Privacy Policy

This Privacy Policy ("Policy") sets out how cata4d ("Platform", "we", "us", "our"), operating at https://cata4d.cam, collects, uses, stores, shares, and protects the personal data of individuals ("Player", "User", "you") who register an account, access, or otherwise interact with the cata4d platform.

We take privacy seriously. This Policy is designed to give you clear, honest information about our data practices so you can make informed decisions about your personal information. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to our data practices as described herein.

This Policy applies to all data collected through the cata4d website, mobile interface, live chat, email communications, and any other channel through which you interact with the Platform. It does not apply to third-party websites linked from within the Platform, which are governed by their own privacy policies.

This Policy was last revised on 1 January 2026. We may update it from time to time; material changes will be communicated as described in Section 15.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, payment information, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means cata4d, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of cata4d in accordance with our documented instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity and age verification procedures applied during account registration and ongoing compliance reviews.
• "Cookie" means a small text file placed on your device by a website to store information about your session, preferences, and usage patterns.
• "Sensitive Data" means a subset of Personal Data warranting heightened protection, including identity document numbers, financial information, and payment credentials.

cata4d collects the following categories of Personal Data in connection with the operation of the Platform:

3.1 Account Registration Data:

• Full legal name;
• Date of birth (for age verification — minimum 21 years required);
• Residential address, including postcode and state;
• Email address and contact telephone number;
• Username and encrypted password hash.

3.2 Identity Verification (KYC) Data:

• Malaysian MyKad number, passport number, or other government-issued identification number;
• Copies of identity documents (front and back);
• Proof of address documentation (utility bill, bank statement dated within 3 months);
• Source of funds declarations where required;
• Facial verification data where applicable to identity confirmation.

3.3 Financial & Payment Data:

• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay account references);
• Bank account details used for FPX, DuitNow, or direct bank transfer transactions;
• Deposit and withdrawal transaction records including amounts and timestamps;
• Wagering history and game session data.

3.4 Technical & Usage Data:

• IP address and approximate geolocation;
• Device type, operating system, browser version, and screen resolution;
• Session duration, pages visited, features used, and clickstream data;
• Log files recording Platform interactions;
• Cookie identifiers and session tokens.

3.5 Communications Data:

• Live chat transcripts and support ticket correspondence;
• Email and WhatsApp communication records;
• Survey responses, feedback submissions, and player preferences.

cata4d collects Personal Data through the following methods:

• Direct Collection: Data you provide voluntarily when registering an account, completing KYC, making a deposit or withdrawal request, contacting support, or participating in a promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including device identifiers, IP addresses, session data, and cookie-based identifiers.
• Payment Processor Data: Transaction data received from third-party payment providers (such as Touch 'n Go eWallet, Boost, DuitNow/FPX gateway operators) in connection with deposits and withdrawals you initiate.
• Identity Verification Services: Data received from third-party KYC and identity verification service providers used to confirm the authenticity of documents you submit.
• Fraud Detection Systems: Behavioural and device fingerprint data collected by automated fraud and anti-money-laundering screening tools operating in the background of Platform sessions.
• Communications: Data contained in your communications with cata4d via live chat, email, or any other support channel.

We process your Personal Data for the following specific and documented purposes:

We do not use Personal Data for unsolicited third-party marketing, profiling for insurance or credit purposes, or any automated decision-making that produces legal effects without human review.

cata4d processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfil the contractual relationship established when you register an account — including identity verification, payment processing, game delivery, and customer support.
• Legal Obligation: Processing is required to comply with applicable anti-money-laundering regulations, age verification obligations, and other mandatory legal requirements under the laws of our operating jurisdiction.
• Legitimate Interests: Processing is carried out for purposes of fraud detection, platform security, responsible gambling monitoring, and service analytics — where our legitimate business interests do not override your fundamental privacy rights.
• Consent: Where we rely on consent as a legal basis (for example, for optional marketing communications), we will obtain your explicit consent prior to processing and you may withdraw that consent at any time.

cata4d does not sell, rent, or trade your Personal Data to third parties. We share your data only in the following limited circumstances and only to the extent necessary for the stated purpose:

7.1 Service Providers and Data Processors. We engage trusted third-party service providers who process data on our behalf and under our documented instructions. These include:

• Payment gateway operators and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX processors, and partner banks including Maybank, CIMB, Public Bank, RHB, and Hong Leong);
• KYC and identity verification service providers;
• Anti-fraud and anti-money-laundering screening systems;
• Cloud infrastructure and data hosting providers;
• Customer support platform operators;
• Analytics and platform performance monitoring tools.

All third-party processors are contractually bound to process data only in accordance with our instructions, implement appropriate security measures, and not use your data for their own purposes.

7.2 Legal and Regulatory Disclosure. We may disclose Personal Data to law enforcement agencies, regulatory authorities, or courts where we are legally compelled to do so by valid legal process, court order, or regulatory direction.

7.3 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of cata4d's assets, your Personal Data may be transferred to the acquiring entity. We will notify affected Players prior to any such transfer and you will have the opportunity to close your account if you object to the new data controller's terms.

cata4d operates under an international licensing framework. Accordingly, your Personal Data may be transferred to, stored, or processed in countries outside of Malaysia — including in the jurisdiction where our operating licence is held and where our data infrastructure is hosted.

Where Personal Data is transferred internationally, we take steps to ensure that appropriate safeguards are in place, which may include:

• Contractual obligations between cata4d and the recipient requiring equivalent data protection standards;
• Use of service providers operating in jurisdictions recognised as providing adequate data protection;
• Technical and organisational security measures proportionate to the sensitivity of the data transferred.

By using the cata4d Platform, you acknowledge and consent to your Personal Data being transferred and processed internationally in accordance with this Policy.

cata4d retains Personal Data only for as long as necessary to fulfil the purposes outlined in this Policy, subject to applicable legal and regulatory retention obligations. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Backup copies are purged in accordance with our data lifecycle management procedures.

cata4d uses cookies and similar technologies (including session tokens, local storage, and device fingerprinting) to operate and improve the Platform. The categories of cookies we use are:

• Strictly Necessary Cookies: Essential for Platform functionality including session authentication, security tokens, and fraud prevention. These cannot be disabled without impairing Platform operation.
• Functional Cookies: Store your preferences such as language settings, display options, and responsible gambling reminder configurations. Improves your experience across sessions.
• Analytical Cookies: Collect anonymised data about how players use the Platform — which pages are visited, where players spend most time, and what causes sessions to end. This data informs product improvements and is not used to identify individuals.
• Security & Fraud Prevention: Device fingerprinting and behavioural analysis tools used to detect and prevent account compromise, bonus abuse, and financial fraud.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing the Platform. We recommend reviewing your browser's cookie controls for guidance on managing individual cookie categories.

cata4d implements a layered security architecture designed to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and our servers is protected using TLS/SSL 256-bit encryption. Sensitive fields including passwords are additionally hashed using industry-standard cryptographic algorithms.
• Encryption at Rest: Personal Data and financial records stored on our servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within the organisation is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions, authenticated via multi-factor authentication, and subject to regular access reviews.
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and continuous network monitoring for anomalous activity.
• Vulnerability Management: The Platform undergoes periodic security assessments and penetration testing. Identified vulnerabilities are remediated on a risk-prioritised basis.
• Incident Response: We maintain a documented data breach response plan. In the event of a breach affecting your Personal Data, we will notify you and relevant authorities in accordance with applicable obligations.

Subject to applicable law and any overriding legal retention obligations, you have the following rights in respect of your Personal Data held by cata4d:

To exercise any of the above rights, please contact our support team via live chat or the email address specified in Section 16. We will respond to all valid data subject requests within thirty (30) days. We may require you to verify your identity before processing your request to protect against unauthorised access to your data.

cata4d strictly prohibits the registration or use of the Platform by persons under the age of twenty-one (21) years. We do not knowingly collect Personal Data from minors.

All registration attempts are subject to age verification as part of the KYC process. Where we identify, or have reason to believe, that Personal Data has been collected from an individual under 21, we will take the following steps:

• Suspend the associated Account immediately pending investigation;
• Delete all Personal Data associated with the Account upon confirmation that the Account holder is a minor;
• Return any real-money deposits to the verified source where legally and operationally feasible;
• Report the incident to relevant authorities where required by applicable law.

If you are a parent or guardian and believe that a person under 21 has created an account on cata4d, please contact our support team immediately so that we may investigate and take appropriate action.

The cata4d Platform may, from time to time, contain references to or links towards third-party services, including payment gateway interfaces and game studio environments hosted by our studio partners.

This Privacy Policy applies solely to data collected and processed by cata4d directly. We do not control, and are not responsible for, the privacy practices of any third-party service you may access via the Platform. We encourage you to review the privacy policy of any third-party service you use in connection with your Platform activity, including your chosen payment provider and e-wallet operator.

The existence of a link or integration between cata4d and a third-party service does not constitute an endorsement of that third party's privacy practices.

cata4d reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The version date at the top of this document indicates when the Policy was last revised.

Where changes are material — affecting your rights or significantly altering how we use your data — we will notify you by:

• Sending an email notification to the address associated with your registered Account; and/or
• Displaying a prominent notice on the Platform for a reasonable period following the change.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to a revised Policy, you may close your Account by contacting support and requesting account closure.

We encourage you to review this Policy periodically to remain informed of how cata4d manages your Personal Data.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a complaint about how your Personal Data has been processed, please contact the cata4d Data Privacy team through the following channels:

• Live Chat: Available 24/7 within the Platform interface. Select "Privacy / Data Query" as your query type for routing to the appropriate team. Average response time: 3–5 minutes.
• Support Email (plain text only — not a clickable link): support@cata4d.cam — please include "Privacy Policy Query" in your subject line.
• Response Time: All privacy-related enquiries and data subject access requests will be acknowledged within 5 business days and resolved within 30 calendar days where possible.

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection authority in your jurisdiction. For Malaysian players, this may include seeking guidance from the Department of Personal Data Protection (JPDP) under Malaysia's Personal Data Protection Act 2010.