Privacy Policy

Medan4d ("the Platform", "we", "us", or "our"), accessible at https://medan4d.cam, is an online betting and gaming platform serving users across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam. We take the privacy and security of your personal data seriously.

This Privacy Policy describes how we collect, use, disclose, store, and protect personal data obtained through your registration, use of our services, and interactions with our support and communication channels. It also sets out the rights you hold as a data subject and how to exercise those rights.

By registering an account on the Platform or continuing to use our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to this Privacy Policy, you must discontinue use of the Platform and request account closure.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the Platform.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, directly or indirectly — including names, identification numbers, contact details, location data, and online identifiers.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, medan4d.
• "Data Processor" means any third party that processes personal data on behalf of the Data Controller under a contractual arrangement.
• "Processing" means any operation performed on personal data, whether automated or manual — including collection, recording, storage, alteration, retrieval, transmission, erasure, or destruction.
• "Consent" means a freely given, specific, informed, and unambiguous indication by you that you agree to the processing of your personal data for a specific purpose.
• "KYC Data" means identity and address verification documentation submitted as part of the Know Your Customer verification process, including government-issued identification and proof of address.
• "Usage Data" means information collected automatically as you interact with the Platform, including IP addresses, device identifiers, browser type, pages visited, and session durations.

We collect personal data from you directly (during registration and account use) and automatically (through your interaction with the Platform). The categories of data we collect are set out in the table below:

We use the personal data we collect for the following specific purposes, and for no other purposes without your prior consent or a separate lawful basis:

• Account Management: Creating, operating, and maintaining your registered account, verifying your identity, and administering your account preferences and settings.
• Payment Processing: Facilitating deposits and withdrawals through your chosen payment method (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC, USDT), verifying transactions, and maintaining financial records.
• Legal & Regulatory Compliance: Satisfying our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and KYC regulatory frameworks, and complying with requests from competent authorities.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, collusion, and other prohibited conduct; protecting the integrity of the Platform and its users.
• Responsible Gambling: Administering deposit limits, session controls, self-exclusion requests, and other responsible gambling tools; identifying patterns of behaviour that may indicate problematic gambling and taking appropriate action.
• Customer Support: Responding to your queries, complaints, and support requests; maintaining records of communications for quality assurance and dispute resolution purposes.
• Service Personalisation: Tailoring your platform experience, game recommendations, and promotional offers based on your preferences and usage history, where you have not opted out of such personalisation.
• Platform Improvement: Analysing aggregated usage data to improve platform performance, fix technical issues, and develop new features and game offerings.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates by email or in-platform messages, subject to your communication preferences. You may opt out at any time.

We rely on one or more of the following lawful bases when processing your personal data:

• Contractual Necessity: Processing that is necessary to perform the contract between you and medan4d — including account operation, payment processing, and service delivery — is conducted on this basis.
• Legal Obligation: Processing required to comply with applicable laws, including AML/CTF regulations, tax obligations, and responses to lawful requests from regulatory authorities or law enforcement.
• Legitimate Interests: Processing conducted for fraud prevention, security monitoring, platform improvement, and responsible gambling risk assessment, where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes such as marketing communications, non-essential cookies, and personalisation features — where you have given your explicit, informed consent. You may withdraw this consent at any time.

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Data sharing is limited to the following categories of recipients, and only to the extent strictly necessary for the stated purpose:

• Payment Service Providers: DuitNow, FPX gateway operators, e-wallet providers (Touch 'n Go, Boost, GrabPay), Malaysian commercial banks (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency network processors — for the sole purpose of completing your requested transactions.
• Identity Verification Providers: Third-party KYC service providers that process your identity documents to verify your identity and age as required by our operational and regulatory obligations.
• Fraud Prevention & AML Services: Providers of fraud detection, risk scoring, and anti-money laundering screening services that help us identify and prevent financial crime and platform abuse.
• Technology & Infrastructure Providers: Cloud hosting, data storage, platform software, and security service providers operating under strict data processing agreements that prohibit independent use of your data.
• Regulatory & Law Enforcement Authorities: Where we are under a legal obligation to disclose personal data to competent authorities, including financial regulators, law enforcement agencies, and courts, we will comply with such requests and will notify you where legally permitted to do so.
• Professional Advisers: Legal, accounting, and audit firms engaged in the course of our business operations, subject to professional confidentiality obligations.
• Business Successors: In the event of a merger, acquisition, or sale of all or part of our business assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

