Privacy Policy

Duitlaju44 ("Company", "we", "us", "our") operates the online gaming platform at duitlaju44.cam ("Platform"). We are committed to protecting the personal data and privacy of every individual who visits, registers, and engages with our Platform. This Privacy Policy ("Policy") describes our information practices in compliance with applicable data protection legislation and international best-practice standards for online gaming operators.

This Policy applies to all personal data collected from individuals who access the Platform, including registered members, prospective users, and visitors who have not yet created an account. By using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy is to be read alongside our Terms & Conditions, which govern the overall contractual relationship between you and Duitlaju44. In the event of any conflict between those documents, the Terms & Conditions shall prevail.

For clarity, the following terms carry the meanings set out below throughout this Policy:

Duitlaju44 collects only the personal data that is necessary to operate the Platform, comply with our regulatory obligations, and deliver a safe and personalised experience to our users. The categories of personal data we collect include, but are not limited to:

Duitlaju44 collects personal data through the following mechanisms:

• Direct Provision: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or filling in any form on the Platform.
• Automated Technologies: Data collected automatically when you use the Platform, including cookies, web beacons, server log files, and session tracking technologies. This includes your IP address, device identifiers, and browsing behaviour within the Platform.
• Third-Party Payment Providers: When you deposit or withdraw funds using DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency channels, we receive transaction confirmation data from those providers necessary to credit or debit your account.
• Fraud Prevention & AML Partners: We may receive data from third-party identity verification and fraud screening services engaged to help us meet our legal obligations as a licensed online gaming operator.
• Publicly Available Sources: In limited circumstances, we may verify information against publicly available records (such as public company registers or sanctions screening databases) as required by applicable law.

Duitlaju44 processes personal data only where a valid lawful basis exists for doing so. The applicable legal bases on which we rely are as follows:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered account holder — including account creation, transaction processing, and dispute resolution.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including Anti-Money Laundering (AML) obligations, KYC verification requirements, responsible gambling regulations, and any regulatory reporting obligations imposed by our licensing authority.
• Legitimate Interests: Processing carried out in pursuit of Duitlaju44's legitimate business interests, including fraud prevention, platform security, service improvement, and direct marketing to existing customers — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where none of the above bases apply, we will seek your explicit consent before processing. You may withdraw consent at any time without affecting the lawfulness of prior processing, by contacting our support team.

Personal data collected by Duitlaju44 is used for the following specific purposes, each tied to an identified lawful basis:

• To create and manage your registered account on the Platform.
• To process deposits and withdrawals through your chosen payment channels (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and supported cryptocurrencies).
• To verify your identity and comply with KYC and AML obligations prior to processing withdrawal requests.
• To operate our responsible gambling tools, including deposit limit enforcement, session time reminders, and self-exclusion management.
• To detect and prevent fraud, money laundering, and other prohibited activities on the Platform.
• To communicate account-related information including transaction confirmations, security alerts, and service updates.
• To respond to your support queries and resolve disputes in an accurate and timely manner.
• To personalise your experience on the Platform based on your usage history and preferences.
• To send you promotional communications about offers, bonuses, and new features — only where you have not opted out of such communications.
• To comply with all applicable laws, regulations, and court orders.

Duitlaju44 does not sell, rent, or trade your personal data to third parties for commercial gain. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing safeguards:

• Payment Service Providers: Banks, e-wallet operators, and cryptocurrency processors engaged to execute your deposit and withdrawal instructions. These entities receive only the transactional data necessary to complete the relevant payment.
• Identity Verification & KYC Providers: Third-party service providers engaged to verify the identity documents submitted during KYC. Data shared is limited to identity documentation and the specific fields required for verification.
• Fraud Prevention Partners: Specialist fraud detection and AML screening services. Data shared with these partners is subject to strict confidentiality obligations.
• IT Infrastructure Providers: Cloud hosting, server management, and cybersecurity service providers who process data on our behalf as data processors under binding contractual agreements.
• Regulatory Authorities: Government agencies, financial regulators, and law enforcement bodies, where disclosure is required by applicable law, court order, or regulatory directive.
• Licensing Authority: Our international gaming licensing authority, where reporting or disclosure obligations arise under the terms of our licence.

All third-party service providers engaged by Duitlaju44 are required to maintain appropriate technical and organisational measures to protect any personal data processed on our behalf, and are contractually prohibited from using that data for any purpose other than the specific service being provided.

As an internationally operated online gaming platform, Duitlaju44 may transfer your personal data to third-party service providers located in jurisdictions outside of Malaysia. Where such transfers occur, Duitlaju44 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to, or exceeding, that required under applicable Malaysian data protection law.

