At lepak, privacy is more than a legal obligation — it is our commitment to every player. This document transparently explains how we collect, use, store and protect your personal information in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
Six core pillars that form lepak's data protection policy for Malaysian players
All your personal data is stored on servers protected with AES-256 encryption and governed by a multi-layered access control system. No staff member may access your data without valid, auditable authorisation.
Lepak never sells, rents, or shares your personal data with advertisers or third parties for commercial purposes. Your data is only shared with service partners who have signed strict confidentiality agreements.
Every aspect of our data handling complies with the provisions of Malaysia's Personal Data Protection Act 2010. We conduct regular compliance reviews to ensure our practices remain in line with the latest legal requirements.
You may access, review, correct or request deletion of your personal data at any time through your account settings or by contacting our support team. Requests are processed within 5 business days.
Every piece of data transmitted between your device and lepak's servers is protected by TLS 1.3 protocol and 256-bit SSL encryption. This ensures no third party can intercept or read your sensitive information in transit.
In the event of any security incident involving your data, lepak is committed to notifying you within 72 hours and taking immediate remediation steps. Transparency is the cornerstone of our relationship with our players.
Lepak collects your personal information in a transparent and responsible manner. We only collect data that is genuinely necessary to deliver high-quality services and maintain platform security. The following are the categories of information we collect:
| Data Categories | Sample Information | Primary Purpose |
|---|---|---|
| Identity Information | Full name, identity card number, date of birth, identity card image | KYC verification, legal compliance |
| Contact Information | Email address, phone number, residential address | Account communications, customer support |
| Financial Information | Bank name, bank account number, deposit and withdrawal transaction records | Payment processing, fraud prevention |
| Usage Data | Game history, betting records, login timestamps, platform activity | Experience enhancement, responsible gaming |
| Technical Data | IP address, device type, browser, operating system, cookie data | Account security, fraud prevention, analytics |
We collect this information through three main channels: first, information you provide directly during registration or use of the platform; second, data automatically generated through your interactions with our services; and third, information received from legitimate service partners such as payment providers and identity verification bodies.
Data Minimisation Principle: lepak only collects data necessary for the stated purposes. We do not collect sensitive information such as biometric data, health records, or political affiliations unless required by applicable law.
Data collected is used solely for legitimate purposes that are clearly communicated to you. lepak never uses your personal data for purposes unrelated to the services we offer without first obtaining your explicit consent.
The main purposes for which your data is used include the following:
All data processing activities are carried out on a solid legal basis, whether that is consent provided by you, contractual necessity, legal obligation, or lepak's legitimate interests in operating a responsible business.
Lepak upholds the trust you place in us. We do not sell, rent, or disclose your personal data to any third party for marketing or commercial purposes. Information sharing only occurs in the following limited situations:
All our service partners are bound by legally enforceable data confidentiality agreements. They are not permitted to use your data for any purpose other than what has been mutually agreed with lepak.
The security of your data is an absolute priority for lepak. We continuously invest in the latest security infrastructure to ensure your personal information is always protected from unauthorised access, loss, or destruction.
The technical security measures we implement include:
However, no security system can guarantee absolute 100% protection. We therefore also encourage you to play an active role in safeguarding your account by using a strong password, not sharing your login credentials, and notifying us immediately if you suspect any unauthorised access.
PCI-DSS Certification: All payment data processing at lepak complies with the Payment Card Industry Data Security Standard (PCI-DSS). Your credit or debit card data is never stored directly on our servers.
Lepak uses cookies and similar tracking technologies to enhance your experience on our platform, maintain login session security, and collect analytics data for service improvement purposes.
There are four types of cookies used on the lepak platform:
You can manage or delete cookies at any time through your web browser or mobile app settings. Please note that disabling certain cookies may affect the functionality and your experience on the lepak platform.
Under Malaysia's Personal Data Protection Act 2010 (PDPA) and lepak's internal policies, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights at no charge:
Request a copy of the personal data we hold about you. We will provide it within 14 business days.
Request correction of inaccurate or incomplete data. Simple updates can be made through your account settings.
Request that your personal data be deleted, subject to retention obligations established by law.
Object to the processing of your data for direct marketing or analytics purposes at any time without giving a reason.
Receive your personal data in a structured, machine-readable format for transfer to another provider.
Request that the processing of your data be restricted in certain situations, for example while the accuracy of data is being reviewed.
To exercise any of the above rights, contact our Data Protection team via live chat or our official email. All requests will be processed within 5 to 14 business days depending on the complexity of the request.
The lepak platform is strictly for individuals aged 18 years and above. We do not intentionally collect, store or process any personal data from minors.
If we discover that personal data of a child or minor under 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the relevant account. Parents or guardians who are concerned that their child may have registered on our platform are encouraged to contact us immediately.
lepak employs age verification technology during the KYC process to ensure only eligible individuals can access the platform. Protecting minors is a shared responsibility that we take very seriously.
In operating an online gaming platform, there are situations where your personal data may be processed or stored outside Malaysia, for example through the use of international cloud services or global technology partners.
When such data transfers occur, lepak ensures that:
The lepak platform may contain links to third-party websites or services in certain contexts. Please note that this Privacy Policy applies solely to the lepak platform and does not cover the privacy practices of external websites.
We are not responsible for the content, privacy policies, or security practices of third-party websites. We encourage you to read the privacy policy of every website you visit and to exercise caution when providing personal information on external sites.
Lepak retains your personal data only for as long as necessary to fulfil the purposes stated in this policy, or as required by applicable Malaysian law.
| Data Types | Retention Period |
|---|---|
| Active account data | For the duration the account remains active, plus 5 years after account closure |
| Financial transaction records | 7 years (in accordance with Malaysia's financial legal requirements) |
| KYC Documents | 5 years after the business relationship ends (AML/CFT requirements) |
| Support communication logs | 3 years after last interaction |
| Analytics & cookie data | 13 months from the date of collection |
| Game records | 3 years for audit and dispute purposes |
Once the retention period expires, data will be securely deleted or anonymised so that it can no longer be personally linked to you.
Lepak reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or to enhance the transparency of the information we provide to you.
In the event of significant changes to how we use your personal data, we will:
Your continued use of the lepak platform after the effective date of any changes will be considered your acceptance of the updated Privacy Policy. If you do not agree with any changes, you have the right to close your account and discontinue use of our platform.
If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer (DPO) through the following channels:
We are committed to responding to all privacy-related inquiries within 5 business days. For complaints that are more serious or cannot be resolved by our team, you have the right to submit a complaint to the Department of Personal Data Protection Malaysia.