Privacy Policy h5atas — How We Protect Your Personal Data

H5atas ("we", "the platform", "h5atas") understands that member trust is the foundation of everything we do. You share your personal information with us when you register, make a deposit, or use our services — and we take that responsibility seriously.

This Privacy Policy is written in plain, straightforward English — not convoluted legal language. We want you to fully understand what happens to your data, from the moment you register to the moment you decide to close your account.

H5atas is fully compliant with Malaysia Personal Data Protection Act 2010 (PDPA) in all aspects of member personal data collection, processing, and storage. We also adhere to international security standards to ensure your information remains protected at all times.

This policy applies to all h5atas products and services, including Live Casino, slots, poker, roulette, Sports Betting (Malaysia Super League, EPL, badminton, e-sports), lottery, and all financial transactions processed through our platform.

H5atas only collects data that is strictly necessary to provide services that are safe, seamless, and legally compliant. The following are the categories of data we may collect:

2.1 Registration & Identity Information

This information is collected during the registration or identity verification (KYC) process. It is used to verify your identity, confirm that you meet the minimum age requirement of 18, and comply with anti-money laundering (AML) obligations.

2.2 Financial & Transaction Information

This information is required to process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks, and FPX, and to ensure withdrawals are credited to the correct and verified account.

2.3 Gaming & Platform Activity Data

2.4 Technical & Device Data

Technical data helps us detect fraudulent activity, safeguard account security, and optimise the user experience on the h5atas platform.

H5atas only uses your personal data for purposes that are lawful, necessary, and directly related to the provision of our services. We will not use your data for any other purpose without first obtaining your consent.

If you no longer wish to receive marketing notifications from h5atas, you may opt out at any time by contacting our customer support or using the unsubscribe link in any marketing email.

H5atas does not sell, rent, or trade members' personal data to any third party for marketing purposes. This is a principle we do not compromise on.

However, in certain limited circumstances, h5atas may need to share your information with the following parties:

• Payment Providers: Payment gateways that handle deposit and withdrawal transactions, such as FPX processors, DuitNow, and e-wallet providers. They receive only the information necessary to process the specific transaction.
• Game Providers: Gaming software companies such as Evolution, Pragmatic Play, and other providers that supply Live Casino, slots, and poker games on the h5atas platform. Data shared is kept to a minimum and subject to strict confidentiality agreements.
• Regulatory Authority: Where h5atas is required by Malaysian law or a court order to disclose information to the relevant authorities (e.g. the police, the Malaysian Anti-Corruption Commission, or the financial intelligence unit).
• IT & Security Service Providers: Companies providing cloud computing, cybersecurity, and analytics services that help us operate the platform securely. They are bound by strict data processing agreements.

H5atas takes data security seriously, knowing that a breach not only harms our members but also erodes trust that takes years to build. The following are the key security measures we have in place:

• SSL 256-bit Encryption: All communications between your browser and h5atas servers are secured with industry-standard SSL encryption, ensuring no third party can intercept or read your data in transit.
• Two-Factor Authentication (2FA): h5atas offers and encourages the use of 2FA on all member accounts as an added layer of protection against unauthorised access.
• Data-at-Rest Encryption: Sensitive data stored in the h5atas database — including bank account details and identification numbers — is kept in encrypted format.
• 24/7 Monitoring: The h5atas security system continuously monitors for suspicious activity. Any unauthorised access attempts are detected and blocked automatically.
• Regular Security Audits: h5atas conducts regular security audits by independent experts to identify and address any system vulnerabilities.
• Internal Access Controls: Only h5atas staff who require access to specific data in order to carry out their authorised duties are permitted to do so, in accordance with the principle of least privilege.

H5atas uses cookies and similar tracking technologies to enhance the user experience, detect fraud, and understand how members use our platform. Cookies are small text files stored on your device when you visit the h5atas site.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect certain h5atas platform functions, such as the ability to log in or complete transactions.

H5atas retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under Malaysian law.

• Active account data: Retained for as long as your account is active and for a reasonable period following account closure.
• Financial transaction records: Retained for a minimum of 7 years in compliance with Malaysia's tax and anti-money laundering laws.
• KYC records: Retained for 5 years after the business relationship ends, in accordance with Bank Negara Malaysia guidelines.
• Customer support communication logs: Retained for 2 years for training and dispute resolution purposes.
• Technical data & system logs: Retained for 12 months for security and fraud detection purposes.

Once the designated retention period has elapsed, your data will be securely deleted or anonymised.

As a data subject under Malaysia's PDPA, you have the following rights regarding the personal data held by h5atas. We are committed to fulfilling these rights within a reasonable timeframe:

In certain operational circumstances, h5atas members' personal data may be processed or stored outside Malaysia — particularly by international gaming software providers and cloud computing service providers.

H5atas ensures that any cross-border data transfers occur only to destinations that provide a level of data protection equivalent to or exceeding Malaysia's PDPA standards. We bind all relevant parties through data processing agreements that require them to comply with our privacy policy.

The h5atas platform is strictly for individuals aged 18 and above. h5atas no intentionally collecting any personal data from individuals under the age of 18.

Should h5atas discover that personal data of a person under 18 years of age has been collected inadvertently, we will take immediate steps to delete that data and close the account in question.

If you have reason to believe that a minor has registered on h5atas, please notify us immediately at support@h5atas.bet.

H5atas may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons.

If we make significant changes — particularly those affecting how we use your data or your rights — we will notify you clearly through:

• Prominent notice on the h5atas homepage
• Email or message to registered members (for material changes)
• Update the "Last Updated" date at the top of this document

We encourage you to review this Privacy Policy periodically. Your continued use of the h5atas platform following any changes will be considered your acceptance of the updated Policy.

H5atas has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with Malaysia's PDPA and this Privacy Policy. If you have any questions, concerns, or wish to exercise your data rights, please contact:

H5atas will respond to all privacy-related requests within 30 working days as required under Malaysia's PDPA. For complex cases, this period may be extended to 60 days with written notice to you.