h89 Privacy Policy

h89 ("the Company", "we", "us", "our") is committed to protecting the privacy and personal data of every individual who uses the h89 online gaming platform, accessible at https://h89.buzz ("the Platform"). This Privacy Policy ("Policy") sets out in full how h89 collects, processes, stores, protects, and in certain circumstances discloses personal data relating to registered and prospective players, visitors, and users of the Platform.

This Policy applies to all personal data processed in connection with your use of h89's services, including our website, account management tools, payment processing channels, customer support interactions, and any promotional communications. It should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form h89's complete user agreement framework.

h89 primarily serves players based in Malaysia and understands the importance of data privacy to our community — from Kuala Lumpur to Penang, Johor Bahru, Petaling Jaya, and Shah Alam. All data handling practices described in this Policy are designed to be consistent with internationally recognised data protection principles including transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

By accessing the h89 Platform, creating an Account, or otherwise interacting with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing activities described herein to the extent permitted by applicable law.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

h89 collects Personal Data across several categories, depending on how you interact with the Platform. We collect only data that is necessary for the stated purpose — we do not collect data speculatively or for undefined future use.

• Full legal name — required for account registration and KYC verification
• Date of birth — required to verify that you are aged 21 years or above
• Email address — used for account communications, support, and optionally for promotional emails (with your consent)
• Phone number — used for account security (SMS-based two-factor authentication) and support escalations
• Government-issued ID details (MyKad number, passport number) — collected during KYC verification only
• Residential address — required for KYC compliance; verified against utility bills or bank statements

• Payment method details — including bank account identifiers, e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay), DuitNow registered phone numbers, and FPX bank references. h89 does not store full card numbers or CVV codes.
• Transaction history — records of all deposits, withdrawals, bonuses, and wagering activity on your Account, retained for regulatory compliance and dispute resolution.
• Cryptocurrency wallet addresses — for players using BTC or USDT deposits.

• IP address, device type, operating system, and browser version
• Login timestamps and session duration records
• Game play history, betting patterns, and platform navigation data
• Error logs and crash reports for platform stability purposes
• Geolocation data (country/region level, derived from IP address)

• Live chat transcripts and support ticket records
• Email correspondence with the h89 support team
• Survey responses and feedback submissions (where you choose to participate)

h89 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, or contacting our support team.
• Automated technical collection: Data collected automatically as you browse or use the Platform, including via cookies, session tokens, and server logs. See Section 11 for full details on cookies.
• Payment processors: Transaction confirmation data received from payment service providers including DuitNow, FPX operator banks (Maybank, CIMB, Public Bank, Hong Leong), and e-wallet providers. h89 receives confirmation data only — full payment credentials are handled by the payment processor directly.
• Identity verification providers: Where we engage a third-party KYC service to verify identity documents, that service may return verification status and extracted data fields to h89 under a Data Processing Agreement.
• Responsible gambling monitoring: Automated systems that analyse account behaviour patterns to identify potential problem gambling indicators, used to trigger safeguarding interventions.

h89 processes your Personal Data exclusively for defined, legitimate purposes. The table below maps each processing activity to its purpose and the category of data involved:

h89 processes Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to enter into or perform the contract between you and h89 — including account registration, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable law — including KYC/AML requirements, responsible gambling obligations, and record-keeping requirements mandated by our licensing jurisdiction.
• Legitimate Interests: Processing for h89's legitimate business interests, provided those interests are not overridden by your privacy rights — including fraud detection, platform security, and aggregated analytics for service improvement.
• Consent: Where h89 relies on your freely given consent — primarily for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

h89 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. Data sharing occurs only in the limited circumstances described below:

• Payment Service Providers: Transaction data is shared with payment processors (DuitNow operators, FPX, e-wallet providers including Touch 'n Go, Boost, and GrabPay, and cryptocurrency infrastructure providers) solely to facilitate your deposits and withdrawals. These providers act as Data Processors under written Data Processing Agreements with h89.
• Identity Verification Services: KYC documents may be shared with certified identity verification providers for the purpose of verifying your identity and age. All such providers are bound by strict confidentiality and data handling obligations.
• Regulatory & Law Enforcement Authorities: h89 may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where required by applicable law, valid legal process, or to protect the safety and security of our platform and players.
• Gaming Studio Partners: Anonymised, aggregated gameplay data may be shared with certified game studio partners for statistical analysis and game performance optimisation. No individually identifiable data is shared for this purpose.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of assets involving h89, Personal Data may be transferred to the relevant successor entity, subject to equivalent privacy protections and prior notification to affected users.

h89 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, Personal Data is either securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

h89 implements technical and organisational security measures appropriate to the risk and sensitivity of the Personal Data we process. These measures include:

