01 Introduction
This Privacy Policy (hereinafter the "Policy") is issued by hijau444 (hereinafter the "Company", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at hijau444.cam (the "Platform"). The Platform is designed primarily for players based in Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions across the country.
This Policy describes how we collect, use, disclose, store, and protect personal data that you provide to us or that we collect from you when you visit, register on, or use the Platform. It also explains your rights in relation to that data and how you may exercise those rights.
By registering an Account, depositing funds, placing wagers, or otherwise using any feature of the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to the terms of this Policy, you must not use the Platform.
02 Definitions
The following terms, as used in this Policy, shall have the meanings ascribed to them below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, and online identifiers such as IP address and device ID. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction. |
| "Data Subject" | The natural person to whom the Personal Data relates — in this context, any registered Player or visitor to the Platform. |
| "Data Controller" | The entity that determines the purposes and means of processing Personal Data — in this context, hijau444. |
| "Third Party" | Any natural or legal person other than the Data Subject and the Company, including payment processors, game content providers, and fraud detection services. |
| "Cookies" | Small text files placed on your device by the Platform to facilitate functionality, analytics, and personalisation. |
| "KYC" | Know Your Customer — the identity and age verification process mandated by the Company to comply with anti-money laundering obligations and the 21+ age restriction. |
03 Data Controller
hijau444 acts as the Data Controller in respect of all Personal Data collected via the Platform. The Company is responsible for determining why and how your Personal Data is processed and for ensuring that such processing complies with applicable data protection principles.
If you have any questions about how we handle your data, or wish to exercise any of your data rights as described in this Policy, you may contact our Data Protection team using the contact details provided in Section 16.
04 Data We Collect
We collect Personal Data from you directly (when you provide it to us) and indirectly (when it is generated automatically through your use of the Platform). The categories of data we collect are as follows:
4.1 Data You Provide Directly
| Category | Examples |
|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, Malaysian MyKad or passport number, selfie/ID photo submitted during KYC. |
| Contact Data | Email address, phone number, residential address (including city/state, e.g., Kuala Lumpur, Penang). |
| Financial Data | Bank account name (Maybank, CIMB, Public Bank, Hong Leong Connect), e-wallet registration details (Touch 'n Go eWallet, Boost, GrabPay), DuitNow/FPX transaction references. We do not store full bank account numbers or card numbers. |
| Account Credentials | Username (hashed) and encrypted password. We never store passwords in plain text. |
| Communications Data | Content of support queries submitted via live chat, WhatsApp, or email; feedback and complaint records. |
4.2 Data Collected Automatically
| Category | Examples |
|---|---|
| Technical Data | IP address, browser type and version, operating system, device type (Android/iOS), screen resolution, referring URL. |
| Usage Data | Pages visited, features used, session duration, betting and gaming history (games played, stake amounts, wager outcomes), login timestamps. |
| Location Data | Approximate geographic location derived from IP address. We do not access GPS or precise device location without explicit consent. |
| Cookie Data | Session tokens, analytics identifiers, preference cookies. See Section 10 for full cookie details. |
05 Lawful Basis for Processing
The Company processes your Personal Data only where we have a valid lawful basis to do so. The applicable lawful bases are:
- Contract Performance: Processing necessary to perform the contract with you — registering your Account, processing deposits and withdrawals in MYR, settling bets, and delivering gaming services.
- Legal Obligation: Processing required to comply with legal and regulatory requirements — including KYC identity verification, anti-money laundering (AML) screening, and age verification (21+ enforcement).
- Legitimate Interests: Processing necessary for the Company's legitimate business interests — fraud prevention, platform security, responsible gambling monitoring, and improvement of services — where these interests are not overridden by your rights.
- Consent: Where we rely on your explicit consent to process data — such as for marketing communications. You may withdraw consent at any time by contacting our support team or updating your Account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
06 How We Use Your Data
We use your Personal Data for the following purposes:
- Account Registration & Management: Creating and maintaining your Player Account, verifying your identity, and managing your preferences and settings.
