Lubangking Privacy Policy – Personal Data Protection for Malaysian Users

1Introduction and Scope of This Policy

This Privacy Policy is published by Lubangking ("we", "Platform") and applies to all users who register, visit or use any Lubangking service through the website lubangking.app, the official mobile app, or any of our official communication channels.

This document is written in English to ensure clarity for our users. We believe that transparency is the foundation of trust. As such, we strive to explain clearly and honestly how your personal data is handled — not merely to fulfil legal requirements, but because we genuinely care about your privacy.

This policy covers:

• The types of personal data we collect from users.
• How and why we collect that data.
• How your data is stored, processed and protected.
• Circumstances under which data may be shared with other parties.
• Your rights as the owner of your personal data.
• How to contact us regarding privacy matters.

2Types of Personal Data We Collect

Lubangking practices a data minimization principle — we only collect information that is strictly necessary to operate the platform safely and fairly. The following are the categories of data we collect:

Identity Data

• Full name as stated in official identification documents.
• National identity card number (MyKad) or passport number for non-Malaysian users.
• Date of birth for minimum age verification.
• Identity document images for the KYC process.

Contact Data

• An active, reachable email address.
• Malaysian mobile phone number (for two-factor authentication and important notifications).
• Current residential address (required for advanced KYC verification).

Financial Data

• The bank account number registered for deposit and withdrawal purposes.
• Bank name and money transfer details.
• Records of deposit and withdrawal transactions on the platform.
• E-wallet information (Touch 'n Go eWallet, GrabPay) if used.

Platform Usage Data

• Login records including time, date, and IP address.
• Game history and wagering records on the platform.
• Account preferences and settings you have saved.
• Interaction data with platform features such as bonuses used.

Technical Data

• IP address and state/city-level geolocation information.
• Device type, operating system, and browser version.
• Cookie data and session identifiers.
• Technical error logs if an issue occurs on your device.

3How We Collect Your Data

Your personal data is collected through several different channels depending on how you interact with the Lubangking platform:

We never collect data from unauthorized sources or without your knowledge. All data collection is transparent, and you will be informed of the purpose of collection at the time the information is requested.

4Personal Data Processing Purpose

Every piece of data we collect is used for a specific and lawful purpose. Below is a detailed explanation of why each data category is used:

Account Management and Identity Verification

Your identity and contact data are used to create and manage your Lubangking account, process identity verification (KYC) as required by compliance obligations, and allow you to log in and use the platform securely. A thorough KYC process also protects you from the risk of identity fraud.

Financial Transaction Processing

Financial data such as bank account numbers is used solely to process incoming deposits and outgoing withdrawals to your bank account. We retain transaction records for financial accountability purposes, to resolve any transaction disputes, and to meet reporting requirements to Malaysian financial authorities where required.

Security and Fraud Prevention

Technical data such as IP addresses and activity logs are used by Lubangking's security systems to detect unusual activity patterns that may indicate fraud attempts, money laundering or platform abuse. This protects all users and ensures a fair gaming environment.

Service Improvement

Anonymised platform usage data is used to understand how users interact with the platform, identify areas for improvement, and develop new features that are more useful for Malaysian players.

Communications and Marketing

With your consent, we may use your email address and phone number to send account-related notifications, promotional offers and Lubangking updates. You may opt out of marketing communications at any time through your account settings.

5Data Sharing With Third Parties

Lubangking maintains a highly restrictive data sharing policy. We do not sell your personal data to anyone. Your data is only shared under the following limited circumstances:

Trusted Service Provider

We work with a number of trusted third-party service providers who help us operate the platform. These include payment gateway providers, cloud storage services, and identity verification service providers. All such providers are bound by strict confidentiality agreements and are only permitted to use your data for the stated purposes.

Legal Requirements

Lubangking may be required to disclose your personal data to relevant authorities such as Bank Negara Malaysia, the Securities Commission, or law enforcement if mandated by a court order, subpoena, or lawful regulatory directive. In such circumstances, we will endeavor to notify you in advance unless directed otherwise by the authorities.

Industry Fraud Prevention

In confirmed cases of fraud or money laundering activity, Lubangking may share necessary information with other platforms in the industry or relevant regulatory bodies as part of a collective industry effort to protect users.

6Data Security Measures

Lubangking invests seriously in security infrastructure to ensure your data is protected at every stage — whether in transit, during processing, or in storage.

Transmission Security

All communication between your device and lubangking's servers uses HTTPS with the latest TLS 1.3 certificate. This means data you send or receive — including login information and financial details — is fully encrypted and unreadable by any party that may intercept network traffic.

Storage Security

Sensitive data such as passwords is stored using one-way hashing techniques that cannot be reversed. Critical financial information is encrypted using AES-256 before being stored in the database. Our data servers are located in certified data centres with strict physical security controls.

Access Control

Internal access to user data is restricted based on the principle of least privilege. All access is automatically logged and reviewed on a regular basis. Two-factor authentication is mandatory for all Lubangking staff accounts with access to user data systems.

Security Incident Response

Lubangking has a comprehensive incident response plan. In the event of any data breach that may affect users, we will notify the affected users and relevant authorities within 72 hours of the incident being detected, in line with industry best practices.

7Data Retention Period

Lubangking does not retain your personal data longer than necessary. Retention periods vary according to the type of data and applicable legal requirements:

After the retention period ends, data will be securely deleted or permanently anonymised so it can no longer be linked to you as an individual. The data deletion process is automated and periodically reviewed by our compliance team.

8Your Rights as a Data Owner

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by Lubangking. We respect and facilitate the exercise of each of these rights:

9Cookies and Tracking Technologies

Lubangking uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better experience to users. Below is an explanation of the types of cookies we use:

Essential Cookies (Cannot Be Disabled)

These cookies are required for the platform's core functions, such as maintaining your login session, processing transactions securely, and remembering your language preference. Without these cookies, the platform cannot function properly.

Performance & Analytics Cookies

These cookies help us understand how users interact with the platform — which pages are visited most often, how long users spend in each section, and where users encounter difficulties. All analytics data is anonymized and used solely to improve the platform.

Preference Cookies

These cookies allow the platform to remember your personal settings and preferences, such as display theme, favorite game selections, and notification settings, so you do not have to reconfigure them every time you log in.

You can manage your cookie settings through your browser settings. Please note that disabling certain cookies may affect platform functionality. For more information on managing cookies, refer to your browser's help documentation.

10Changes to This Privacy Policy

Lubangking reserves the right to amend or update this Privacy Policy from time to time to reflect changes in how we handle data, new technological developments, or changes in applicable laws and regulations.

When we make significant changes to this policy, we will:

• Updating the "Last Updated" date shown at the top of this document.
• Sending email notifications to all registered users with active accounts.
• Displaying a clear notice on the platform at least 14 days before changes take effect.
• Maintaining an archive of previous versions of this policy, which users may request.

Continued use of the lubangking platform after changes take effect constitutes your acceptance of the updated policy. If you disagree with the changes, you have the right to close your account and request deletion of your personal data.

11Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, we encourage you to contact us directly. Our privacy team is ready to assist you.

You can reach us via:

• In-Platform Support: Use the live chat function or support ticket within your Lubangking account — the fastest way to get a response.
• Privacy Email: [email protected]
• FAQ Page: Many common privacy-related questions have been answered in the FAQ page us.

We are committed to responding to all privacy-related inquiries within 5 business days. For formal data rights requests, please clearly state the type of right you wish to exercise along with your account number so we can process your request more efficiently.