Privacy Policy 438 —
Member Personal Data Protection

1Introduction and Scope of This Policy

438 takes data protection seriously. We understand that you trust us with your personal information every time you use this platform, and we do not take that trust lightly. This Privacy Policy has been prepared in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA) and international best practices in personal data management.

This Policy applies to all individuals who interact with the 438 platform, including:

• Website visitors who have not yet registered as members.
• Registered members who actively use the platform's services.
• Former members whose accounts have been terminated or suspended.
• Individuals who contact our customer support team.

This Policy may be updated from time to time. The latest version will always be available on this page. We encourage you to review this page periodically to stay informed about how we handle your personal information.

2Personal Data We Collect

We collect various types of personal information depending on how you interact with the 438 platform. Below are the data categories we collect and examples of information within each category:

3Purpose of Personal Data Use

We use collected personal data solely for legitimate, stated purposes. Below are the primary purposes for which your data is used, along with the legal basis that permits such processing:

• Account management: Creating, managing, and maintaining your member account, including the login process, identity verification, and personal preference settings.
• Transaction processing: Processing deposits, withdrawals, and all other financial transactions made through the platform.
• Customer support: Providing effective technical assistance and customer service when you contact our team.
• Legal compliance: Fulfilling obligations under PDPA 2010, the Anti-Money Laundering Act (AMLA), and other financial regulations in force in Malaysia.
• Platform security: Detecting and preventing fraud, unauthorized access, account misuse, and suspicious activity.
• Service improvement: Analyzing aggregated usage patterns to develop new features and enhance the user experience.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and offering appropriate support to members who need it.
• Marketing communications: Sending promotional information, bonus offers, and platform updates — only to members who have given their consent.

4Data Sharing with Third Parties

438 does not sell or commercialise member personal data. However, we share certain personal information with carefully selected third parties in the following situations:

• Payment service providers: DuitNow, FPX, Touch 'n Go, GrabPay, and Boost operators receive the transaction information required to process your payments.
• Game software providers: Game development companies that provide slots, Live Casino, and other games on our platform may receive game session data necessary for game operations.
• Cloud service providers: Our data storage infrastructure is operated by certified cloud providers that comply with international security standards.
• Authority: Information may be disclosed to law enforcement agencies, Bank Negara Malaysia, or other regulatory bodies when required by law or court order.
• Identity verification services: Third-party KYC providers that assist us in verifying member identities during the registration and compliance process.

All third parties we work with are bound by data processing agreements that require them to protect the information received to security standards no less stringent than our own.

5Data Security Measures

The security of your personal data is our top technical priority. 438 implements multiple layers of security to protect your information from unauthorized access, modification, disclosure, or destruction:

• Data encryption in transit using TLS 1.3 protocol with 256-bit SSL certificates issued by trusted certificate authorities.
• Data encryption at rest for sensitive information such as KYC documents and financial records.
• Role-based access control (RBAC) ensures that only authorized personnel can access member data according to their job requirements.
• 24/7 activity monitoring using intrusion detection systems (IDS) and intrusion prevention systems (IPS).
• Regular security audits by independent third parties to identify and address system vulnerabilities.
• A comprehensive incident response plan to ensure any security breach is addressed swiftly and effectively.
• Regular data security training for all staff who handle member personal information.

6Cookies and Tracking Technologies

The 438 platform uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions correctly. The following are the types of cookies we use:

• Essential cookies: Required for core platform functions such as login sessions, security, and navigation. These cookies cannot be disabled as they are essential for site operation.
• Performance cookies: Helps us understand how visitors interact with the platform through anonymous data collection, enabling us to make continuous improvements.
• Functional cookies: Saving your preferences such as interface language, display settings, and favorite game selections so you do not need to reconfigure them each time you login.
• Security cookies: Used to detect suspicious activity, prevent CSRF attacks, and ensure user sessions are valid and secure.

You can manage cookie settings through your web browser preferences. However, disabling essential cookies may affect platform functionality and your overall user experience. Note: Our platform does not use third-party cookies for advertising that tracks you across other websites.

7Your Rights as a Data Subject

Under the Malaysian Personal Data Protection Act 2010, you have the following rights regarding your personal data held by 438:

• Right of access: You have the right to obtain a copy of the personal data we hold about you and information on how it is used.
• Right to rectification: You have the right to request correction of any personal data that is inaccurate, incomplete, or outdated.
• Right to withdraw consent: For data processing that relies on your consent (such as marketing communications), you may withdraw your consent at any time.
• Right to restrict processing: In certain circumstances, you have the right to request that we restrict the processing of your personal data.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes at any time.

To exercise any of the above rights, please contact our data protection team by email at [email protected], clearly stating your request. We will respond within 30 business days. Some requests may require additional identity verification before we can process them.

8Data Retention Period

438 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or to comply with applicable legal obligations. The following are our general data retention guidelines:

• Active account data: Retained for the duration your account remains active and for a reasonable period after account termination for legal compliance purposes.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian financial and tax legal requirements.
• KYC Documents: Retained for the period prescribed by applicable anti-money laundering laws.
• Support communication logs: Retained for 2 years from the date of last interaction.
• Technical log data: Retained for 90 days for security and system debugging purposes.

When data is no longer needed, we will securely delete or anonymise it so that it can no longer be personally associated with you. Our data deletion and anonymisation processes follow established procedures to ensure data is unrecoverable.

9Children's Privacy

The 438 platform is exclusively for individuals aged 18 and above. We do not knowingly collect, process, or store any personal data from individuals under the age of 18.

All account registrations are required to confirm they are at least 18 years of age, and our KYC process is designed to verify each member's actual age. Should we discover that a child's personal data has been collected inadvertently, we will take immediate action to delete that data and close the relevant account.

10Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding how we handle your personal data, or if you wish to exercise your rights under PDPA 2010, please contact our Data Protection Officer via:

• Email: [email protected] (please include "Privacy Inquiry" in the subject line of your email)
• Platform: Via the live chat function in your account (available 24/7)
• Response time: We aim to respond to all privacy enquiries within 5–10 business days

We value every piece of feedback and complaint we receive, as it helps us continuously improve our data protection practices. If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia as the responsible regulatory authority.