Privacy Policy
— hemat138 Platform

This Privacy Policy ("Policy") is published by hemat138 ("Company", "Platform", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://hemat138.cam. This Policy applies to all users ("User", "Player", "you") who access or use our website, products, and services (collectively, the "Services"), including players registered from Malaysia and other permitted jurisdictions.

hemat138 is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy describes in detail what personal information we collect, the purposes for which we use it, the safeguards we employ to protect it, and the rights available to you as a data subject.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together constitute the full agreement governing your use of the hemat138 platform.

For the purposes of this Privacy Policy, the following terms shall carry the meanings assigned below:

hemat138 collects personal data across several categories depending on the nature of your interaction with the Platform:

3.1 Identity & Registration Data

• Full legal name as it appears on a government-issued identity document
• Date of birth (required for 21+ age verification)
• Nationality and country of residence
• Username chosen during account registration
• Password (stored in encrypted, hashed form — never in plaintext)

3.2 Contact Data

• Email address
• Mobile phone number
• Residential or mailing address (for KYC verification purposes)

3.3 Financial & Payment Data

• Bank account details or e-wallet identifiers used for deposits and withdrawals (e.g., Maybank2u account number, Touch 'n Go eWallet ID, DuitNow-registered number)
• Transaction history, including deposit amounts in RM, withdrawal requests, and bonus activity
• KYC documentation such as a copy of a national identification card (MyKad), passport, or proof of payment method

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from it
• Device type, operating system, and browser version
• Session duration, pages visited, and features accessed
• Game history, bet placement records, and session logs
• Login timestamps and authentication events

3.5 Communications Data

• Records of live chat conversations, email correspondence, and support tickets submitted to hemat138's customer service team
• Feedback, complaints, and any voluntary information you provide when contacting us

hemat138 collects personal data through the following primary methods:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, claiming promotions, or contacting support.
• Automated technical collection: Data collected automatically when you visit or interact with the Platform, including through cookies, server logs, and analytics tools.
• Payment processors: Transaction-related data received from third-party payment providers such as FPX, DuitNow, Boost, GrabPay, and banking institutions including Maybank, CIMB, Public Bank, and Hong Leong, when you initiate a financial transaction.
• Identity verification services: Data received from KYC service providers engaged by hemat138 to verify identity documents and confirm eligibility.
• Fraud detection and compliance systems: Data received from third-party tools used to detect suspicious activity, prevent money laundering, and ensure compliance with applicable regulations.

hemat138 processes your personal data strictly for the following documented purposes:

hemat138 processes personal data under one or more of the following lawful bases:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you entered into upon account registration — including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws, including KYC/AML obligations and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out for hemat138's legitimate business interests, including fraud prevention, platform security, and service improvement — where these interests are not overridden by your fundamental rights.
• Consent: Processing based on your explicit opt-in consent, such as the receipt of marketing communications. You may withdraw consent at any time by contacting our support team.

hemat138 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data may be disclosed to third parties only in the following limited and controlled circumstances:

• Payment service providers: Financial institutions and e-wallet operators (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX) receive only the transactional data necessary to process your specific deposit or withdrawal request.
• KYC and identity verification providers: Accredited third-party KYC services engaged by hemat138 to verify identity documents and confirm player eligibility, bound by strict data handling agreements.
• Fraud prevention and AML services: Specialist compliance tools that analyse transaction patterns to detect and prevent financial crime, operating under contracted data processor agreements.
• Technology and infrastructure providers: Cloud hosting, database, and platform infrastructure providers who process data on our behalf under documented data processing agreements.
• Legal and regulatory authorities: Where required by law, court order, or the legitimate request of a competent regulatory authority, hemat138 may disclose personal data without prior notice to the data subject.
• Business transfers: In the event of a merger, acquisition, or sale of business assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

hemat138 uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies enable core functions such as session management, login authentication, and security features. They cannot be disabled without disrupting core functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how players interact with the Platform — including pages visited, session duration, and error events — to help us improve performance and usability.
• Functional Cookies: Store your preferences such as language settings, preferred game categories, and display options to deliver a more personalised experience on return visits.
• Marketing & Targeting Cookies: Used only where you have provided explicit consent, to deliver relevant promotional communications and measure the effectiveness of marketing campaigns.

You may manage or restrict non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of parts of the Platform. For full details on cookie management, please refer to your browser's help documentation.

hemat138 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required to meet our legal, regulatory, and compliance obligations. The following retention principles apply:

• Active accounts: Personal data associated with an active account is retained for the duration of the account's lifetime plus a minimum retention period required by applicable AML and financial record-keeping regulations.
• Closed accounts: Following account closure, transaction records, KYC documentation, and compliance-related data are retained for a period of up to seven (7) years in accordance with standard financial record-keeping requirements.
• Support communications: Records of customer support interactions are retained for up to three (3) years following the closure of the relevant support case.
• Marketing preferences: Opt-in records and marketing communication logs are retained until you withdraw your consent, plus a reasonable period thereafter for compliance recordkeeping.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

hemat138 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the hemat138 servers, ensuring that sensitive information — including login credentials and payment details — is secured in transit.
• Encrypted password storage using industry-standard hashing algorithms. hemat138 does not store passwords in any readable or reversible format.
• Access controls and role-based permissions limiting internal access to personal data to authorised personnel with a documented business need.
• Regular security audits and vulnerability assessments conducted on Platform infrastructure, software components, and third-party integrations.
• Incident response procedures in place to detect, assess, and respond to data security incidents promptly, including notification to affected individuals where required by applicable law.

As a user of the hemat138 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact our support team through the channels listed in Section 15.

• Right of Access: You have the right to request a copy of the personal data hemat138 holds about you and to receive information about how it is being processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may also update certain account details directly within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain records.
• Right to Restriction of Processing: You may request that we limit the processing of your personal data in certain circumstances, such as while a dispute about its accuracy is being resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request that your personal data be provided to you in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing communications. Marketing opt-outs will be actioned within 10 business days of your request.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

hemat138 will respond to all verified data subject requests within 30 calendar days of receipt. We may require identity verification before processing certain requests to protect against fraudulent or unauthorised access to another person's data.

The hemat138 platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. Age verification is conducted as a mandatory step during the KYC process for all registered accounts.

If hemat138 becomes aware that personal data has been collected from a person under 21 years of age, that account will be immediately suspended, all associated data will be reviewed, and appropriate action will be taken, including data deletion and referral to relevant authorities where required.

Parents or guardians who believe that a minor may have registered on the hemat138 platform should contact our support team immediately at [email protected].

The hemat138 platform may reference or interact with third-party services, including payment processors and game content providers, as part of normal Platform operation. hemat138 does not control the privacy practices of these third parties and is not responsible for their data handling policies.

Where you interact with a third-party service — such as initiating a payment through your Maybank2u, Touch 'n Go eWallet, or GrabPay account — that interaction is governed by the respective third party's own privacy policy. We encourage you to review the privacy policies of any third-party services you use in connection with your hemat138 account.

hemat138 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. The date of the most recent revision is displayed prominently at the top of this page.

Where amendments are material — meaning they meaningfully affect your rights or how your data is used — we will notify active account holders via email or an on-site notification prior to the changes taking effect. Your continued use of the Platform following the publication of any updated Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by hemat138, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly on the hemat138 platform. Average response time under 5 minutes.
• Email: [email protected] — responses within 24 hours.

For data subject rights requests specifically — including access, rectification, erasure, or portability requests — please include your registered account username and a clear description of your request. We may require identity verification before processing the request to protect against unauthorised access.

For responsible gambling enquiries, self-exclusion requests, or problem gambling support, please visit our dedicated Responsible Gambling page.