Privacy Policy lepak –
Protection of Your Personal Data

Lepak collects various types of information to ensure a smooth, secure, and personalized user experience. Data collection is divided into two main categories — information you provide directly and information collected automatically when you use the platform.

Information You Provide Directly

• Registration information: Full name, phone number, email address, date of birth, and password when you open a lepak account.
• Identity verification (KYC): Identity document images (MyKad), verification selfies, and additional information required for anti-money laundering (AML) compliance.
• Financial information: Bank account number, account holder name, and e-wallet details (such as Touch 'n Go, GrabPay, Boost) for processing deposits and withdrawals.
• Communications: The content of messages you send to Lepak's customer support team via live chat or email.
• Feedback: Surveys, reviews, or any information you voluntarily share with us.

Information Collected Automatically

• Device data: Device type, operating system, browser version, screen resolution, and unique device identifier.
• Network data: IP address, Internet Service Provider (ISP), and estimated location information based on IP.
• Usage data: Pages visited, session duration, games played, clicks, and navigation patterns within the platform.
• Transaction data: Deposit history, withdrawals, total wagering amount, and win/loss records.

Every piece of data collected by lepak is used for a specific and legitimate purpose. We do not use your data for any purpose unrelated to platform operations without your consent.

Lepak will only send you marketing communications if you have provided consent during registration or through the communication preferences settings in your account. You may withdraw this consent at any time via your account settings.

Lepak does not sell, rent, or disclose your personal data to third parties for marketing or commercial purposes. However, there are specific situations where we need to share data with limited parties, and this is done solely to enable the platform to operate properly.

Third Parties That May Receive Your Data

• Payment providers: Data required to process deposits and withdrawals is shared with licensed payment gateways such as FPX and e-wallet providers partnered with Lepak.
• Game software providers: Limited game session information may be shared with game providers (such as Pragmatic Play, PG Soft, and others) solely for technical purposes.
• Cloud service providers: Data is stored on cloud servers managed by providers that comply with international security standards.
• Authorities: lepak will disclose information to the police, commission, or regulatory body if required by law or court order.
• Professional advisors: Lawyers, accountants, or auditors bound by confidentiality obligations may be granted limited access in the context of professional services they provide to lepak.

Every third party that works with lepak is required to adhere to data protection standards as stringent as our own, and may only use that data for authorised purposes.

Lepak uses cookies and similar tracking technologies to enhance the user experience, maintain login session security, and understand overall platform usage patterns.

Types of Cookies Used

• Essential cookies: Required for the platform to function properly — including login session authentication and language preferences. These cookies cannot be disabled without affecting core functionality.
• Performance cookies: Collects anonymous data on how users interact with the platform (most visited pages, page load times, errors encountered) to help us improve our services.
• Functional cookies: Saves your preferences such as language, game preferences, and display settings so you don't have to reconfigure them every time you log in.
• Security cookies: Detects suspicious login attempts and protects your account from unauthorized access.

Managing Cookie Preferences

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect your platform experience. For detailed guidance, refer to the help section of your browser (Chrome, Firefox, Safari, etc.).

Lepak continuously invests in robust security infrastructure to ensure your personal data is always protected against cyber threats, data breaches, and unauthorized access.

Security Measures Implemented

• Data encryption in transit using TLS 1.3 and SSL 256-bit protocols.
• Data encryption at rest for all sensitive records.
• Role-based access control (RBAC) — only authorised staff can access user data.
• Real-time threat monitoring with intrusion detection and prevention systems (IDS/IPS).
• Regular penetration testing conducted by independent security experts.
• Two-factor authentication (2FA) is mandatory for all internal system administrative access.
• Automatic daily data backups with tested disaster recovery procedures.

While we take all reasonable steps to protect your data, no security system is 100% impenetrable. If you suspect your account has been compromised, please contact our support team immediately.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding your personal data held by Lepak. We are committed to respecting and facilitating the exercise of these rights.

• Right to Access: You have the right to request a copy of the personal data we hold about you. Requests will be processed within 21 business days.
• Right to Rectification: If any of your personal data is inaccurate or outdated, you may request a correction through your profile settings or by contacting customer support.
• Right to Erasure: You may request deletion of your personal data, subject to legally mandated record retention requirements (such as financial records for 7 years).
• Right to Restrict Processing: In certain circumstances, you may request that Lepak restrict how your data is processed while a dispute is being resolved.
• Right to Withdraw Consent: For processing that relies on your consent (such as marketing communications), you may withdraw your consent at any time without affecting your eligibility to use the platform.
• Right to Lodge a Complaint: If you are dissatisfied with how lepak handles your data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.

Lepak retains your personal data for as long as your account is active or as long as necessary to provide our services. After account closure, the following retention periods apply:

Upon expiry of the retention period, data will be permanently deleted or anonymised so that it can no longer be identified. Anonymised data may be retained for statistical purposes with no personally identifying elements.

Lepak is a platform exclusively for individuals aged 18 and above. We do not knowingly collect personal data from children or underage minors.

If we become aware that personal data of a child under 18 has been collected without proper age verification, we will take immediate action to delete that data and close the associated account. Parents or guardians who believe their child has registered with lepak without their knowledge are welcome to contact us promptly for follow-up.

Lepak reserves the right to update or amend this Privacy Policy from time to time in line with changes in law, technology, or our operational practices. Any material amendments will be communicated to all active members via their registered email or in-app notification.

Notifications will be sent at least 14 days before the amendments take effect, giving you sufficient time to review the changes. Continued use of the lepak platform after the effective date will be considered acceptance of the updated terms.

Previous versions of this Privacy Policy are available upon request from our support team for your reference. We recommend checking this page from time to time to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Lepak handles your personal data, our team is available 24 hours a day, 7 days a week.

• Data Protection Email: [email protected]
• Live Chat: Available on the lepak app and website — click the chat icon at the bottom right corner.
• Response Time: Privacy-related requests will be processed within 3 business days; complex requests within 21 business days.

For formal complaints, you may also contact the Department of Personal Data Protection Malaysia (JPDP) through their official channels. However, we encourage you to reach out to lepak first so we can resolve any issues directly and more promptly.