Hbm4 Privacy Policy – Our Commitment to Protecting Malaysian Players' Personal Data

hbm4 takes the responsibility of protecting each platform user's personal data extremely seriously. This Privacy Policy outlines our practices regarding the collection, use, storage, disclosure, and processing of personal data in connection with the use of the online entertainment platform hbm4 accessible via hbm4.my.

This Privacy Policy applies to all individuals who register as members, access the platform, or interact with any services provided by hbm4 — including the use of slot games, live casino, card games, and all other features available on the platform. It also applies to visitors who browse the platform hbm4 without registering as a member.

hbm4 operates in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and all regulations made thereunder. We are committed to ensuring that all personal data processing on our platform is lawful, fair, and transparent, in line with the principles set out in the PDPA.

hbm4 only collects personal data that is strictly necessary to provide our platform services safely and effectively. The following are the categories of personal data we may collect:

hbm4 does not collect sensitive categories of personal data such as medical information, religious beliefs, or political views unless required by law or with your explicit consent. Children's personal data is not collected under any circumstances — the platform hbm4 is exclusively for individuals aged 18 and above.

hbm4 collects personal data through a variety of channels, all in a transparent and lawful manner. The methods we use to collect data include:

• Account Registration Form: Information you provide when registering a new hbm4 account — your name, Malaysian phone number, email address, and password.
• KYC (Know Your Customer) Process: Identity documents submitted for identity and age verification, including copies of your MyKad or Malaysian passport.
• Financial Transactions: Information recorded when you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX (Maybank2u or CIMB Clicks), or withdraw your winnings.
• Platform Usage: Technical data collected automatically when you access and use the hbm4 platform, including IP address, device information, and session history.
• Customer Support Interactions: Information you share when contacting the hbm4 support team via Live Chat or email for assistance.
• Cookies & Tracking Technologies: hbm4 uses cookies and similar technologies to enhance the user experience, analyse usage patterns, and maintain the security of your login session.
• Authorised Third Parties: In certain cases, hbm4 may receive data from payment service providers or identity verification bodies that we engage, strictly within the boundaries permitted by law.

hbm4 uses personal data collected solely for legitimate, clearly stated purposes. We will not use your data for any other purpose without obtaining fresh consent from you. Key purposes for which personal data is used at hbm4 include:

• Account Management and Verification: To create, verify, and maintain your hbm4 user account, including the KYC and age verification processes as required.
• Platform Service Provision: To give you full access to all games and features available on hbm4, including slots, live casino, and card games.
• Financial Transaction Processing: To securely and accurately process deposits in MYR and withdrawals to your preferred Malaysian payment method.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, and any security threats to the hbm4 platform and user accounts.
• Legal Compliance: To fulfil hbm4's legal obligations under the PDPA 2010, the Anti-Money Laundering Act (AMLA), and other applicable Malaysian legislation.
• Customer Support: To provide assistance, address enquiries, and effectively resolve complaints raised by hbm4 members.
• Personalising Your Gaming Experience: To personalise content, game recommendations, and promotional offers based on your preferences and playing habits on hbm4.
• Responsible Gaming Programme: To monitor playing patterns and identify users who may require assistance or support relating to gambling habits, in line with hbm4's commitment to responsible entertainment.
• Service Communications: To send you important notifications relating to your account, platform updates, and relevant security information.

hbm4 understands that your trust is something we never take for granted. We do not sell your personal data to any third party. However, in certain limited circumstances, hbm4 may need to share your personal data with the following categories of third parties — and only within the limits permitted by law and for clearly defined purposes:

• Payment Service Providers: The eWallet and online banking providers we work with (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX) receive the transaction information necessary to process your deposits and withdrawals. All these providers are held to strict security standards.
• Identity Verification Service Providers: The third-party KYC providers we use to verify the identity and age of new members, in accordance with anti-money laundering legal requirements.
• Game Software Providers: Game developers providing slots, live casino, and card games for the hbm4 platform may receive game statistical data required for technical operations — no personal identity data is shared without a clear and justified need.
• Malaysian Authorities: hbm4 will disclose personal data to the relevant Malaysian authorities when required by law, court order, or a legitimate official investigation — including to anti-money laundering authorities.
• Professional Advisors: Lawyers, accountants, or auditors providing professional advice to hbm4, subject to strict confidentiality obligations.