We retain your personal data for no longer than is necessary for the purposes for which it was collected, subject to any legal or regulatory obligations that require extended retention periods. The following general retention guidelines apply:

• Account and Registration Data: Retained for the duration of your account's active status and for a minimum of five (5) years following account closure, in accordance with AML/CTF regulatory retention obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, as required by applicable financial regulation.
• Transaction and Financial Records: Retained for a minimum of seven (7) years to comply with financial record-keeping obligations.
• Communication Records: Live chat transcripts, email correspondence, and support ticket records are retained for three (3) years following the close of the relevant interaction.
• Usage and Analytics Data: Aggregated and anonymised usage data may be retained indefinitely for platform improvement purposes. Identifiable usage logs are retained for twelve (12) months.
• Responsible Gambling Data: Self-exclusion records and responsible gambling interaction history are retained for a minimum of five (5) years to prevent circumvention of exclusion periods.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual.

We implement a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse. These measures include:

• Encryption: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols. Sensitive data at rest (including passwords, which are stored as salted cryptographic hashes, and financial identifiers) is encrypted using industry-standard algorithms.
• Access Controls: Access to personal data within our internal systems is restricted on a strict need-to-know basis. Staff with access to personal data are subject to contractual confidentiality obligations and regular security training.
• Two-Factor Authentication: We offer and recommend the use of two-factor authentication (2FA) on all user accounts to protect against unauthorised account access.
• Continuous Monitoring: Our platform and infrastructure are subject to continuous security monitoring, intrusion detection, and periodic third-party security audits and penetration testing.
• Data Breach Response: We maintain a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

The Platform uses cookies and similar tracking technologies to support platform functionality, maintain session security, and analyse usage patterns. The following categories of cookies are in use:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable session management, authentication, and security features. These cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred display settings and language configuration — to personalise your experience on return visits.
• Analytics Cookies: We use first-party analytics cookies to collect aggregated information about how users interact with the Platform. This data is used to identify performance issues, improve navigation, and develop new features. Analytics data is not linked to individual user identities without your consent.

We do not use third-party advertising cookies or cross-site tracking technologies. You may manage or disable non-essential cookies through your browser's settings. Disabling certain cookies may affect Platform functionality. Your continued use of the Platform following your initial session constitutes acceptance of our necessary cookies.

As a data subject, you hold the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond to all valid requests within thirty (30) days.

The Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect or process personal data from individuals below this age. Our registration process includes a mandatory age declaration and is subject to KYC identity verification that confirms the user's date of birth.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately close the relevant account, void all associated transactions, and securely delete all personal data attributable to that individual from our active systems, subject to any mandatory retention obligations arising from the underage gambling incident.

If you believe that a minor has accessed or registered on our Platform, please notify us immediately at [email protected] so that we may investigate and take appropriate action.

Your personal data is primarily stored on servers located within or serving the Southeast Asian region. Some of our third-party service providers — including cloud infrastructure, KYC verification, and fraud detection providers — may be based in or operate from other jurisdictions, including but not limited to Singapore and Hong Kong.

Where personal data is transferred to countries that do not provide a level of data protection equivalent to that in Malaysia, we ensure appropriate safeguards are in place, such as contractual data transfer agreements that bind the recipient to adequate privacy protections. We will not transfer your data to any jurisdiction without first satisfying ourselves that an adequate level of protection exists.

The Platform may reference certain third-party services — including payment providers and game studios — in the course of providing its services. This Privacy Policy applies solely to the Platform itself and to our processing of your personal data.

Where you interact directly with a third-party service (for example, when completing a payment transaction through your banking app or e-wallet), that third party's own privacy policy will govern the processing of your data within their system. We are not responsible for the privacy practices of third parties and encourage you to review their policies before interacting with their services.

We review and update this Privacy Policy periodically to reflect changes in our data processing practices, applicable legal requirements, and platform functionality. When material changes are made, we will update the "Last Updated" date at the top of this document and, where practicable, provide notice to registered users via email or in-platform notification.

Your continued use of the Platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. The current version of this Privacy Policy is always accessible at https://medan4d.cam/privacy-policy.

If a proposed change materially alters how we use your personal data in a way that requires your renewed consent, we will seek that consent before applying the change to your account.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or have a concern about how your personal data has been handled, please contact our Data Support team using the details below:

We are committed to resolving all privacy-related concerns promptly and transparently. If you are dissatisfied with our response to a data rights request or privacy complaint, you retain the right to escalate your concern to the relevant data protection authority in your jurisdiction.