform and fulfilling our contractual and compliance obligations, Personal Data may be transferred to and processed in jurisdictions outside of Malaysia — for example, where our technology infrastructure, game studio partners, or compliance service providers are located.

Where such transfers occur, we take steps to ensure that your Personal Data receives an equivalent level of protection to that afforded under applicable Malaysian data-protection standards. These steps include:

• Entering into data-processing agreements with all international processors that include binding data-protection obligations.
• Conducting due diligence on the data-protection practices of all overseas processors before engaging their services.
• Restricting the scope of data shared with overseas processors to the minimum necessary for the stated purpose.

By using the Platform and accepting this Policy, you consent to the international transfer of your Personal Data as described in this clause, subject always to the protections described herein.

The hmis2 Platform may contain links to or embed content from third-party websites or services — for example, payment gateway interfaces or identity verification portals. This Privacy Policy does not apply to those third-party services.

We encourage you to review the privacy policies of any third-party service you access through or in connection with the Platform. hmis2 accepts no responsibility for the data-handling practices of third-party operators, and inclusion of a link or integration does not constitute endorsement of their privacy standards.

hmis2 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, our data-processing activities, or operational practices. Where amendments are material — meaning they significantly affect how we use your Personal Data or your rights in relation to it — we will notify you via the email address registered to your Account and/or via a prominent notice on the Platform prior to the amendments taking effect.

The effective date of the current version of this Policy is shown in the "Last Updated" field at the top of this page. We recommend that you review this Policy periodically to remain informed of how we protect your data. Continued use of the Platform following notification of a material amendment constitutes your acceptance of the revised Policy.

If you do not agree to a revised version of this Policy, please contact our support team to discuss your options, which may include Account closure in accordance with the process described in our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the hmis2 Data Privacy team through any of the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line to ensure prompt routing to the correct team.
• Live Chat: Available 24/7 directly through the Platform. State that your enquiry relates to a privacy or data matter.
• Response Time: Live chat within 2 minutes; email acknowledgement within 5 working days; substantive response within 30 calendar days.

For formal data-subject rights requests under applicable law, please submit your request in writing via email. We may ask you to verify your identity before processing your request to protect against fraudulent data-access attempts.