Privacy Policy — 365huat

1 Introduction

This Privacy Policy (the "Policy") sets out the practices of 365huat (hereinafter "365huat", "we", "us", or "our") with respect to the collection, use, storage, disclosure, and protection of personal data belonging to users (hereinafter "User", "you", or "your") of the 365huat online platform accessible at https://365huat.cam (the "Platform").

365huat operates as an online sports betting and live casino entertainment platform serving players in Malaysia and other permitted jurisdictions. We are committed to handling your personal data responsibly, transparently, and in compliance with applicable data protection legislation, including Malaysia's Personal Data Protection Act 2010 (PDPA) and any other applicable data privacy regulations.

By registering an account, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you should not use the Platform.

2 Definitions

For the purposes of this Policy, the following terms shall carry the meanings assigned below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" refers to 365huat as the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of 365huat under a data processing agreement.
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the Processing of your Personal Data.
• "Cookies" means small text files stored on your device by a website to retain session and preference information.
• "KYC" means Know Your Customer — the identity verification process required for regulatory compliance.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, as amended or supplemented from time to time.

3 Data We Collect

365huat collects the following categories of Personal Data from Users, depending on the context in which it is provided or generated:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification
• Date of birth (for age verification — minimum age 21 years)
• Malaysian MyKad number or passport number (where required for KYC)
• Residential address, including postcode and state
• Email address and Malaysian mobile phone number
• Username and encrypted password

3.2 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts MYR and timestamps
• Payment method identifiers (e-wallet account references, bank account numbers in masked form, cryptocurrency wallet addresses)
• Bonus and promotional credit history
• Wagering and game activity records for KYC, AML, and responsible gambling purposes

3.3 Technical & Device Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser version
• Session logs, login timestamps, and page interaction data
• Cookie identifiers and similar tracking technologies (see Section 7)

3.4 Communications Data

• Records of live chat, email, and support ticket communications between you and 365huat
• Responses to surveys or feedback requests (where voluntarily provided)
• Marketing preference selections and communication opt-in/opt-out records

4 How We Use Your Data

365huat uses your Personal Data for the following purposes:

5 Legal Basis for Processing

365huat processes your Personal Data only where it has a valid legal basis to do so. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing required to perform our obligations under the User Agreement — including operating your account, processing transactions, and delivering platform services.
• Legal Obligation: Processing required to comply with applicable laws — including KYC identity verification, AML obligations, age verification, and regulatory reporting requirements.
• Legitimate Interest: Processing carried out in pursuit of 365huat's legitimate business interests — including fraud prevention, platform security, responsible gambling monitoring, and product analytics — where those interests are not overridden by your rights.
• Consent: Processing based on your freely given, informed consent — primarily in connection with direct marketing communications and personalised promotional offers. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

365huat does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We may, however, share your Personal Data with the following categories of recipients under appropriate safeguards:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who process data on our behalf, including: payment processors (including operators of Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank partners such as Maybank, CIMB, Public Bank, and Hong Leong Bank); KYC and identity verification providers; fraud detection and AML compliance services; customer support platforms; cloud hosting and infrastructure providers; and analytics service providers. All such providers are bound by data processing agreements and are required to process your data only for the specified purposes and under adequate security measures.

6.2 Regulatory Authorities and Law Enforcement

365huat may disclose your Personal Data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where required to do so by applicable law, court order, or regulatory direction. We will, where permissible, notify you of such disclosures.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any changes to this Policy that may result.

7 Cookies & Tracking Technologies

365huat uses cookies and similar technologies on its Platform for the following purposes:

• Essential Cookies: Required for the Platform to function correctly — including session management, authentication, and security functions. These cannot be disabled without affecting core functionality.
• Functional Cookies: Store your preferences such as language, display settings, and previously selected payment methods to improve your experience.
• Analytics Cookies: Allow us to understand how Users navigate the Platform so we can optimise performance and usability. Data collected via analytics cookies is aggregated and anonymised where possible.
• Security Cookies: Used to detect fraudulent activity, identify suspicious session behaviour, and protect the integrity of the Platform.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of some Platform features.365huat does not use third-party advertising cookies or cross-site tracking for commercial advertising purposes.

8 Data Retention

365huat retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status and for period of five (5) years following account closure, in compliance with AML and financial record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification, or such longer period as may be required by applicable law.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction for audit and regulatory compliance purposes.
• Support Communications: Retained for up to three (3) years following resolution of the relevant support interaction.
• Marketing Preference Records: Retained until you withdraw consent or for three (3) years following your last interaction with our marketing communications, whichever is earlier.

Upon expiry of the applicable retention period, your Personal Data will be securely deleted, anonymised, or archived in accordance with our data disposal procedures.

9 Data Security

365huat implements industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our Platform
• Encrypted storage of sensitive data, including passwords (stored using one-way cryptographic hashing) and payment identifiers
• Role-based access controls limiting employee access to Personal Data to those with a legitimate operational need
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure
• Two-factor authentication (2FA) options available to Users to protect account access
• Continuous real-time monitoring for anomalous activity, unauthorised access attempts, and potential data breaches

In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected Users, 365huat will notify relevant authorities and affected Users as required by applicable data protection law, within the timeframes prescribed therein.

10 Your Rights

Subject to applicable data protection law, you hold the following rights in respect of your Personal Data held by 365huat:

• Right of Access: You have the right to request confirmation of whether365huat holds Personal Data about you and, if so, to receive a copy of that data.
• Right to Rectification: You have the right to request correction of any Personal Data held by us that is inaccurate or incomplete.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to any overiding legal retention obligations.
• Right to Restriction: You have the right to request that we restrict Processing of your Personal Data in certain circumstances, such as where you contest its accuracy.
• Right to Data Portability: Where Processing is based on consent or contractual necessity, you may request that your Personal Data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to Processing based on legitimate interests, including profiling for marketing purposes.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection contact via email at [email protected] or through the live chat function on the Platform. We will respond to verified requests within 30 calendar days. We may require proof of identity before processing a request.

11 Minors & Age Policy

The 365huat Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21.

All registrations are subject to age verification. If 365huat determines or has reasonable grounds to suspect that a User is under the age of 21, the Account will be immediately suspended, all funds will be frozen pending investigation, and any Personal Data collected during the underage registration will be handled in accordance with applicable data protection law, including deletion where no legal ground for retention applies.

If you are a parent or guardian and believe that a person under 21 may have registered on the Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action.

12 International Data Transfers

Some of our service providers, including cloud infrastructure providers and analytics platforms, may be located outside of Malaysia. Where your Personal Data is transferred outside of Malaysia, 365huat ensures that appropriate safeguards are in place to maintain an equivalent level of data protection, including:

• Transfer to countries recognised as providing an adequate level of data protection;
• Use of standard contractual clauses or binding corporate rules requiring the recipient to apply equivalent data protection standards; or
• Ensuring the transfer is necessary for the performance of the contract between you and 365huat.

By using the Platform, you acknowledge and consent to the transfer of your Personal Data outside of Malaysia where necessary for the provision of our services, subject to the safeguards described above.

13 Policy Updates

365huat reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. The revised Policy will be published on this page with an updated effective date.

Where changes are material, we will endeavour to notify registered Users via the email address associated with their account. Continued use of the Platform following publication of an updated Policy constitutes acceptance of those changes. We encourage you to review this Policy periodically.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data by 365huat, please reach out to us through any of the following channels:

For requests relating to your rights under the PDPA or applicable data protection law — including access requests, rectification, deletion, or withdrawal of consent — please state the specific right you are exercising in your communication and provide sufficient information for us to verify your identity. We may need to request additional documentation before processing your request.