Privacy Policy

Sahabet ("we", "us", "our", "the Operator") operates the online gaming platform accessible at sahabet.cam and related digital interfaces (collectively, the "Platform"). We are committed to protecting the privacy and personal data of all individuals who access or use our Services.

This Privacy Policy ("Policy") explains our practices in relation to the collection, use, disclosure, storage, and protection of personal data that you provide to us or that we collect when you interact with the Platform. It applies to all registered Members, visitors, and any other individuals whose personal data we process in connection with the provision of our Services.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the Sahabet Platform. By using the Platform, registering an Account, or submitting your personal data to us in any form, you acknowledge that you have read and accepted the practices described in this Policy.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that, alone or in combination with other data, can identify a natural person — including but not limited to name, national identification number (MyKad/IC), email address, device identifiers, IP address, and payment account details.
• "Processing" means any operation performed on Personal Data, whether automated or manual — including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means Sahabet as the entity that determines the purposes and means of Processing Personal Data.
• "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates — in the context of this Policy, typically the registered Player or website visitor.
• "Consent" means any freely given, specific, informed, and unambiguous indication by which the Data Subject signifies agreement to the Processing of their Personal Data for one or more specific purposes.
• "KYC Data" means identity verification documents and information collected for the purposes of Know Your Customer compliance, anti-money-laundering obligations, and age verification.
• "Third Party" means any natural or legal person other than the Data Subject, Sahabet, and persons directly authorised by Sahabet to process Personal Data under its direct authority.

Sahabet collects Personal Data across several categories, depending on how you interact with our Platform. We do not collect more information than is necessary for the specified purpose.

Where data is collected from third-party payment providers (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, or FPX), we receive only the minimum data necessary to confirm payment completion and account ownership — we do not receive or store full payment credentials.

Sahabet processes your Personal Data for the following purposes:

• Account administration: Creating, managing, and maintaining your registered Account, including authentication and security;
• Service delivery: Enabling access to sports betting, live casino, slots, lottery, and all other gaming products on the Platform;
• Identity verification and KYC compliance: Verifying your identity and age (21+ requirement) in accordance with our regulatory obligations;
• Payment processing: Facilitating deposits and withdrawals via your chosen payment method, and maintaining accurate financial records;
• Fraud prevention and anti-money-laundering: Detecting, investigating, and preventing fraudulent activity, financial crime, and misuse of the Platform;
• Responsible gambling: Monitoring gameplay patterns to identify potential problem gambling behaviours and administering player protection tools such as deposit limits and self-exclusion;
• Customer support: Responding to inquiries, resolving disputes, and providing assistance through our live chat and email channels;
• Legal and regulatory compliance: Meeting our obligations under applicable licensing conditions, anti-money-laundering regulations, and data protection laws;
• Platform improvement: Analysing aggregated usage data to improve product features, game performance, and user experience;
• Marketing communications: Sending promotional offers, bonus notifications, and relevant updates — but only where you have provided consent or where we have a legitimate interest in doing so, and in all cases subject to your opt-out rights.

Sahabet processes Personal Data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual necessity: Processing required to perform our obligations under the Account agreement with you — including account registration, payment processing, and service delivery;
• Legal obligation: Processing necessary for compliance with applicable laws and regulatory requirements — including KYC, anti-money-laundering obligations, and responsible gambling controls;
• Legitimate interests: Processing for our legitimate business interests or those of third parties — such as fraud prevention, Platform security, and service improvement — where such interests are not overridden by your rights and freedoms;
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Sahabet does not sell, rent, or trade your Personal Data to any third party for their own independent commercial purposes. We share your data only in the following limited circumstances, and only to the extent necessary:

• Payment service providers: We share payment-related data with our contracted payment processors (including providers supporting DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank) solely to facilitate transaction processing;
• KYC and identity verification partners: We may share identity documents with contracted third-party verification services engaged to conduct KYC checks on our behalf;
• Gaming software providers: Game providers may receive technical session data necessary to deliver game content to your device. These providers are bound by contractual data processing restrictions;
• Fraud prevention and security agencies: We may share data with fraud prevention agencies, law enforcement, and regulatory authorities where we are legally obligated to do so, or where disclosure is necessary to prevent or investigate suspected criminal activity;
• Professional advisers: We may share data with lawyers, auditors, or other professional advisers under confidentiality obligations where necessary for the conduct of our business;
• Business transfers: In the event of a merger, acquisition, or sale of assets, your Personal Data may be transferred to the relevant acquiring entity, subject to equivalent data protection commitments.

Sahabet retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following general retention periods apply:

• Account and registration data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, in accordance with anti-money-laundering and gaming regulatory requirements;
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable law or ongoing compliance investigations;
• Financial transaction records: Retained for a minimum of seven (7) years from the transaction date for audit, tax, and regulatory purposes;
• Support and communication records: Retained for three (3) years from the date of the last interaction, unless a longer period is required for the resolution of a dispute;
• Technical and usage data: Retained for up to two (2) years in identifiable form; thereafter, data may be retained in aggregated, anonymised form for analytical purposes without limitation.

When Personal Data is no longer required for any lawful purpose, Sahabet will delete or permanently anonymise it in a secure manner.

Sahabet uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain session security, and analyse Platform performance. Cookies are small text files placed on your device that allow us to recognise you across sessions.

We use the following categories of cookies:

• Strictly necessary cookies: Essential to the operation of the Platform — enabling login sessions, security authentication, and core functionality. These cannot be disabled without significantly impairing your ability to use the Platform;
• Performance and analytics cookies: Used to collect aggregated, anonymised data on how visitors interact with the Platform — page visits, session duration, and error reports — to help us improve performance and content;
• Functional cookies: Used to remember your preferences such as language settings and responsible gambling configuration, enabling a more personalised experience;
• Marketing and targeting cookies: Used, where you have consented, to deliver relevant promotional content. These cookies track your interaction with Platform features and may share data with our contracted marketing technology providers.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of parts of the Platform. Your consent to non-essential cookies is sought on your first visit to the Platform and may be updated at any time.

Sahabet employs comprehensive technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• 256-bit SSL (Secure Sockets Layer) encryption for all data transmitted between your device and our servers;
• Encryption at rest for sensitive data categories including KYC documentation and financial information;
• Role-based access controls ensuring that staff members access only the data necessary for their specific job function;
• Regular third-party security audits, penetration testing, and vulnerability assessments;
• Multi-factor authentication on administrative systems and Account login;
• Automated fraud detection and anomaly monitoring systems operating continuously across the Platform.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Sahabet will notify the relevant regulatory authority and, where required, affected individuals, within the timeframes required by applicable data protection law.

Sahabet operates internationally and may transfer your Personal Data to countries or territories outside Malaysia in the course of providing our Services, including for the purposes of data hosting, payment processing, and third-party service delivery.

Where Personal Data is transferred to a jurisdiction that does not offer an equivalent level of data protection, Sahabet implements appropriate safeguards to ensure the security and integrity of the transfer, including:

• Standard contractual clauses or data processing agreements with the receiving party;
• Transfer to entities that have demonstrated equivalent data protection standards;
• Any other legally approved transfer mechanism applicable under relevant data protection frameworks.

By using the Platform, you acknowledge that your Personal Data may be transferred, stored, and processed in countries outside Malaysia. Sahabet will at all times ensure such transfers are conducted in compliance with applicable data protection obligations.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your Personal Data held by Sahabet:

In summary, these rights permit you to:

• Access: Request a copy of the Personal Data we hold about you;
• Rectification: Request correction of inaccurate or incomplete Personal Data;
• Erasure: Request deletion of your Personal Data where there is no compelling reason for its continued processing — subject to overriding legal retention obligations;
• Restriction: Request that we limit the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is contested;
• Portability: Request that we provide your Personal Data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller;
• Object: Object to the processing of your Personal Data for direct marketing purposes or where processing is based on our legitimate interests;
• Withdraw consent: Withdraw any consent you have previously given to the processing of your Personal Data at any time, without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our Data Protection team using the contact details set out in Section 15. We will respond to all legitimate requests within 30 days of receipt. Where requests are complex or numerous, we may extend this period by a further two months, of which we will notify you.

The Sahabet Platform is strictly intended for adult users aged 21 years and above. We do not knowingly collect or process Personal Data from any person under the age of 21.

If we become aware that Personal Data has been collected from an individual under the age of 21 without appropriate consent, we will take immediate steps to delete that data, close the associated Account, and, where appropriate, return any deposited funds in accordance with our responsible gambling obligations.

If you believe that a minor has registered on the Platform or that we may have inadvertently collected data belonging to an underage individual, please contact our support team immediately so that we may investigate and take prompt corrective action.

We strongly encourage parents and guardians to make use of parental control software to prevent underage access to online gambling content.

The Sahabet Platform integrates with various third-party service providers — including game studios, payment processors, analytics platforms, and fraud detection tools — each of which may process certain categories of your Personal Data as described in this Policy.

All third-party processors engaged by Sahabet are contractually bound to process Personal Data only on our documented instructions, to implement appropriate technical and organisational security measures, and to delete or return Personal Data upon termination of their engagement.

Sahabet is not responsible for the privacy practices of any external websites, services, or platforms not operated by us. This Policy does not apply to data collected by any third party independently of the Sahabet Platform, including through any external links that may appear in our communications (none of which appear on this Platform in linkable form without your express navigation).

Sahabet reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the nature of our Services. When material changes are made, we will:

• Update the "Last Updated" date displayed at the top of this Policy and in the page header;
• Display a prominent notice on the Platform informing you of the change; and
• Where required by applicable law, seek your renewed consent to any material change in our processing activities.

Your continued use of the Platform following publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. We recommend reviewing this Policy periodically to remain informed of how we protect your data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by Sahabet, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly on the Platform — this is the fastest route for urgent data inquiries;
• Email: [email protected] — please mark the subject line "Privacy Inquiry" for prompt routing to our Data Protection team;
• Response time: We aim to acknowledge all privacy-related correspondence within 48 hours and to provide a substantive response within 30 days.

For further information about your rights or to make a formal data subject access request, please clearly state your request, your Account username, and provide a copy of your identification document to facilitate secure verification before we process the request.