Privacy Policy — Kapal4D

This Privacy Policy ("Policy") describes how Kapal4D ("we", "us", "our", "the Operator") collects, processes, stores, and protects personal data belonging to individuals ("you", "the Member", "the User") who register an account on, or otherwise interact with, the kapal4d online platform accessible at kapal4d.cam and all associated services (collectively, the "Platform").

Kapal4d operates as a Malaysia-focused online betting and casino platform. We understand that our Members entrust us with sensitive personal and financial information — including payment details linked to Malaysian payment services such as GrabPay, Touch 'n Go eWallet, DuitNow, and FPX — and we take that responsibility seriously. This Policy is designed to be transparent, readable, and comprehensive, so that you can make informed decisions about how your data is handled.

By registering an account on the Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not create or continue to use a kapal4d account.

This Policy should be read alongside our Terms & Conditions, which govern your broader rights and obligations as a Member of the kapal4d Platform.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means Kapal4D as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of and under the instruction of Kapal4D.
• "Sensitive Personal Data" means a sub-category of Personal Data that includes financial account details, identity document numbers, and other information requiring heightened protection.
• "Consent" means any freely given, specific, informed, and unambiguous indication of a Member's agreement to the processing of their Personal Data for a stated purpose.
• "KYC Data" means identity verification documents and related information collected as part of the Platform's Know Your Customer process, including copies of Malaysian MyKad or passport.
• "Cookies" means small text files placed on your device by the Platform to facilitate functionality, session management, and analytics.

Kapal4d collects the following categories of Personal Data in connection with the operation of the Platform:

We do not intentionally collect Sensitive Personal Data beyond what is strictly required for KYC verification and financial transaction processing. Where such data is collected, it is handled with enhanced security controls and access restrictions.

4.1 Directly from You

The majority of Personal Data we hold is provided directly by you during the registration process, KYC verification, deposit and withdrawal requests, customer support interactions, and account settings updates. All registration fields and their purpose are clearly labelled at the point of collection.

4.2 Automatically During Platform Use

When you access or use the Platform, we automatically collect technical and behavioural data through server logs, session management systems, and browser-based technologies including cookies and local storage. This data is used to maintain session continuity, detect fraud, ensure platform security, and improve user experience.

4.3 From Payment Processors

When you initiate a transaction via GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, or direct bank transfer through Maybank, CIMB Clicks, Public Bank, or Hong Leong Connect, the relevant payment processor transmits transaction confirmation data and reference identifiers to our systems for the purpose of reconciling your account balance. We do not store full card numbers, full bank account numbers, or e-wallet PINs.

4.4 From Third-Party Verification Services

Where required for KYC or anti-fraud purposes, we may engage third-party identity verification services that cross-reference the documents you submit against authoritative data sources. These providers operate under strict data processing agreements with us.

Kapal4d processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and administering your Member account, including processing logins, password resets, and account preference changes.
• Transaction Processing: Facilitating deposits and withdrawals via Malaysian payment channels, reconciling account balances, and maintaining accurate financial records denominated in MYR.
• Identity Verification (KYC): Confirming your eligibility to use the Platform, including age verification (21+), identity confirmation, and compliance with anti-money laundering obligations.
• Platform Operation: Providing access to sports betting, live casino, 4D lottery, and instant game products; calculating and crediting winnings; managing bonus and VIP programme entitlements.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, unauthorised account access, duplicate accounts, prohibited conduct, and money laundering.
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Responsible Gambling: Monitoring account activity to identify patterns consistent with problem gambling behaviour, administering self-exclusion and deposit limit tools, and ensuring compliance with our responsible gambling obligations.
• Legal Compliance: Meeting obligations under applicable laws and regulations, responding to lawful requests from regulatory authorities, and maintaining records required under anti-money laundering legislation.
• Service Improvement: Analysing aggregated, anonymised usage data to improve Platform functionality, game selection, and user experience.
• Marketing Communications: Where you have consented, sending you promotional offers, bonus notifications, and betting event updates (such as EPL match odds or Liga Super Malaysia promotions) via email or in-app notification.

We do not use Personal Data for automated decision-making that produces legal or similarly significant effects without human review, except in the context of anti-fraud screening where automated systems may flag accounts for subsequent manual investigation.

Kapal4d processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to perform our contractual obligations under the Terms and Conditions — including account management, transaction processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and responses to lawful regulatory authority requests.
• Legitimate Interests: Processing carried out in pursuit of our legitimate business interests — including fraud prevention, platform security, and service improvement — where these interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications and certain non-essential cookies, where your explicit consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Kapal4d does not sell, rent, or trade your Personal Data to third parties. We share Personal Data only in the following limited and controlled circumstances:

7.1 Payment Processors

We share necessary transaction data with authorised payment processors including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Connect to facilitate deposits and withdrawals. These providers operate under their own privacy policies and are subject to contractual data protection obligations.

7.2 Identity Verification Providers

KYC documents (such as MyKad images) are shared with licensed identity verification service providers for the sole purpose of confirming Member identity. These providers are bound by strict data processing agreements and are prohibited from using your data for any purpose beyond identity verification.

7.3 Technology and Infrastructure Providers

We use trusted third-party service providers for cloud hosting, database management, and cybersecurity services. These providers act as Data Processors under our instruction and are contractually prohibited from processing your Personal Data for their own purposes.

7.4 Regulatory and Law Enforcement Authorities

We may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where we are legally obligated to do so, or where we have a good-faith belief that disclosure is necessary to prevent fraud, protect public safety, or comply with a legal process. We will, where permitted by law, notify you of such disclosure.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the Operator's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection commitments.

We retain your Personal Data for as long as your account remains active and for a period thereafter as required by applicable legal and regulatory obligations. Our general retention periods are as follows:

• Account and registration data: Duration of account activity plus 7 years following account closure (to meet anti-money laundering record-keeping requirements).
• KYC and identity documents: Duration of account activity plus 7 years following account closure.
• Financial transaction records: 7 years from the date of each transaction, in accordance with financial record-keeping obligations.
• Customer support communications: 3 years from the date of the interaction, unless a longer period is required by an unresolved dispute.
• Technical and session data: Up to 12 months from collection, unless retained longer for security investigation purposes.
• Marketing consent records: Until consent is withdrawn, plus 1 year as an audit record.

Where Personal Data is no longer required for any legitimate purpose, we will securely delete or anonymise it in accordance with our data disposal procedures.

Kapal4d uses cookies and similar tracking technologies to operate the Platform effectively. Cookies are small text files stored on your device when you access the Platform. They do not contain executable code and cannot access other data on your device.

Types of Cookies We Use

• Essential Cookies: Required for the Platform to function. These include session management cookies, authentication tokens, and security cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Store your preferences such as language settings, bet display format, and notification preferences to improve your experience across sessions.
• Analytics Cookies: Collect anonymised, aggregated data about how Members navigate the Platform — which game categories are most visited, session durations, and navigation paths — to help us improve the Platform. These are subject to your consent.
• Security Cookies: Used to detect and prevent fraudulent access, duplicate sessions, and suspicious account behaviour.

You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies may result in degraded Platform functionality. Your initial visit to the Platform will present a cookie consent notice through which you can make granular choices about non-essential cookies.

As a Member of the kapal4d Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us using the details in Section 15 below.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. Some corrections can be made directly through your account settings.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain records (see Section 8).
• Right to Restrict Processing: You may request that we limit the processing of your Personal Data in certain circumstances — for example, while you dispute the accuracy of the data we hold.
• Right to Data Portability: You may request a structured, machine-readable export of the Personal Data you have provided to us, where technically feasible.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gambling monitoring, where you have compelling grounds to do so.
• Right to Withdraw Consent: Where processing is based on your consent (including marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

We will respond to data rights requests within 30 days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days with prior written notice. There is no charge for submitting a data rights request.

Kapal4d implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Multi-factor authentication requirements for staff access to systems containing Personal Data.
• Role-based access controls ensuring that staff members can only access the Personal Data required for their specific job functions.
• Continuous automated monitoring for anomalous access patterns, intrusion attempts, and data breach indicators.
• Regular third-party penetration testing and security audits conducted by qualified cybersecurity specialists.
• Incident response procedures with defined notification timelines in the event of a data breach affecting Member data.

Notwithstanding these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorised access to your account.

The kapal4d Platform is strictly intended for use by individuals who are 21 years of age or older. We do not knowingly collect Personal Data from individuals below this age threshold.

Age verification is a mandatory component of our KYC process. Where our systems identify, or we receive credible notification, that a Member is under 21 years of age, we will immediately suspend the account, initiate a review of all associated transactions, and take appropriate action in accordance with our Terms and Conditions and applicable law.

If you believe that a minor has accessed the Platform using your account or using false credentials, please contact our support team immediately. We take underage gambling seriously and will act swiftly on all such reports.

Kapal4d operates infrastructure that may be hosted across multiple geographic regions. As a result, your Personal Data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, we take appropriate steps to ensure that your data receives equivalent protection, including:

• Contractual data protection clauses that bind recipient parties to standards equivalent to those described in this Policy.
• Transfer only to jurisdictions or service providers that we have assessed as providing adequate data protection standards.
• Pseudonymisation of data where technically practicable prior to cross-border transfer.

Your use of the Platform constitutes your acknowledgement that your Personal Data may be transferred internationally in the manner described above, subject to the safeguards outlined.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. Material changes will be communicated to registered Members via the email address associated with their account or through a prominent notice on the Platform, with a minimum of 14 days' prior notice where practicable.

We recommend reviewing this Policy periodically. The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

If you have any questions about this Privacy Policy, wish to exercise a data rights request, or have a concern about how your Personal Data is being handled, please contact the kapal4d Data Protection team through any of the following channels:

• Live Chat: Available 24/7 within the Platform — our fastest support channel for urgent privacy concerns.
• Email: [email protected] — please include "Privacy Request" in your subject line for prompt routing to our data protection team.

We handle all privacy enquiries with the seriousness they deserve. Our support team is Malaysia-based and fully conversant with the data rights provisions described in this Policy. All privacy communications are conducted in English.

For concerns related to responsible gambling, self-exclusion, or account-level restrictions, please visit our dedicated Responsible Gambling page.