Hemat138 Privacy Policy – Malaysia Member Personal Data Protection

1Introduction – Who We Are and Why This Policy Matters

hemat138 is an online sports betting and casino platform operating through hemat138.best. We serve over 50,000 active members across Malaysia — from Kuala Lumpur to Sabah and Sarawak — and we take our responsibility to protect every one of their privacy seriously.

In today's digital age, personal data is something of great value. We understand that when you register at hemat138, make a deposit via Touch 'n Go or GrabPay, or place a bet on your favourite Malaysia Super League match, you are entrusting us with sensitive information. That trust is not something we take lightly.

This Privacy Policy was written to answer the most fundamental questions: what we know about you, why we need to know it, what we do with that information, and what you can do if you are uncomfortable with any aspect of it. We have written this in clear, accessible English because we believe every member in Malaysia deserves to understand their own privacy rights without needing a lawyer.

This Policy applies to all data collected through the hemat138.best website, including all services offered on it — Sports Betting, Live Casino, slots, progressive jackpots, online lottery, and all our communication channels including Live Chat and support email.

2Personal Data We Collect

hemat138 collects your personal information in several different situations. Below is a full overview of the types of data we collect and how it is collected:

Data You Provide Directly

• Registration information: Malaysian phone number, password (stored in hashed form — unreadable to us), and your chosen username.
• Identity verification information: MyKad number or passport number, full name, date of birth, and address – collected when required for age verification or identity verification prior to processing large withdrawals.
• Payment information: eWallet phone number (Touch 'n Go, GrabPay, Boost, ShopeePay), DuitNow account number, or bank account details for FPX via Maybank2u or CIMB Clicks. Please note that credit or debit card numbers are never stored on our servers.
• Communications with us: The content of messages, enquiries, and complaints you send to our support team via Live Chat or email at support@hemat138.best.

Automatically Collected Data

• Usage data: Pages you visit on hemat138.best, time spent on each page, buttons clicked, searches made, and navigation paths taken within the platform.
• Device data: Device type (Android, iOS, desktop), phone model, operating system, browser version, and screen resolution — used to optimise how the platform displays on your device.
• Network data: IP address, internet service provider (ISP), and geographic location derived from your IP address (state or city level, not precise location).
• Session data: Login time, logout time, session duration, and records of bets placed and transactions made during that session.
• Cookie data: Information stored by cookies and similar tracking technologies active on our website — described in further detail in Section 6.

3How Your Data Is Used

hemat138 use collected data solely for legitimate purposes necessary to operate the platform effectively. Below is a full list of how your data is used:

• Account management: Creating and maintaining your account, verifying your identity at login, processing password change requests, and ensuring that only you can access your account.
• Transaction processing: Processing deposits via Touch 'n Go, GrabPay, DuitNow, and FPX, handling withdrawal requests, maintaining accurate transaction records, and resolving any financial disputes.
• Service provision: Allowing you to place bets on football, badminton, cricket, and e-sports matches, access Live Casino tables, play slots, and make use of the Welcome Bonus and any other promotions you are eligible for.
• Platform security: Detecting and preventing fraud, multi-account use, money laundering, unauthorised access, and any violations of our Terms & Conditions. IP addresses and session data are actively used for this purpose.
• Customer support: Answering your enquiries and resolving issues you raise, verifying your identity before discussing any account details.
• Legal compliance: Fulfil relevant legal obligations, including the retention of financial records and cooperation with lawful authorities when required by law.
• Platform improvements: Analysing usage patterns in aggregate and anonymised form to understand how the platform is used and make meaningful improvements to the user experience. This data is never linked back to any individual's identity.
• Service communications: Sending you important account-related notifications, such as deposit confirmations, credited bonus alerts, and reminders for rollovers that are about to expire.

4Data Storage & Security

Your data security is the highest technical priority at hemat138. We continuously invest in security infrastructure to keep our members' data safe at all times.

On the encryption front, all communication between your browser or app and the hemat138 servers is protected by TLS 1.3 with AES-256 encryption — the same security standard used by financial institutions and banks in Malaysia. Your account password is stored as a bcrypt hash that cannot be reversed, meaning even our own staff cannot view your password.

For payment information, hemat138 using tokenisation. This means your eWallet account number or banking details are never stored in their original form on our servers — instead, they are converted into tokens that are meaningless without the correct context. Actual transaction processing is handled by certified third-party payment gateways, which are responsible for maintaining their own security standards.

