Lepak Privacy Policy – Your Data Security Is Our Priority

Lepak collects various categories of information depending on how you interact with our platform. This information falls into two main categories: information you provide directly and information collected automatically while you use the platform.

Information You Provide Directly:

• Registration Information: Full name, date of birth, MyKad or passport number, Malaysian mobile number, email address and encrypted password.
• KYC Information: A copy of your identification document (MyKad or passport), a verification selfie and proof of residential address when required.
• Financial Information: Bank account details, e-wallet account numbers (Touch 'n Go, DuitNow) and records of deposit and withdrawal transactions. Note: we do not store full credit card numbers; card data is processed through trusted payment processors.
• Communications: Customer support chat content, emails you send us, and satisfaction survey feedback.

Information Collected Automatically:

• Technical Data: IP address, browser type and version, operating system, screen resolution and device identifier.
• Activity Data: Login and logout records, games played, total wagering amount, wins and losses, and session duration.
• Cookie & Analytics Data: Session cookies, preference cookies and platform usage analytics data for service improvement.

Lepak collects your personal data through several clear and transparent methods. Understanding these collection methods helps you know exactly when and how your information is recorded by our systems.

• During Account Registration: When you complete the registration form at lepak.fun, basic information such as your name, email and phone number is collected directly.
• During the KYC Process: Identity documents you upload for identity verification are collected and stored in a secure, encrypted environment.
• During Financial Transactions: Payment details are collected when you make a deposit or request a withdrawal through supported payment methods.
• Via Platform Usage: Activity and technical data is collected automatically through server logs, cookies and permitted tracking technologies during your active session.
• Via Support Interactions: When you contact our customer support team via live chat or email, the content of those communications is recorded for quality control and issue resolution purposes.
• From Trusted Third Parties: In certain cases, we may receive verification information from approved third-party KYC providers or relevant authorities.

Every piece of data we collect is used for a specific, legitimate purpose related to the operation of the lepak platform. We do not use your data for unrelated purposes without first obtaining your additional consent.

For marketing communications, you may withdraw your consent at any time by updating your notification preferences in your account settings or by contacting our support team.

Lepak does not sell, rent or trade member personal data to any third party for commercial purposes. This is our core commitment. However, there are limited situations where data sharing is necessary to keep the platform operating properly.

Third parties that may receive limited access to your data:

• Payment Processing Provider: Transaction information is shared with trusted payment processors (such as FPX and DuitNow providers) solely for the purpose of processing your deposits and withdrawals.
• KYC Service Provider: Identity verification documents may be processed through a certified third-party KYC platform to verify document authenticity.
• Game Provider: Minimum required game session data is shared with licensed game providers to enable participation in their games.
• Legal Authority: lepak will disclose required information to the relevant authorities when mandated by a court order, warrant or valid legal requirement.
• Technical Service Provider: Cloud infrastructure and cybersecurity providers that have signed strict confidentiality agreements with lepak.

The security of member personal data is lepak's highest priority. We implement multiple layers of technical and organisational protection to ensure your data is always safeguarded against unauthorised access, disclosure, alteration or destruction.

• Encryption in Transit: All data transmitted between your browser and lepak's servers is encrypted using TLS 1.3 protocol, ensuring no third party can intercept your communications.
• Storage Encryption: Sensitive data such as KYC information, bank details and passwords are stored in encrypted form using AES-256 encryption. Passwords are stored as irreversible hashes.
• Access Control: Only lepak staff who require access to perform their authorised duties are permitted to view member personal data. This access is regularly audited and logged.
• 24/7 Monitoring: Our cybersecurity team continuously monitors systems to detect any suspicious activity or intrusion attempts.
• Penetration Testing: lepak conducts regular security testing by independent security experts to identify and address system vulnerabilities before they can be exploited.
• Data Backup: Member data is automatically backed up to a secure, encrypted location to ensure service continuity in the event of a system failure.

Lepak uses cookies — small text files stored in your browser — to enhance your experience, ensure the platform functions smoothly and gather analytics data that helps us improve our services.

Types of Cookies Used:

• Essential Cookies: Required for core platform functions such as login sessions, language preferences and security. These cookies cannot be disabled as the platform will not function properly without them.
• Preference Cookies: Saves your personal preferences such as display settings, theme and game preferences so you don't need to reconfigure them every time you log in.
• Analytics Cookies: Collecting anonymised platform usage data to help us understand how members interact with the platform and identify areas for improvement.
• Security Cookies: Helps detect fraudulent activity, suspicious login attempts and ensures your session remains secure at all times.

You can manage your cookie preferences through your browser settings. However, disabling essential cookies may affect platform functionality. Third-party cookies are only used from providers approved by lepak.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by lepak:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Such requests will be processed within 21 business days.
• Right to Rectification: If your data is inaccurate or outdated, you have the right to request a correction. You may also update basic information directly through your account settings.
• Right to Erasure: You may request the deletion of your personal data, subject to record-keeping obligations required by law, such as AML (Anti-Money Laundering) requirements.
• Right to Object to Processing: You may object to the processing of your data for direct marketing purposes at any time. Such requests will be actioned immediately.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the validity of prior processing.
• Right to Complain: If you believe your privacy rights have been violated, you have the right to file a complaint with the Personal Data Protection Commissioner of Malaysia.

Lepak retains your personal data for as long as necessary to fulfil the original purpose of collection and meet applicable legal obligations. We do not retain data longer than required.

• Active Account Data: Retained for the duration your account remains active and for an additional period after account closure as required by law.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysia's anti-money laundering and tax legal requirements.
• KYC Documents: Retained for 5 years after account closure, or longer if required by regulatory direction.
• Support Communication Log: Retained for 2 years for quality control and dispute resolution purposes.
• Analytics Data: Aggregated anonymised data may be retained for a longer period for trend analysis and platform improvement purposes.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered. Backed-up data will also be deleted within a reasonable time after removal from the primary system.

The lepak platform is exclusively intended for individuals aged 18 years and above. We do not knowingly collect any personal data from individuals under the age of 18.

If we determine that personal data of an individual under 18 years of age has been collected without proper age verification, we will immediately take the following steps:

• Suspending the relevant account until valid age verification is provided.
• Deleting all collected data relating to that individual from our systems.
• Returning any financial balance to the original payment method if no other evidence of fraud is present.

Lepak reserves the right to update or modify this privacy policy from time to time to reflect changes in our data practices, legal compliance requirements or platform improvements. All material changes will be communicated to active members via their registered email or a prominent notice within the platform.

Notice of material changes will be provided at least 14 days before the effective date, giving you sufficient time to review and make a decision regarding your continued use of our platform.

The "Updated" date at the top of this policy will always reflect the date of the latest review. We encourage you to check this page periodically. Continued use of the platform after changes take effect will be considered your acceptance of the updated policy.

If you have any questions, concerns or requests regarding this privacy policy or how we handle your personal data, lepak's Data Protection Officer (DPO) team is here to assist you.

You can reach us via:

• Email: [email protected] — state the subject "Privacy Inquiry" to expedite your response.
• Live Chat: Via the chat icon at the bottom corner of lepak.fun (available 24/7).
• Response Time: We aim to respond to all privacy enquiries within 3 business days and data rights requests within 21 business days.