Privacy Policy AuraHoki – Malaysian Player Data Protection

This Privacy Policy applies to all users who access or use the AuraHoki platform via aurahoki.best, the AuraHoki mobile app, or any other digital channel operated by AuraHoki. It covers all personal data collected during account registration, platform use, financial transactions, and interactions with the AuraHoki customer support team.

AuraHoki takes privacy seriously. As an online casino platform serving Malaysian players, we understand that your trust in us goes beyond fair gameplay and fast payouts — it also means knowing that your personal information is in safe, responsible hands.

AuraHoki collects the personal data necessary to provide a safe and high-quality online casino experience. The following are the categories of data we collect:

Information you provide directly:

• Full name as stated on your Malaysian identity document (MyKad)
• An active Malaysian phone number for OTP verification
• Email address (if provided)
• Date of birth for age verification (18 years and above)
• Registered payment method information (account name — not the full number)
• Identity verification documents (MyKad or passport) when required for the KYC process

Data collected automatically during platform use:

• Your device's IP address for security and location verification purposes
• Device type, operating system, and web browser used
• Gaming session data including games played, bets placed, and time spent playing
• Deposit and withdrawal transaction history
• Interaction logs with the AuraHoki customer support team
• Cookie data and similar tracking technologies (see Section 7)

Data collected by AuraHoki is used only for clearly defined and legitimate purposes. The following are the primary ways your data is used:

• Account management: Creating and managing your account, verifying your identity and processing secure logins.
• Transaction processing: Processing deposits and withdrawals via your registered Malaysian payment methods, including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX Maybank2u, and CIMB Clicks.
• Provision of gaming services: Unlocks access to all AuraHoki games, including slots, Live Casino (baccarat, blackjack, roulette), live matches, and the VIP Rewards programme.
• Service communications: Sending important notices related to your account, transactions, policy changes and critical security information.
• Promotional communications: Sending relevant bonus offers, promotions and VIP Rewards information – only where you have not objected to receiving such communications.
• Security and fraud prevention: Identifying and preventing fraudulent activity, money laundering and unauthorised access to your account.
• Legal compliance: Fulfilling legal obligations including anti-money laundering (AML) requirements and customer identity verification (KYC).
• Platform improvement: Analysing usage patterns on an aggregate and anonymised basis to improve the AuraHoki user experience.

AuraHoki does not sell or trade your personal data to any third party. However, in certain limited and legitimate circumstances, AuraHoki may share your data with the following parties:

• Payment processors: Information required to process your deposits and withdrawals through your registered Malaysian payment methods. These payment processors are bound by strict confidentiality agreements and may only use the data for transaction processing purposes.
• Technology service providers: Parties that help operate AuraHoki's technical infrastructure — such as cloud computing providers, cybersecurity service providers, and customer support systems — are all bound by data protection agreements that restrict use of your data strictly to the purposes specified.
• Regulatory bodies and legal authorities: When required by Malaysian law or a valid court order, AuraHoki will disclose the necessary data to the relevant authorities. AuraHoki will notify you of any such disclosure unless prohibited by law from doing so.
• Fraud and money laundering investigators: In situations where there is reasonable suspicion of fraud or illegal activity, AuraHoki reserves the right to share relevant information with the appropriate authorities for investigation purposes.

In all of the above situations, AuraHoki will ensure that only the necessary information is shared — not your entire data profile. Every instance of data sharing is logged and can be reviewed by any member who requests an audit of their data records.

AuraHoki continually invests in cybersecurity to ensure member data remains protected against the latest threats. The following are the concrete security measures we have in place:

• 256-bit SSL end-to-end encryption: All communications between your device and AuraHoki's servers are fully encrypted. This means that even if data were intercepted in transit, it cannot be read without the appropriate encryption key.
• Financial data separation: Member funds are held in accounts completely separate from AuraHoki's operational funds. This ensures your money remains safe even in highly unlikely scenarios.
• Two-factor authentication (2FA): AuraHoki encourages all members to enable two-factor authentication via SMS OTP to a registered Malaysian phone number. This additional security layer keeps your account protected even if your password is compromised.
• Real-time threat detection system: The AuraHoki platform is equipped with an intrusion detection system (IDS) that monitors for suspicious activity around the clock. Any anomaly triggers an immediate alert to the AuraHoki security team.
• Regular security audits: AuraHoki conducts regular security audits by independent third parties to identify and address any vulnerabilities before they can be exploited.
• Strict internal access controls: Different AuraHoki staff members have different levels of access to member data based on the requirements of their respective roles. No single staff member has unrestricted access to the entire member database.

