Privacy Policy – lepak44 Data Practices

This Privacy Policy ("Policy") describes how lepak44 ("lepak44", "we", "us", or "our") — the operator of the online gaming platform accessible at lepak44.one — collects, uses, stores, discloses, and otherwise processes personal data relating to individuals who access or use the Platform ("Players", "you", or "your").

This Policy applies to all personal data processed in connection with the lepak44 Platform, including data collected through the website, account registration, identity verification processes, transaction records, customer support interactions, and marketing communications.

By registering an account on lepak44 or otherwise accessing the Platform, you acknowledge that you have read and understood this Policy and that your personal data will be processed as described herein. If you do not agree with the data practices described in this Policy, you should not use the Platform.

This Policy should be read together with the lepak44 Terms & Conditions, which govern your use of the Platform and are incorporated into this Policy by reference.

lepak44 acts as the data controller in respect of the personal data of Players processed through the Platform. As data controller, lepak44 determines the purposes and means of processing personal data collected in connection with the operation of the Platform.

For all data protection enquiries, rights requests, and complaints, Players may contact lepak44's data protection contact point at: [email protected]

lepak44 collects the following categories of personal data in the course of operating the Platform:

lepak44 does not collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) except where strictly necessary for legal compliance purposes and with appropriate safeguards in place.

lepak44 collects personal data through the following means:

• Direct provision by you: Data you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or updating your Account Settings.
• Automated collection: Technical and usage data collected automatically through cookies, log files, and similar technologies when you access and navigate the Platform. See Section 8 for further details on cookies.
• Third-party sources: Identity verification data from KYC service providers; payment data from payment processing partners; fraud and risk data from third-party risk management services; geolocation data from IP address resolution services.

lepak44 processes personal data on the following legal bases, depending on the specific processing activity:

• Performance of a contract: Processing necessary to open and manage your Account, process deposits and withdrawals, provide access to gaming products, and fulfil other obligations under the Terms & Conditions.
• Legal obligation: Processing necessary to comply with applicable legal and regulatory requirements, including KYC and anti-money-laundering obligations, age verification requirements, data retention obligations, and compliance with lawful orders of competent authorities.
• Legitimate interests: Processing necessary for lepak44's legitimate business interests, including fraud prevention, Platform security, responsible gaming monitoring, business analytics, and improving Platform performance — where such interests are not overridden by your interests or fundamental rights.
• Consent: Processing for marketing communications and certain optional personalisation features, where consent has been obtained from you. You may withdraw consent at any time without affecting the lawfulness of prior processing.

lepak44 uses personal data for the following purposes:

• Account management: Creating, maintaining, and administering your lepak44 Account; processing login authentication; managing account security including 2FA.
• Identity and age verification: Conducting KYC checks to verify your identity, age (21+ requirement), and eligibility to use the Platform; fulfilling anti-money-laundering due diligence obligations.
• Transaction processing: Processing deposits made via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and other supported payment methods; processing withdrawal requests; maintaining transaction records.
• Service delivery: Providing access to and operation of all Platform products — Sportsbook, lepak44 Casino, Slots, Toto 4D, and Jackpot games — and personalising your experience based on account preferences.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account compromises, collusion, match-fixing, prohibited conduct, and other security incidents.
• Responsible gaming: Monitoring gaming activity to identify patterns that may indicate problem gambling; applying and enforcing deposit limits, loss limits, cool-off periods, and self-exclusion settings; sending responsible gaming communications.
• Customer support: Responding to enquiries, resolving disputes, processing complaints, and maintaining records of customer interactions.
• Legal compliance: Fulfilling record-keeping, reporting, and disclosure obligations under applicable law and regulation; responding to lawful requests from competent authorities.
• Marketing (with consent): Sending promotional offers, bonus notifications, product updates, and other marketing communications where consent has been provided.
• Platform improvement: Analysing aggregate usage patterns to improve Platform functionality, game offerings, and user experience.

lepak44 does not sell, rent, or trade personal data. Personal data is disclosed to third parties only in the following circumstances:

• Service providers and processors: Third-party organisations that process personal data on lepak44's behalf for the purposes of operating the Platform, including KYC and identity verification providers, payment processing partners, fraud detection services, cloud infrastructure providers, and customer support tooling providers. All third-party processors are subject to contractual data processing agreements requiring them to process personal data only as instructed and with appropriate security measures.
• Game suppliers: Personal data necessary to facilitate gameplay may be shared with game content providers whose products are available on the Platform, to the extent required for the delivery of those services.
• Legal and regulatory authorities: lepak44 will disclose personal data to regulatory bodies, law enforcement agencies, courts, or other competent authorities where required to do so by applicable law, court order, or regulatory direction — including disclosures required under anti-money-laundering legislation.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of lepak44's business, personal data may be transferred to the relevant third party as part of that transaction, subject to appropriate confidentiality arrangements and notification to affected Players.

Where personal data is transferred to third parties outside of Malaysia, lepak44 will ensure that appropriate safeguards are in place to protect the data in accordance with applicable data protection standards.

8.1 Types of Cookies Used. lepak44 uses the following categories of cookies and similar tracking technologies on the Platform:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies, security cookies, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences — such as language settings and display preferences — to personalise your experience. These do not track activity across third-party sites.
• Analytics cookies: Used to collect aggregated information about how Players interact with the Platform, including pages visited, session durations, and navigation paths. This data is used to improve Platform design and performance.
• Marketing cookies: Used to track the effectiveness of promotional campaigns and, where consent is given, to deliver relevant promotional offers. These are only placed where consent has been provided.

8.2 Managing Cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect Platform functionality. For analytics and marketing cookies, you may withdraw consent at any time through the cookie preference settings accessible on the Platform.

lepak44 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law and regulation. The following general retention periods apply:

• Account and transaction records: Retained for a minimum of five (5) years from the date of Account closure, in compliance with anti-money-laundering record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, or such longer period as may be required by applicable financial crime legislation.
• Responsible gaming records: Self-exclusion records and related responsible gaming data are retained indefinitely to support enforcement of exclusion requests and to prevent circumvention.
• Customer support records: Retained for a minimum of three (3) years from the date of resolution, or longer where records are relevant to ongoing legal proceedings or regulatory investigations.
• Marketing data: Retained until consent is withdrawn, or for three (3) years from the last marketing interaction, whichever is earlier.

Where personal data is no longer required for any applicable purpose, lepak44 will securely delete or anonymise it in accordance with our data disposal procedures.

lepak44 implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser and the Platform;
• Encryption of sensitive data fields at rest in our database infrastructure;
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need;
• Multi-factor authentication for staff access to production systems containing personal data;
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure;
• Intrusion detection systems and real-time security monitoring;
• Documented incident response procedures for handling data security incidents.

While lepak44 takes all reasonable measures to secure personal data, no internet-based system can be guaranteed to be completely secure. You are responsible for maintaining the security of your Account credentials and for notifying lepak44 promptly of any suspected Account compromise.

Subject to applicable law, you have the following rights in respect of your personal data held by lepak44:

• Right of access: You may request a copy of the personal data lepak44 holds about you, together with information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. For most account details, you can update information directly through Account Settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is unlawful — subject to overriding legal obligations that require retention (e.g., anti-money-laundering record-keeping).
• Right to restriction of processing: You may request that lepak44 restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data pending verification.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request that lepak44 provide your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests where you believe your interests, rights, or freedoms override lepak44's legitimate grounds. You also have an absolute right to object to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact lepak44's data protection contact point at [email protected]. Requests will be acknowledged within 5 business days and responded to within 30 days, subject to verification of your identity. lepak44 will not charge a fee for routine rights requests.

12.1 Consent-Based Marketing. lepak44 sends promotional emails, SMS notifications, and in-platform messages only to Players who have provided explicit consent to receive such communications at the point of registration or through Account Settings.

12.2 Opting Out. You may withdraw consent for marketing communications at any time by: (a) clicking the unsubscribe link in any marketing email; (b) updating your communication preferences in Account Settings; or (c) contacting support at [email protected]. Opt-out requests for email marketing will be processed within 7 business days.

12.3 Service Communications. Withdrawing marketing consent does not affect lepak44's ability to send transactional and service communications — such as deposit confirmations, withdrawal notifications, KYC requests, Account security alerts, and responsible gaming notifications — which are sent on the basis of contract performance or legal obligation rather than marketing consent.

12.4 Responsible Gaming Restrictions. Players who have activated a self-exclusion or cool-off period will be suppressed from all marketing communications for the duration of the applicable restriction period, regardless of their stated communication preferences.

lepak44 processes gaming activity data — including bet frequency, session duration, deposit patterns, and loss trajectories — for the specific purpose of identifying patterns that may indicate problematic gambling behaviour and delivering appropriate responsible gaming interventions.

This processing is conducted on the basis of lepak44's legitimate interests in supporting player welfare and complying with responsible gaming obligations applicable to online gaming operators. It may result in lepak44 proactively reaching out to a Player, applying enhanced responsible gaming monitoring, or — in serious cases — temporarily restricting Account activity pending a responsible gaming review.

Responsible gaming records — including self-exclusion requests, exclusion history, deposit limit settings, and responsible gaming interventions — are retained indefinitely. This is to ensure that self-exclusion and exclusion decisions can be enforced across time and to prevent previously excluded Players from circumventing their own restrictions through account closure and re-registration.

For more information on lepak44's responsible gaming tools and resources, visit the Responsible Gaming page.

The lepak44 Platform is strictly intended for adults aged 21 years and above. lepak44 does not knowingly collect, process, or retain personal data from individuals who are under the age of 21. Account registration is subject to age verification as part of the KYC process.

If lepak44 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to close the Account, delete the associated personal data, and — where applicable — report the matter to relevant authorities in accordance with applicable law.

If you believe that a minor may have registered an Account on lepak44, please contact us immediately at [email protected] with all available relevant details.

lepak44 reviews this Privacy Policy periodically and reserves the right to update it at any time to reflect changes in our data practices, applicable law, or the Platform's services. The date of the most recent revision is displayed at the top of this page.

Where changes to this Policy are material — significantly affecting your rights or how your data is processed — lepak44 will provide notice through the Platform interface and/or by email to your registered account address prior to the changes taking effect. Continued use of the Platform following the effective date of material changes constitutes your acknowledgement of the revised Policy.

We encourage you to review this Policy periodically to stay informed of how lepak44 handles your personal data.

For all data protection enquiries, rights requests, or complaints, please contact lepak44 through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 through the Platform interface (log in to access live chat)

Please include your registered Account username, a description of your request or complaint, and any relevant supporting information. Rights requests and formal complaints will be acknowledged within 5 business days. lepak44 will endeavour to resolve all data protection matters promptly and in good faith.

If you are not satisfied with lepak44's handling of a data protection complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

This Privacy Policy was last updated on 12 June 2026. All previous versions are superseded by this version in their entirety.