Sobat500 Privacy Policy – Malaysian Player Data Protection

1Introduction

Sobat500 ("we", "our platform") is committed to protecting the privacy and security of the personal data of all members who use our online entertainment platform at sobat500.biz. This Privacy Policy explains how we collect, use, store, protect and disclose your personal information when you register for and use Sobat500's services.

This Privacy Policy applies to all users of the Sobat500 platform, including visitors who browse the website without registering, registered members, and former members whose accounts have been closed. This Policy should be read together with Terms & Conditions Sobat500, which constitutes the entire agreement between you and us.

This Privacy Policy is prepared in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). In the event of any conflict between this policy and applicable Malaysian law, Malaysian law shall prevail.

2Personal Data We Collect

Sobat500 collects your personal data through various means as you use our platform. Below are the categories of data we collect and their sources:

Data you provide directly:

• Full name as stated on your identity card or passport
• An active Malaysian mobile number
• A valid email address
• Date of birth for age verification
• Bank account number or eWallet (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) for deposit and withdrawal processing
• A copy of your identity card or passport (for KYC/identity verification purposes when required)
• Any information you provide when contacting our support team

Data collected automatically during platform usage:

• Your device's IP address
• Device type, operating system and web browser used
• History of gaming and betting activity on the Sobat500 platform
• Records of all deposit and withdrawal transactions
• Date, time and duration of login sessions
• Cookie and website tracking technology data (explained further in Section 8)
• General geolocation data (state/city) based on your IP address

Below is a summary of the data collected, its purposes, and the legal basis for its collection:

3How We Use Your Personal Data

Sobat500 uses your personal data only for legitimate and transparent purposes. The following are the primary purposes for which your data is used:

• Service Provision: Processing account registration, verifying your identity, and handling deposits and withdrawals via Touch 'n Go eWallet, GrabPay, DuitNow, FPX and other local Malaysian payment methods, as well as enabling access to all games on the Sobat500 platform.
• Account Communications: Sending important account-related notifications such as transaction confirmations, security alerts and policy updates via SMS or email.
• Security & Fraud Prevention: Monitoring account activity to detect and prevent unauthorised access, fraud, money laundering and platform abuse.
• Legal Compliance: To fulfil legal obligations under Malaysia's PDPA, anti-money laundering laws, and other reporting requirements set by the relevant Malaysian authorities.
• Responsible Gaming: Monitoring members' gaming patterns to identify early signs of problem gambling and provide appropriate assistance or limits when needed.
• Platform Improvement: Analysing aggregated (non-individual) usage data to understand how members use the platform and identify areas for improvement.
• Marketing & Promotions: Sending you information about Sobat500 promotions, bonuses and special offers that may interest you, subject to the marketing preferences you provided at registration. You may withdraw this consent at any time.

Sobat500 will not use your personal data for purposes beyond those stated in this policy without your prior consent, unless required by applicable Malaysian law.

4Data Sharing & Disclosure

Sobat500 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. However, we may share your data with the following categories of third parties in limited and specific circumstances:

• Payment Processors: Payment partners who handle eWallet transactions (Touch 'n Go, GrabPay, Boost, ShopeePay), DuitNow, and FPX on behalf of Sobat500. They receive only the minimum data necessary to process the relevant transaction.
• Identity Verification Service Provider: Companies that assist Sobat500 in carrying out KYC processes and identity document verification to comply with anti-money laundering legal requirements.
• Technology Service Providers: Companies that provide the technical infrastructure to operate the Sobat500 platform, including server, analytics and cybersecurity services. All such providers are bound by strict confidentiality agreements.
• Malaysian Authorities: Malaysian government authorities or law enforcement bodies making lawful requests under Malaysian law, such as the police, courts or relevant commissions.
• Professional Advisors: Lawyers, auditors and other professional advisors who access data only to the extent necessary to provide their advisory services to Sobat500, subject to professional confidentiality obligations.

5Data Security

The security of members' personal data is a core technical priority for Sobat500. We implement multiple layers of security controls to protect your data from unauthorised access, disclosure, alteration or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or app and Sobat500's servers is encrypted using the latest TLS protocol with 256-bit keys — the same standard used by Malaysia's leading banks.
• Data-at-Rest Encryption: Sensitive data stored in Sobat500's databases is encrypted using modern encryption algorithms. Account passwords are stored in a hashed format that cannot be decrypted.
• Internal Access Controls: Access to members' personal data within the Sobat500 system is granted only to staff who genuinely require it to carry out their responsibilities, in accordance with the principle of least privilege.
• Two-Factor Authentication (2FA): Sobat500 supports two-factor authentication for member accounts as an added layer of security. Members are encouraged to enable this feature in their account settings.
• 24/7 Security Monitoring: Sobat500's automated security monitoring system operates around the clock to detect and respond to cybersecurity threats swiftly.
• Regular Security Audits: Sobat500's technical infrastructure undergoes regular security audits and penetration testing by independent parties to identify and address vulnerabilities before they can be exploited.

