Privacy Policy — high5my

high5my ("the Platform", "we", "us", "our") is an online casino and sports betting platform accessible at https://high5my.cam. We are committed to protecting the privacy and personal data of every individual who registers an account, visits our website, or otherwise interacts with our services — including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

This Privacy Policy ("Policy") describes in clear and accessible terms: what personal data we collect from you, why we collect it, how we use it, who we share it with, how long we retain it, and what rights you hold in respect of your own data.

This Policy applies to all users of the Platform, including registered players, visitors who have not yet created an account, and individuals who contact us through support channels. It should be read alongside our Terms & Conditions, which govern the broader contractual relationship between you and high5my.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including names, identification numbers, location data, device identifiers, and online behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" means high5my, as the entity that determines the purposes and means by which Personal Data is processed.
• "Data Processor" means a third party that processes Personal Data on behalf of high5my, strictly in accordance with documented instructions and data processing agreements.
• "Player" / "You" / "Your" means the individual accessing or using the Platform.
• "KYC Data" means identity and address verification documents submitted by Players to satisfy Know Your Customer obligations, including Malaysian IC (MyKad), passport, driver's licence, and proof of address documentation.
• "Sensitive Personal Data" means a subset of Personal Data warranting heightened protection — including government-issued identification numbers, financial account details, and documents that could reveal ethnicity, health status, or other protected characteristics.
• "Cookies" means small text files placed on a user's device by the Platform for the purpose of storing session or preference information.

high5my collects Personal Data through several channels: directly from you when you register or interact with the Platform, automatically through technical systems as you browse and play, and from authorised third parties (such as payment processors and identity verification providers) where necessary.

high5my uses your Personal Data strictly for the following purposes:

4.1 Account Management & Service Delivery

To create and maintain your Player Account, verify your identity and age (21+ enforcement), process deposits in MYR via Maybank, CIMB, DuitNow, FPX, Touch 'n Go eWallet, and other supported methods, process withdrawals, calculate and award bonuses, and deliver the gaming and betting services you access on the Platform.

4.2 Compliance & Legal Obligations

To fulfil our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) regulations as required by the terms of our international gaming licence. This includes screening transactions, verifying the source of funds where required, and reporting suspicious activity to competent authorities.

4.3 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, unauthorised account access, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms & Conditions. Technical data including IP addresses and device fingerprints are used for fraud risk scoring and geographic compliance checks.

4.4 Responsible Gambling

To monitor gameplay patterns for indicators of problem gambling behaviour, enforce self-exclusion requests and deposit limits, send responsible gambling notifications, and maintain records necessary for compliance with our responsible gambling programme obligations.

4.5 Customer Support

To respond to your support enquiries via live chat or email ([email protected]), to maintain records of communications for quality assurance and dispute resolution, and to assist with account recovery.

4.6 Marketing Communications (Opt-In Only)

Where you have provided explicit consent, to send you promotional communications regarding bonuses, new game launches, and Platform updates. You may withdraw consent for marketing communications at any time through your Account settings. Withdrawal of marketing consent does not affect processing for any other purpose.

4.7 Platform Improvement & Analytics

To analyse aggregated, anonymised usage data for the purpose of improving the Platform's functionality, game offering, and user experience. Individual player data is not used for profiling or automated decision-making that produces legal or significant effects without human review.

high5my processes your Personal Data only where a valid legal basis exists. The applicable legal bases for each category of processing are as follows:

• Performance of Contract — Processing necessary to deliver the gaming and payment services you have requested, including account creation, deposit processing, and withdrawal execution.
• Legal Obligation — Processing required to comply with AML, KYC, and other regulatory requirements applicable to licensed gaming operators, including record-keeping and regulatory reporting obligations.
• Legitimate Interests — Processing for fraud prevention, security monitoring, responsible gambling oversight, and Platform improvement, where such interests are not overridden by your fundamental rights.
• Consent — Processing for direct marketing communications, where you have provided explicit opt-in consent. You retain the right to withdraw this consent at any time without affecting the lawfulness of prior processing.

high5my does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. We share your data only where necessary for the following purposes:

6.1 Payment Service Providers

Personal and financial data necessary to process deposits and withdrawals is shared with our authorised payment service providers, including Malaysian banking partners (Maybank, CIMB, Public Bank, Hong Leong, RHB), e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), DuitNow and FPX network participants, and cryptocurrency processing services. These providers are contractually obligated to process your data only for payment execution purposes.

6.2 Identity Verification Partners

Where KYC verification is conducted with the assistance of a third-party identity verification provider, your KYC documents and identity data will be shared with that provider under a data processing agreement that restricts their use of your data to verification purposes only.

6.3 Regulatory & Law Enforcement Authorities

high5my may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where required by applicable law or by a valid legal order. We will not disclose more data than is strictly required to comply with such requests and, where legally permissible, will notify you of such disclosures.

6.4 Game Studio Partners

Anonymised or pseudonymised gameplay data may be shared with licensed game studio partners for the purpose of game performance analysis, RNG certification, and game improvement. No identifiable Personal Data (name, contact details, payment information) is shared with game studios.

