Privacy Policy Heng36 — Your Personal Data Protection

Heng36 collects various types of information from users in order to provide a secure, fair, and high-quality service. Data collection is divided into two main categories: information you provide directly, and information collected automatically while you use the platform.

Information you provide directly:

• Full name as shown on a valid identity card or passport.
• Date of birth for age verification purposes (18 years and above).
• Active email address used for account communications.
• Mobile phone number registered in your name.
• Current residential address for regulatory compliance purposes.
• Payment method details including bank account or e-wallet information.
• A copy of your identity document for the KYC (Know Your Customer) verification process.

Information collected automatically:

• IP address and general location information of your device.
• Web browser type, operating system, and device specifications.
• Access log data including timestamps, pages visited, and actions taken within the platform.
• Session cookies and user preferences saved for ease of use.
• Gaming behaviour data including games played, total wagering amounts, and transaction records.

All information collected is used solely for legitimate and necessary purposes to ensure the heng36 platform operates smoothly, securely, and in compliance with all applicable legal obligations. We will not use your data for any other purpose without your explicit consent.

• Identity verification and account security — ensuring every account is held by an eligible individual and preventing unauthorised access.
• Financial transaction processing — facilitating deposits, withdrawals, and payment verification accurately and securely.
• Legal and regulatory compliance — fulfilling anti-money laundering (AML), counter-terrorism financing (CFT), and other mandatory reporting requirements.
• Service communications — sending important notifications related to accounts, transactions, security, and platform updates.
• Platform improvements — analysing aggregate usage patterns to improve the user experience, technical performance, and system security.
• Fraud detection — identifying and preventing suspicious activity, multiple-account usage, and unauthorised access attempts.
• Marketing and promotions — sending promotional offers and information related to heng36 only to users who have given consent to receive such communications.

Heng36 does not sell, rent, or disclose users' personal information to third parties for commercial purposes. However, in certain limited situations, we may need to share information with the following parties:

All third parties we work with are required to uphold data security standards equal to or exceeding those of heng36. Binding data protection agreements are in place across all data-sharing partnerships.

Heng36 invests seriously in technical security infrastructure to protect users' personal data from unauthorised access, disclosure, alteration, or loss. The security measures we implement include:

• 256-bit SSL/TLS encryption for all data communications between the user's browser and heng36 servers.
• Data encryption at rest for all sensitive information including passwords (hashed + salted), account numbers, and identity documents.
• Role-based access control ensuring that only authorised personnel can access user data, and only to the extent required for their duties.
• 24/7 security monitoring using intrusion detection systems (IDS) and real-time threat analytics.
• Regular security audits by independent third parties to proactively identify and address system vulnerabilities.
• Two-factor authentication (2FA) available on all user accounts as an additional layer of protection.
• Layered data backup in geographically separate data centres to ensure service continuity.

Heng36 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance, and ensure security functions operate correctly. Cookies are small text files stored on your device when you visit our platform.

Types of cookies we use:

• Essential Cookies — required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled.
• Performance Cookies — collecting information about how users use the platform (pages visited, time spent) to help us improve our services.
• Preference Cookies — saving user preferences such as language, display settings, and gaming preferences for a more convenient experience next time.
• Analytics Cookies — used to understand aggregate usage patterns for platform and content improvement purposes.

You can manage and delete cookies through your web browser settings. However, disabling essential cookies may affect platform functionality and your overall user experience.

Under Malaysia's Personal Data Protection Act (PDPA) 2010 and applicable international privacy principles, you as a heng36 user have the following rights regarding your personal data:

• Right of Access — you have the right to request a copy of the personal data we hold about you.
• Right to Rectification — you may request that we correct any data that is inaccurate or incomplete.
• Right to Erasure — under certain circumstances, you may request that your personal data be deleted, subject to applicable legal retention obligations.
• Right to Restrict Processing — you may request that we restrict how we process your data under certain circumstances.
• Right to Object — you may object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability — you may request your data in a machine-readable format for transfer to another service provider.
• Right to Withdraw Consent — where processing is based on consent, you may withdraw that consent at any time.

To exercise any of the rights above, please contact the heng36 support team. We will respond to your request within 30 days from the date it is received.

As a responsible online gambling platform, heng36 is required to comply with strict KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements. This process involves collecting and verifying identity documents in greater depth than standard registration.

Documents that may be required during the KYC process include:

• A valid and active copy of your MyKad or passport.
• Recent proof of address (utility bill, bank statement, or other official document not older than 3 months).
• Proof of payment method ownership (screenshot of bank account or e-wallet).
• A selfie holding your identity document for cases requiring additional verification.

All KYC documents are stored in an encryption-protected environment and are accessible only by specifically authorised personnel. These documents will not be shared with any party unless required by law or a valid authority directive.

Heng36 reserves the right to update or amend this Privacy Policy from time to time in line with changes in law, regulatory requirements, or improvements to our privacy practices. Any significant amendments will be communicated to users via in-platform notifications or email at least 14 days before the amendments take effect.

We encourage you to review this page periodically to ensure you are always aware of the latest privacy terms applicable to your use. The last updated date is always displayed at the top of this page for your reference.

Your continued use of the heng36 platform after any amendment takes effect constitutes your acceptance of the revised Privacy Policy. If you do not agree with any amendment, please discontinue use of the platform and contact us to close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or how heng36 manages your personal data, our team is ready to assist you at any time.

• Support Email: [email protected]
• LiveChat: Available 24 hours a day, 7 days a week via the heng36 platform.
• Response Time: We aim to respond to all privacy enquiries within 3 business days.

For official complaints related to data protection that cannot be resolved through heng36 support channels, you may refer to the Department of Personal Data Protection (JPDP) Malaysia, the country's data protection regulatory body.