Privacy Policy — hfive5

This Privacy Policy ("Policy") issued by hfive5 (the "Operator", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://hfive5.cam (the "Platform"). This Policy governs the collection, use, storage, disclosure, and protection of personal data provided by or collected from individuals ("Users", "Players", or "you") who access or use the Platform in any capacity, including registered account holders and anonymous visitors.

hfive5 is committed to maintaining the confidentiality and security of your personal information. We process personal data only for legitimate, defined purposes and in accordance with applicable data protection principles. Our platform serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond, and we recognise the importance of transparent data practices in building and maintaining player trust.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, all of which form part of the agreement between hfive5 and its users.

The following terms carry the meanings assigned below throughout this Policy:

hfive5 collects personal data through several channels, including account registration, payment processing, platform usage, customer support interactions, and automated technical means. The categories of data we collect are set out below.

• Account Registration: Full name, date of birth, email address, mobile phone number, username, and password (stored in encrypted form).
• KYC Verification: Government-issued photo identification (e.g., Malaysian MyKad, passport), proof of address, and in some cases proof of source of funds.
• Payment Information: Bank account details, e-wallet identifiers (e.g., Touch 'n Go, Boost, GrabPay), DuitNow/FPX account references, and cryptocurrency wallet addresses. Full payment credentials are processed by our certified payment partners and are not stored on hfive5 servers in unencrypted form.
• Customer Support: Messages, queries, complaints, and any personal data you voluntarily share when contacting our support team.
• Preference Settings: Responsible gambling limits, communication preferences, and account notification settings.

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, games played, betting history, session duration, click paths, and feature interactions.
• Location Data: General geographic location inferred from your IP address. hfive5 does not collect precise GPS-level location data.
• Cookie Data: Session tokens, preference identifiers, and analytics data collected via cookies and similar tracking technologies. See Section 7 for full details.

The following table summarises the primary purposes for which hfive5 processes your personal data, together with the categories of data used in each case:

hfive5 processes personal data only where a valid legal basis exists. The applicable legal bases for our primary processing activities are as follows:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accepted upon registration, including account management, payment processing, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, know your customer (KYC) requirements, and financial record-keeping obligations.
• Legitimate Interests: Processing carried out in pursuit of hfive5's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily applicable to marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

hfive5 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data with third parties only in the following limited and defined circumstances:

We engage trusted third-party service providers who process personal data on our behalf under strict contractual data processing agreements. These include payment gateway operators (covering DuitNow, FPX, Touch 'n Go, Boost, GrabPay, and cryptocurrency processors), identity verification providers, cloud hosting and infrastructure providers, live casino game software providers, and customer support platform operators. All such providers are contractually obligated to handle your data in accordance with applicable data protection standards and exclusively for the purposes specified by hfive5.

hfive5 may disclose personal data to competent regulatory authorities, financial intelligence units, law enforcement agencies, or courts of law where required to do so by applicable law, legal process, or regulatory obligation — including obligations arising from anti-money laundering and counter-terrorism financing frameworks.

In the event of a merger, acquisition, restructuring, or sale of all or part of hfive5's business, personal data held by the Operator may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and the privacy implications thereof prior to or at the time the transfer occurs.

hfive5 uses cookies and similar tracking technologies (including web beacons and local storage) to operate the Platform effectively, maintain your session state, and improve your experience. The categories of cookies we deploy are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. They cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, responsible gambling limits, and display configurations. Disabling these may reduce the personalisation of your experience.
• Analytics Cookies: Used to collect anonymised data on how users interact with the Platform — including pages visited, session duration, and feature usage. This data is used solely to improve Platform performance and user experience.
• Marketing Cookies (Opt-in): Used only where you have explicitly consented to receive personalised promotional content. You may withdraw this consent at any time via your account preferences or by contacting our support team.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use core Platform features. For detailed browser-level cookie management instructions, please refer to your browser's help documentation.

hfive5 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. Indicative retention periods are set out in Section 4 (Data Processing) of this Policy.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in manner that prevents re-identification. Where data is anonymised rather than deleted, the resulting anonymised dataset may be retained indefinitely for aggregated analytics and Platform improvement purposes.

In circumstances where a legal hold is required — for example, where data is relevant to pending or reasonably anticipated litigation, regulatory investigation, or legal proceedings — hfive5 will preserve the relevant data beyond the standard retention period until the hold is lifted.

hfive5 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure.

• Encryption in Transit: All data transmitted between your device and the hfive5 Platform is encrypted using 256-bit SSL/TLS protocols.
• Encryption at Rest: Sensitive data stored on hfive5 infrastructure, including passwords (hashed) and KYC documents, is encrypted at rest using industry-standard algorithms.
• Access Controls: Personal data is accessible only to hfive5 personnel and authorised processors who require it for legitimate operational purposes. Role-based access controls and the principle of least privilege are applied throughout our systems.
• Security Monitoring: Our infrastructure is subject to continuous security monitoring, regular vulnerability assessments, and periodic penetration testing by independent security professionals.
• Incident Response: hfive5 maintains a documented data breach response procedure. In the event of a breach likely to result in a significant risk to your rights and freedoms, we will notify affected users without undue delay and in accordance with applicable regulatory notification obligations.

Subject to applicable law, you hold the following rights in relation to your personal data held by hfive5. To exercise any of these rights, please submit a written request to our support team via the contact details in Section 14.

• Right of Access: You have the right to request confirmation of whether hfive5 processes your personal data and, if so, to receive a copy of that data together with details of the processing purposes, data categories, and recipients.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update certain account information directly from within your account settings.
• Right to Erasure: Subject to legal retention obligations, you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis for processing applies.
• Right to Restriction of Processing: You may request that hfive5 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request receipt of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for direct marketing purposes. hfive5 will cease such processing upon receipt of a valid objection unless compelling legitimate grounds for processing exist that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

hfive5 will respond to valid data rights requests within a reasonable timeframe, typically within 30 days of receipt. Requests may be subject to identity verification before processing, to protect against unauthorised data access.

The hfive5 Platform is strictly intended for use by individuals aged 21 years or above. We do not knowingly collect or process personal data from persons under the age of 21. Age verification is a mandatory step in our onboarding process, and we reserve the right to request documentary proof of age at any time.

If hfive5 becomes aware that personal data has been inadvertently collected from a person under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any deposited funds to the extent operationally feasible. Parents or guardians who believe their child has registered on the Platform are encouraged to contact us immediately at [email protected] so that appropriate action can be taken without delay.

The hfive5 Platform integrates with a number of third-party services necessary to deliver our products — including live casino game providers, payment processors (covering Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and cryptocurrency gateways), identity verification services, and infrastructure providers.

When you interact with these integrated third-party services — for example, when processing a payment via an e-wallet provider — that provider's own privacy policy governs the handling of any data you submit directly to them. hfive5 is not responsible for the privacy practices of third-party service providers operating outside the scope of our data processing agreements.

hfive5 conducts due diligence on all third-party providers prior to engagement and requires contractual assurances that personal data is handled in a manner consistent with this Policy and applicable data protection law. We do not permit third-party processors to use your personal data for their own independent purposes.

hfive5 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform services. Where material changes are made, we will provide notice to registered users via email or a prominent notification on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed of how hfive5 handles your personal data. Your continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

Prior versions of this Privacy Policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by hfive5, please contact us through the following channels:

• Live Chat: Available directly on the Platform,24 hours a day, 7 days a week — the fastest way to reach our team.
• Email: [email protected] — for data rights requests, privacy concerns, or written formal enquiries. Please do not click this address as a link; copy and paste it into your email client.
• Languages: English, Bahasa Melayu, and Mandarin Chinese are supported across all contact channels.
• Response Time: Data rights requests and privacy-related email enquiries will receive a substantive response within 30 days of receipt, subject to identity verification requirements.

hfive5 operates from Malaysia and primarily serves players across the country. All formal data protection correspondence should be directed to the email address above.