Kebaya4D Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy") is issued by Kebaya4D (hereinafter referred to as "the Company", "we", "our", or "us"), the operator of the online gaming and sports betting platform accessible at https://kebaya4d.cam. This Policy applies to all users who access, register on, or otherwise interact with the Kebaya4D platform ("the Platform"), including visitors who have not yet completed registration.

We are committed to safeguarding the privacy and personal data of every individual who uses Kebaya4D, including players based in Kuala Lumpur, Penang, Johor Bahru, Shah Alam, Petaling Jaya, and across Malaysia. This Policy explains in clear, plain terms how we collect, process, store, share, and protect your personal data, and what rights you hold in relation to that data.

By accessing the Platform, registering an account, or using any of our services — including sports betting on Liga Super Malaysia, the EPL, or UFC markets; casino games; or depositing via Touch 'n Go eWallet, DuitNow, Maybank2u, or other payment methods — you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein.

The following terms carry specific meanings throughout this Policy:

• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, whether directly or indirectly. This includes name, identification number, contact details, financial information, IP address, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.
• "Data Controller" — the Company, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third-party entity that processes personal data on behalf of the Company under a written agreement and pursuant to the Company's instructions.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" — Know Your Customer — the identity and age verification process required before a User may withdraw funds from their Kebaya4D account.
• "Cookies" — small text files stored on your device by your web browser that allow the Platform to recognise your browser and retain session information and preferences.

Kebaya4D collects personal data in the following categories depending on your level of engagement with the Platform:

3.1 — Registration & Identity Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (for age verification — players must be 21 or older)
• Residential address
• Email address and mobile phone number
• Username and encrypted password
• Preferred language and currency (MYR / RM by default for Malaysian users)

3.2 — Identity Verification (KYC) Data

• Scanned copies or photographs of government-issued identity documents (MyKad, Passport, or Driver's License)
• Proof of residential address documents (utility bills, bank statements, or official correspondence dated within three months)
• Selfie photographs taken for liveness verification

3.3 — Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, and payment method identifiers
• Payment method details necessary to process transactions — e.g., partial account numbers for bank transfers via Maybank, CIMB, Public Bank, or Hong Leong; e-wallet transaction references for Touch 'n Go eWallet, Boost, or GrabPay; DuitNow and FPX transaction IDs; cryptocurrency wallet addresses for BTC, ETH, or USDT TRC20 deposits
• Account balance history and bonus credit records

3.4 — Gaming & Betting Activity Data

• Wager history, game session data, and bet settlement records
• Sports betting selections including football (Liga Super Malaysia, EPL), UFC, and other markets
• Session duration and gaming frequency data used for responsible gambling monitoring

3.5 — Technical & Device Data

• IP address and approximate geolocation at the time of access
• Browser type, version, and operating system
• Device identifiers and hardware configuration data
• Login timestamps and session activity logs

3.6 — Communications Data

• Live chat transcripts and support ticket content
• Email correspondence with Kebaya4D support teams
• Feedback, survey responses, and complaint records

We collect personal data through the following channels and mechanisms:

• Direct provision by you — when you register an account, complete KYC verification, make deposits or withdrawals, contact our support team, or respond to communications from us.
• Automated technical collection — through cookies, web beacons, session tracking technologies, and server logs that record interaction data when you visit or use the Platform.
• Payment service providers — transaction confirmation data received from payment processors including e-wallet platforms, banking FPX gateways, and cryptocurrency confirmation services.
• Identity verification partners — KYC and anti-fraud service providers that assist in verifying the authenticity of identity documents submitted during account verification.
• Fraud prevention and compliance services — third-party providers that cross-reference your data against watchlists and politically exposed persons (PEP) screening databases as required by anti-money-laundering (AML) regulations.

We process your personal data for the following purposes, each of which is grounded in a legitimate legal basis as described in Section 06:

The Company processes your personal data on the following legal bases, as applicable:

• Contractual necessity: Processing required to perform the contract between you and the Company — specifically, to create and maintain your account, process your transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering legislation, KYC regulatory requirements, and age verification obligations.
• Legitimate interests: Processing carried out for the Company's legitimate operational interests, including fraud prevention, platform security, and responsible gambling monitoring, where such interests are not overridden by your privacy rights.
• Consent: Where we rely on your consent for specific processing activities (such as sending you promotional communications), you may withdraw that consent at any time by contacting our support team or updating your communication preferences in your Account settings.

Kebaya4D does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. We may share your personal data with the following categories of recipients solely for the purposes outlined in this Policy:

• Payment processors and financial institutions: To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, cryptocurrency networks, and other payment services.
• KYC and identity verification providers: Third-party services engaged to validate identity documents and screen against sanctions and PEP lists.
• Fraud prevention and security vendors: Service providers assisting in the detection and prevention of fraudulent activity, multiple accounts, and system abuse.
• Game software providers: Providers whose games are hosted on our platform may receive anonymised or pseudonymised gaming activity data for RNG compliance and fairness auditing purposes.
• Legal and regulatory authorities: We may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts in response to a lawful request, court order, or applicable legal obligation. We will notify you of such disclosures where legally permitted to do so.
• Professional advisers: Lawyers, auditors, and compliance consultants engaged by the Company on a confidential basis.