As financial transactions are an integral part of using the AuraHoki platform, AuraHoki places particular emphasis on the security and privacy of members' payment information.

AuraHoki supports the following local Malaysian payment methods: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX via Maybank2u or CIMB Clicks. For each of these payment methods, AuraHoki stores only the minimum information required — typically the account name and confirmation that the method is registered in your name. Your full account number, PIN, or e-wallet login credentials are never stored or accessible by AuraHoki.

• All transactions are processed through encrypted, authorised payment channels.
• AuraHoki will never ask for your PIN, OTP or e-wallet password directly through the platform or via any communication channel.
• Your transaction history on the AuraHoki platform is retained for internal record-keeping purposes and can be accessed through your account history.
• In the event of a transaction dispute, AuraHoki may need to share relevant transaction records with payment processors or financial authorities for resolution purposes.

AuraHoki uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

• Essential cookies: Required for core platform functions such as login authentication, game session management, and security. Without these cookies, the AuraHoki platform cannot function properly. They cannot be disabled.
• Performance cookies: Collects anonymous information about how you use the platform to help us improve performance and user experience — for example, which pages are visited most frequently and how long each page takes to load.
• Functional cookies: Saving your preferences such as interface language, display settings and game choices to make return visits more convenient.
• Analytics cookies: Used to understand aggregate usage patterns for product improvement purposes. This data is not linked to the identity of individual members.

You can manage cookie settings through your web browser preferences. Please note, however, that disabling certain cookies may affect the functionality of some AuraHoki platform features.

As an AuraHoki member, you have the following rights regarding your personal data:

• Right of access: You may request a copy of all personal data AuraHoki holds about you at any time.
• Right to rectification: If any data we hold about you is inaccurate or outdated, you have the right to request an immediate correction.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data in certain circumstances — for example, if you close your AuraHoki account and there is no legal obligation requiring us to retain that data.
• Right to restrict processing: In certain circumstances, you may request that AuraHoki restrict how we process your data while an issue or complaint is being resolved.
• Right to object: You may object to the processing of your data for direct marketing purposes at any time, and AuraHoki will honour that request immediately.
• Right to data portability: You have the right to receive your personal data in a machine-readable format for the purpose of transferring it to another platform.

AuraHoki retains members' personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. Retention periods vary depending on the type of data:

• Active account data: Retained for the duration your account remains active with AuraHoki. Upon account closure, basic account data will be retained for the period required by applicable law.
• Financial transaction records: Retained for a minimum of 7 years to comply with Malaysia's anti-money laundering (AML) legal requirements and applicable financial regulations.
• Security and access logs: Retained for 12 months to enable security incident investigations if required.
• Customer support communication records: Retained for 2 years after the last interaction for reference in the event any follow-up is required.
• Marketing data (with consent): Retained until you withdraw consent or close your account, whichever comes first.

Once the retention period has ended, your data will be securely deleted or permanently anonymised using methods that ensure it cannot be recovered or re-linked to your identity.

The AuraHoki platform is strictly restricted to individuals aged 18 and above. AuraHoki does not knowingly collect personal data from children or anyone under the age of 18.

If AuraHoki discovers that personal data belonging to someone under 18 years of age has been collected through a fraudulent registration, that data will be deleted immediately and the account will be closed. If you believe a minor has registered an AuraHoki account without authorisation, please contact us at support@aurahoki.best and we will take immediate action.

AuraHoki reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or changes to the services we offer. When a material amendment occurs, AuraHoki will:

• Updating the "Last updated" date at the top of this document.
• Sending email notices to all active members to inform them of important changes.
• Displaying a prominent notice within the AuraHoki platform for a reasonable period after an amendment takes effect.

Continued use of the AuraHoki platform after any amendments to this Privacy Policy take effect will be considered your acceptance of the updated terms. If you do not agree with the amendments, you have the right to close your AuraHoki account in accordance with the procedures set out in the Terms & Conditions.

For any enquiries, complaints, or requests related to this Privacy Policy or your personal data at AuraHoki, please contact us via:

• Email: support@aurahoki.best
• Live Chat: Available on the AuraHoki platform, 24 hours a day, 7 days a week
• Response time: Under 24 hours for most privacy inquiries