4rabet Privacy Policy

4rabet ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all individuals who access or register on the 4rabet website at https://4rabet.casa ("Platform"). This Privacy Policy sets out in clear, formal terms how we collect, use, store, share, and protect personal data in connection with our online sports betting and live casino services, which are made available principally to users in Malaysia.

This Privacy Policy applies to all users of the Platform, including individuals who browse without registering, registered account holders, and players who have closed their accounts but whose data is retained for regulatory purposes. By accessing the Platform or submitting personal data through any channel (registration, KYC upload, support contact), you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is incorporated by reference into 4rabet's Terms & Conditions and forms an integral part of the agreement between you and the Platform. Where any conflict exists between this Privacy Policy and the Terms & Conditions in respect of data matters, this Privacy Policy shall prevail.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, payment information, and behavioural data.
• "Data Controller" means 4rabet, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party engaged by 4rabet to process Personal Data on its behalf under contractual obligations.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "User" or "Player" means any natural person who accesses, browses, registers on, or interacts with the 4rabet Platform.
• "KYC" means Know Your Customer — the identity and address verification procedures required by anti-fraud and regulatory obligations.
• "Cookies" means small text files placed on a User's device by the Platform to facilitate functionality, security, and session management.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data in commercial transactions in Malaysia.

4rabet collects the following categories of personal data from Users, depending on the nature of their interaction with the Platform:

4rabet does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or criminal records) except where explicitly required for regulatory compliance (e.g., self-exclusion documentation).

Personal data is collected through the following channels and mechanisms:

• Direct Submission: Data provided voluntarily by the User during registration, account profile updates, KYC document uploads, deposit and withdrawal requests, and communications with our support team.
• Automated Technical Collection: Technical data such as IP addresses, browser fingerprints, session timestamps, and device identifiers are collected automatically when a User accesses the Platform, via server logs, cookies, and similar tracking technologies.
• Payment Processing Partners: When a User initiates a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, Maybank FPX, CIMB, DuitNow, or USDT TRC20, relevant transactional data is received from the respective payment service provider necessary to complete and verify the transaction.
• Identity Verification Partners: Where third-party KYC services are used to assist with document verification, the results of such verification (pass/fail status and supporting metadata) are shared with 4rabet by the verification partner.
• Fraud Prevention Services: Technical signals and behavioural data may be shared with and received from fraud detection service providers to identify suspicious activity on the Platform.

4rabet processes personal data only for specific, legitimate, and clearly defined purposes. The primary purposes for which data is processed are:

• Account Registration and Management: To create, maintain, and administer player accounts, verify eligibility (including the 21+ age requirement), and authenticate login sessions.
• Payment Processing: To process deposits and withdrawals via Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, Maybank FPX, CIMB, Public Bank, DuitNow, and USDT TRC20, and to maintain accurate financial records.
• Identity Verification (KYC): To verify player identity and address in compliance with anti-money laundering (AML) obligations and to prevent underage gambling.
• Regulatory Compliance: To comply with applicable laws and regulatory obligations, including the retention of transaction records and the reporting of suspicious financial activity to appropriate authorities.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and breaches of our Terms & Conditions.
• Customer Support: To respond to queries, resolve disputes, and provide assistance to players via Live Chat, email, and other support channels.
• Responsible Gambling: To implement and monitor responsible gambling tools such as deposit limits, loss limits, and self-exclusion requests, and to identify players who may be at risk.
• Marketing Communications: To send relevant promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. Marketing communications may be withdrawn at any time.
• Platform Improvement: To analyse aggregated and anonymised usage data to improve platform performance, user experience, and the range of games and services offered.

4rabet relies on the following legal bases for processing personal data, in accordance with applicable data protection principles including those reflected in Malaysia's Personal Data Protection Act 2010 (PDPA):

• Contractual Necessity: Processing is necessary to perform the contract between 4rabet and the User (i.e., the Terms & Conditions governing the use of the Platform), including account management, betting services, and payment processing.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including AML/KYC requirements and regulatory reporting obligations.
• Legitimate Interests: Processing is necessary for 4rabet's legitimate interests in fraud prevention, platform security, responsible gambling monitoring, and product improvement, provided such interests are not overridden by the User's fundamental privacy rights.
• Consent: Where processing is based on consent (principally in relation to direct marketing communications), the User has the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4rabet does not sell, rent, or trade personal data to any third party for their independent commercial purposes. Personal data may be shared with the following categories of third parties solely to the extent necessary for the purposes described in Section 5:

• Payment Service Providers: Malaysian e-wallet operators and bank payment processors (including providers for Touch 'n Go eWallet, Boost, GrabPay, Maybank FPX, CIMB, Public Bank, DuitNow, and cryptocurrency channels) as required to complete financial transactions.
• Identity Verification Partners: Third-party KYC and document verification services engaged to assist with the verification of user identity and address.
• Fraud and Security Services: Providers of fraud detection, anti-bot, and cybersecurity services used to protect the integrity of the Platform and its users.
• Cloud Infrastructure Providers: Data hosting and cloud computing service providers on whose infrastructure 4rabet's Platform operates, subject to appropriate contractual data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or regulatory direction, personal data may be disclosed to relevant Malaysian or international regulatory authorities, law enforcement agencies, or financial intelligence units.
• Professional Advisers: Lawyers, auditors, and compliance consultants, where disclosure is reasonably necessary for the purposes of obtaining professional advice or managing legal proceedings.

