Cartel4D Privacy Policy

Cartel4D ("Company", "We", "Us", "Our") operates the online gaming and sports betting platform accessible at cartel4d.cam. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, visitors, and prospective users.

This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which we process it, the parties with whom we may share it, and the rights available to you as a data subject. It applies to all personal data processed through the Cartel4D website, associated mobile interfaces, and any communications between you and our customer support team.

This Policy should be read alongside our Terms & Conditions, which govern the overall legal relationship between you and Cartel4D. By registering an account or continuing to use the platform, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data: Any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, and online identifiers such as IP addresses and device IDs.
• Processing: Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• Data Controller: The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Cartel4D acts as the Data Controller with respect to the personal data of its users.
• Data Processor: A third party that processes personal data on behalf of the Data Controller, under a documented agreement containing appropriate data protection obligations.
• Consent: A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a defined purpose.
• Data Subject: The individual to whom personal data relates — in the context of this Policy, this includes all Cartel4D registered users and platform visitors.
• Cookies: Small text files placed on your device by the Cartel4D platform to facilitate session management, preference storage, and analytics functionality.

Cartel4D collects personal data that is necessary to provide our gaming services, comply with our legal obligations, and protect the integrity of the platform. The following table summarises the categories of data we may collect:

Cartel4D collects personal data through the following channels:

4.1 Directly from You

• When you create and register a Cartel4D account, including completion of the registration form and any subsequent profile updates.
• When you submit KYC documentation for identity and age verification purposes.
• When you initiate a deposit or withdrawal transaction using any of our supported Malaysian payment methods.
• When you contact our customer support team via live chat or email correspondence.
• When you voluntarily provide feedback, complete surveys, or participate in promotional activities.

4.2 Automatically via Platform Technology

• Through cookies, web beacons, and session tracking technologies when you browse or interact with the Cartel4D platform.
• Through server-side logging of technical data including IP addresses, device identifiers, and access timestamps for security and fraud prevention purposes.
• Through in-platform analytics tools that track aggregated usage patterns to improve platform functionality and user experience.

4.3 From Third Parties

• From payment service providers — including Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX operators, Touch 'n Go eWallet, Boost, and GrabPay — to confirm the status and authenticity of financial transactions.
• From identity verification and KYC service providers engaged to assist in meeting our regulatory obligations.
• From fraud prevention and anti-money laundering (AML) databases, where legally permissible, to assess risk associated with account activity.

Cartel4D processes personal data only where a lawful basis exists for doing so. The applicable legal bases and associated processing purposes are set out below:

• Performance of a Contract: Processing necessary to create and manage your account, facilitate deposits and withdrawals, and provide access to gaming services as per our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, age verification requirements, and international gaming licence conditions — including the retention of transaction records and KYC documentation.
• Legitimate Interests: Processing for platform security, fraud detection, abuse prevention, responsible gambling monitoring, and internal analytics — where such interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications, where you have explicitly opted in. You may withdraw consent for marketing communications at any time.

Cartel4D does not sell, rent, or trade your personal data to third-party commercial organisations. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and under appropriate data protection safeguards:

6.1 Payment Service Providers

To process financial transactions, we share relevant transaction and identity data with licensed payment processors in Malaysia — including but not limited to Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, and FPX network operators. Data shared is limited to what is necessary to complete the specific transaction.

6.2 Identity Verification & KYC Providers

We engage regulated third-party KYC and identity verification providers to assist in validating the authenticity of documents submitted for account verification. These providers are bound by confidentiality obligations and data processing agreements.

6.3 Fraud Prevention & AML Services

To meet our anti-money laundering and fraud prevention obligations, we may share relevant data with risk assessment and AML compliance service providers. This processing is carried out under our legal obligation basis.

6.4 Legal and Regulatory Authorities

Cartel4D may disclose personal data to competent legal authorities, regulators, or law enforcement bodies where required to do so by applicable law, court order, or regulatory directive. We will not make such disclosures beyond what is legally required.

6.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, personal data held by Cartel4D may be transferred to the successor entity. Users will be notified of any such transfer and the applicable privacy terms applicable to the successor.

The Cartel4D platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain session security, and to improve your overall experience. The following types of cookies are deployed:

You can manage your cookie preferences through your browser settings at any time. Please note that disabling certain categories of cookies may affect the functionality of specific platform features.

Cartel4D retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active Cartel4D account is retained for the duration of the account's active status.
• Transaction Records: Financial transaction data, including deposit and withdrawal history, is retained for a minimum of five (5) years following the transaction date, in accordance with AML regulatory requirements.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years following account closure or the last transaction date, whichever is later.
• Support Communications: Customer support correspondence is retained for a period of two (2) years following the closure of the relevant support case.
• Marketing Data: Data held for marketing communication purposes is retained until you withdraw consent or request deletion, subject to any applicable legal minimum retention periods.
• Closed or Suspended Accounts: Upon account closure, data is retained for the applicable regulatory minimum period before being securely deleted or anonymised.

When personal data is no longer required and no legal basis for further retention exists, Cartel4D will securely delete or irreversibly anonymise the data in accordance with our internal data disposal procedures.

Cartel4D implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure. Key security measures in place include:

• Transport Layer Security (TLS): All data transmitted between your device and the Cartel4D platform is encrypted using 256-bit SSL/TLS encryption, ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Encryption at Rest: Sensitive personal data and financial information stored on our servers is encrypted using industry-standard AES-256 encryption.
• Access Controls: Access to personal data within Cartel4D's internal systems is restricted on a strict need-to-know basis, with role-based access controls and regular access reviews in place.
• Infrastructure Security: Our platform is hosted on secure, audited infrastructure with regular penetration testing, vulnerability assessments, and security patch management.
• Incident Response: Cartel4D maintains a documented data breach response plan. In the event of a security incident affecting your personal data, we will notify affected users and relevant authorities in accordance with applicable legal obligations.

As an international online gaming platform, Cartel4D may process or store personal data on servers or through service providers located outside of Malaysia. Where such international transfers occur, we ensure that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applicable within your home jurisdiction.

Safeguards applied to international data transfers include:

• Data processing agreements with all third-party processors that include binding data protection obligations aligned with internationally recognised privacy frameworks.
• Transfers to jurisdictions with adequacy decisions or equivalent data protection frameworks recognised under applicable international standards.
• Where required, reliance on standard contractual clauses or equivalent legal instruments as the transfer mechanism for personal data leaving the applicable jurisdiction.

As a data subject, you hold a defined set of rights with respect to the personal data Cartel4D holds about you. These rights are summarised below. To exercise any of these rights, please contact us using the details provided in Section 15.

We aim to respond to all rights requests within thirty (30) calendar days. In complex cases, this period may be extended by a further sixty (60) days, with notification provided to you of the extension and the reason for it.

The Cartel4D platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data relating to persons under this age threshold.

Where Cartel4D becomes aware that personal data has been submitted by or on behalf of a person under 21, such data will be immediately deleted and the associated account will be closed. Cartel4D conducts mandatory age verification as part of the KYC process to enforce this restriction.

The Cartel4D platform does not include links to external third-party websites for commercial or advertising purposes. Where references to external support resources or regulatory bodies appear in our communications (for example, responsible gambling organisations), these references are for informational purposes only.

Cartel4D accepts no responsibility for the privacy practices, data processing activities, or content of any external websites or services. If you navigate to a third-party website from any reference in our communications, we recommend that you review that website's own privacy policy before providing any personal data.

Cartel4D reserves the right to amend, update, or replace this Privacy Policy at any time, in response to changes in applicable law, regulatory requirements, our business operations, or updates to our data processing practices. All amendments will be published on this page with a revised "Last Updated" date.

Where a material change is made to this Policy — particularly any change that significantly affects how we process your personal data or your rights as a data subject — we will endeavour to provide advance notice via your registered email address or through a prominent platform notification. Your continued use of the Cartel4D platform following the effective date of a revised Policy constitutes your acceptance of the updated terms.

We recommend that you review this Privacy Policy periodically to remain informed of how Cartel4D processes and protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data Cartel4D holds about you, please contact our Data Protection team using the details below. We treat all privacy enquiries with strict confidentiality and respond within the timeframes specified in Section 11.

• Support Email: [email protected] (plain text only — not a clickable link)
• Subject Line: Please include "Privacy Request" in the subject line of your email for expedited routing to our data protection team.
• Live Chat: Available 24/7 via the Cartel4D platform interface. For data subject rights requests, please follow up by email to ensure a documented record.
• Response Time: Privacy enquiries are acknowledged within 5 business days; formal data subject rights requests are responded to within 30 calendar days.

You also have the right to lodge a complaint with a competent data protection supervisory authority if you believe that Cartel4D's processing of your personal data is not in compliance with applicable data protection law.