6.5 Professional Advisers

Personal Data may be disclosed to our legal advisers, auditors, and insurers where strictly necessary for the provision of their professional services, subject to professional confidentiality obligations.

high5my uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, and support our security and fraud-prevention systems. The categories of cookies we use are as follows:

You may control cookie behaviour through your browser settings. Please note that disabling non-essential cookies may affect some Platform functionality. For strictly necessary and fraud-prevention cookies, disabling via browser settings may impair your ability to log in or use certain features.

high5my retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations.

• Active Account Data — Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in compliance with AML record-keeping requirements.
• KYC Documents — Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable regulatory guidance.
• Transaction Records — All deposit, withdrawal, wager, and bonus transaction records in MYR are retained for a minimum of five (5) years.
• Support Communications — Live chat logs and email correspondence retained for three (3) years from the date of interaction.
• Marketing Preference Records — Consent and opt-out records retained for five (5) years from the date the consent was given or withdrawn, to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be attributed to any individual.

high5my implements a layered technical and organisational security programme designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS Encryption — All data transmitted between your device and the Platform is encrypted in transit.
• Encryption at Rest — Sensitive Personal Data, including KYC documents and financial records, is encrypted in our database storage systems.
• Access Controls — Personal Data is accessible only to authorised personnel with a documented operational need. Access is governed by role-based permissions and audit logging.
• Two-Factor Authentication (2FA) — Available to all Players to protect Account access against unauthorised logins.
• Penetration Testing & Vulnerability Management — Regular security assessments conducted to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident Response — A documented data breach response procedure is in place. In the event of a security incident involving your Personal Data, affected players will be notified in accordance with applicable legal obligations.

high5my operates under an international gaming licence and may process or store Personal Data on servers located outside Malaysia. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applicable in Malaysia, high5my ensures appropriate safeguards are in place, including:

• Data processing agreements incorporating internationally recognised standard contractual clauses;
• Transfers only to jurisdictions and service providers that maintain security standards equivalent to or exceeding those described in this Policy;
• Documentation of all cross-border data transfer mechanisms, available to Players upon request.

By using the Platform, Malaysian players acknowledge and consent to the cross-border transfer of their Personal Data as described in this section, subject to the safeguards outlined above.

Subject to applicable law and certain limitations arising from our legal and regulatory obligations, you hold the following rights in respect of your Personal Data processed by high5my:

11.1 Right of Access

You have the right to request confirmation of whether we process your Personal Data and, if so, to receive a copy of the data we hold about you, together with information about the purposes and recipients of that processing.

11.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete Personal Data we hold about you. Please note that corrections to identity data (e.g., name, date of birth) may require supporting documentation.

11.3 Right to Erasure

You may request deletion of your Personal Data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and no other legal basis applies; or the data has been processed unlawfully. This right is subject to overriding legal and regulatory retention obligations described in Section 8.

11.4 Right to Restriction of Processing

You may request that we restrict the processing of your data while a correction request is under review, or where you have objected to processing based on legitimate interests pending our assessment.

11.5 Right to Data Portability

Where processing is based on your consent or contract performance and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.

11.6 Right to Object

You have the right to object to processing based on legitimate interests, including profiling. You may also withdraw consent for direct marketing at any time through your Account settings, resulting in immediate cessation of marketing communications.

11.7 Exercising Your Rights

To exercise any of the rights described above, please submit a request to our support team via live chat or at [email protected]. We will respond within 30 days of receiving a complete and valid request. Identity verification may be required before we process a rights request to protect against unauthorised access to another person's data.

The Platform is strictly intended for adults aged 21 years and above. high5my does not knowingly collect, process, or retain Personal Data from individuals under the age of 21. Age verification is enforced at account registration level through our KYC process.

If high5my becomes aware that Personal Data has been collected from an individual under the age of 21 without appropriate parental consent, we will immediately close the Account, void all associated transactions, and delete the minor's Personal Data in accordance with our data retention procedures. If you believe a minor has created an account on the Platform, please contact us immediately at [email protected].

The Platform may, from time to time, reference third-party services such as payment processors or game studio providers. Any third-party websites or services linked from or associated with the Platform operate under their own privacy policies, which high5my does not control. We recommend reviewing the privacy practices of any third-party service before submitting your Personal Data to them.

high5my accepts no liability for the data handling practices of third-party services, including payment providers such as Maybank, CIMB, Touch 'n Go eWallet, and Boost. Your interactions with those providers are governed by the respective provider's terms and privacy policy.

high5my reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, business practices, or data processing activities. The "Last updated" date at the top of this page will be revised accordingly.

Where changes are material — for example, involving a new category of Personal Data or a new purpose of processing that affects your rights — we will notify registered Players by email or by prominent in-Platform notification at least 14 days before the revised Policy takes effect.

Your continued use of the Platform after a revised Policy has been published constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must discontinue use of the Platform and may request Account closure in accordance with our Terms & Conditions.

For all privacy-related enquiries, requests to exercise your data rights, or concerns about this Policy, please contact the high5my Data & Privacy team through the following channels: