GameMatrix Privacy Policy
Last updated: 3 Nov 2026
This document is intended as a global core privacy policy, supplemented by the Malaysia addenda below where applicable. It is not limited to those two markets.
1. Who We Are and Scope
This Privacy Policy explains how [SHYY TECHNOLOGY LIMITED], a company incorporated in Hong Kong with registered address at FLAT/RM 511 MING SANG INDUSTRIAL BUILDING 19-21 HING YIP ST KWUN TONG KL (“Company”, “we”, “us” or “our”), processes personal data in connection with the GameMatrix website, online marketplace, account features, customer support and related services (collectively, the “Services”).
“GameMatrix” is a trading name/brand of the Company and is not a separate legal entity, unless expressly stated otherwise. If another entity is identified as the seller, payment recipient or service provider on a product page, checkout page, invoice or order confirmation, that entity’s role will be explained in the relevant transaction terms.
This Policy applies to personal data collected directly from you, generated through your use of the Services, or received from payment providers, game publishers, distributors, top-up providers, fraud-prevention providers and other lawful sources. It should be read with our Terms of Use, product-specific terms and any notices displayed at checkout.
The laws applicable to our processing depend on the circumstances, including where you are located, the Services offered to you, and where and how the processing takes place. This Policy does not exclude mandatory rights or protections available under applicable law.
2. Personal Data We Collect
Depending on the Services you use, we may collect the following categories of personal data:
(a) Account and contact data: email address, mobile number, username, account identifiers, password credentials in protected form, language and communication preferences.
(b) Order and product data: order number, product or denomination selected, currency, price, taxes or charges displayed, purchase time, order status, delivery status, refund or cancellation status, and customer support history.
(c) Game and fulfilment data: game title, player ID or game account identifier, server/region, user-supplied fulfilment details, top-up amount, redemption code status and confirmation received from a game publisher, distributor or fulfilment provider. We do not require your game password unless a specific service lawfully and transparently requires it; do not provide passwords unless expressly requested through an approved secure process.
(d) Payment and transaction data: payment method, transaction reference, amount, currency, time, payment status, payment-provider token or reference, and information needed to investigate refunds, chargebacks or suspected fraud. Payment providers may collect and process card, bank or e-wallet details directly. We do not intentionally store full payment-card numbers or security codes unless expressly stated in a separate notice.
(e) Communications and support data: information you provide when contacting us, including complaints, enquiries, screenshots or other supporting materials.
(f) Technical and usage data: IP address, device and browser type, operating system, language, timestamps, pages viewed, referring URLs, approximate location derived from IP, log data, cookie identifiers and security events.
(g) Risk and compliance data: limited information used to verify transactions, prevent abuse, detect fraud, comply with legal obligations and resolve disputes. We will not request identity documents or other higher-risk information unless reasonably necessary and supported by an appropriate purpose.
Please provide only information that is accurate and necessary for your order. Do not submit another person’s personal data unless you are authorised to do so.
3. How We Collect Personal Data
We collect personal data: (i) directly from you when you register, log in, place an order, submit a game ID, contact support or exercise a privacy right; (ii) automatically through cookies, logs and similar technologies when you use the Services; and (iii) from third parties involved in a transaction, including payment providers, game publishers, distributors, fulfilment providers, fraud-prevention services and customer-support platforms.
Where we receive information from a third party, we use it only for purposes consistent with the transaction, the relevant notice, our legitimate operational needs where recognised by applicable law, or another lawful basis. The third party may separately process your data under its own privacy notice.
4. Purposes and Legal Grounds
We use personal data for the following purposes, subject to applicable law:
(a) to create and administer accounts and authenticate users; (b) to display products, process orders and payments, deliver digital goods or top-ups, and provide order status updates; (c) to provide customer service, handle refunds, cancellations, complaints, chargebacks and disputes; (d) to secure the Services, detect and prevent fraud, abuse, unauthorised access and payment risks; (e) to maintain business, accounting, tax and transaction records and comply with lawful requests; (f) to troubleshoot, monitor performance, analyse aggregate usage and improve the Services; (g) to send service-related communications, including receipts, security alerts and material service notices; (h) to send promotional communications where permitted and, where required, with your consent; and (i) to establish, exercise or defend legal claims.
Depending on the jurisdiction and activity, processing may be based on performing a contract with you, complying with legal obligations, your consent, or another basis permitted by applicable law. Where consent is required, you may withdraw it through the method described in the relevant notice or by contacting us. Withdrawal does not affect processing lawfully carried out before withdrawal, and may affect features that depend on the relevant data.
5. Cookies and Similar Technologies
We may use cookies, pixels, SDKs, local storage and similar technologies for: (i) essential functions such as security, login and checkout; (ii) remembering settings; (iii) analytics and performance measurement; and (iv) advertising attribution or personalised marketing, if implemented.
Where required by law, non-essential technologies will be activated only after the required consent or preference is obtained. You may manage available preferences through the cookie banner or settings tool, and may also use your browser settings. Blocking essential technologies may affect the availability or security of parts of the Services.
Before publication, we will maintain an internal cookie/SDK inventory identifying each technology, provider, purpose, data collected, retention period and any international transfer. We will not claim that a consent banner or preference tool is available unless it has actually been implemented.
6. Disclosure and Sharing
We do not sell personal data for money. We may disclose or make personal data available, as necessary and subject to applicable law, to:
(a) payment service providers, banks, e-wallet providers and payment processors to process payments, refunds, payment verification and chargebacks; (b) game publishers, game operators, distributors, top-up or digital-goods fulfilment providers to validate orders and deliver the products or services purchased; (c) hosting, cloud, cybersecurity, analytics, communications and customer-support providers; (d) fraud-prevention, risk-management and dispute-resolution providers; (e) our professional advisers, auditors, insurers and financing providers where necessary for their services; (f) our affiliates where necessary for the purposes described in this Policy and subject to appropriate safeguards; (g) courts, regulators, law-enforcement agencies or other persons where disclosure is required or permitted by law; and (h) a successor or relevant parties in connection with a merger, reorganisation, financing, acquisition or sale of all or part of our business, subject to appropriate safeguards.
Some recipients may act as our service providers; others may independently determine purposes and means of processing. Their role depends on the actual arrangement. We require service providers to protect personal data through appropriate contractual, organisational and technical measures and to use it only as authorised, subject to applicable law.
7. International Data Transfers
The Company is incorporated in Hong Kong, and our service providers, payment partners, game publishers, distributors and technology infrastructure may be located in different countries or regions. As a result, personal data may be transferred to or accessed from locations outside the country in which you are located.
Before making a transfer that is subject to legal restrictions, we will assess the applicable requirements and implement any necessary measures, which may include contractual protections, assessments of the recipient or destination, security controls, notices, consent or other permitted transfer mechanisms. The exact mechanism depends on the jurisdictions and the specific transfer.
This Policy describes the possibility and purposes of cross-border processing; it does not itself replace any transfer assessment, contract, consent or other legal step required for a particular transfer.
8. Data Security
We use reasonable technical, organisational and administrative safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, encryption in transit where appropriate, secure authentication, logging, staff access restrictions, vendor review and incident-response procedures, as appropriate to the risks and systems involved.
No website, network or storage system can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential, using a secure device and notifying us promptly if you suspect unauthorised access to your account.
9. Personal Data Breaches
If we become aware of a personal data breach, we will assess and respond to it, take reasonable steps to contain and remediate the incident, preserve relevant records and make any notifications to regulators or affected individuals required by applicable law. The timing, recipients and content of any notification depend on the applicable legal threshold and circumstances of the incident.
10. Retention and Deletion
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining transaction and accounting records, handling complaints and disputes, preventing fraud, complying with legal obligations and establishing or defending legal claims.
Retention periods vary by data type and purpose. Order, payment, refund, tax or accounting records may need to be retained for a period prescribed by applicable law. Account, support, marketing and technical data are retained according to their purpose, operational need and applicable requirements. When data is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it, unless further retention is legally required or permitted.
11. Your Rights and Choices
Subject to applicable law and its conditions, you may have rights to request access to personal data, correction of inaccurate data, information about our processing, deletion or restriction of processing, objection to certain processing, data portability, or withdrawal of consent where processing relies on consent. You may also opt out of direct marketing communications using the unsubscribe mechanism provided or by contacting us.
We may need to verify your identity and clarify your request before acting. Some requests may be refused or limited where the law permits, including where retention is required by law, the data is needed for a transaction or legal claim, or the request would adversely affect the rights of others. We will respond within the time required by applicable law.
To exercise a right, contact [privacy@game-matrix.com]. If you are dissatisfied with our response, you may have the right to complain to the relevant data protection regulator in your jurisdiction.
12. Children and Age Restrictions
The Services are not intended for children who are below the minimum age permitted under the applicable law or the age stated on the relevant product or checkout page. If our Services are intended to be limited to adults, the operational website and account flow must implement that restriction consistently.
We do not knowingly collect personal data from children in breach of applicable law. If you believe a child has provided personal data to us improperly, contact [privacy@game-matrix.com]. We will assess the request and take steps required by applicable law. This section does not replace any age rating or age restrictions imposed by game publishers or payment providers.
13. Third-Party Websites and Services
The Services may contain links to third-party websites, games, payment pages or services. Those third parties may collect and process personal data under their own terms and privacy notices. We do not control third-party privacy practices and are not responsible for them, except to the extent required by applicable law. Please review the relevant third-party terms before using their services.
14. Changes to This Policy
We may update this Policy from time to time to reflect changes in the Services, our processing practices or applicable law. We will publish the updated version on the website and revise the “Last updated” date. Where required by law or where a change is material, we will provide additional notice or seek consent as required. Your continued use of the Services after an update does not override any consent requirement imposed by law.
15. Contact Us
Privacy contact: privacy@game-matrix.com Customer support: support@game-matrix.com Company legal name: SHYY TECHNOLOGY LIMITED Registered address: FLAT/RM 511 MING SANG INDUSTRIAL BUILDING 19-21 HING YIP ST KWUN TONG KL
Please do not send payment-card security codes or account passwords by email. For your protection, we may ask for reasonable verification before responding to a privacy request.
Appendix A — Malaysia Privacy Addendum
This Addendum applies to processing activities subject to Malaysian law. It supplements, and does not replace, the main Privacy Policy.
A1. Applicable framework
Where applicable to the relevant processing, we will handle personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended, and applicable regulations, orders and guidance. The application of Malaysian law depends on the statutory scope and facts of the processing; this Addendum does not imply that every provision applies to every user or activity.
A2. Notice and choice
We will provide information about the purposes of processing, categories of personal data, relevant disclosures and other information required by applicable law. Where required, users may exercise choices relating to direct marketing. Marketing messages will include an appropriate opt-out method where required.
A3. Access and correction
Subject to applicable law, users may request access to and correction of personal data by contacting privacy@game-matrix.com. We may request reasonable information to verify the request and will respond within the applicable legal timeframe.
A4. Cross-border transfers
Before transferring personal data from Malaysia to another country where section 129 or related requirements apply, we will assess and implement the transfer conditions and safeguards required by the law then in force, taking account of applicable official guidance. The mere publication of this Policy does not itself establish that a transfer is lawful.
A5. DPO and regulatory contact
Where the Company meets applicable criteria requiring appointment of a Data Protection Officer, it will make the appointment and any required notification or registration in accordance with the applicable rules. Do not publish a named DPO or local office unless confirmed. Relevant regulator: Personal Data Protection Commissioner, Malaysia (official website: https://www.pdp.gov.my).
A6. Breach response
We will assess suspected personal data breaches and make notifications to the Commissioner and affected individuals where required by the applicable Malaysian law, regulations and official guidance, within the relevant time limits.
Appendix B — Philippines Privacy Addendum
This Addendum applies to processing activities subject to Philippine law. It supplements, and does not replace, the main Privacy Policy.
B1. Applicable framework
Where applicable, we will process personal data in accordance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations and applicable National Privacy Commission issuances.
B2. Transparency, legitimate purpose and proportionality
We will process personal data for declared, specified and legitimate purposes, and will limit processing to data that is adequate, relevant, suitable, necessary and not excessive for those purposes, as required by applicable law.
B3. Data subject rights
Subject to legal conditions and exceptions, individuals may exercise rights available under Philippine law, including rights to be informed, access, rectification, erasure or blocking, object, damages, file a complaint and data portability where applicable. Requests may be submitted to privacy@game-matrix.com.
B4. Cross-border processing
Where personal data is transferred or made accessible outside the Philippines, we will implement safeguards and oversight appropriate to our role and the requirements of Philippine law. We will remain responsible for compliance to the extent imposed on us by law, including where processing is outsourced.
B5. Personal data breach notification
We will assess personal data breaches and notify the National Privacy Commission and affected data subjects where notification is required under the Data Privacy Act, its Implementing Rules and Regulations and applicable NPC rules. Notification requirements depend on the nature of the information, risk of serious harm and other statutory criteria.
B6. Regulatory contact
Relevant regulator: National Privacy Commission, Philippines (official website: https://privacy.gov.ph). Any local representative or DPO contact must be added only if actually appointed or legally required.
Publication Checklist — Internal, Not for Website
Confirm the exact Hong Kong company legal name, registration number if desired, and registered address.
Confirm final consumer-facing brand: GameMatrix or another brand. Remove all KachiShop references unless it is genuinely the operating brand.
Map data flows: account, order, game ID, payment, fulfilment, refunds/chargebacks, support, analytics, ad pixels and cloud locations.
List payment providers, game publishers, distributors, top-up providers, hosting, customer support and fraud vendors; determine independent-controller vs processor roles.
Confirm whether physical delivery ever occurs; remove shipping/address language if not applicable.
Confirm age policy and operational age controls.
Confirm Cookie/SDK inventory and deploy preference controls where required before stating they exist.
Set retention schedule by data type and legal/business purpose; avoid generic 5–10 year statement unless verified.
Confirm privacy contact email, support channel and whether DPO appointment/registration is required in each market.
Review applicable local law and consumer-facing translations before launch; ensure terms and actual checkout disclosures match the real business flow.