While Sobat500 takes all reasonable security measures, no system can be guaranteed 100% secure. In the event of a data breach affecting your personal data, Sobat500 will notify you as promptly as possible in accordance with Malaysia's PDPA requirements and will take immediate steps to contain and remediate the situation.

You also play an important role in keeping your data secure. Please ensure your Sobat500 account password is strong, unique, and not shared with any other account. Never share your password with anyone, including Sobat500 staff — we will never ask for your password via email, SMS, or Live Chat.

6Data Retention Period

Sobat500 retains your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable Malaysian law. The following are general guidelines for data retention periods:

• Active Account Data: For as long as your account remains active on Sobat500, your personal data will be retained to support the ongoing provision of our services.
• Financial Transaction Data: Deposit and withdrawal transaction records are retained for a minimum of 7 years, in accordance with Malaysia's financial and accounting legal requirements.
• Identity Verification (KYC) Data: Identity verification documents and records are retained for a minimum of 5 years after account closure, in compliance with Malaysia's anti-money laundering legal requirements.
• Game History: Gaming activity records are retained for 2 years for fraud detection and responsible gaming support purposes.
• Communication Records (Chat/Email Logs): Customer support communication records are retained for 1 year for quality control and dispute resolution purposes.

Once the retention period expires, data will be securely deleted or anonymised so that it can no longer be linked to any specific individual. Anonymised data may be used for analytics and platform improvement purposes without any time restriction.

7Your Rights Under Malaysia's PDPA

As a Sobat500 member residing in Malaysia, you have the following rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). Sobat500 is committed to making it easy for you to exercise these rights:

To exercise any of the rights above, please contact the Sobat500 support team via Live Chat or email at support@sobat500.biz, stating the right you wish to exercise and the relevant details. We do not charge any fee for reasonable data rights requests and will respond within the timeframe stipulated under Malaysia's PDPA.

8Cookies & Tracking Technologies

Sobat500 uses cookies and similar tracking technologies to enhance user experience, maintain platform security, and analyse how our platform is used. Cookies are small text files stored on your device when you visit the Sobat500 platform.

Below are the types of cookies used by Sobat500:

You can control and manage cookies through your web browser settings. Please note that disabling essential cookies may affect the functionality of the Sobat500 platform and could prevent you from logging in or using certain features. Optional cookies can be deleted or blocked without affecting the platform's core functionality.

In addition to cookies, Sobat500 uses other tracking technologies such as web pixels to measure the effectiveness of our email communications. You can disable images in your emails to prevent web pixels from functioning.

9Protection of Children's Data

The Sobat500 platform is intended exclusively for adults aged 18 and above. Sobat500 does not knowingly collect, store, or process the personal data of any individual under the age of 18.

If Sobat500 discovers that we have inadvertently collected the personal data of an individual under the age of 18, we will take immediate steps to:

• Suspend or terminate the account in question immediately;
• Delete all personal data relating to the minor concerned from our systems;
• Reject any financial transactions associated with that account.

10Cross-Border Data Transfers

Sobat500 operates primarily in Malaysia and processes the personal data of Malaysian members within an environment that complies with Malaysian law. However, in certain circumstances, data may be processed or stored outside Malaysia, particularly when we engage international technology service providers.

In all cases of cross-border data transfers, Sobat500 ensures that:

• The recipient country or region has data protection laws equivalent to or stricter than those of Malaysia;
• Appropriate data transfer agreements have been put in place with receiving parties to ensure adequate protection standards;
• International service providers are bound by contractual terms requiring them to protect the personal data of Sobat500 members to a standard equivalent to Malaysia's PDPA.

If you would like to learn more about the safeguards applied to cross-border data transfers, please contact our team at support@sobat500.biz.

11Changes to the Privacy Policy

Sobat500 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, technology, legal requirements, or other operational needs. When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date shown at the top of this document;
• Displaying a prominent notice on the Sobat500 platform homepage for a reasonable period;
• Sending notifications to members via their registered email address for significant changes that directly affect your privacy rights.

Your continued use of the Sobat500 platform following any amendments to this Privacy Policy will be considered your acceptance of the updated policy. If you do not agree with the changes made, you have the right to close your account and request deletion of your data in accordance with the procedure set out in Section 7.

12Contact Us About Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way Sobat500 handles your personal data, please reach out to us through the following channels:

• Privacy Email: support@sobat500.biz (please include the subject line "Data Privacy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week within the Sobat500 platform
• Service Language: Bahasa Malaysia and English
• Response Time: Data privacy requests will be responded to within 7 business days

We encourage you to contact Sobat500 directly in the first instance should you have any privacy concerns. Our team will make every effort to resolve your concerns promptly and to your satisfaction. If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant regulatory body.