Privacy Policy

Zora4D ("we", "us", "our", "the Platform") takes the privacy of its Members seriously. This Privacy Policy sets out, in clear and accessible language, the manner in which Zora4D collects, processes, stores, shares, and protects personal data relating to individuals who access or use the zora4d.click platform and any associated services, mobile applications, or digital communications.

As an online casino and sports betting platform serving players across Malaysia — including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — Zora4D processes personal data as part of delivering its core gaming, payment, and customer support functions. We are committed to ensuring that this processing is lawful, proportionate, transparent, and respectful of your individual rights at all times.

Zora4D processes data for a number of essential operational reasons, including: verifying the identity and age of account holders, facilitating deposit and withdrawal transactions through Malaysian payment channels such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong; preventing fraud and money laundering; providing responsive customer support; and meeting regulatory obligations applicable to licensed gaming operators.

We do not sell your personal data to third parties. We do not use your data for unsolicited third-party marketing purposes. Where data is shared with service partners, it is done solely to the extent necessary to deliver the services you have requested, under contractual data processing protections.

The following definitions apply throughout this Policy:

Zora4D collects Personal Data across several categories, each serving a distinct operational purpose:

• Full legal name as it appears on government-issued identification;
• Date of birth (for age verification — minimum 21 years);
• Residential address, including postcode and state within Malaysia;
• Email address and mobile phone number;
• Copies of identity documents submitted during KYC (Malaysian MyKad, passport, or driving licence).

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• Payment method identifiers (e-wallet account names, bank account numbers partially masked, cryptocurrency wallet addresses);
• Betting history, game participation records, win/loss summaries, and bonus usage records;
• Account Wallet Balance and transaction ledger entries.

• IP address and approximate geolocation at the time of each login and transaction;
• Device type, operating system, browser type and version;
• Session duration, page interaction logs, and clickstream data;
• Cookie identifiers and similar tracking technologies.

• Records of all live chat conversations with the Zora4D support team;
• Email correspondence submitted to [email protected];
• Details of complaints, disputes, or feedback submitted through the Platform.

Personal Data is collected through the following channels:

• Direct Submission: Data you actively provide when creating an account, completing KYC verification, requesting a withdrawal, submitting a support enquiry, or participating in a promotion;
• Automated Platform Activity: Technical and behavioural data collected passively through your use of the Platform, including login events, navigation patterns, game sessions, and transaction activity;
• Third-Party Payment Processors: Transaction confirmation data received from payment service providers such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and connected Malaysian banking institutions when you initiate a deposit or withdrawal;
• Cookies and Tracking Technologies: Data collected via cookies, pixel tags, and similar technologies as described in Section 8 of this Policy;
• Fraud Prevention Services: Risk signals and identity verification data received from third-party identity verification and AML screening service providers engaged by Zora4D.

Zora4D processes Personal Data for the following specific and documented purposes:

All processing of Personal Data by Zora4D is conducted on one or more of the following lawful bases:

• Contractual Necessity: Processing that is necessary to deliver the services you have contracted with Zora4D to receive — including account operation, payment processing, KYC verification, and customer support;
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), age verification, and financial reporting obligations;
• Legitimate Interests: Processing undertaken to protect the security and integrity of the Platform, prevent fraud, improve service quality, and maintain responsible gambling safeguards — where these interests are not overridden by your fundamental privacy rights;
• Consent: Where processing is based on your specific, informed, and freely given consent — for example, optional marketing communications. You may withdraw consent at any time by contacting our support team, without prejudice to the lawfulness of any processing that occurred prior to withdrawal.

Zora4D does not sell Personal Data to third parties. Data may be shared with the following categories of recipients solely to the extent necessary for the stated purpose:

• Payment Service Providers: DuitNow operators, FPX gateway partners, Touch 'n Go eWallet, Boost, GrabPay, and connected Malaysian banking institutions receive transaction data to process your deposits and withdrawals securely;
• Identity Verification Partners: Third-party KYC and AML screening providers receive identity document data and associated verification signals to facilitate account approval and regulatory compliance;
• Game Content Providers: Licensed international game studios integrated into the Platform receive session-level data (player identifier, stake, and outcome) to operate game rounds and calculate payouts. No directly identifiable personal data is passed to game studios beyond the minimum required;
• IT Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity service providers that maintain and protect the Platform's technical infrastructure under data processing agreements with Zora4D;
• Regulatory and Legal Authorities: In response to lawfully issued orders, warrants, or formal requests from competent regulatory authorities, law enforcement agencies, or courts of jurisdiction — to the extent required and no further;
• Professional Advisers: Legal, accounting, and audit professionals bound by confidentiality obligations who assist Zora4D in its compliance and operational functions.

All third-party data processors engaged by Zora4D are subject to written data processing agreements that impose obligations consistent with the protections set out in this Policy.