- Payment Processing: Facilitating deposits and withdrawals via Malaysian payment methods including Touch 'n Go eWallet, Maybank2u, CIMB Clicks, DuitNow, FPX, Boost, and GrabPay. All transactions are denominated in MYR.
- KYC & Age Verification: Confirming that you are 21 years of age or above and that your identity documents are valid, in compliance with our licensing obligations.
- Gaming Service Delivery: Operating casino games, live dealer tables, sports betting markets (including EPL, Liga Super Malaysia, UFC, and more), and associated features.
- Fraud & AML Compliance: Screening transactions and behaviour patterns for indicators of money laundering, fraud, or collusion, and taking protective action where required.
- Responsible Gambling Monitoring: Identifying patterns of play that may indicate problematic gambling behaviour and proactively offering support tools — deposit limits, session caps, or self-exclusion — where appropriate.
- Customer Support: Responding to your queries, resolving disputes, and managing feedback received via live chat, WhatsApp, or email.
- Security & Technical Operations: Maintaining Platform security, diagnosing technical issues, and preventing unauthorised access.
- Analytics & Improvement: Analysing usage patterns to understand how players interact with the Platform and to improve product features, betting markets, and user experience.
- Marketing (with consent): Where you have opted in, sending you promotional communications about bonuses, new games, or events. You may opt out at any time.
07 Data Sharing & Disclosure
We do not disclose your Personal Data to third parties except in the circumstances described below. Where we engage third-party processors, we require them to implement appropriate technical and organisational security measures and to process data only in accordance with our documented instructions.
We may share your data with:
- Payment Service Providers: Financial institutions and e-wallet operators (Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX) to facilitate deposit and withdrawal processing. These providers receive only the minimum data necessary to complete the transaction.
- Identity Verification Providers: Third-party KYC and AML screening services that assist us in verifying your identity and monitoring for suspicious activity as required by our licensing framework.
- Game Content Providers: Licensed game studios that supply casino games, live dealer software, and sports data feeds. These providers may receive anonymised or pseudonymised technical data necessary for game operation but do not receive personal identity information.
- IT Infrastructure Providers: Hosting, cloud storage, and cybersecurity service providers who process data on our behalf to support Platform operations. All such providers are bound by strict data processing agreements.
- Regulatory & Law Enforcement Authorities: Where required by law, a court order, or regulatory direction, we may disclose Personal Data to competent authorities. We will inform you of such disclosure wherever legally permissible.
- Professional Advisors: Legal counsel, auditors, and financial advisors, subject to binding confidentiality obligations.
In the event of a merger, acquisition, or sale of assets involving the Company, your Personal Data may be transferred to the acquiring entity, subject to equivalent data protection standards. You will be notified of such a transfer in advance where reasonably practicable.
08 Data Retention
We retain your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account & Identity Data | Duration of Account plus 5 years from Account closure (to meet AML legal obligations). |
| Financial / Transaction Data | 7 years from the date of the transaction, in accordance with financial record-keeping requirements. |
| KYC Documents | 5 years from Account closure or last transaction, whichever is later. |
| Support Communications | 3 years from the date of the communication, or until resolution of any associated dispute. |
| Marketing Preferences | Until you withdraw consent or request erasure, whichever is earlier. |
| Analytics / Usage Data | 26 months on an aggregated, pseudonymised basis. |
Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised. If you request deletion of your Account before the retention period expires, we will delete all data for which we have no overriding legal obligation to retain, and restrict processing of retained data to compliance purposes only.
09 Security Measures
hijau444 implements a multi-layered approach to data security, combining technical controls, organisational procedures, and staff training to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction.
Key security measures in place include:
- 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. The padlock icon in your browser confirms this protection is active during every session.
