Privacy Policy h25 — Protecting Your Data

Welcome to the h25 Privacy Policy page. We understand that your trust is the most valuable asset in our relationship. That is why h25 has built every aspect of this platform with member security and privacy as a foundation from the ground up.

This Privacy Policy explains in detail how h25 ("we", "Platform", "h25") collects, processes, stores, protects, and in certain circumstances shares your personal information when you use our services through the h25.ad website, mobile app, or any other official h25 channel.

This policy applies to all users of the h25 platform, including unregistered visitors, registered members, and any individual interacting with our platform in any capacity. By using the h25 platform, you agree to the practices described in this document.

H25 is the data controller for all personal information collected through this platform. We are fully responsible for ensuring your data is processed lawfully, fairly and transparently in accordance with applicable data protection laws in Malaysia.

H25 only collects data that is strictly necessary to provide a safe, responsible and high-quality service. The following are the main categories of data we collect:

We do not collect sensitive data such as health information, religious beliefs, political views, or biometric data unless required by KYC regulations or applicable law. In such cases, you will be notified separately.

The data we collect is used responsibly for the following purposes only. h25 will not use your data for any other purpose without obtaining fresh consent from you:

• Identity verification and KYC: Ensuring every member is a verified individual aged 18 and above, in line with legal requirements and platform responsibilities.
• Financial transaction processing: Securely and accurately verifying and processing deposits, withdrawals, and account balance management.
• Account Security: Detecting and preventing fraudulent activity, multiple account usage, bonus abuse, and other security threats.
• Service communications: Sending important notifications relating to accounts, transactions, policy updates, and security information.
• Platform improvements: Analysing usage patterns in aggregate (not individually) to improve the gaming experience and platform technical performance.
• Legal compliance: Fulfilling reporting and compliance obligations to relevant authorities as required by Malaysian law.
• Responsible gaming: Monitoring gameplay patterns to identify members who may require support or responsible gaming intervention.

H25 does not sell, rent or disclose your personal data to third parties for commercial purposes. However, in the following limited situations, we may need to share some of your information:

• Trusted service providers: Payment processing providers such as TNG eWallet, GrabPay, Boost, ShopeePay, and FPX, as well as cloud service providers that help us operate the platform. All parties are bound by strict data protection agreements with h25.
• Game providers: Game studios and game operators providing content within the h25 platform may receive the minimum game session data required for technical functionality.
• Legal authorities: Law enforcement agencies, regulatory bodies, or courts issuing valid orders or warrants under Malaysian law.
• Fraud prevention: Approved third-party fraud screening and anti-money laundering services that help us maintain platform integrity.

In all data-sharing scenarios, h25 shares only the minimum information necessary for the stated purpose. Every third-party provider involved is required to sign a data protection agreement prohibiting them from using your information for any other purpose.

Your data security is h25's absolute priority. We continuously invest in cutting-edge security infrastructure to ensure your personal and financial information is always protected at the highest level:

• 256-bit SSL/TLS encryption protects all data communications between the platform and users.
• Databases are fully encrypted at rest using AES-256, the security standard adopted by global financial institutions.
• An intrusion detection system (IDS/IPS) operates 24/7 to automatically detect and block unauthorised access attempts.
• Tiered internal access controls ensure only authorised staff can access data relevant to their role.
• Independent security audits are conducted periodically by accredited external cybersecurity firms.
• Two-factor authentication (2FA) is available for all member accounts as an additional layer of security.
• Automatic data backups are performed daily, with storage across redundant data centres at separate locations.

H25 uses cookies and similar tracking technologies to enhance the user experience, maintain session security and understand how our platform is used. The cookies we use fall into several categories:

• Essential Cookies: Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting aggregate data on how users interact with the platform to help us identify areas for improvement.
• Functional Cookies: Storing your preferences such as language, display settings, and login information to streamline repeat visits.
• Analytics Cookies: Helping us understand overall traffic patterns and user behaviour using privacy-compliant analytics tools.

You can control or delete cookies through your web browser settings at any time. Please note that disabling certain cookies may affect the functionality or user experience of the h25 platform.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by h25:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Such requests will be processed within 21 working days.
• Right to Rectification: If your data is inaccurate or outdated, you may request that we update or correct it through your account settings or by contacting customer support.
• Right to Erasure: You may request deletion of your personal data under certain circumstances, subject to h25's legal obligations to retain specific records for compliance purposes.
• Right to Restrict Processing: You may request that we restrict the processing of your data in certain situations while a dispute or review is being resolved.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time, free of charge.
• Right to Data Portability: You may request that we provide your data in a structured, machine-readable format for transfer to another service provider.

H25 does not retain your personal data for longer than is necessary for the purpose for which it was collected. The following are our data retention period guidelines:

• Active account data is retained for as long as your account remains active and for 7 years after account closure to meet financial regulatory requirements.
• Financial transaction records are retained for a minimum of 7 years in accordance with Malaysia's anti-money laundering legal requirements.
• KYC documents are retained for 5 years after the business relationship ends, or longer if required by applicable regulations.
• Customer support communication logs are retained for 3 years for quality assurance and dispute resolution purposes.
• Platform analytics and statistical data are stored indefinitely in aggregated, non-individually identifiable form for service improvement purposes.

Once the retention period expires, data will be securely deleted using methods that ensure it cannot be recovered. Data that must be retained for legal reasons will be quarantined and not used for any other purpose.

The h25 platform is strictly for individuals aged 18 and above. We do not knowingly collect or process any personal data from individuals under the age of 18.

H25 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or platform improvements. The "Updated" date at the top of this page will always reflect the date of the latest amendment.

For significant amendments that affect how we use your data, we will:

• Sending email notifications to all registered members at least 14 days before amendments take effect.
• Displaying clear notices on the platform's home page throughout the notice period.
• For amendments requiring fresh consent, we will request your explicit consent before continuing to process your data.

Continued use of the h25 platform after the effective date of any amendment is considered your acceptance of the updated Privacy Policy.

If you have any questions, concerns or complaints regarding this Privacy Policy or how h25 handles your personal data, our team is ready to assist you:

• Live Chat: Available on the h25 platform 24 hours a day, 7 days a week for the fastest response.
• Support Email: [email protected] — for general enquiries and account-related requests.
• Privacy Email: [email protected] with the subject line "Privacy Inquiry" — specifically for matters relating to the Privacy Policy and data rights.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection under Malaysia's Ministry of Communications, which is the supervisory authority for the PDPA in this country.