All third-party processors engaged by Kebaya4D are contractually bound to process personal data solely in accordance with our documented instructions and to maintain appropriate security standards.

As an internationally licensed online gaming operator, Kebaya4D may transfer certain personal data to third-party service providers located in jurisdictions outside Malaysia. Where such transfers occur, the Company takes reasonable contractual and technical measures to ensure that an adequate level of data protection is maintained, consistent with applicable international standards.

These measures may include entering into standard contractual clauses, conducting due diligence on the data protection practices of recipient organisations, and ensuring that data processing agreements are in place before any cross-border transfer is initiated.

By using the Kebaya4D Platform, you acknowledge and consent to the transfer of your personal data to such jurisdictions for the purposes described in this Policy.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Account and registration data: Retained for the duration of your active Account relationship with Kebaya4D, plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of last transaction or account closure, whichever is later.
• Financial and transaction records: Retained for a minimum of seven (7) years from the date of each transaction, as commonly required for financial record-keeping under applicable international standards.
• Communications and support records: Retained for three (3) years from the date of last communication, unless part of a longer ongoing dispute or investigation.
• Technical and session logs: Typically retained for twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with any identified or identifiable individual.

Kebaya4D uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies may be placed on your device when you visit or use our services:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without severely impairing Platform functionality.
• Functional Cookies: Enable the Platform to remember your preferences, such as your chosen language, currency (MYR), and last-used payment method. These improve your user experience but are not essential.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including page views, session durations, and navigation paths. This information is used to improve Platform design and performance. No personally identifiable information is transmitted via analytics cookies.
• Security Cookies: Support fraud detection and prevention systems by identifying unusual patterns of behaviour, such as multiple failed login attempts or access from atypical device configurations.

You may control cookie preferences through your browser settings. Please note that disabling certain cookie categories may affect the functionality of the Platform. Detailed cookie management options are available in your Account preferences once registered.

Subject to applicable law and any overriding regulatory obligations, you have the following rights in relation to your personal data held by Kebaya4D. You may exercise any of these rights by contacting us using the details in Section 16.

We will respond to all verified data rights requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reasons for it. We will not charge a fee for processing rights requests except where requests are manifestly unfounded or excessive.

The Kebaya4D Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data from any individual under the age of 21. Age verification is conducted as part of the mandatory KYC process before any withdrawal is permitted.

If we discover, at any stage, that an account has been registered by or on behalf of an individual under the age of 21, we will immediately suspend the account, initiate a full review, return any deposited funds where legally permissible, and permanently delete all personal data associated with that account in accordance with our data retention obligations.

If you have reason to believe that a minor may have accessed or registered on the Kebaya4D Platform, please contact us immediately at [email protected].

Kebaya4D implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and our servers;
• Encryption at rest for all sensitive personal and financial data stored in our databases;
• Two-factor authentication (2FA) available on all user accounts and mandatory for all administrative access;
• Role-based access controls ensuring that only authorised personnel with a defined business need may access personal data;
• Regular security audits and penetration testing conducted by independent third-party security firms;
• 24/7 intrusion detection and monitoring systems that alert our security team to anomalous access patterns in real time;
• Data pseudonymisation and anonymisation applied where full identification is not required for the processing purpose.

Despite these measures, no data transmission over the internet or electronic storage system is entirely free from risk. We encourage all users to maintain strong, unique passwords and to enable 2FA on their accounts. You are responsible for maintaining the confidentiality of your login credentials.

The Kebaya4D Platform may reference or integrate with third-party payment services — including but not limited to Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, and FPX — and third-party game content providers. These services operate under their own independent privacy policies and terms of service.

When you interact with a third-party payment gateway or game provider through the Platform, your data is transmitted to that provider in accordance with their applicable privacy policy. Kebaya4D is not responsible for the privacy practices or data handling of any third-party service provider, and we encourage you to review the privacy policies of any third-party services you use.

We do not knowingly embed links to external websites within the Platform for non-operational purposes. Any third-party integrations present on the Platform are for the sole purpose of delivering the services described in our Terms & Conditions.

Kebaya4D reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we provide. Material changes will be communicated to registered users via email or through a prominent notice displayed on the Platform no fewer than seven (7) days prior to the changes taking effect, except where an immediate amendment is required by law.

The date of the most recent revision is stated at the top of this document. Your continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not accept the changes, you must discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

The current version of this Privacy Policy is always available at https://kebaya4d.cam/privacy-policy. We recommend reviewing this page periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or the exercise of any of your data rights, please contact the Kebaya4D Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the support portal within your Account dashboard. Live chat provides the fastest response for most enquiries.
• Email: [email protected] — for data rights requests, please include "Data Privacy Request" in the subject line. We aim to respond within two (2) business hours during peak hours and within five (5) business days for formal written requests.

To exercise any of your rights described in Section 11, we may require you to verify your identity before processing your request, to ensure that personal data is not disclosed to or actioned on behalf of an unauthorised party. Verification will be conducted in accordance with our KYC procedures.