Privacy Policy — Bandit4D

This Privacy Policy ("Policy") is issued by Bandit4D ("We", "Us", "Our", "Platform") and applies to all personal data collected from individuals ("You", "User", "Player") who access, register with, or otherwise interact with the Bandit4D online casino and sports betting platform available at https://bandit4d.cam and any associated sub-domains, mobile interfaces, or applications.

Bandit4D is committed to protecting the privacy and security of all personal data we process. We operate in accordance with applicable data protection and privacy laws, including the Personal Data Protection Act 2010 (PDPA) of Malaysia, and take our obligations as a data processor and data controller seriously.

By registering an account with Bandit4D, you acknowledge that you have read, understood, and consented to the collection and processing of your personal data in accordance with this Policy. Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The following terms carry the meanings assigned to them below wherever they appear in this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes names, identification numbers, location data, email addresses, IP addresses, and any factors specific to the physical, economic, or social identity of that person.
• "Processing" — Any operation or set of operations performed on personal data, including collection, recording, storage, use, transmission, disclosure, restriction, erasure, or destruction.
• "Data Controller" — Bandit4D, in its capacity as the entity that determines the purposes and means of processing personal data.
• "Data Processor" — Any third party that processes personal data on behalf of Bandit4D under a contractual arrangement and subject to binding data protection obligations.
• "KYC" — Know Your Customer. The regulatory-mandated identity and age verification process conducted on new and existing account holders.
• "Cookies" — Small data files stored on your device by your browser when you visit the Bandit4D Platform, used to maintain session state, track preferences, and analyse usage patterns.
• "Third Party" — Any person, organisation, or entity other than you and Bandit4D, including payment service providers, technology vendors, analytics providers, and regulatory authorities.

Bandit4D collects the following categories of personal data, depending on how you interact with the Platform:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is strictly required for identity verification. Where identity documents contain such data incidentally, access to those documents is restricted to authorised KYC personnel only.

Bandit4D collects personal data through the following means:

• Direct Interactions: Information you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting our support team, or participating in surveys and promotions.
• Automated Technologies: When you access the Platform, we automatically collect technical and usage data through cookies, web beacons, server logs, and similar tracking technologies embedded in the Platform.
• Payment Providers: Our payment processing partners — including those operating the Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX gateways — may share transaction confirmation data with us for the purposes of reconciling deposits and withdrawals.
• Third-Party Sources: Identity verification and fraud prevention service providers may supply us with data necessary to verify your identity or assess the risk profile of a transaction. We may also receive data from analytics providers to help us understand aggregate Platform usage patterns.
• Publicly Available Sources: In limited circumstances relating to fraud prevention or KYC compliance, we may cross-reference your details against publicly available databases or credit reference agencies.

Bandit4D processes personal data only where a valid legal basis exists. The applicable legal bases are as follows:

• Contractual Necessity: Processing is necessary to perform the contract between you and Bandit4D — i.e., to provide you with a functional account, process your deposits and withdrawals, and make games available to you.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) rules, know-your-customer (KYC) requirements, tax reporting obligations, and responses to lawful requests from regulatory authorities.
• Legitimate Interests: Processing is necessary for Bandit4D's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud detection, network security, IT maintenance, and improving the Platform experience.
• Consent: For activities not covered by the above bases — primarily marketing communications and the use of non-essential cookies — we rely on your explicit consent. Consent can be withdrawn at any time with immediate effect on future processing.

The personal data we collect is used for the following clearly defined purposes:

• To create, verify, and manage your Bandit4D account, including processing the mandatory KYC verification required before withdrawals are released.
• To process deposits and withdrawals through your selected payment method — including Touch 'n Go eWallet, DuitNow, FPX bank transfers, and USDT TRC20 cryptocurrency transactions.
• To administer bonuses, promotions, cashback offers, and VIP tier rewards that you are eligible for or have opted into.
• To detect, investigate, and prevent fraudulent transactions, account abuse, multi-accounting, and other prohibited conduct as described in our Terms and Conditions.
• To monitor gameplay patterns and account behaviour for responsible gambling purposes, including identifying signs of problem gambling and applying protective measures where appropriate.
• To comply with anti-money laundering (AML) obligations, including transaction monitoring, suspicious activity reporting, and the retention of records as required by law.
• To communicate with you about account-related matters, including deposit confirmations, withdrawal updates, security alerts, and support responses.
• To send you marketing communications, promotions, and personalised offers — strictly where you have given your explicit consent to receive such communications.
• To analyse aggregated Platform usage data to improve the quality, performance, and user experience of the Platform.
• To enforce our Terms and Conditions and resolve any disputes arising from your use of the Platform.

Bandit4D does not sell, rent, or otherwise monetise your personal data. We may share your personal data with the following categories of third parties only to the extent necessary and subject to appropriate contractual protections:

• Payment Service Providers: Banks, e-wallet operators (Touch 'n Go, Boost, GrabPay), and payment aggregators that facilitate your deposit and withdrawal transactions. These providers receive only the data necessary to process and verify the transaction.
• Identity Verification Partners: KYC and AML technology providers that assist in verifying player identities, screening against sanctions lists, and assessing fraud risk. These providers operate under strict confidentiality and data processing agreements.
• Game Software Providers: Third-party game studios and live dealer platform operators whose games are integrated into Bandit4D. These providers may receive session and gameplay data for purposes of game integrity and technical support, but do not receive financial or full identity data.
• Regulatory & Law Enforcement Authorities: We are required to disclose certain information to regulatory bodies, law enforcement agencies, and courts where lawfully obligated to do so. Bandit4D does not voluntarily disclose player data to authorities beyond its legal obligations.
• IT & Infrastructure Providers: Cloud hosting, database management, and cybersecurity service providers who access data solely for the purpose of delivering infrastructure services to Bandit4D under binding data processing agreements.
• Analytics Providers: Aggregated and anonymised usage data may be shared with analytics platforms to assist in understanding Platform performance. No individually identifiable data is shared for this purpose.

The Bandit4D Platform uses cookies and similar tracking technologies to maintain session state, remember your preferences, detect fraud, and analyse how the Platform is used. Cookies are small data files stored locally on your device by your web browser.

• Strictly Necessary Cookies: These are essential for the Platform to function. They enable core features such as login sessions, account navigation, and secure payment processing. These cookies cannot be disabled without impairing the functionality of the Platform.
• Performance & Analytics Cookies: These cookies collect anonymised information about how users interact with the Platform — such as which pages are most visited and how long sessions last — to help us improve the overall user experience.
• Functional Cookies: These remember your preferences such as language settings, preferred payment method, and last login details to provide a more personalised experience on return visits.
• Marketing Cookies: Where you have given consent, these cookies track your browsing behaviour and interactions with promotional content so that we can present more relevant offers and communications. Marketing cookies can be withdrawn at any time.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of the Bandit4D Platform. Most browsers provide options to block, delete, or receive notifications before cookies are stored.

Bandit4D retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Active Account Data: Maintained for the duration of your account's active status, plus a minimum of five (5) years following permanent account closure to comply with AML and financial record-keeping obligations.
• KYC Documentation: Identity and address verification documents are retained for a minimum of five (5) years from the date of account closure, in accordance with Malaysian PDPA requirements and applicable AML legislation.
• Transaction Records: Deposit and withdrawal records, including payment method references and amounts in MYR, are retained for a minimum of seven (7) years to satisfy financial reporting and AML compliance obligations.
• Support Communications: Customer support records, including chat transcripts and email correspondence, are retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing Data: Marketing preferences and consent records are maintained until you withdraw consent, after which marketing data is deleted within 30 days. Records of consent withdrawal are retained indefinitely for compliance purposes.

Upon expiry of the applicable retention period, personal data is either securely deleted or anonymised such that it can no longer be associated with an identified individual.

Bandit4D implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure.

• All data transmitted between your device and Bandit4D servers is encrypted using 256-bit SSL/TLS protocols. HTTPS is enforced across all Platform endpoints without exception.
• Personal data at rest is stored in encrypted database systems protected by access controls restricted to authorised personnel only.
• Account access is protected by password hashing using industry-standard algorithms. Two-factor authentication (2FA) is available and strongly recommended for all players.
• Bandit4D undergoes regular independent penetration testing and security audits conducted by qualified cybersecurity professionals.
• Internal access to personal data is governed by a role-based access control (RBAC) system, ensuring that staff can only access the minimum data necessary to perform their duties.
• In the event of a data breach that poses a risk to your rights and freedoms, Bandit4D will notify affected individuals as soon as reasonably practicable, and report to the relevant authorities within the timelines prescribed by applicable law.

Subject to applicable law and certain limited exceptions, you hold the following rights with respect to your personal data held by Bandit4D. All rights listed below may be exercised free of charge by contacting us at the details provided in Section 15.

We will respond to all valid data rights requests within 30 calendar days. In complex cases this may be extended by a further 60 days with prior notification. We may request proof of identity before processing a data rights request to prevent fraudulent access to another person's data.

The Bandit4D Platform is intended exclusively for persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Where Bandit4D discovers that personal data belonging to a minor has been collected — whether through misrepresentation at registration or any other means — all such data will be immediately and permanently deleted, the associated account will be closed without prior notice, and any balance held in the account will be handled in accordance with applicable law.

Parents and guardians who believe a minor may have registered with Bandit4D or provided their personal data to the Platform are requested to contact our support team immediately at [email protected]. We will prioritise such reports and respond within 24 hours.

Some of our third-party service providers — including cloud hosting infrastructure, game software suppliers, and fraud detection systems — may be located outside of Malaysia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that required under Malaysian law, Bandit4D ensures that appropriate safeguards are in place.

• Standard contractual clauses or equivalent data transfer mechanisms are incorporated into agreements with all international data processors.
• Transfers are limited to the minimum data necessary for the specific processing purpose.
• Recipient organisations are required to maintain security standards at least equivalent to those applied by Bandit4D.

You may request further information about the specific safeguards applicable to any international transfer of your data by contacting our Data Protection team at the address in Section 15.

Bandit4D reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Material changes to this Policy will be communicated to registered players via email to the address associated with your account, or via a prominent notice on the Platform, no fewer than 14 days before the updated Policy takes effect.

Your continued use of the Platform after the revised Policy takes effect constitutes your acceptance of the changes. If you do not agree with any amendments, you should cease using the Platform and, if desired, close your account in accordance with the procedure described in our Terms and Conditions.

If you have any questions, concerns, or complaints regarding this Privacy Policy, wish to exercise any of your data rights, or need to report a potential privacy incident, please contact the Bandit4D Data Protection team through the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate. We aim to acknowledge all privacy-related emails within 48 hours and provide a full response within 30 calendar days.
• Live Chat: Our support team is available 24 hours a day, 7 days a week via the live chat function on the Platform. For data rights requests, please follow up by email after initial contact via chat so that we have a written record of your request.
• Formal Complaints: If you believe your data protection rights have been violated and our response to your complaint is unsatisfactory, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. In Malaysia, this is the Department of Personal Data Protection (JPDP) under the Ministry of Communications and Digital.

We are committed to resolving all privacy concerns transparently and in good faith. Players across Malaysia — whether based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere — should feel confident that their personal data is handled with care, integrity, and full respect for their rights.