Privacy Policy — xhtab4 Online Casino & Sports Betting
At xhtab4 we take the privacy of Malaysian players seriously. This Privacy Policy explains in plain, clear terms exactly what personal data we collect, how we use it, who we share it with, and what rights you hold over your own information.
Our Privacy Commitments at a Glance
These cards summarise how xhtab4 approaches player data — full details are in the policy sections below.
Bank-Grade Encryption
All personal and financial data transmitted between your device and xhtab4 is protected with256-bit SSL/TLS encryption — the same security standard used by Malaysian commercial banks including Maybank and CIMB.
We Never Sell Your Data
xhtab4 does not sell, rent, or trade your personal information to third-party advertisers, data brokers, or marketing companies. Your data is used solely to operate, improve, and secure the xhtab4 platform for you.
You Control Your Data
You have the right to access, correct, port, and request deletion of your personal data at any time. Submit a request via our live chat or at [email protected] and we will respond within 30 days.
Only What We Need
xhtab4 applies data minimisation principles — we collect only the personal information genuinely required to operate your account, process MYR transactions, fulfil KYC obligations, and deliver responsible gambling tools.
Clear Purpose for Every Use
Every category of data we collect has a documented, lawful purpose — account management, payment processing, fraud prevention, regulatory compliance, or responsible gambling monitoring. Nothing is collected "just in case".
Responsible Gambling Safeguards
We use account activity data specifically to identify players who may need support — unusually long sessions, rapid deposit patterns, or self-set limit breaches — as part of our responsible gambling monitoring obligations.
1. Introduction
This Privacy Policy ("Policy") is issued by xhtab4 ("we", "us", "our", "the Platform") and applies to all personal data collected, processed, and stored in connection with the operation of the xhtab4 online casino, sports betting, and gaming services available at xhtab4.cam and any related mobile-optimised interfaces.
xhtab4 serves players primarily located in Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, Ipoh, and other cities and states across the country. We are committed to handling your personal information with transparency, integrity, and care in accordance with applicable data protection principles and international best practices.
By creating an account on xhtab4 or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection, processing, and storage of your personal data as described herein. If you do not agree to this Policy, please do not use the xhtab4 Platform and contact us to arrange account closure.
This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which form part of the overall agreement between you and xhtab4.
2. Definitions
For the purpose of this Policy, the following definitions apply:
3. Data We Collect
xhtab4 collects personal data through several channels — account registration, platform activity, payment transactions, KYC verification, and direct communications. The categories of data we collect are set out below.
3.1 Registration & Identity Data
- Full legal name (as it appears on your MyKad or passport)
- Date of birth (for age verification — players must be 21 or above)
- Residential address (including city, state, and postcode)
- Email address and mobile phone number
- Username and encrypted password
- Preferred language and communication settings
3.2 Identity Verification (KYC) Data
- Government-issued photo identification (MyKad front and back, passport, or driving licence)
- Proof of residential address (utility bill, bank statement, or official correspondence dated within 3 months)
- Source of funds documentation where required by our AML compliance procedures
- Selfie or live photograph for biometric identity matching where applicable
3.3 Financial & Transaction Data
- Deposit and withdrawal transaction records, including amounts MYR, timestamps, and payment method
- Payment account identifiers — such as Touch 'n Go eWallet account reference, DuitNow registered number, FPX bank account number (last four digits), Maybank or CIMB account holder name
- Transaction history and account balance records
- Chargeback or dispute records where applicable
3.4 Gaming & Behavioural Data
- Gaming session history — game titles played, wager amounts, win/loss outcomes, session duration
- Sports betting selections, odds accepted, and bet settlement records
- Bonus and promotion redemption history
- VIP tier status and loyalty points balance
- Responsible gambling tool usage — deposit limits set, self-exclusion requests, session time limits
3.5 Technical & Device Data
- IP address and approximate geolocation
- Browser type, version, and language settings
- Device type, operating system, and screen resolution
- Session timestamps, page views, and navigation paths
- Cookie identifiers and similar tracking technologies (see Section 9)
3.6 Communications Data
- Records of live chat conversations with xhtab4 support agents
- Email correspondence sent to or received from [email protected]
- Feedback, complaints, and dispute submissions
4. How We Use Your Data
xhtab4 processes your personal data for the following specific purposes:
| Purpose | Data Categories Used | Lawful Basis |
|---|---|---|
| Account registration and management | Registration & Identity Data | Contract performance |
| Age verification (21+ requirement) | Date of birth, KYC documents | Legal obligation; Legitimate interests |
| Processing MYR deposits & withdrawals | Financial & Transaction Data | Contract performance |
| KYC identity & address verification | KYC Data, Financial Data | Legal obligation (AML compliance) |
| Fraud detection and prevention | Technical Data, Financial Data, Gaming Data | Legitimate interests |
| Responsible gambling monitoring | Gaming & Behavioural Data | Legal obligation; Legitimate interests |
| Customer support communications | Communications Data, Registration Data | Contract performance; Legitimate interests |
| Platform improvement and analytics | Technical & Device Data, Gaming Data | Legitimate interests |
| Personalised promotions and VIP tier management | Gaming Data, Registration Data | Consent; Contract performance |
| Regulatory reporting and compliance | All categories where required | Legal obligation |
5. Legal Basis for Processing
xhtab4 processes personal data only where a valid lawful basis exists. The primary bases we rely upon are:
- Contract Performance: Processing that is necessary to fulfil the agreement between you and xhtab4 — including creating your account, processing deposits and withdrawals in MYR, and delivering gaming services.
