Privacy Policy ST789 – Protecting Your Personal Data

ST789 collects various types of Personal Data depending on how you interact with our platform. The following are the main categories of data we collect:

Data You Provide Directly:

• Full name as stated on your Malaysian identity card (MyKad).
• An active Malaysian phone number for OTP verification and communications.
• A valid email address for account verification and official communications.
• Date of birth for age verification (you must be 18 years of age or older).
• Bank account or e-wallet information (account numbers only — we do not store your banking passwords).
• A copy of your identity document such as your MyKad or passport for the identity verification (KYC) process.

Automatically Collected Data:

• The IP address of your device when accessing the ST789 platform.
• Device type, operating system, and web browser version used.
• Access log data including login times, pages visited, and session duration.
• Gaming activity data including game types played, bet amounts, and outcomes.
• General geolocation data derived from your IP address (country and region).
• Cookies and device identifiers to improve the user experience and account security.

ST789 uses the Personal Data collected for the following legitimate and limited purposes:

ST789 will not use your Personal Data for any purpose not stated in this Policy without first obtaining your consent. If we intend to use your data for a new purpose, we will notify you via email or an in-platform notification and request your consent accordingly.

Protecting member personal data is the number one priority of the ST789 technical team. We implement multiple layers of security measures to keep your data protected at all times:

Technical Security:

• 256-bit SSL/TLS Encryption for all data communications between your device and ST789 servers.
• Data encryption at rest (at-rest encryption) for all Personal Data stored in our databases.
• Two-Factor Authentication (2FA) available to all members to enhance login security.
• Intrusion detection system (IDS) that monitors platform traffic in real time for unusual activity.
• Network Segregation — systems storing financial and personal data are isolated in separate network segments.
• Data Backup regularly with full encryption to ensure safe data recovery in the event of a system failure.

Operational Security:

• Role-based access control — only staff with a legitimate business need are permitted to access members' Personal Data.
• All access to sensitive data is logged and audited on a regular basis.
• Mandatory data security and privacy training for all ST789 staff.
• Independent third-party security audits are conducted every quarter.
• A clear, tested security incident response procedure to address any data breaches swiftly.

ST789 maintains a firm commitment to never selling or sharing members' Personal Data for commercial or marketing purposes. However, there are limited circumstances in which we may need to share data with certain parties for legitimate reasons:

Trusted Service Providers: ST789 works with third-party service providers that help us operate the platform — including payment gateways (Touch 'n Go, GrabPay, DuitNow, FPX), cloud service providers, game software developers (Evolution Gaming, Pragmatic Live, and others), and analytics service providers. All these providers are bound by strict confidentiality agreements and may only use your data for the purposes we have specified.

Legal & Regulatory Requirements: ST789 may be required to disclose member Personal Data if mandated by Malaysian law, court order, directive from a regulatory authority, or a law enforcement agency with valid jurisdiction. In such circumstances, ST789 will disclose only the minimum data necessary and will notify the member concerned, as long as doing so is not prohibited by law.

Fraud Prevention & Security: To help prevent fraud, money laundering, and other unlawful activities, ST789 may share certain information with industry fraud prevention platforms or networks. This data sharing is limited and strictly controlled to ensure that the data of legitimate members is not compromised.

Business Transfer: If ST789 is involved in a merger, acquisition, or asset sale, member Personal Data may be transferred to the new entity. In such a situation, we will notify members in advance and ensure the new entity is bound by privacy standards equal to or higher than those set out in this Policy.

ST789 uses cookies and similar tracking technologies to enhance the user experience, maintain account security, and understand how our platform is used. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session authentication and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects anonymous information about how you use the platform to help us identify technical issues and improve performance.
• Functional Cookies: Saves your preferences such as language selection and display settings for a smoother return experience.
• Security Cookies: Helps identify and prevent fraudulent activity and unauthorised access to your account.

You can manage cookies through your web browser settings. However, disabling certain cookies may affect the functionality of the ST789 platform. Continued use of our platform is considered your consent to the use of cookies as described.

ST789 retains members' Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal and regulatory requirements. The following outlines our data retention guidelines:

• Active Account Data: Retained for the duration your account remains active and for a period of three (3) years after account closure.
• Financial Transaction Records: Retained for seven (7) years in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• Identity Verification Documents (KYC): Retained for five (5) years after the business relationship ends.
• Support Communication Logs: Retained for two (2) years for quality assurance and dispute resolution purposes.
• Activity & Security Log Data: Retained for twelve (12) months for audit and security purposes.

Once the relevant retention period expires, your Personal Data will be securely deleted or anonymised so that it can no longer be linked back to you personally.

As an ST789 member and under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your Personal Data:

• Right to Access: You have the right to request a copy of the Personal Data we hold about you at any time.
• Right to Rectification: You have the right to request that we correct or update any Personal Data that is inaccurate or incomplete.
• Right to Erasure: You may request the deletion of your Personal Data in certain situations, subject to our legal obligations to retain specific records.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data under certain circumstances, such as while you are disputing the accuracy of the data.
• Right to Object: You may object to the processing of your Personal Data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the rights above, please contact the ST789 support team via live chat, WhatsApp, or email at support@st789.biz. We will process your request within thirty (30) days of receipt and inform you of the action taken or to be taken.

ST789 takes special measures to protect the privacy of your financial transactions. All deposits and withdrawals made via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks, and other Malaysian banks) are processed through certified, secure payment gateways.

ST789 does not store your credit card details or bank account login credentials in our systems. We only retain transaction records (amount, date, payment type, and status) as required for account management and legal compliance. This means that even in the unlikely event of a security breach on our end, your sensitive financial information remains protected.

For every successful transaction, you will receive a confirmation through the ST789 platform and/or by email or SMS, depending on your communication preferences. If you receive a transaction notification for something you did not do, please contact our support team immediately — we are available 24/7.

ST789 may update or revise this Privacy Policy from time to time to reflect changes in our practices, applicable legal requirements, or improvements to how we protect your data. When we make material changes to this Policy, we will:

• Updating the "Last updated" date at the top of this page.
• Posting a clear notice on the ST789 platform homepage for a minimum of thirty (30) days.
• Sending email notifications to all registered members where changes are significant and affect your privacy rights.

We encourage you to review this Privacy Policy periodically to stay informed about how we manage your Personal Data. Your continued use of the ST789 platform after any amendments are published will be considered your acceptance of the updated Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how ST789 handles your Personal Data, please contact us through the following channels:

• Live Chat: Available directly on the ST789 platform, 24 hours a day, 7 days a week — the fastest way to get an immediate response.
• Privacy Email: support@st789.biz with the subject "Privacy Policy Enquiry" — responses within 48 hours for privacy-related queries.
• WhatsApp: Our WhatsApp number is available after logging in to your account under the Support section.

ST789 is committed to handling all privacy complaints seriously and within a reasonable timeframe. If you are not satisfied with our response, you have the right to escalate your complaint to the Department of Personal Data Protection Malaysia or the relevant regulatory authority.