All third-party data processors engaged by 4rabet are subject to contractual obligations requiring them to process personal data only on 4rabet's instructions, to maintain appropriate security measures, and not to disclose data to further parties without authorisation.

4rabet's primary operations are directed toward users in Malaysia. However, some of our infrastructure partners and service providers may process data in data centres located outside Malaysia. Where personal data is transferred outside Malaysia, 4rabet takes appropriate steps to ensure that such transfers comply with applicable data protection requirements, including:

• Transferring data only to service providers in jurisdictions that maintain adequate data protection standards;
• Implementing contractual data processing agreements with overseas processors that include appropriate data protection obligations; and
• Ensuring that recipients are bound by data security and confidentiality obligations no less stringent than those applicable under Malaysian law.

4rabet retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be attributed to a specific individual.

4rabet implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption at Rest and in Transit: All stored personal data is encrypted using AES-256. Data transmitted between Users and the Platform is encrypted via TLS 1.3.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations and undergo regular security training.
• Two-Factor Authentication (2FA): Internal administrative systems accessing player data require multi-factor authentication.
• Regular Security Audits: The Platform and its infrastructure undergo periodic independent security assessments and penetration testing.
• Incident Response: 4rabet maintains a documented data breach response plan. In the event of a data breach that poses a risk to Users, affected individuals will be notified promptly in accordance with applicable legal obligations.
• Secure Payment Processing: Financial transactions are processed exclusively through certified Malaysian payment partners and are subject to their own security frameworks and PCI-DSS compliance requirements where applicable.

4rabet uses cookies and similar tracking technologies (including session storage and browser fingerprinting) to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for basic Platform functionality, including maintaining login sessions, processing transactions, and ensuring Platform security. These cookies cannot be disabled without materially affecting the User's ability to use the Platform.
• Functional Cookies: Used to remember User preferences such as language settings, game lobby layout, and responsible gambling tool configurations. These improve the consistency of the User's experience across sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats. These cookies collect information such as IP addresses and session behaviour patterns.
• Analytics Cookies: Used on an aggregated, anonymised basis to understand how Users navigate the Platform, which features are most used, and where performance improvements should be prioritised. Individual user behaviour is not profiled for commercial purposes through these cookies.

4rabet does not use third-party advertising cookies or allow third-party advertising networks to set cookies through the Platform. Users may configure cookie preferences through their browser settings; however, disabling strictly necessary cookies may impair Platform functionality.

As a User of the 4rabet Platform, you hold the following rights in respect of your personal data. These rights are subject to applicable legal limitations and regulatory obligations that may require 4rabet to retain certain data regardless of a User's request:

To exercise any of the above rights, please contact our support team via Live Chat or email [email protected] (plain text — not a link). We will acknowledge your request within five (5) business days and complete it within thirty (30) calendar days, unless an extension is necessary due to the complexity or volume of requests, in which case you will be informed of the revised timeline.

The 4rabet Platform is strictly prohibited to individuals under the age of twenty-one (21). 4rabet does not knowingly collect personal data from minors. Where we become aware that personal data has been submitted by an individual under the minimum age requirement, we will:

• Immediately suspend and permanently close the associated account;
• Forfeit all balances and pending withdrawals associated with the account;
• Delete all personal data associated with the account as far as regulatory obligations permit; and
• Where legally required, refer the matter to the appropriate Malaysian authorities.

Parents and guardians who believe their child may have accessed or registered on the Platform are encouraged to contact 4rabet support immediately via Live Chat so that the matter can be investigated and resolved without delay.

With your consent, 4rabet may send you direct marketing communications about promotions, bonuses, new games, and platform updates relevant to your account. Marketing communications may be delivered via email, SMS, or in-platform notification.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your marketing preferences in your account settings;
• Clicking the "unsubscribe" link in any marketing email you receive; or
• Contacting our support team directly via Live Chat.

Withdrawal of marketing consent does not affect the lawfulness of marketing communications sent prior to withdrawal. It also does not affect your receipt of transactional communications (such as deposit confirmations, withdrawal notifications, and account security alerts), which are necessary for the operation of your account and are not subject to marketing opt-out.

The 4rabet Platform may contain references to or integrations with third-party payment services (such as Touch 'n Go eWallet, Boost, GrabPay, and bank payment portals). Where you are directed to or interact with a third-party platform to complete a transaction, that platform's own privacy policy and data processing practices will govern the handling of any data submitted directly to that platform.

4rabet is not responsible for the privacy practices of third-party payment providers or any other external services. Users are encouraged to review the privacy policies of any third-party services they interact with in connection with their use of the 4rabet Platform.

4rabet reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our operational practices. The "Last updated" date at the top of this document will be revised to reflect the effective date of any amendment.

Where changes are material — meaning they significantly affect how your personal data is collected or used — 4rabet will provide prior notice to registered Users via the email address on file, or through a prominent notice displayed upon login.

Your continued use of the Platform following the publication of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept the revised policy, you must discontinue use of the Platform and contact support to close your account.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about how 4rabet has handled your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the 4rabet Platform. Average response time: 3–5 minutes. Support available in English, Bahasa Melayu, and 中文.
• Email: [email protected] (plain text — not a clickable link). Please allow up to 24 hours for email responses during business hours.

When submitting a data rights request, please include your registered email address, account username, and a clear description of your request or complaint to allow our team to process it efficiently.

If you are dissatisfied with our response to a privacy complaint, you retain the right to escalate the matter to the relevant Malaysian data protection authority or such regulatory body as may have jurisdiction over 4rabet's data processing activities.