Kerbau28 Privacy Policy – Personal Data Protection Commitment for Malaysian Players

Kerbau28 (hereinafter referred to as "we", "the Platform", or "Kerbau28") understands that our members' trust depends not only on a great gaming experience, but also on the confidence that their personal data is handled responsibly and transparently. This Privacy Policy is written in Bahasa Malaysia to ensure every Malaysian member fully understands their rights and the protections available to them.

This policy applies to all information we collect through the kerbau28.run website, including during the registration process, platform usage, customer support interactions, and all financial transactions made using Malaysian local payment methods such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX. It also covers information collected automatically through cookies and related tracking technologies.

By using the platform Kerbau28, you consent to the collection and use of your data as described in this document. If you do not agree, please stop using the platform and contact us to close your account and delete your data.

Kerbau28 collect your personal data through two main channels — information you provide directly and data collected automatically while you use our platform.

Information you provide directly:

• Identity information: Full name (as on MyKad or valid identification document), date of birth, gender
• Contact information: Malaysian phone number, active email address
• Account information: Username, password (stored in encrypted form), security questions
• KYC verification documents: MyKad or passport copy, proof of address (recent utility bill or bank statement)
• Financial information: E-wallet account name (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay) or FPX details for withdrawal purposes — we no store full credit or debit card numbers

Automatically collected data:

• Technical data: IP address, browser type, operating system, screen resolution, device model
• Usage data: Pages visited, session duration, clicks and in-platform navigation
• Gaming data: Betting records, game history, session duration, wins and losses
• General location data: State or region based on IP address (not GPS — we do not access your device's precise location)

Kerbau28 only uses your personal data for legitimate purposes directly related to the delivery of our platform services. Below is a summary of our data usage purposes:

Kerbau28 does not use your data to make automated decisions that significantly affect you without appropriate human oversight, except for fraud detection and platform security purposes, which are critical operational requirements.

Kerbau28 do not sell, rent, or trade your personal data to any third party for their own marketing purposes. This is a non-negotiable policy and one of our core commitments to Malaysian members.

However, in the normal course of platform operations, there are limited situations where your data may be shared with third parties that have undergone rigorous security and privacy assessments by Kerbau28:

• Local payment providers: Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX processors (Maybank2u, CIMB Clicks) receive only the minimum transaction information necessary to process your deposits and withdrawals in MYR.
• Gaming software providers: Companies such as Pragmatic Play, PG Soft, and Evolution Gaming may receive non-personally identifiable account identifiers to enable smooth gameplay. They do not receive your full name or any financial information.
• KYC verification services: Third-party providers we use to verify members' identities in order to meet anti-fraud and relevant legal requirements.
• Statutory authorities: Where required by Malaysian law or a lawful directive from a competent authority, we may be obliged to disclose certain information. We will notify you of any such request unless prohibited from doing so by law.

Data security is the greatest investment made by Kerbau28 in our operations. We employ multiple layers of security technology and procedures to ensure your personal data remains protected at all times.

Technical security measures we practise:

• 256-bit SSL encryption: All communications between your device and Kerbau28's servers are encrypted using TLS/SSL 256-bit protocol — the same standard used by major Malaysian banks such as Maybank and CIMB for their online banking.
• Data encryption at rest: Sensitive data stored in our databases — including passwords (stored as hashes, not plain text) and financial information — is encrypted using industry-recognised encryption algorithms.
• Tiered access controls: Only specifically authorised personnel have access to members' personal data, and all access is logged and audited on a regular basis.
• 24-hour security monitoring: Kerbau28's IT security team monitors our systems around the clock to detect and respond promptly to any threats or suspicious activity.
• Periodic penetration testing: Our platform undergoes regular security testing by independent experts to identify and address any vulnerabilities before they can be exploited.

Cookies are small text files stored on your device when you visit a website. Kerbau28 use cookies to enhance your experience on our platform and to ensure certain features function correctly.

Types of cookies we use:

• Essential Cookies: These cookies are required for the platform to function properly. They include login session cookies, CSRF security tokens, and language settings. Without them, the platform cannot operate and you will be unable to log in or play. These cookies cannot be disabled.
• Preference Cookies: Saves your preferences such as display language, default betting limits, and other interface settings so you do not have to reconfigure them each time you log in.
• Analytics Cookies: Helps us understand how members use the platform — which pages are most popular, where users encounter difficulties, and how we can improve the overall experience. This data is aggregated and anonymised.
• Security Cookies: Used to detect suspicious login activity and fraud attempts, and to protect your account from unauthorised access.

How to manage your cookies: You can manage and delete cookies through your browser settings. However, disabling essential cookies will affect platform functionality and you may be unable to log in or use certain features properly. For guidance on managing cookies in your browser, refer to your browser's help section.

As a member Kerbau28, you have clear and enforceable rights regarding your personal data. Below is a list of your rights and how to exercise them:

Kerbau28 only retains your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law.

Standard retention period:

• Active account data: Retained for the full duration your Kerbau28 account remains active.
• Financial transaction records: Retained for a minimum of 7 years after a transaction occurs, in line with applicable accounting and anti-money laundering legal requirements.
• Game records: Retained for 2 years from the date of play for dispute resolution and responsible gaming program verification purposes.
• KYC documents: Retained for 5 years from the date of submission or until account closure, whichever is longer, in accordance with compliance requirements.
• Support communication logs: Retained for 12 months for service quality and complaint resolution purposes.
• Analytics cookie data: Automatically deleted after 13 months.

When data is no longer required, Kerbau28 delete it using secure, non-recoverable methods — whether verified digital deletion or, for any physical data (where applicable), secure destruction. We do not allow data that is no longer needed to remain in our systems.

Kerbau28 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements in how we protect your data. The "Updated" date at the top of this document will change whenever amendments are made.

For material and significant amendments, Kerbau28 will notify members via in-platform notifications or email to the registered address before any amendments take effect. For minor changes that do not materially affect your fundamental rights, updates may be made without a separate notice.

Your continued use of the Kerbau28 platform after any amendments to this policy are published constitutes your acceptance of the updated terms. We encourage you to review this page periodically.

We take every privacy complaint and enquiry seriously. If you are not satisfied with our response, you have the right to refer the matter to the relevant data protection authority in Malaysia.