- Legal Obligation: Processing required to comply with applicable laws and regulations — including Anti-Money Laundering (AML) obligations, age verification requirements, KYC procedures, and regulatory reporting.
- Legitimate Interests: Processing necessary for purposes that serve xhtab4's legitimate business interests and which do not override your fundamental rights — including fraud prevention, platform security, responsible gambling monitoring, and service analytics.
- Consent: Processing based on your freely given, specific, informed consent — including the sending of personalised promotional communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
6. Data Sharing & Disclosure
xhtab4 does not sell your personal data to third parties. We share personal data only in the limited circumstances described below, and only to the extent necessary for the stated purpose.
6.1 Payment Service Providers
To process financial transactions, we share necessary financial and identity data with our verified Malaysian payment partners — including DuitNow operators, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay). These providers process your data as independent data controllers under their own privacy policies and applicable financial regulations.
6.2 KYC & Identity Verification Providers
We engage regulated third-party KYC verification services to authenticate identity documents and perform AML screening. These providers act as data processors bound by contractual data protection obligations and may not use your data for any purpose beyond the verification services they provide to xhtab4.
6.3 Game Technology Providers
Game software providers integrated into the xhtab4 platform receive the minimum gaming session data required to operate games, settle outcomes, and return RTP data. These providers do not receive your full identity data and are contractually prohibited from using game data for independent commercial purposes.
6.4 Regulatory & Legal Authorities
xhtab4 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, court order, or regulatory direction — including in connection with AML investigations, fraud proceedings, or other lawful legal process.
6.5 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of xhtab4's business assets, player personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected players of any such transfer by way of a prominent notice on the Platform or by email to the address on file.
7. Data Retention
xhtab4 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our retention periods are guided by the following principles:
- Active Account Data: Retained for the duration of your account relationship with xhtab4 plus a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations.
- Financial Transaction Records: Retained for a minimum of seven (7) years to satisfy financial regulatory requirements applicable to online gaming operators.
- KYC Documentation: Retained for a minimum of five (5) years from the date of submission, or longer where required by applicable AML regulations.
- Customer Support Correspondence: Retained for three (3) years from the date of the last interaction to facilitate dispute resolution and service quality improvement.
- Technical & Device Data: Retained for twelve (12) months unless required longer for fraud investigation purposes.
- Marketing Consent Records: Retained for the duration of your account relationship and for five (5) years thereafter to evidence consent or objection.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures. Where anonymisation is applied, the resulting dataset no longer constitutes personal data and is not subject to this Policy.
8. Data Security
xhtab4 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, destruction, and accidental loss. These measures include:
- 256-bit SSL/TLS Encryption: All data transmitted between your device and xhtab4 servers is encrypted in transit using industry-standard TLS 1.3 protocols.
- Encrypted Data Storage: Personal and financial data is stored in encrypted form on secured servers with restricted access controls and audit logging.
- Two-Factor Authentication (2FA): Available to all account holders as an additional layer of login security.
- Access Controls: Internal access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access permissions and regular access reviews.
- Security Monitoring: Continuous monitoring for unusual account activity, suspicious access patterns, and potential data breaches, with automated alerting and incident response procedures.
- Third-Party Security Audits: Our platform infrastructure and data handling practices are subject to periodic independent security assessments.