All third parties that receive personal data from hbm4 are bound by strict data protection agreements and are not permitted to use such information for any purpose other than what is specified in their agreement with us. hbm4 ensures that every data transfer complies with Malaysia's PDPA 2010.

hbm4 invests seriously in cybersecurity infrastructure to ensure every member's personal data is protected to the highest achievable standard. The security measures we have implemented include:

• 256-bit SSL Encryption: All communications between your browser and hbm4's servers are encrypted using 256-bit SSL — the same security protocol used by Malaysian financial institutions such as Maybank and Public Bank.
• Data-at-Rest Encryption: Personal data stored in hbm4's databases is encrypted using robust cryptographic algorithms, ensuring that even in the event of unauthorised access, the data remains unreadable.
• Strict Access Controls: Only authorised hbm4 personnel with a clear operational need are permitted to access members' personal data. All access is logged and continuously monitored.
• 24/7 Threat Monitoring: hbm4's security monitoring system operates around the clock to detect and respond to any threats or suspicious activity affecting the platform and its users' data.
• Regular Penetration Testing: hbm4 conducts regular security assessments carried out by independent cybersecurity experts to identify and address any vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): hbm4 supports and encourages the use of two-factor authentication to add an extra layer of protection to your account, beyond your password alone.

As a platform user hbm4 and as a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you hold the following rights, which we fully respect and are ready to help you exercise:

To exercise any of the above rights, please contact our data protection team hbm4 via email at [email protected] stating the type of request and your account details. We will process your request within 21 working days as required under the PDPA, or earlier where possible. Certain rights may be subject to legal requirements that prevent their full exercise — we will inform you clearly should this be the case.

hbm4 uses cookies and similar tracking technologies to enhance the user experience, analyse platform usage patterns, and ensure security features function correctly. The following types of cookies are used:

• Essential Cookies (Required): These cookies are essential for the basic functioning of the hbm4 platform — including maintaining your login session, remembering language preferences, and ensuring transaction security. They cannot be disabled.
• Performance & Analytics Cookies: Used to gather information on how users interact with the hbm4 platform — including the most frequently visited pages, time spent, and navigation patterns. This data helps us improve the overall user experience.
• Functional Cookies: Allows hbm4 to remember your preferences — such as favourite games, display settings, and other choices — to deliver a more personalised experience.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and safeguard the integrity of your login sessions on hbm4.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the platform. hbm4. For more information on managing cookies in Chrome, Safari, or Firefox, please refer to the official documentation for your browser.

hbm4 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required under applicable Malaysian law. The following is a general guide to data retention periods at hbm4:

• Active Account Data: Retained for as long as your hbm4 account remains active and you continue to use our services.
• Data After Account Closure: Following account closure, hbm4 retains your personal data for a minimum period of 7 years in accordance with Malaysia's anti-money laundering legal requirements — after which the data is securely deleted or anonymised.
• Financial Transaction Records: All transaction records in MYR (RM) are retained for 7 years in accordance with Malaysian taxation and financial regulatory requirements.
• Security Logs: Access and security logs are retained for 2 years for investigation purposes in the event of a security incident or fraudulent activity.
• Marketing Data (with consent): Retained until you withdraw consent or request deletion — whichever comes first.

Once the retention period has lapsed, your personal data will be securely deleted or anonymised so that it can no longer be linked to you personally. hbm4 has systematic data deletion procedures that are regularly audited.

hbm4 is an exclusive platform for individuals aged 18 and above. We do not knowingly collect, store, or process any personal data belonging to children under the age of 18. If you believe a child has registered on our platform, please contact us immediately at [email protected] and we will investigate and close the account in question as promptly as possible.

hbm4 implements a rigorous KYC process that requires age verification before an account is fully activated. Notwithstanding this, should there be any doubt regarding a user's age, hbm4 reserves the right to request additional verification documents and to suspend an account until verification is complete.

In the course of operating the platform, hbm4 may utilise server services or technology providers located outside Malaysia. In such cases, hbm4 ensures that any transfer of personal data outside Malaysia is carried out with adequate safeguards in place, including:

• Ensuring that the recipient country maintains data protection laws equivalent to or more stringent than Malaysia's PDPA 2010.
• Applying internationally recognised standard data transfer agreements with overseas service providers.
• Limiting data transferred to the minimum required for technical purposes only, with strict access controls in place.
• Ensuring all overseas providers comply with ISO 27001 or equivalent standards for information security management.

hbm4 prioritises the use of infrastructure located in Malaysia or the Asian region that upholds high privacy standards, in order to minimise the need for cross-border data transfers.

hbm4 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements. You will be notified of any material changes via:

• Pop-up notifications within your hbm4 account upon your next login.
• Notification emails sent to your registered email address.
• Updating the "Last Updated" date at the top of this document.

We encourage you to review this Privacy Policy periodically. Your continued use of the platform hbm4 following the implementation of any changes will be considered your acceptance of the updated policy.

If you have any questions, concerns, or wish to exercise your rights regarding personal data, please contact our Data Protection Officer hbm4 through the following channels: