roda4d Privacy Policy

This Privacy Policy ("Policy") is issued by roda4d ("we", "us", "our", "Company"), the operator of the online platform accessible at https://roda4d.lat and all associated subdomains and services (the "Platform"). This Policy describes the manner in which roda4d collects, stores, processes, uses, and protects personal data submitted by users ("User", "Player", "you", "your") in connection with their registration, account management, and use of the Platform.

roda4d is committed to handling your personal information responsibly and in accordance with applicable data protection legislation. Our Platform primarily serves users located in Malaysia, and we are mindful of the obligations imposed by the Personal Data Protection Act 2010 (PDPA) of Malaysia in respect of the processing of personal data. Where applicable, we also observe internationally recognised data protection principles.

By registering an account or continuing to use the roda4d Platform, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not consent to this Policy, please discontinue your use of the Platform immediately and contact our support team to close your account.

For the purposes of this Privacy Policy, the following terms shall be interpreted as set out below:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, either on its own or in combination with other data available to roda4d. This includes, without limitation, name, date of birth, identification number, email address, device identifiers, and payment account details.
• "Processing" — Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — roda4d, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — Any third party engaged by roda4d to process Personal Data on its behalf and subject to roda4d's instructions.
• "KYC Data" — Identity verification documentation including government-issued photo identification, proof of address, and source of funds documentation submitted by a Player in compliance with our Know Your Customer requirements.
• "Cookies" — Small data files placed on your device by the Platform to facilitate session management, analytics, and personalisation functions.
• "PDPA" — The Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data in commercial transactions within Malaysia.

roda4d collects Personal Data across several categories, depending on how you interact with the Platform. The data categories and specific data points collected are as follows:

3.1 Registration & Account Data

• Full legal name
• Date of birth (to verify the 21+ age eligibility requirement)
• Malaysian identity card number (MyKad) or passport number
• Email address
• Mobile phone number
• Residential address (including city, state, and postcode)
• Preferred username and encrypted password

3.2 Financial & Payment Data

• Bank account details (account holder name, bank name, account number) for withdrawal processing
• E-wallet identifiers (e.g., registered mobile number for Touch 'n Go eWallet, Boost, or GrabPay)
• Transaction history — deposits, withdrawals, wagering activity, and bonus awards
• Source of funds documentation where requested for enhanced KYC procedures

3.3 KYC Verification Data

• Scanned copies or photographs of government-issued identity documents
• Selfie or live photo for liveness verification, where applicable
• Proof of address documentation (utility bills, bank statements)

3.4 Technical & Usage Data

• IP address and approximate geolocation data
• Device type, operating system, and browser information
• Session duration, pages visited, game history, and betting patterns
• Click-stream data and interaction logs
• Cookie identifiers and similar tracking technologies

3.5 Communications Data

• Records of live chat interactions with our support team
• Email correspondence relating to your Account, disputes, or enquiries
• Responsible gambling self-assessment responses and self-exclusion requests

roda4d collects Personal Data through the following channels and mechanisms:

• Direct submission: Information you provide when completing the registration form, completing KYC verification, submitting a withdrawal request, or contacting our customer support team.
• Automated collection: Technical and usage data collected automatically when you access or interact with the Platform, including via Cookies, web beacons, and server-side logging systems.
• Third-party sources: Identity verification agencies and fraud prevention databases engaged to assist with KYC compliance; payment service providers (such as FPX operators and bank APIs) that confirm the status of a transaction; and public registers where permitted by applicable law.
• Responsible gambling tools: Data you provide voluntarily when setting deposit limits, requesting a cooling-off period, or submitting a self-exclusion request.

roda4d processes your Personal Data for the following purposes. The table below maps each processing activity to its corresponding purpose and the data categories involved:

roda4d processes your Personal Data on the following legal grounds as recognised under applicable data protection legislation, including the PDPA (Malaysia):

• Contractual necessity: Processing required to perform the contract between roda4d and you, including account management, game access, and payment processing.
• Legal obligation: Processing required to comply with legal duties, including age verification, KYC procedures, AML obligations, and compliance with regulatory or court orders.
• Legitimate interests: Processing carried out for roda4d's legitimate business interests — including fraud prevention, security monitoring, and platform analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications, personalisation features, and non-essential Cookies, where your specific, informed, and freely given consent has been obtained. You retain the right to withdraw such consent at any time.

roda4d does not sell your Personal Data to third parties. We may share your Personal Data with third parties only in the circumstances described below, and only to the extent necessary for each specified purpose:

• Payment service providers: We share necessary financial and identity data with payment partners — including banks operating Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect; e-wallet operators for Touch 'n Go eWallet, Boost, and GrabPay; DuitNow transfer infrastructure; and FPX — to process your deposits and withdrawals securely.
• Identity verification providers: Specialist KYC and anti-fraud agencies engaged to verify your identity, validate documents, and screen against regulatory watchlists.
• Game content providers: Certified third-party game providers may receive anonymised gameplay session data to support RNG certification, RTP auditing, and game performance monitoring.
• IT & infrastructure providers: Cloud hosting, database, and security service providers engaged under contractual data processing agreements that bind them to equivalent data protection standards.
• Legal and regulatory authorities: Government agencies, law enforcement bodies, financial regulators, or courts where we are required by law or a lawful order to disclose your information. roda4d will notify affected Players of such disclosures to the extent permitted by applicable law.
• Business successors: In the event of a merger, acquisition, or sale of assets involving roda4d, your Personal Data may be transferred to the successor entity, which will be bound by this Privacy Policy.

roda4d retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following general retention periods apply:

• Active Account data: Retained for the duration of your Account's active status plus a minimum period of 5 years following Account closure, in compliance with AML regulatory requirements applicable to gaming and financial services operators.
• KYC documentation: Retained for a minimum of 5 years from the date of submission or Account closure (whichever is later), as required by applicable anti-money laundering and financial compliance regulations.
• Transaction records: Retained for a minimum of 7 years to meet financial record-keeping obligations.
• Marketing preferences and consent records: Retained until withdrawal of consent, plus a reasonable period thereafter for audit purposes.
• Support interaction records: Retained for 3 years from the date of the interaction, unless longer retention is required for ongoing dispute resolution.

Upon expiry of applicable retention periods, Personal Data will be securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

roda4d implements appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to:

• 256-bit SSL/TLS encryption across all Platform communications, including login sessions, financial transactions, and data transfer endpoints.
• Password hashing using industry-standard one-way hashing algorithms. roda4d staff cannot retrieve your password in plain text under any circumstances.
• Two-factor authentication (2FA) available and recommended for all registered Accounts.
• Access controls: Strict role-based access permissions limiting employee access to Personal Data on a need-to-know basis. All access is logged and audited.
• Data segmentation: Financial and KYC data are stored in isolated, restricted-access systems separate from gameplay and analytics data.
• Regular security audits and penetration testing conducted by independent third-party cybersecurity professionals.
• Incident response procedures: In the event of a data breach that poses a risk to your rights and freedoms, roda4d will notify affected Players and relevant authorities in accordance with applicable legal obligations.

The roda4d Platform uses Cookies and similar tracking technologies to operate effectively, improve user experience, and analyse Platform usage. The following categories of Cookies are employed:

• Strictly Necessary Cookies: Essential for core Platform functionality including login session management, security tokens, and payment flow continuity. These Cookies cannot be disabled without impacting Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how Players interact with the Platform — pages visited, session duration, error reports — to enable us to identify performance issues and improve the Platform experience.
• Functional Cookies: Used to remember your preferences such as language settings, game display preferences, and responsible gambling tool settings.
• Marketing Cookies: Used, where consent has been given, to track interaction with promotional content and to measure the effectiveness of marketing campaigns. You may opt out of Marketing Cookies at any time.

You may manage Cookie preferences through your browser settings. Note that disabling Strictly Necessary Cookies will prevent you from using core Platform features. For most other Cookie categories, you can opt out without affecting your ability to access account and gaming functions.

Subject to applicable data protection legislation — including the PDPA (Malaysia) — you hold the following rights in respect of your Personal Data held by roda4d. To exercise any of these rights, please contact our Data Protection team using the details in Section 15.

We will respond to all verified rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

The roda4d Platform is strictly for individuals aged 21 years and above. We do not knowingly collect Personal Data from persons under the age of 21. Age verification is a mandatory step during the registration process, and we employ both automated checks and manual KYC review to enforce this requirement.

If roda4d becomes aware that Personal Data has been collected from an individual under 21 years of age without appropriate consent from a parent or guardian, we will promptly delete that data, close the associated Account, and take any further steps required by applicable law.

If you are a parent or guardian and believe that a minor may have registered on our Platform using your or their own details, please contact us immediately at [email protected] so that we may investigate and take appropriate action.

In the course of operating the Platform and engaging third-party service providers, your Personal Data may be transferred to and processed in jurisdictions outside of Malaysia. Where such transfers occur, roda4d ensures that appropriate safeguards are in place to maintain the protection of your data at a standard consistent with the PDPA and internationally recognised data protection principles, including:

• Entering into contractual arrangements with recipient entities that impose equivalent data protection obligations.
• Transferring data only to jurisdictions with adequate data protection frameworks as determined by relevant regulatory assessment.
• Applying pseudonymisation or aggregation techniques to data sets transferred for analytics or performance optimisation purposes where possible.

roda4d reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or operational requirements. Where changes are material — meaning they meaningfully alter the nature of how your Personal Data is collected or used — we will notify registered Players via the email address on their Account at least 14 days prior to the changes taking effect.

Non-material updates (such as typographical corrections, clarifications, or formatting revisions) may take effect immediately without specific advance notice. The current version number and effective date of this Policy are displayed at the top of this page. We encourage you to review this Policy periodically.

Your continued use of the Platform following any notification period constitutes your acceptance of the updated Policy. If you do not accept the revised terms, you should discontinue use of the Platform and contact us to close your Account.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact our Data Protection team using the details below. We are committed to addressing all privacy-related enquiries promptly and transparently.