- Password Hashing: Account passwords are hashed using a strong cryptographic algorithm. We never store passwords in plain text, and our support team cannot view your password under any circumstances.
- Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. All staff who handle Personal Data are subject to confidentiality obligations and regular data protection training.
- Tokenised Payments: Financial transaction data is processed through secure, tokenised payment gateways. The Company does not store full bank account numbers, card numbers, or e-wallet credentials on its servers.
- Intrusion Detection: Automated monitoring systems run continuously to detect and respond to suspicious access attempts, unusual login patterns, or potential data breaches.
- Data Breach Response: In the event of a personal data breach that poses a risk to your rights, the Company will notify affected individuals and, where legally required, relevant supervisory authorities, within the timeframes mandated by applicable law.
11 International Data Transfers
As an internationally licensed online gaming operator, some of the third-party service providers we engage — including cloud infrastructure providers, KYC verification services, and game content studios — may be located outside of Malaysia. Where Personal Data is transferred to servers or processors in other jurisdictions, the Company takes the following steps to ensure your data remains adequately protected:
- We enter into binding data processing agreements with all international processors, incorporating standard contractual clauses that require them to maintain data protection standards equivalent to those applied within the Company.
- We conduct due diligence assessments on international processors before engaging them, including a review of their security certifications and data handling practices.
- Where a transfer involves a jurisdiction that does not have an adequacy determination, we apply additional safeguards as appropriate, including encryption of data in transit and at rest.
12 Protection of Minors
The Platform is strictly restricted to persons aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21. All Accounts are subject to mandatory KYC age verification prior to activation of withdrawal functions.
If the Company discovers that Personal Data has been provided by a person under the age of 21, we will immediately suspend the associated Account, delete the Personal Data to the extent legally permissible, return any deposited funds, and forfeit any bonus-derived winnings. If you believe that a minor has registered on the Platform, please notify us immediately via live chat or email.
13 Your Data Rights
Subject to applicable law and the constraints of our legal obligations (including KYC/AML record-keeping requirements), you hold the following rights in relation to your Personal Data held by the Company:
Request a copy of all Personal Data we hold about you, along with information on how it is processed and for how long it is retained.
Request correction of any inaccurate or incomplete Personal Data we hold about you. You may also update many details directly via your Account settings.
Request deletion of your Personal Data where we no longer have a lawful basis to retain it. Note that AML and financial record-keeping obligations may require us to retain certain data for defined periods.
Request that we restrict processing of your Personal Data in certain circumstances — for example, while you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to erasure.
Receive a copy of Personal Data you provided to us in a structured, commonly used, machine-readable format, and request that we transmit it directly to another controller where technically feasible.
Object to processing of your Personal Data where we rely on legitimate interests as the lawful basis. You also have an absolute right to object to processing for direct marketing purposes at any time.
To exercise any of these rights, please submit a written request to our Data Protection team via the contact details in Section 16. We will acknowledge receipt within 5 business days and aim to respond substantively within 30 calendar days. In complex cases, we may extend this period by a further 60 days with prior notification.
We will verify your identity before processing any data rights request to prevent unauthorised access to Personal Data. You will not be charged a fee for exercising your rights except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act.
14 Complaints
If you believe that the Company has not handled your Personal Data in accordance with this Policy or applicable data protection law, you have the right to lodge a complaint. We encourage you to contact us directly in the first instance, as many concerns can be resolved efficiently through our support channels.
If you remain dissatisfied after contacting us, you are entitled to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. The Company will cooperate fully with any regulatory investigation and will provide all information requested within the timeframes specified by the relevant authority.
15 Policy Amendments
We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes to the Policy will be communicated to registered Players via email notification and/or a prominent notice on the Platform, with a minimum of 14 days' advance notice where practicable.
The date of the most recent revision is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed of how we protect your data. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.
16 Contact Us
For all privacy-related enquiries, data rights requests, or concerns regarding the handling of your Personal Data, please contact our Data Protection team through the following channels: