Privacy Policy

This Privacy Policy ("Policy") describes the data privacy practices of Deluna4D ("we", "us", "our", "Platform") in connection with your use of the Deluna4D online casino and sports betting platform, accessible at deluna4d.cam and its associated subdomains and mobile applications.

Deluna4D is committed to protecting the privacy and personal data of its users ("you", "User", "Player"). We operate in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, storage limitation, and data security. Where local laws applicable to Malaysian users impose additional requirements, we comply with those requirements to the extent practicable.

By registering an account on Deluna4D, accessing any part of the platform, or providing us with your personal information in any context, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Deluna4D operates as the Data Controller in respect of all personal data collected through its platform. All decisions regarding the purposes for which personal data is collected, and the means by which it is processed, are made by Deluna4D.

Deluna4D operates under an international online gaming licence. Regulatory compliance obligations under that licence inform certain data processing activities, including KYC identity verification, AML transaction monitoring, and responsible gambling record-keeping.

Deluna4D collects the following categories of personal data, grouped by the context in which they are obtained:

4.1 Registration & Account Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to confirm you are 21 years of age or older)
• Email address and chosen username
• Country of residence and, optionally, city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya)
• Password (stored only in hashed, non-recoverable form)

4.2 KYC & Identity Verification Data

• Copy of government-issued photo identification (MyKad, Passport, or Driver's Licence)
• Proof of address (utility bill, bank statement, or official correspondence dated within 3 months)
• Selfie photograph holding your identification document
• Payment method ownership verification (e.g., screenshot of bank account or e-wallet showing account holder name)

4.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and methods (including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT, BTC)
• Account balance history and bonus credit records
• Wagering activity records, including bet placement, game selections, and settlement data

4.4 Technical & Device Data

• IP address and approximate geolocation at the time of access
• Device type, operating system, browser type and version
• Session duration, login timestamps, and platform navigation data
• Cookie identifiers and similar tracking technologies (see Section 11)

4.5 Support & Communications Data

• Content of live chat transcripts, support tickets, and email correspondence
• Records of responsible gambling tool activations (deposit limits, self-exclusion requests, session time limits)

Personal data is collected through the following means:

• Directly from you — during account registration, KYC submission, deposit and withdrawal requests, and customer support interactions.
• Automatically through platform use — via cookies, server logs, and device fingerprinting technologies that operate when you access and navigate the platform.
• From third-party payment processors — transaction confirmation data and payment method validation results received from e-wallet providers, banks, and cryptocurrency networks when you make a deposit or withdrawal.
• From identity verification partners — where we use third-party KYC or AML screening services to cross-check submitted documents and verify identity.
• From publicly available sources — where permitted by law, we may supplement account data with information from public registers or sanctions lists for AML compliance purposes.

The table below sets out the primary purposes for which we process personal data, the categories of data involved, and the legal basis relied upon in each case:

Deluna4D does not sell personal data to third parties. We may share personal data with the following categories of recipients, in each case only to the extent necessary for the defined purpose:

7.1 Service Providers (Data Processors)

We engage third-party service providers to assist with the operation of the platform. These include payment processors (for MYR and cryptocurrency transactions), KYC verification service providers, cloud hosting and infrastructure providers, fraud detection and cybersecurity vendors, and customer support technology providers. Each provider operates under a binding data processing agreement that restricts their use of your data to the specified service.

7.2 Regulatory & Law Enforcement Authorities

We may disclose personal data to competent authorities — including gaming regulators, financial intelligence units, law enforcement agencies, and courts — where we are legally required or compelled to do so. Such disclosures are made strictly in accordance with applicable legal requirements.

7.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or part of Deluna4D's business, personal data held by the platform may be transferred to the acquiring entity. Users will be notified of any such transfer and of any material change to privacy practices that may result.

