Privacy Policy

JomMain is operated by Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor. For anything you send us through this website, we are the data user.

Campaign data works differently, and the difference matters. When you enter a brand’s campaign, that brand is the data user for the details you provide — the leads belong to them. We host the campaign and process those details on their instructions, as their service provider. If you want your details removed from a campaign, the brand running it is the party that decides; we will pass your request on and act on their instruction.

When you play a campaign game and claim a prize:

• the details that campaign’s form asks for — typically your name, and an email address or a mobile number, plus any extra field the brand has configured
• your consent record: that you accepted the terms, when, which version of the consent text you were shown, and separately whether you opted in to marketing
• how you played — your score, and the gameplay events the session produced, which we re-simulate to check the score is genuine
• a random browser identifier used to estimate unique players within a campaign and investigate suspected cheating

That random identifier is not your name. Your browser sends it to our server, which combines it with the campaign and a secret and stores only a one-way hash in the play record. Clearing browser storage removes the browser’s identifier; it does not delete records already held by us.

When you contact us through this website:

• whatever you put in your email to us — the site has no contact form and no sign-up

Campaigns use our own first-party analytics. We use no third-party trackers on campaign or game pages, and no advertising pixels or cross-site tracking.

On the public marketing pages at jom-main.com, we use Cloudflare Web Analytics to understand visits, referral sources and page-loading performance. It reports information such as the page visited, referring website, browser, device type, country and loading timings.

Cloudflare describes this service as cookie-free and does not use it to track individual visitors across websites. We do not send campaign player identifiers, contact details, scores, claim details or consent records to this service.

This service is limited to the production marketing website. It is excluded from campaign and game pages, admin and owner consoles, legal pages including this notice, staging sites and local development.

• to issue and verify your voucher, or to enter you into the draw you asked to enter
• to run the campaign fairly — checking a score is real, and applying the published limit on entries
• to measure campaign activity using first-party analytics, including approximate unique-player counts
• to contact you if you win
• to send you marketing from the brand, but only if you ticked the separate box asking for it
• to answer an enquiry you sent us

We process campaign data on the basis of the consent you give on the claim form, and to perform the campaign you chose to enter. We do not use campaign data for any purpose the campaign did not tell you about, and we do not sell it.

The claim form asks for two things and keeps them separate on purpose. Accepting the terms is required, because it is what lets us issue the voucher. Marketing consent is a second, unticked box — it is optional, and refusing it never costs you a prize.

You can withdraw either consent at any time by emailing support@jom-main.com with the campaign name. Withdrawing marketing consent stops further marketing. Withdrawing consent to the campaign itself may mean we can no longer verify or honour a voucher already issued to you.

• The brand running the campaign you entered. They are the data user for those details and can export them.
• Cloudflare, Inc. — hosting, content delivery, file storage, and the bot check on the claim form.
• Neon, Inc. — the managed database the platform stores data in.
• A party we are required to disclose to by law, or by an order of a court or regulator.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

Campaign data is stored in Singapore using Neon’s managed database on Amazon Web Services. This means your personal data is transferred outside Malaysia to operate the campaign. The same protections described in this policy apply to that data.

Files that are part of a campaign — artwork, logos, audio — are served from Cloudflare’s global network, which caches them close to the people viewing them. Those files carry no personal data.

Live sample demos collect real contact details when you choose to try the claim form. They are used to demonstrate claiming and to send a sample copy only if you request one. Demo leads, plays and analytics events are deleted on a rolling 30-day schedule, including while the demo remains open. Expired sample vouchers, email-copy metadata and claim records are also purged. After deletion, an identity may claim another sample; this does not create entitlement to a real reward. Marketing consent is separate, optional and unticked by default.

For ordinary reward campaigns, once a campaign has been over for 90 days, a scheduled job automatically deletes lead details, play records and analytics events that are older than that period. If a campaign has no end date, this deletion period does not begin until an end date is set.

For ordinary reward campaigns, voucher and published prize-award records, redemption staff labels and access/action audit records are retained separately and are not deleted by this scheduled purge. Deleting a lead removes its contact details from linked voucher and prize views without cancelling a voucher that is still redeemable.

A client can ask us to delete their campaign’s data sooner, and can export it at any time while it is held. Emails you send us are kept for as long as we need them to deal with your enquiry.

• Everything travels over an encrypted connection.
• Each client’s data is separated at the database level, and every query is scoped to a single campaign’s owner. A brand cannot see another brand’s leads.
• Staff access needs a sign-in, and staff only see the campaigns they are attached to.
• Personal details are never displayed on a shared booth screen — a claim is always completed on the player’s own phone.

No system is perfectly secure. If a breach affects your data, we will act on it and tell the brand running your campaign so that affected players can be informed.

We use only what the service needs to work. None of it profiles you and none of it follows you to another website.

• Your language choice, so the page stays in English or Bahasa Malaysia.
• Your choice to mute or unmute game audio.
• A random browser identifier for approximate unique-player analytics and investigation of suspected cheating.
• A first-party analytics session identifier and queued analytics events, used to measure campaign activity and retry delivery when a connection fails.
• A short-lived queue of a score that could not be submitted because the connection dropped, so it is not lost.
• Routing and preview values that tell our servers which campaign a page belongs to.
• A bot check from Cloudflare Turnstile on the claim form, which is what stops a script harvesting vouchers.
• A sign-in session, for our staff and our clients’ staff only.

You can clear these through your browser at any time. Doing so resets saved language and audio choices and browser identifiers, may discard unsent scores and analytics events, and may sign you out. It does not reset server-side traffic limits or delete records already held by us.

Campaigns are intended for adults unless the campaign says otherwise. We do not knowingly collect personal data from a child. If you believe a child has given us their details, write to support@jom-main.com and we will remove them.

This section is our notice under section 7 of the Personal Data Protection Act 2010. It is published in English and Bahasa Malaysia, and both versions say the same thing.

Under the Act you have the right to:

• ask what personal data we hold about you, and get a copy of it
• ask us to correct data that is wrong, incomplete or out of date
• withdraw your consent to us processing your data
• ask us to limit how your data is processed, including stopping direct marketing

To exercise any of these, email support@jom-main.com with the campaign name and the details you gave. We may ask you for enough information to confirm it is your data. We will respond within 21 days, as the Act requires. Where the brand running the campaign is the data user, we will pass your request to them and act on their instruction.

A request that we are not able to grant will be answered with the reason. If you are not satisfied with how we handled it, you may complain to the Personal Data Protection Commissioner of Malaysia.

The data user for this website is Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor, contactable at support@jom-main.com.

We may update this policy. The version and date at the top of this page tell you which text is current. Where a change materially affects data already collected, we will ask the brand running the campaign to tell affected players.

For anything in this policy, including an access or correction request, email support@jom-main.com. Demo support: Fitri, support@jom-main.com. We are Algomatrix Enterprise, SSM 202403131295 (CT0136618-D), No. 1, Jalan PJU 3/29, Section 13, Kota Damansara, 47810 Petaling Jaya, Selangor.