Privacy Policy — Hebat303

1. Introduction

This Privacy Policy ("Policy") describes how Hebat303 ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "the User", "the Player") who access or use the services available at https://hebat303.cam, including online casino games, sports betting markets, account management tools, promotional services, and customer support channels.

Hebat303 is committed to handling your personal data with transparency, respect, and in accordance with applicable data protection principles. We process personal data only for the purposes described in this Policy, and we do not sell your personal information to third parties for commercial gain.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which collectively govern your relationship with Hebat303.

2. Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes name, identification number, contact details, financial data, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In the context of this Policy, Hebat303 acts as the Data Controller in respect of all Player data.
• "Data Processor" — a third party that processes personal data on behalf of Hebat303 under contractual instruction and confidentiality obligations.
• "Sensitive Data" — a subset of personal data requiring heightened protection, including but not limited to government-issued identification numbers (such as Malaysian MyKad numbers), financial account details, and data relating to health or responsible gambling status.
• "Cookies" — small text files stored on your device by the Hebat303 website for the purposes of session management, preference storage, and analytics.

3. Personal Data We Collect

The categories of personal data that Hebat303 collects depend on how you interact with the Platform. The following table summarises the key data categories and examples of specific data points within each:

Data Category	Examples	Collection Trigger
Identity Data	Full legal name, date of birth, gender, nationality, MyKad or passport number	Account registration, KYC verification
Contact Data	Email address, mobile phone number, residential address (city, postcode)	Account registration, support interactions
Financial Data	Bank account numbers, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), transaction history, deposit and withdrawal records	Payment processing, withdrawal requests
Account Activity Data	Login history, session duration, game history, betting records, bonus usage, promotional participation	Active platform use
Technical Data	IP address, device type, browser type and version, operating system, cookie identifiers	Website access, automated collection
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions
Responsible Gambling Data	Self-exclusion status, deposit limits set, cooling-off period requests	Responsible gambling tool activation

We collect only the minimum data necessary for each processing purpose and do not retain data beyond its required retention period.

4. How We Collect Personal Data

Hebat303 collects personal data through the following channels:

4.1 Direct Collection

Data you provide voluntarily when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact our support team, or respond to a survey or promotional offer. This includes information entered into registration forms, uploaded identity documents, and details shared during live chat or email support interactions.

4.2 Automated Collection

When you access the Hebat303 website or use our services, we automatically collect technical data via server logs, cookies, and similar tracking technologies. This includes your IP address, device identifiers, browser fingerprint, pages visited, time spent on each page, and click-path data.

4.3 Third-Party Sources

In limited circumstances, we may receive personal data about you from third parties, including:

• Payment service providers (e.g., FPX gateway operators, DuitNow, Touch 'n Go eWallet) when confirming transaction status.
• KYC and identity verification service providers who verify identity documents against public registries.
• Fraud prevention and anti-money laundering (AML) screening services that flag suspicious transaction patterns.

5. Purposes of Processing

Hebat303 processes your personal data for the following specific and documented purposes:

1. Account Creation and Management — to establish, maintain, and administer your player account, including verifying eligibility, authenticating login, and managing account settings.
2. Identity and Age Verification (KYC) — to verify that you are at least 21 years of age and that the identity information you have provided is accurate, as required by applicable gaming regulations.
3. Payment Processing — to process deposits and withdrawals via your chosen payment method (FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC, USDT) in Malaysian Ringgit (MYR).
4. Regulatory Compliance and AML — to fulfil our obligations under anti-money laundering legislation, responsible gambling regulations, and any applicable reporting requirements.
5. Fraud Prevention and Security — to detect, investigate, and prevent fraudulent activity, bonus abuse, multiple account creation, and other prohibited conduct as defined in our Terms & Conditions.
6. Customer Support — to respond to your queries, complaints, and requests through live chat, email, and other support channels, and to maintain records of such communications for quality assurance.
7. Responsible Gambling — to administer self-exclusion, deposit limit, and cooling-off requests, and to monitor for signs of problematic gambling behaviour in accordance with our Responsible Gambling Policy.
8. Platform Improvement — to analyse aggregated usage data, optimise platform performance, and develop new features based on player activity patterns. Analysis at this level uses anonymised or pseudonymised data wherever possible.
9. Marketing Communications — where you have opted in to receive promotional communications, to send you relevant offers, bonus notifications, and platform updates. You may withdraw consent at any time by contacting our support team.

6. Legal Basis for Processing

Hebat303 processes personal data on the following legal bases, which vary depending on the purpose of processing:

• Contractual Necessity — processing required to fulfil the Terms & Conditions that constitute the contract between you and Hebat303 (e.g., account management, payment processing).
• Legal Obligation — processing required to comply with applicable legal and regulatory requirements (e.g., KYC/AML obligations, responsible gambling reporting).
• Legitimate Interest — processing necessary for Hebat303's legitimate business interests, including fraud prevention, platform security, and service improvement, where these interests are not overridden by your rights.
• Consent — processing based on your explicit, freely given consent, primarily in the context of optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

7.1 Hebat303 does not sell, rent, or trade your personal data to any third party for commercial marketing or advertising purposes, under any circumstances.