In the event of a personal data breach that poses a risk to your rights and freedoms, xhtab4 will notify affected players promptly via the email address registered on your account and will take all reasonable steps to mitigate the breach and prevent recurrence.
9. Cookies & Tracking Technologies
xhtab4 uses cookies and similar tracking technologies on the Platform to enable essential functionality, improve user experience, maintain session security, and analyse platform usage patterns. The categories of cookies we use are as follows:
- Strictly Necessary Cookies: Essential to the operation of the xhtab4 Platform — including session management, login state, and security tokens. These cannot be disabled without significantly impairing platform functionality.
- Functional Cookies: Enable personalisation features such as remembering your preferred language, game display settings, and responsible gambling tool configurations.
- Analytics Cookies: Collect anonymised data about how players navigate and use the Platform — used to identify usability issues, optimise page performance, and guide product improvements. No personally identifiable information is included in analytics reports.
- Security Cookies: Support fraud detection and abuse prevention by identifying unusual session patterns or device fingerprinting anomalies.
xhtab4 does not use third-party advertising or behavioural targeting cookies. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the Platform effectively.
10. Minors & Age Restriction
The xhtab4 Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect, process, or store personal data relating to persons under the age of 21. Age verification is conducted as part of the account registration process and reinforced through KYC documentation requirements.
If xhtab4 becomes aware that personal data belonging to an individual under the age of 21 has been collected, we will immediately suspend the relevant account, delete the associated personal data (except where retention is required by law), and return any real-money balance to the payment source in accordance with our underage gambling procedures.
If you believe that a person under 21 has registered on xhtab4 using false information, please contact us immediately at [email protected] with relevant details.
11. Your Rights Over Your Personal Data
Subject to applicable law, you have the following rights in respect of the personal data that xhtab4 holds about you. Requests may be submitted via live chat on the Platform or in writing to [email protected]. We will respond within 30 calendar days of receiving a valid request.
Right of Access
Request a copy of the personal data we hold about you and information about how it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held your account profile.
Right to Erasure
Request deletion of your personal data where it is no longer necessary, consent is withdrawn, or processing is unlawful — subject to retention obligations.
Right to Restriction
Request that we restrict processing of your data while a complaint or accuracy challenge is being resolved.
Right to Portability
Receive your personal data in a structured, machine-readable format for transfer to another service provider.
Right to Object
Object to processing based on legitimate interests, including direct marketing and certain analytical uses.
Right to Withdraw Consent
Withdraw previously given consent for any processing activity at any time without affecting prior lawful processing.
Right re: Automated Decisions
Request human review of any significant decision made solely by automated processing that affects your account status.
To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request" and include your registered email address and account username. We may request additional identity verification before processing sensitive data requests.
12. International Data Transfers
xhtab4 operates with technology infrastructure and third-party service partners that may be located outside Malaysia. Where your personal data is transferred to servers or processors in other jurisdictions, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to or higher than the protections described in this Policy.
Safeguards for international data transfers include: contractual clauses that impose equivalent data protection obligations on overseas processors; transfers only to jurisdictions with recognised adequate data protection frameworks; and ongoing monitoring of third-party compliance with agreed data protection standards.
By using xhtab4, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia as described in this section.
13. Changes to This Privacy Policy
xhtab4 may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or platform functionality. Material changes — those that meaningfully affect how we use your personal data or the rights available to you — will be communicated to registered players via email to the address on file, or by a prominent notice on the Platform, at least fourteen (14) days before the changes take effect.
Minor or clarificatory changes (such as typographical corrections or non-material restructuring) may be made without specific notification. The "Last Reviewed" date at the top of this Policy reflects the most recent update.
Continued use of the xhtab4 Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, please cease using the Platform and contact us to arrange account closure.
14. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the personal data xhtab4 holds about you, please contact us through the following channels:
[email protected] — please use subject line "Privacy Policy Enquiry". Response within 24–48 hours.
Available directly on the xhtab4 Platform. Typical response time: under 2 minutes. For data rights requests, please follow up via email to create a written record.
Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, Ipoh, and all states. All enquiries handled in English.
We are committed to resolving privacy concerns fairly and promptly. If you remain unsatisfied after contacting us, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.
Questions About Your Privacy?
Your data is yours. If you have any questions about how xhtab4 handles your personal information, or if you'd like to exercise any of your data rights, our support team is available 24/7. You can also review our full Terms & Conditions or visit our FAQ page for quick answers.
For players aged 21 and above only. Play responsibly. Gambling should be entertainment, not a financial solution.