Zora4D uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential to the core operation of the Platform — including session management, login authentication, and security token validation. These cookies cannot be disabled without rendering the Platform inoperable;
• Functional Cookies: Used to remember your preferences such as language settings, preferred odds format, and table game view configurations across sessions;
• Analytics Cookies: Used to collect aggregated, anonymised data on how users navigate the Platform — enabling us to identify and improve areas with high drop-off, slow loading, or usability issues. Analytics data is not linked to individual identifiable profiles;
• Fraud Prevention Cookies: Device fingerprinting and behavioural analytics signals used to detect unusual activity patterns that may indicate account fraud, bonus abuse, or multi-accounting;
• Session Duration Cookies: Used to support responsible gambling features, including session time alerts and reality check prompts that appear at defined intervals during active play.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in or using core Platform functions. Disabling analytics or functional cookies will not prevent access but may reduce personalisation and functionality.

Zora4D retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained throughout the duration of the Member's active account relationship with the Platform, plus an additional period following account closure as described below;
• KYC and Identity Documents: Retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, consistent with financial regulatory obligations;
• Support and Communications Records: Retained for up to three (3) years from the date of the relevant communication, to support dispute resolution and quality assurance functions;
• Technical and Device Logs: Retained for up to twelve (12) months from collection, unless extended retention is required in connection with an active fraud investigation or legal proceeding;
• Self-Exclusion Records: Retained for the full duration of the self-exclusion period and a further five (5) years thereafter to prevent re-registration in circumvention of the exclusion.

Upon expiry of applicable retention periods, Personal Data is securely deleted or irreversibly anonymised in accordance with Zora4D's data disposal procedures.

Zora4D implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the Platform is protected using TLS 1.2 or higher (256-bit SSL encryption);
• Encryption at Rest: Sensitive data fields stored on Zora4D's servers — including KYC document references, payment method identifiers, and account credentials — are encrypted at rest using AES-256 or equivalent standards;
• Access Controls: Strict role-based access controls limit which internal personnel may view or process Member data, with all access events logged and subject to audit;
• Two-Factor Authentication: 2FA is available and strongly recommended for all Member accounts, and is mandatory for internal administrative systems;
• Penetration Testing: The Platform undergoes scheduled and unscheduled penetration testing by qualified third-party security professionals to identify and remediate vulnerabilities;
• Incident Response: Zora4D maintains a documented data breach response procedure. In the event of a confirmed breach affecting Member data, affected individuals will be notified in accordance with applicable legal requirements.

Subject to applicable data protection law and the operational constraints of a licensed gaming platform, you hold the following rights in relation to your Personal Data processed by Zora4D:

To exercise any of the above rights, please submit a written request to our support team via live chat or email at [email protected]. We will acknowledge your request within 5 business days and endeavour to respond substantively within 30 calendar days. Complex requests may require an extension, of which you will be informed.

Please note that certain rights — particularly the right to erasure — may be limited where the data in question is subject to mandatory legal retention obligations, such as AML record-keeping requirements. Where this applies, we will explain the basis for any restriction in our response to your request.

The Zora4D Platform may link to or integrate with third-party services in the course of delivering its functions — including licensed game content studios, payment gateway providers, and customer support infrastructure tools. This Privacy Policy applies exclusively to Personal Data processed by Zora4D as Data Controller.

Third-party services — including Malaysian payment operators such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — operate under their own privacy policies and data handling practices, which are independent of and not governed by this Policy. Zora4D is not responsible for the privacy practices of any third-party service provider, and we encourage you to review the privacy documentation of any such service directly.

Where third-party services process Personal Data on Zora4D's behalf as Data Processors (rather than independent Data Controllers), they do so under contractual terms that require compliance with standards equivalent to those set out in this Policy.

The Zora4D Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, store, or process Personal Data belonging to individuals under the age of 21 under any circumstances.

Age verification is a mandatory component of the account registration and KYC process. Any account found to have been registered by or on behalf of a person under the age of 21 will be immediately suspended, all associated data will be reviewed and handled in compliance with applicable child protection obligations, and any balances will be subject to the account closure procedures set out in our Terms and Conditions.

If you believe that Zora4D may have inadvertently collected data from a person under the age of 21, please contact us immediately at [email protected]. We will investigate and take appropriate remedial action without delay.

Zora4D reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, operational practices, or the nature of the services offered. The effective date of the most recent revision is displayed at the top of this document and within the table of contents sidebar.

Where an amendment materially affects how we process your Personal Data, we will provide reasonable advance notice via Platform notification or email to the registered address on file, prior to the amended terms taking effect.

Continued use of the Platform following notification of any amendment constitutes your acceptance of the revised Policy. We recommend reviewing this page periodically to remain informed of how your data is being handled. If you do not agree with any amendment, you may request account closure in accordance with Section 13 of our Terms and Conditions.

For all privacy-related queries, data subject access requests, consent withdrawals, or complaints regarding our data handling practices, please contact the Zora4D Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget accessible from any page on the Platform. Suitable for general privacy queries and consent withdrawal requests;
• Email: [email protected] — for formal written data subject rights requests, complaints, or matters requiring documented correspondence. Please mark the subject line clearly as "Privacy Request" or "Data Subject Rights" to ensure prompt routing to the appropriate team member.

Zora4D aims to acknowledge all formal privacy communications within 2 business days and to provide a substantive response within 30 calendar days of receipt. Where the complexity of a request requires additional time, we will inform you in writing of the extended timeline and the reasons for the delay.

This Privacy Policy was last reviewed and updated on 1 January 2026. Thank you for trusting Zora4D with your personal information. We take that responsibility seriously and remain committed to handling your data with care, transparency, and respect.