As an internationally operating platform, Deluna4D may transfer personal data to countries outside of Malaysia for processing by our service providers. Such transfers may include data stored on cloud infrastructure located in jurisdictions other than where you reside.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to or greater than that which applies in Malaysia. Safeguards may include:

• Contractual clauses binding the receiving party to internationally recognised data protection standards
• Transfers to jurisdictions recognised as providing an adequate level of data protection
• Technical and organisational security measures applied in addition to contractual protections

You may request information about the specific safeguards applicable to any international transfer of your data by contacting our data privacy team.

We retain personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following retention principles apply:

• Active account data — retained for the duration of the account relationship and for a period of five (5) years thereafter, to fulfil AML regulatory record-keeping requirements.
• KYC documents — retained for the period required under applicable anti-money laundering legislation, typically five (5) years from the end of the business relationship.
• Transaction records — retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications — retained for two (2) years from the date of the interaction, or longer if related to an unresolved dispute.
• Technical and device data — retained for a rolling period of twelve (12) months from the date of collection, unless required for active security investigation.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

Deluna4D implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Transport Layer Security (TLS/SSL): 256-bit encryption applied to all data in transit between your device and our servers.
• Encryption at Rest: Sensitive data, including KYC documents and payment credentials, stored using AES-256 encryption at rest.
• Two-Factor Authentication (2FA): Available to all registered users and mandatory for access to administrative systems.
• Access Controls: Internal data access restricted on a strict need-to-know basis, with role-based permissions and audit logging for all access events.
• Regular Security Audits: Penetration testing and vulnerability assessments conducted on a regular scheduled basis by internal and independent security teams.
• Incident Response Procedures: Documented procedures for detecting, containing, and notifying affected parties of data security incidents within defined timeframes.

Deluna4D uses cookies and similar technologies (such as web beacons, local storage, and session identifiers) to operate and improve the platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session cookies that maintain your login state and security cookies that detect fraudulent activity. These cannot be disabled without affecting platform functionality.
• Functional Cookies: Remember your preferences, language settings, and display choices to provide a personalised platform experience.
• Analytical Cookies: Collect anonymous data on how users navigate the platform, which pages are visited most frequently, and where errors occur. This data is used to improve the platform — not to identify individual users.
• Responsible Gambling Cookies: Track session duration and activity patterns to support the operation of responsible gambling tools such as reality checks and session time limits.

You may control non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair the functionality of the platform and may prevent you from accessing certain features, including the ability to log in.

Subject to applicable law and certain regulatory limitations (for example, where processing is required for AML compliance, certain rights may be restricted), you hold the following rights in respect of your personal data:

To exercise any of the rights above, please contact our support team at the details provided in Section 15. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we reserve the right to charge a reasonable administrative fee or to decline the request.

Deluna4D strictly prohibits the use of its platform by any person under the age of 21 years. We do not knowingly collect personal data from individuals under 21. Age verification is a mandatory step of the KYC process, and any account found to belong to a minor will be immediately closed.

If you believe that we have inadvertently collected personal data from a minor, please contact us immediately using the details in Section 15. We will investigate and, if confirmed, delete all relevant data promptly and return any deposited funds to the originating payment source.

Deluna4D reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory requirements, or platform features. The date of the most recent update is displayed at the top of this page.

Where amendments are material — for example, where we introduce a new category of processing or a new purpose for which existing data is used — we will provide advance notice through the platform's announcement system or by email to your registered address, and we will obtain fresh consent where required by law.

Your continued use of the Deluna4D platform following publication of any amended Policy constitutes acceptance of the revised version. If you do not accept the revised Policy, you should cease use of the platform and contact us to request account closure and data handling in accordance with your rights under Section 12.

For all enquiries relating to this Privacy Policy, the exercise of your data rights, or any data privacy concern, please contact us through the following channels. We aim to respond to all data privacy requests within 30 calendar days.

When contacting us about a data rights request, please include your registered email address, a description of your request, and any relevant reference information. We may need to verify your identity before processing the request to protect against unauthorised disclosure.

If you are dissatisfied with our handling of any privacy concern, you may have the right to lodge a complaint with the competent data protection authority in your jurisdiction.