• Encryption in Transit: All data transmitted between your device and the h89 Platform is encrypted using TLS 1.3 (Transport Layer Security). This applies to all Platform pages including login, account management, deposit, and withdrawal interfaces.
• Encryption at Rest: Personal Data stored on h89 servers is encrypted using AES-256 (Advanced Encryption Standard). Payment method references and KYC documents are subject to additional field-level encryption.
• Access Controls: Internal access to Personal Data is restricted on a need-to-know basis. All staff with access to Personal Data are subject to confidentiality obligations and role-based access controls with full audit logging.
• Two-Factor Authentication: h89 offers and recommends two-factor authentication (2FA) for all player accounts. Internal system access by h89 staff requires mandatory multi-factor authentication.
• Security Audits: h89 conducts regular internal security reviews and periodic independent security assessments of our platform infrastructure, payment integrations, and data handling processes.
• Incident Response: h89 maintains a documented data breach response procedure. In the event of a confirmed breach affecting Personal Data, affected users will be notified within the timeframe required by applicable law.

As a data subject, you hold the following rights in relation to your Personal Data processed by h89. To exercise any of these rights, please contact us at [email protected] with your Account username and a clear description of your request. We will respond within 30 calendar days.

You have the right to request a copy of all Personal Data h89 holds about you, along with information about how it is processed, the legal basis for processing, retention periods, and any third parties with whom it has been shared.

If any Personal Data h89 holds about you is inaccurate or incomplete, you have the right to request correction. You may update most account details directly within your h89 Account dashboard; where document-backed changes are required (e.g., name change post-KYC), please contact our support team.

You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent (and no other legal basis applies), or where h89 has processed data unlawfully. This right is subject to h89's legal obligations — data required for regulatory compliance, financial record-keeping, or ongoing dispute resolution cannot be deleted until the applicable retention period expires.

In certain circumstances — such as where you contest the accuracy of data, or where you have objected to processing pending verification of h89's legitimate grounds — you may request that h89 restrict active processing of your data while the matter is resolved.

Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another data controller where technically feasible.

You have the right to object to the processing of your Personal Data on the grounds of h89's legitimate interests at any time. You also have an absolute right to object to processing for direct marketing purposes; upon receipt of such an objection, h89 will cease marketing communications immediately.

Where h89's processing is based on your consent — primarily for marketing communications and non-essential cookies — you may withdraw that consent at any time by updating your Account preferences or contacting our support team. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

h89 uses cookies and similar tracking technologies (including local storage and session tokens) on the Platform. Cookies are small data files stored on your device that help us provide a functional, secure, and personalised experience.

You may manage your cookie preferences through your browser settings at any time. Most modern browsers allow you to block or delete cookies, or to alert you when a cookie is being set. Please note that blocking strictly necessary cookies will impair or prevent access to the h89 Platform. For all other cookie types, you may opt out at any time without affecting your ability to use core Platform features.

h89 is strictly an adult gaming platform. Our services are available only to individuals who are aged 21 years or above. h89 does not knowingly collect Personal Data from individuals under 21 years of age.

Age verification is a mandatory step in the h89 registration and KYC process. Where we have reasonable grounds to believe that a user may be under 21, we will suspend account access and request documentary proof of age — typically a copy of MyKad, passport, or other government-issued identification showing date of birth.

If it is confirmed that Personal Data has been collected from a person under 21 years of age, h89 will immediately close the relevant Account, refund any deposited funds to the verified payment source, and securely delete all associated Personal Data within a reasonable timeframe, subject only to any mandatory regulatory reporting obligations.

h89's primary player base is in Malaysia, and our platform infrastructure is designed to serve the Malaysian market. However, some of h89's third-party service providers — including identity verification and payment processing partners — may process data in jurisdictions outside Malaysia.

Where Personal Data is transferred to a third country, h89 ensures that appropriate safeguards are in place prior to the transfer, including:

• Data Processing Agreements containing standard contractual clauses that impose data protection obligations equivalent to those applicable in Malaysia
• Selection of processors in jurisdictions with recognised adequate levels of data protection
• Technical measures (encryption, pseudonymisation) that reduce the risk exposure of transferred data

You may request details of the specific safeguards applied to any international data transfer by contacting us at [email protected].

h89 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform functionality. All updates will be reflected in the "Last Updated" date at the top of this page.

Where amendments are material — meaning they significantly change how h89 processes your data or affect your rights — h89 will provide advance notice via email to registered players and/or a prominent notification on the Platform. We encourage all players to review this Policy periodically.

Your continued use of the h89 Platform following the publication of an updated Privacy Policy constitutes your acceptance of the changes, to the extent that such acceptance is permissible under applicable law. Where changes require fresh consent, h89 will obtain that consent before the change takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or h89's data handling practices, please contact our Data Protection team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.