7.2 We share personal data with third parties only where necessary and in accordance with this Policy. The categories of third parties with whom we share data include:

• Payment Service Providers — FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong, AmBank), DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing services. Data shared is limited to the minimum required to process your transaction.
• Identity Verification Providers — third-party KYC services that verify your identity documentation and cross-reference against relevant registries. These providers process data under binding data processing agreements.
• Fraud and AML Screening Services — services that screen transactions and accounts against sanctions lists, politically exposed persons (PEP) databases, and known fraud patterns.
• IT Infrastructure Providers — cloud hosting, server management, and cybersecurity vendors who process data on our behalf under strict contractual confidentiality and security obligations.
• Regulatory and Law Enforcement Authorities — where we are legally required to disclose data in response to a valid legal order, court order, or regulatory direction from a competent authority.

8. Data Retention

Hebat303 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

Data Category	Retention Period	Basis
Account and Identity Data	Duration of account + 5 years post-closure	AML regulatory obligation
Transaction and Financial Records	7 years from transaction date	Financial reporting obligation
KYC Verification Documents	Duration of account + 5 years post-closure	AML regulatory obligation
Support Communications	3 years from last interaction	Legitimate interest (dispute resolution)
Technical/Log Data	12 months	Security monitoring
Marketing Consent Records	Until consent withdrawn + 3 years	Legal obligation (consent records)
Responsible Gambling Records	Duration of account + 5 years post-closure	Regulatory obligation

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

9. Security Measures

9.1 Hebat303 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Hebat303 platform.
• AES-256 encryption for data at rest, including all stored personal and financial data.
• Role-based access control (RBAC) ensuring that internal personnel can only access the data necessary for their specific job functions.
• Multi-factor authentication (MFA) for all internal systems containing personal data.
• Regular third-party security penetration testing and vulnerability assessments.
• 24/7 automated intrusion detection and incident response monitoring.

9.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Hebat303 will notify affected Players without undue delay and take all reasonably practicable steps to mitigate the impact of the breach.

9.3 You are responsible for maintaining the security of your own account credentials. Do not share your password with any third party. If you suspect unauthorised access to your account, contact our support team immediately.

10. Cookies & Tracking Technologies

10.1 Hebat303 uses cookies and similar technologies to operate the platform, improve your experience, and analyse usage patterns. The following cookie categories are in use:

• Strictly Necessary Cookies — essential for platform functionality, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing your ability to use the Platform.
• Performance Cookies — collect anonymised data about how visitors use the Platform (e.g., pages visited, errors encountered) to help us improve performance. No personally identifiable information is collected by these cookies.
• Functional Cookies — remember your preferences (e.g., preferred language, deposit method last used) to provide a more personalised experience across sessions.
• Analytics Cookies — used by our internal analytics tools to understand aggregate traffic patterns and user journeys. All data collected is anonymised before analysis.

10.2 Hebat303 does not deploy third-party advertising or behavioural tracking cookies. We do not use cross-site tracking technologies that would allow third-party advertisers to build profiles about you based on your activity on the Platform.

10.3 You may configure your browser to refuse or delete cookies at any time. Note that disabling strictly necessary cookies may impair the security and functionality of your account.

11. Your Data Rights

Subject to applicable law and the specific circumstances of your request, you hold the following rights in relation to your personal data held by Hebat303:

To exercise any of the above rights, please contact our Data Privacy team via live chat or email at [email protected]. We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days. In complex cases, this period may be extended by a further 30 days, and you will be notified accordingly.

Please note that certain rights may be limited where their exercise would conflict with our legal obligations — for example, we cannot delete KYC data that we are required to retain under AML legislation.

12. Children's Privacy and Age Restriction

Hebat303 is strictly an adult platform. Our services are available exclusively to individuals who are 21 years of age or older. We do not knowingly collect, store, or process the personal data of any individual under the age of 21.

All accounts are subject to mandatory KYC age verification before any financial transactions are permitted. Where we discover or have reasonable grounds to believe that a player is under the age of 21, we will immediately suspend the relevant account, refund any deposits to the originating payment method, and delete all associated personal data to the extent permitted by our legal retention obligations.

13. International Data Transfers

13.1 Hebat303 primarily processes and stores data within secure data centres in jurisdictions that maintain adequate data protection standards. In cases where personal data is transferred to a jurisdiction outside of Malaysia, we ensure that adequate safeguards are in place to protect your data to the same standard as required under this Policy.

13.2 Safeguards for international data transfers include contractual clauses that impose data protection obligations equivalent to those applicable in Malaysia, or the use of service providers operating in jurisdictions with recognised adequate data protection frameworks.

14. Changes to This Privacy Policy

14.1 Hebat303 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform functionality. The date of the most recent revision is displayed at the top of this page.

14.2 Where changes are material — meaning they meaningfully affect how we process your personal data — we will notify you via email or through a prominent notice on the Platform at least 14 days before the changes take effect. Your continued use of the Platform following the effective date constitutes acceptance of the revised Policy.

14.3 We encourage you to review this Policy periodically to stay informed of how your data is being handled.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the Hebat303 Data Privacy team through the following channels:

For concerns specifically relating to responsible gambling, self-exclusion tools, or deposit limit requests, please also visit our Responsible Gambling page. For the full terms governing your use of our platform, please refer to our Terms & Conditions.