• Access controls: Only authorised staff with a legitimate business need may access members' personal data, and every access is logged for audit purposes.
• Continuous monitoring: The hemat138 system is monitored 24 hours a day to detect any suspicious activity or attempted security breaches.
• Regular backups: Data is regularly backed up to a secure, separate location to ensure service continuity in the event of an unexpected incident.
• Retention period: Financial transaction data is retained for the period required by law. Active account data is kept for as long as the account remains active. Following account closure, data is deleted within 90 days unless a longer retention period is required by law.

5Data Sharing with Third Parties

hemat138 does not sell, rent, or trade your personal data to any third party. This is our absolute commitment to every member. However, there are limited situations where we need to share certain information with other parties in order to operate our services:

• Payment providers: When you make a deposit or withdrawal, the necessary transaction information is shared with our payment gateway providers (such as FPX providers or eWallet infrastructure) solely for the purpose of processing that transaction. These providers are bound by strict confidentiality agreements and industry security standards.
• Game providers: To ensure the integrity of casino and slots games, relevant session data is shared with the third-party game providers that supply the software. This does not include your personal identity information.
• Technical service providers: We work with cloud service, cybersecurity, and analytics providers who may process certain data on our behalf. All such providers are contractually bound to use your data solely for the purpose of delivering the services requested by hemat138.
• Lawful authorities: hemat138 will disclose required data to Malaysian government authorities or law enforcement when compelled to do so by a court order or applicable law. We will endeavour to notify you of any such request unless prohibited by law.

In all of the above cases, data sharing is limited to the minimum necessary for the relevant purpose, and all parties receiving the data are bound by strict confidentiality obligations.

6Cookies & Tracking Technologies

Website hemat138 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform operates smoothly. The types of cookies we use are as follows:

• Essential cookies (required): These cookies are required for the platform's core functions – such as maintaining your login session, temporarily storing your bet slip contents, and ensuring session security. The platform cannot function properly without them.
• Preference cookies: These cookies save your preferences such as display language, odds display settings, and layout choices — so you do not have to reconfigure them every time you visit the platform.
• Analytical cookies: We use internal platform analytics to understand how members interact with hemat138 in aggregate — which pages are visited most, which buttons are clicked most often. This helps us make meaningful improvements. These analytics do not share your data with any external advertising platforms.
• Security cookies: Used to detect suspicious activity, prevent cyberattacks, and verify that users are human rather than automated bots.

You can manage cookies through your browser settings. However, disabling essential cookies may affect the functionality of the platform hemat138. For guidance on managing cookies in popular browsers, please refer to the help section of the browser you are using.

7Your Rights Over Your Personal Data

As a member hemat138, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

To exercise any of the rights above, you may contact the hemat138 privacy team hemat138 via email at support@hemat138.best, stating the right you wish to exercise and your account information (registered phone number). We will process your request within 14 business days and provide updates on its status.

8Children's Privacy

Platform hemat138 is strictly for individuals aged 18 and above. We do not knowingly collect, store, or process the personal data of children under the age of 18.

We apply an age verification process during registration and an identity verification step for the first withdrawal as a safeguard. Should we determine at any point that a member is under 18, the account will be closed immediately and all collected data will be permanently deleted in accordance with our standard security procedures.

9Amendments to This Privacy Policy

hemat138 may update this Privacy Policy from time to time to reflect changes in our privacy practices, technological developments, or new legal requirements. When we make significant changes, we will:

• Updating the "Last Updated" date at the top of this page.
• Notifying active members of any changes via in-platform notifications upon login.
• For highly significant changes that materially affect your privacy rights, we will send a notification to your registered phone number.

We encourage you to review this page periodically to stay informed of the latest version of our Privacy Policy. Continued use of the platform hemat138 continued use of the platform after changes have been updated will be considered acceptance of the amended policy.

10Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the way hemat138 handling your personal data, we are here to help:

• Email: Send your enquiry to support@hemat138.best with the subject line "Privacy Enquiry". Privacy rights requests are prioritised and processed within 14 business days.
• Live Chat: For general privacy enquiries that do not involve a data access or deletion request, our 24/7 customer support team is available to assist via Live Chat at hemat138.best.

We take all privacy enquiries seriously and are committed to providing meaningful, helpful responses — not automated replies that leave your issue unresolved. If you are not satisfied with our response, you have the right to seek independent advice on your privacy rights in Malaysia.