Privacy Policy — Hengongbet Platform

Introduction

This Privacy Policy ("Policy") is issued by Hengongbet ("Company", "Platform", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "Player", "User") who access, register on, or use any services offered through the hengongbet website at hengongbet.cam and any associated mobile-optimised or application-based services (collectively, the "Platform").

Hengongbet is an online casino and sports betting platform serving players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities. As part of operating a regulated online gaming environment, we are required to collect and process personal data for purposes including account administration, identity verification (KYC), financial transaction processing, anti-money laundering (AML) compliance, responsible gaming management, and customer support.

We take your privacy seriously. This Policy has been written in plain language and structured for clarity so that you understand exactly what data we collect, why we collect it, how we use it, and what rights you have over it. If you have any questions not answered by this Policy, please contact us using the details in Section 15.

Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly. This includes your name, email address, MyKad or passport number, date of birth, phone number, IP address, and payment account details.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, deletion, or destruction.
• "Data Controller" means hengongbet in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of hengongbet under a contractual data processing agreement (e.g., payment processors, game providers, cloud infrastructure providers).
• "KYC" means Know Your Customer — the identity and age verification process required by AML regulations and responsible gaming obligations.
• "Sensitive Data" means special categories of personal data, such as government-issued identity document numbers, financial account details, and information relating to problem gambling disclosures.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and user experience personalisation.

Data We Collect

Hengongbet collects personal data through several channels: information you provide directly during registration and account operation, data generated automatically through your use of the Platform, and information received from third-party service providers as part of our verification and payment processing obligations.

3.1 Information You Provide Directly

• Full legal name (as shown on your government-issued ID — MyKad or passport).
• Date of birth (to verify you are aged 21 or above).
• Email address and contact phone number.
• Residential address (street, city, postcode — e.g., Petaling Jaya, Selangor or Bangsar, Kuala Lumpur).
• Username and password (password is stored in hashed, non-reversible form).
• Payment method details: e-wallet account identifiers (Touch 'n Go, Boost, GrabPay), bank account details (Maybank, CIMB, Public Bank, Hong Leong), DuitNow IDs, FPX bank codes, or cryptocurrency wallet addresses (BTC, USDT).
• KYC identity documents: scans or photographs of your MyKad, passport, or other government-issued photo ID; proof of address documents; proof of payment method ownership.
• Communications: messages, support tickets, and live chat transcripts submitted to hengongbet's support team.
• Responsible gaming disclosures: self-declared deposit limits, self-exclusion requests, or problem gambling disclosures.

3.2 Data Collected Automatically

• IP address and geolocation data (country and city level) at login and during sessions.
• Device information: browser type and version, operating system, device model, screen resolution.
• Session data: login and logout timestamps, session duration, pages visited, games played, bets placed, wager amounts, and game results.
• Cookie and tracking data (see Section 8 for full details).
• Transaction logs: all deposit and withdrawal events, amounts, timestamps, and payment method identifiers.

3.3 Data Received from Third Parties

• Identity verification results from third-party KYC service providers.
• Payment confirmation and fraud risk signals from payment processors and e-wallet operators (Touch 'n Go, DuitNow/PayNet, FPX/MyClear, CIMB, Maybank, and others).
• AML screening results from sanctions list and politically exposed persons (PEP) screening services.

How We Use Your Data

Hengongbet processes your personal data for the following specific purposes. We do not use your data for any purpose not listed below without your explicit consent or as required by applicable law.

We will never sell your personal data to third-party advertisers, data brokers, or marketing companies. Your data is not a product — it is information you have entrusted to us for specific, stated purposes.

Legal Basis for Processing

Hengongbet processes your personal data under the following legal bases:

• Contract Performance: Processing is necessary to fulfil our obligations under the Terms and Conditions you agreed to when creating your account. This includes account administration, payment processing, and bonus delivery.
• Legal Obligation: We are required to process certain data to comply with AML obligations, KYC requirements, sanctions screening, and responsible gaming regulations imposed by our licensing authority.
• Legitimate Interest: We process data for fraud prevention, platform security, responsible gaming monitoring, and service improvement where these interests are not outweighed by your data protection rights.
• Consent: Where processing is based on consent — such as sending marketing emails about promotions, new games, or Liga Super Malaysia and EPL betting markets — you may withdraw that consent at any time by contacting support or updating your communication preferences in your account settings.

Data Sharing & Disclosure

Hengongbet does not sell, rent, or trade your personal data. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.

6.1 Service Providers and Data Processors

We engage third-party service providers who process data on our behalf under binding data processing agreements that prohibit them from using your data for any purpose beyond the contracted service. These include:

• Payment processors: DuitNow/PayNet, FPX/MyClear, Touch 'n Go eWallet operator, Boost operator, GrabPay operator, and direct banking integrations with Maybank, CIMB, Public Bank, Hong Leong, and others — for processing deposits and withdrawals.
• KYC verification providers: Third-party identity verification services that cross-reference your submitted documents against official identity databases.
• Game providers: Software providers (e.g., Pragmatic Play, Evolution Gaming, Microgaming, Playtech) receive the minimum data required to render game content and record round outcomes in their systems. These providers operate under their own data protection frameworks and are subject to independent regulation.
• Cloud infrastructure: Server, database, and content delivery infrastructure providers who store and transmit platform data under strict security agreements.
• Customer support tools: Live chat and ticketing system providers that facilitate communication between players and the hengongbet support team.

6.2 Legal and Regulatory Disclosure

We may disclose personal data to competent authorities, law enforcement bodies, or regulatory agencies where we are legally required to do so, including but not limited to: court orders, subpoenas, AML suspicious activity reporting obligations, and requests from our licensing authority.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of hengongbet's business, your personal data may be transferred to the acquiring entity. We will notify affected players in advance via registered email in the event of any such transfer.

Data Retention

Hengongbet retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and contractual obligations.

• Active Accounts: Personal data associated with an active account is retained for the lifetime of the account plus a minimum of five (5) years following account closure, in compliance with AML record-keeping obligations.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years from the date of the last transaction on the account, in accordance with AML regulatory requirements.
• Transaction Records: All financial transaction logs, including deposits, withdrawals, and wager histories, are retained for a minimum of seven (7) years.
• Support Communications: Live chat transcripts and email correspondence are retained for two (2) years from the date of the communication.
• Marketing Data: Where consent for marketing was given and has not been withdrawn, marketing preference data is retained until consent is withdrawn or the account is closed.
• Anonymised Data: Aggregated, anonymised analytics data (from which no individual can be identified) may be retained indefinitely for platform improvement purposes.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. If you request erasure of your data and there is no overriding legal basis to retain it, we will process the deletion request within 30 calendar days.

Cookies & Tracking Technologies

Hengongbet uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate the Platform, maintain your login session, and improve your user experience. Below is a summary of the categories of cookies we use:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing identifiers. These cannot be disabled without breaking the Platform's core functionality.
• Functional Cookies: Store your preferences such as language selection, last accessed game lobby section, and notification settings. These enhance your experience but are not strictly required for basic operation.
• "Analytics Cookies: Collect anonymised, aggregated data about how players navigate the Platform — which pages are visited, how long sessions last, and which features are most used. This data is used purely for internal platform improvement and is not shared with advertising networks.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and unusual login patterns. These include device fingerprinting tokens and geolocation verification markers.

You may configure your browser to block or delete cookies; however, doing so may impair the functionality of the Platform, including preventing you from logging into your account. Hengongbet does not use third-party advertising or tracking cookies that serve ads or build cross-site user profiles.

Data Security

Hengongbet implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, and destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and hengongbet servers is encrypted using TLS 1.2 or higher (256-bit SSL encryption). This includes login credentials, payment data, and KYC document uploads.
• Encryption at Rest: Sensitive data fields — including identity document references, financial account identifiers, and personally identifiable data — are encrypted in our database using AES-256 encryption.
• Password Security: Passwords are never stored in plain text. We use bcrypt hashing with individual salt values to ensure that even in a database breach scenario, raw passwords cannot be recovered.
• Access Controls: Access to player personal data within hengongbet's internal systems is restricted to personnel with a legitimate need, governed by role-based access control (RBAC) and logged audit trails.
• Two-Factor Authentication (2FA): Available to all players as an optional additional layer of login security. Hengongbet strongly encourages all players to enable 2FA on their accounts.
• Penetration Testing: The Platform undergoes periodic security assessments to identify and remediate vulnerabilities.

While we take all reasonable measures to protect your data, no internet-based system can be guaranteed to be completely secure. If you believe your account has been compromised, please contact hengongbet support immediately via 24/7 live chat.

Your Data Rights

You have the following rights regarding your personal data held by hengongbet. To exercise any of these rights, please contact our support team using the details in Section 15. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days.

• Right of Access: You have the right to request a copy of the personal data hengongbet holds about you (a Subject Access Request). We will provide this in a structured, commonly used, machine-readable format within 30 days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Please note that changes to name, date of birth, or identity-critical fields require supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes it was collected, or where you withdraw consent on which processing was based — provided there is no overriding legal obligation requiring us to retain it (e.g., AML retention requirements).
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on contract performance and is carried out by automated means, you may request that we transfer your data to you or to another service provider in a structured format.
• Right to Object: You have the right to object to processing based on legitimate interests, including for marketing purposes. Where marketing is concerned, you may opt out at any time via your account settings or by contacting support.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Please note that exercising certain rights — such as erasure of account data — may result in the closure of your account, as we cannot operate an account without the minimum personal data required for KYC, AML compliance, and payment processing.

Minors & Age Policy

Hengongbet's services are strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from persons under the age of 21. Our mandatory KYC process — which requires submission of a government-issued photo ID (MyKad or passport) — is specifically designed to verify that all account holders meet this age requirement before any real-money transaction is processed.

If we discover that an account has been registered by or on behalf of a person under the age of 21, we will immediately suspend the account, delete all associated personal data to the extent not required for legal compliance, return any deposits made to the originating payment method, and forfeit any bonus-derived balances.

International Data Transfers

Hengongbet operates under international online gaming licensing and uses cloud infrastructure and service providers that may process or store your data outside of Malaysia. Where personal data is transferred internationally, hengongbet takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections described in this Policy.

These safeguards include contractual data processing agreements with all third-party processors that bind them to data protection standards consistent with internationally recognised frameworks, including appropriate security measures, access restrictions, and data retention limits.

By using hengongbet, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia, where data protection laws may differ from those applicable in Malaysia, subject to the safeguards described above.

Third-Party Services

The hengongbet Platform may contain links to pages or functionality provided by third parties, including game content iframes served by licensed game providers (e.g., Pragmatic Play, Evolution Gaming). When you interact with third-party content or services, those interactions are governed by the third party's own privacy policy, not this Policy.

Hengongbet is not responsible for the privacy practices, data collection, or data handling of any third-party service provider, game studio, or linked external resource. We recommend reviewing the privacy policies of any third-party service you interact with.

For game providers specifically: the minimum data necessary to render game content and record outcomes is shared with game providers as described in Section 6.1. Game providers do not receive your full personal profile, payment history, or identity documents.

Changes to This Privacy Policy

Hengongbet reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, where we introduce a new category of data collection, a new purpose for processing, or a new category of third-party recipient — we will notify registered players via their registered email address at least 14 days before the changes take effect.

Minor changes (such as clarifications of existing practices, corrections of typographical errors, or structural improvements that do not affect the substance of the Policy) may be made without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the Platform after the effective date of any change to this Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you must cease using the Platform and close your account.

Contact Us

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your personal data, please contact the hengongbet Data Protection team through the following channels:

• Live Chat: Available 24/7 directly through the Platform. Average response time under 5 minutes. Select "Privacy / Data Request" from the support category menu.
• Email: [email protected] (plain text — not a clickable link). Please include the subject line "Privacy Policy Inquiry" or "Data Subject Request" as appropriate.
• Response Timeframe: We acknowledge all data subject requests within 5 business days and provide a substantive response within 30 calendar days.
• Support Languages: English and Bahasa Malaysia.