Privacy notice.
Version 1.0 · Effective 16 July 2026
This notice is issued under the Personal Data Protection Act 2010 (Malaysia). It covers what ICM Gaming collects when you browse and buy, why, who processes it and what you can ask of us. The short version: we collect what a card shop needs to sell you cards, and nothing else.
What we collect
We collect four kinds of personal data:
- Account data - name, email address and password hash if you create an account, plus the things attached to it: wishlist, store credit balance, loyalty points, alert subscriptions.
- Order data - what you bought, when, for how much, and the payment reference. Guest checkout creates order data without an account.
- Delivery data - recipient name, shipping address and phone number.
- Payment references - the Stripe payment identifier or your bank transfer reference. We never receive or store card numbers; those go to Stripe directly.
Why we use it
We use personal data to:
- process and deliver your orders, including matching manual transfers to orders;
- run your account: wishlist, store credit, points, buylist quotes and gift cards;
- send transactional email - order confirmations, shipping and tracking notices, and the back-in-stock or price-drop alerts you subscribed to;
- send you a single reminder if you enter your email at checkout and leave without ordering (your cart is held against that email for the reminder);
- handle returns, damage claims and refunds;
- meet our legal obligations, mainly tax record-keeping.
We do not sell personal data, and we do not use it for third-party advertising.
Who processes it
Five service providers process personal data on our behalf, each only for its role:
- Stripe
- Processes card, FPX and GrabPay payments. Your card number goes to Stripe directly and never touches our servers; we keep only the payment reference.
- Supabase
- Hosts our database - account and order data - in its Singapore region.
- Delyva
- Our courier network. Receives your delivery name, address and phone number to deliver your order.
- Resend
- Sends our transactional email: order confirmations, shipping notifications, alerts you asked for.
- Cloudflare
- Serves and secures the site; sees traffic data such as your IP address in the course of doing so.
No other party receives your personal data.
Where it lives
Account and order data is stored with Supabase in Singapore. This is a cross-border transfer under the PDPA: by ordering from us you consent to your data being stored there, protected by the same safeguards described in this notice. Stripe, Resend and Cloudflare also process data on infrastructure outside Malaysia in the course of providing their services.
How long we keep it
Order records - including the delivery details and payment references attached to them - are kept for at least seven years, as Malaysian tax law requires. Account data is kept while your account exists and deleted when you ask us to close it, except for the order records above. Alert subscriptions are deleted as soon as you unsubscribe or the alert fires.
Your rights
Under the PDPA 2010 you can, at any time:
- request access to the personal data we hold about you;
- request correction of data that is inaccurate or out of date;
- withdraw consent to processing - noting that we can't deliver orders without delivery data, or erase order records we're legally required to keep.
Email us at the address below; we respond to data access and correction requests within 21 days, as the Act prescribes.
Contact
Data matters go to icmgaming26@gmail.com [placeholder address, goes live with the domain]. ICM Gaming, Kuala Lumpur, Malaysia.