Safeguards employed for international transfers include, without limitation: contractual clauses requiring the receiving party to implement adequate data protection measures; processing by entities operating in jurisdictions recognised as offering an adequate level of data protection; and technical measures including encryption of data in transit and at rest.

Duitlaju44 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship, and for a minimum of 5 years following account closure, in accordance with AML and gaming regulatory record-keeping requirements.
• Transaction Records: Retained for a minimum of 7 years following the date of each transaction, to meet financial reporting and AML compliance obligations.
• KYC Documents: Retained for a minimum of 5 years following account closure or the last transaction, whichever is later.
• Support & Communications Records: Retained for a minimum of 3 years following the close of each support interaction, for quality assurance and dispute resolution purposes.
• Technical Log Data: Retained for a maximum of 12 months, after which it is anonymised or deleted.

At the conclusion of each applicable retention period, personal data is securely deleted or anonymised in accordance with our data lifecycle management procedures, unless a longer retention period is required by applicable law or a legitimate ongoing legal dispute.

Duitlaju44 uses cookies and similar technologies on the Platform to deliver a functional, secure, and personalised experience. The categories of cookies we deploy are as follows:

• Essential Cookies: Strictly necessary for the Platform to operate. These cookies manage session authentication, security tokens, and load balancing. They cannot be disabled without materially impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, game history, and display preferences. These enhance your user experience but are not essential for core operations.
• Analytical Cookies: Used to collect anonymised data about how users interact with the Platform, including pages visited, session duration, and navigation patterns. This data is used internally to improve Platform performance and user experience.
• Security Cookies: Used by our fraud detection systems to identify suspicious access patterns and protect accounts from unauthorised access.

Duitlaju44 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security framework includes:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and our servers is protected by industry-standard TLS encryption, the same standard used by major financial institutions globally.
• Data Encryption at Rest: Sensitive personal and financial data stored within our systems is encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All personnel with access to personal data are subject to confidentiality obligations and regular security training.
• Intrusion Detection Systems: Continuous real-time monitoring of our infrastructure for anomalous access patterns, attempted breaches, and unauthorised activity.
• Two-Factor Authentication (2FA): Optional 2FA is available for all registered accounts and is strongly recommended for enhanced account security.
• Penetration Testing: Regular independent security audits and penetration testing are conducted to identify and remediate vulnerabilities before they can be exploited.

Despite our best efforts, no system of data transmission or storage over the internet can be guaranteed to be 100% secure. In the event of a data breach that materially affects your rights and freedoms, Duitlaju44 will notify affected users as required by applicable law and within the timeframe specified by our regulatory obligations.

Subject to applicable law and certain exceptions (including our AML and record-keeping obligations), you have the following rights in relation to your personal data held by Duitlaju44:

To exercise any of the above rights, please contact our support team using the details in Section 16. We will respond to all valid requests within 30 days of receipt. Complex or multiple concurrent requests may require up to 60 days, in which case we will notify you of the extended timeline.

The Duitlaju44 Platform is strictly intended for use by persons aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21. Age verification is mandatory during registration, and KYC verification is required prior to withdrawal processing.

If Duitlaju44 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data from our systems and permanently suspend the associated account. If you believe that an underage person has registered an account on the Platform, please contact us immediately at the details provided in Section 16.

The Duitlaju44 Platform may contain references to or integrations with third-party payment providers and gaming technology suppliers. Where you access third-party services (such as initiating a DuitNow or FPX payment through your bank's interface, or interacting with a cryptocurrency network), your use of those services is governed by the privacy policies of those respective third parties.

Duitlaju44 does not control the data practices of third-party services and is not responsible for their privacy policies or practices. We encourage you to review the privacy policies of any third-party service you access in connection with your use of the Platform.

Duitlaju44 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The effective date at the top of this document will be updated whenever material changes are made.

Where a change is material — meaning it significantly affects how we collect, use, or share your personal data — we will notify registered users via email or an in-platform notification at least 14 days before the change takes effect, wherever practicable.

We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy. The most current version of this Policy is always available at duitlaju44.cam/privacy-policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights outlined in Section 12, please contact the Duitlaju44 data team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform. For privacy-related queries, please state "Privacy Request" at the start of your message so it can be routed appropriately.
• Email: [email protected] — Responses within 4–12 hours (Malaysia Time, MYT, UTC+8) for standard queries. Data subject access requests will receive a formal acknowledgement within 5 business days.

When submitting a privacy-related request, please include your registered username, your full legal name, and a clear description of the action you are requesting. We may require additional identity verification before fulfilling your request, consistent with our obligations under applicable data protection law.