Privacy Policy

JomMain is operated by Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor. For anything you send us through this website, we are the data user.

Campaign data works differently, and the difference matters. When you enter a brand’s campaign, that brand is the data user for the details you provide — the leads belong to them. We host the campaign and process those details on their instructions, as their service provider. If you want your details removed from a campaign, the brand running it is the party that decides; we will pass your request on and act on their instruction.

When you play a campaign game and claim a prize:

• the details that campaign’s form asks for — typically your name, and an email address or a Malaysian mobile number, plus any extra field the brand has configured
• your consent record: that you accepted the terms, when, which version of the consent text you were shown, and separately whether you opted in to marketing
• how you played — your score, and the gameplay events the session produced, which we re-simulate to check the score is genuine
• a random identifier stored in your browser so we can apply the campaign’s limit on plays per day

That random identifier is not a name and is never sent to us as it stands: it is combined with the campaign and a secret and stored only as a one-way hash. Clearing your browser storage clears it.

When you contact us through this website:

• whatever you put in your email to us — the site has no contact form and no sign-up

We use no third-party trackers, no advertising pixels and no cross-site analytics, on this website or on any campaign we run.

• to issue and verify your voucher, or to enter you into the draw you asked to enter
• to run the campaign fairly — checking a score is real, and applying the published limit on entries
• to contact you if you win
• to send you marketing from the brand, but only if you ticked the separate box asking for it
• to answer an enquiry you sent us

We process campaign data on the basis of the consent you give on the claim form, and to perform the campaign you chose to enter. We do not use campaign data for any purpose the campaign did not tell you about, and we do not sell it.

The claim form asks for two things and keeps them separate on purpose. Accepting the terms is required, because it is what lets us issue the voucher. Marketing consent is a second, unticked box — it is optional, and refusing it never costs you a prize.

You can withdraw either consent at any time by emailing privacy@jom-main.com with the campaign name. Withdrawing marketing consent stops further marketing. Withdrawing consent to the campaign itself may mean we can no longer verify or honour a voucher already issued to you.

• The brand running the campaign you entered. They are the data user for those details and can export them.
• Cloudflare, Inc. — hosting, content delivery, file storage, and the bot check on the claim form.
• Neon, Inc. — the managed database the platform stores data in.
• A party we are required to disclose to by law, or by an order of a court or regulator.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

Campaign data is stored in a database hosted in Singapore (Amazon Web Services, ap-southeast-1). Our database provider does not currently offer a Malaysian region, so data you give us is transferred outside Malaysia and stored there. We disclose this so that your consent to the campaign is an informed one. The same protections described in this policy apply to it wherever it sits.

Files that are part of a campaign — artwork, logos, audio — are served from Cloudflare’s global network, which caches them close to the people viewing them. Those files carry no personal data.

Campaign data is kept for 90 days after the campaign ends, and is then deleted automatically by a scheduled job. Deletion is not something anyone has to remember to run.

A client can ask us to delete their campaign’s data sooner, and can export it at any time while it is held. Emails you send us are kept for as long as we need them to deal with your enquiry.

• Everything travels over an encrypted connection.
• Each client’s data is separated at the database level, and every query is scoped to a single campaign’s owner. A brand cannot see another brand’s leads.
• Staff access needs a sign-in, and staff only see the campaigns they are attached to.
• Personal details are never displayed on a shared booth screen — a claim is always completed on the player’s own phone.

No system is perfectly secure. If a breach affects your data, we will act on it and tell the brand running your campaign so that affected players can be informed.

We use only what the service needs to work. None of it profiles you and none of it follows you to another website.

• Your language choice, so the page stays in English or Bahasa Malaysia.
• Your sound preference in the game.
• A random device identifier, used only for the plays-per-day limit described above.
• A short-lived queue of a score that could not be submitted because the connection dropped, so it is not lost.
• Routing and preview values that tell our servers which campaign a page belongs to.
• A bot check from Cloudflare Turnstile on the claim form, which is what stops a script harvesting vouchers.
• A sign-in session, for our staff and our clients’ staff only.

You can clear these through your browser at any time. Clearing them resets your language choice and your remaining plays for the day.

Campaigns are intended for adults unless the campaign says otherwise. We do not knowingly collect personal data from a child. If you believe a child has given us their details, write to privacy@jom-main.com and we will remove them.

This section is our notice under section 7 of the Personal Data Protection Act 2010. It is published in English and Bahasa Malaysia, and both versions say the same thing.

Under the Act you have the right to:

• ask what personal data we hold about you, and get a copy of it
• ask us to correct data that is wrong, incomplete or out of date
• withdraw your consent to us processing your data
• ask us to limit how your data is processed, including stopping direct marketing

To exercise any of these, email privacy@jom-main.com with the campaign name and the details you gave. We may ask you for enough information to confirm it is your data. We will respond within 21 days, as the Act requires. Where the brand running the campaign is the data user, we will pass your request to them and act on their instruction.

A request that we are not able to grant will be answered with the reason. If you are not satisfied with how we handled it, you may complain to the Personal Data Protection Commissioner of Malaysia.

The data user for this website is Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor, contactable at privacy@jom-main.com.

We may update this policy. The version and date at the top of this page tell you which text is current. Where a change materially affects data already collected, we will ask the brand running the campaign to tell affected players.

For anything in this policy, including an access or correction request, email privacy@jom-main.com. We are Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor.