Privacy Policy Hana4D – How We Protecting Your Data Every Member, to the Highest Standard

1 Introduction and Scope

This Privacy Policy applies to all services operated by hana4d, including the website at hana4d.vu, mobile apps for Android and iOS, and all other official communication channels. This document comprehensively explains our data handling practices and applies to all users, whether registered members or visitors browsing without an account.

Hana4d acts as the data controller for all personal data collected through its services. We are responsible for ensuring that data is processed in accordance with applicable data protection principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

For any questions, concerns, or requests regarding your personal data, you can reach the hana4d support team via live chat available 24/7 from within the platform.

2 Personal Data We Collect

Hana4d collects data you provide directly, data generated through your use of the service, and in limited cases, data from trusted third-party sources. Here are the details:

We do not collect special category data such as health information, political affiliations, religious beliefs, or biometric data, unless explicitly required by applicable regulations and with your explicit consent.

3 How We Use Your Personal Data

Every use of data by hana4d has a specific and legitimate purpose. We do not process data for any undisclosed purpose without appropriate notice and consent.

• Create and manage member accounts, including the identity verification (KYC) process.
• Process financial transactions: deposits, withdrawals, and bonus payments.
• Provide gaming services and ensure the integrity of every game session.
• Detect, prevent, and investigate fraud, money laundering, and platform abuse.
• Comply with applicable legal and regulatory obligations, including reporting to competent authorities.
• Send essential service communications: transaction confirmations, policy updates, and security notifications.
• Improve service quality based on aggregated and anonymized usage pattern analysis.
• Operate responsible gaming programs, including monitoring for potentially problematic play patterns.
• Send promotional information and offers — only if you have given consent to receive marketing communications.

4 Legal Basis for Data Processing

Hana4d ensures every data processing activity has a valid legal basis. Depending on the type of processing and its context, we rely on one of the following legal bases:

• Contract performance: Processing required to deliver services under the agreement with members, including transaction processing and account management.
• Legal obligation: Processing required by applicable laws and regulations, including KYC/AML obligations and reporting to financial authorities.
• Legitimate interest: Processing for fraud prevention, platform security, and service improvement — provided it does not override members' fundamental rights.
• Consent: For marketing communications and other optional data processing not covered by the three bases above. Consent may be withdrawn at any time.

5 Data Sharing with Third Parties

Hana4d does not sell members' personal data. However, in the course of its operations, hana4d may share data with a limited number of third parties under the following conditions — always with adequate protection guarantees:

• Payment service providers: GoPay, OVO, DANA, ShopeePay, banks, and QRIS providers receive transaction data necessary to process payments. This data is not used by them for any other purpose.
• Third-party game providers: Minimal data required to initiate a game session. Game providers do not receive full identity information or financial data.
• Cloud infrastructure services: Hosting and CDN providers that store and distribute platform content, bound by strict data processing agreements.
• Identity verification agencies: For KYC purposes, identity data is verified through licensed third-party verification services.
• Legal authority: Hana4d is required to respond to valid data requests from law enforcement authorities or regulators pursuant to a court order or applicable legal obligation.

6 Data Security and Protection Infrastructure

Data security is a core investment for hana4d. We apply a multi-layered security approach covering technical, organizational, and operational aspects:

• TLS 1.3 encryption for all data communications in transit.
• AES-256 encryption for all sensitive data stored on servers.
• Two-factor authentication (2FA) for internal staff access to systems containing member data.
• Role-based access control: each staff member can only access data relevant to their role.
• 24/7 security monitoring by the Network Operations Center (NOC) team.
• Periodic penetration testing and security audits conducted by independent third parties.
• Documented incident response procedures, tested on a regular basis.
• Mandatory data security training for all hana4d staff who handle member data.

In the event of a data breach that could harm members, hana4d commits to notifying affected members within 72 hours of the breach being detected.

7 How Long Data Is Retained

Hana4d retains personal data only for as long as necessary for the purpose it was collected, or as required by applicable regulations. The following are our general data retention guidelines:

• Active account data: For the duration the account remains active, plus 5 years after account closure, for AML compliance purposes.
• Financial transaction data: 7 years from the transaction date, in accordance with financial regulatory requirements.
• KYC data and identity documents: A minimum of 5 years after the end of the business relationship.
• Access and security logs: 12 months for operational logs, 36 months for security logs related to investigations.
• Support communication history: 3 years from the last conversation.
• Cookie and analytics data: 13 months from the date of collection.

Once the retention period has passed, data is permanently deleted or fully anonymized so that it can no longer be linked to any specific identity.

8 Cookies and Tracking Technologies

Hana4d uses cookies and similar tracking technologies to keep the platform running smoothly, enhance the user experience, and understand how the service is used. We use three categories of cookies:

• Strictly necessary cookies: Used for core platform functions such as login session authentication, transaction security, and language preferences. Cannot be disabled without affecting basic service functionality.
• Performance and analytics cookies: Collect anonymous information about how visitors use the platform — which pages are most visited, where users encounter difficulties, and how quickly pages load. This data helps us improve service quality.
• Preference cookies: Save your display preferences and personal settings so you do not need to reconfigure them each time you access the platform.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect core platform functions, including the ability to stay logged in and complete transactions.

9 Member Rights over Personal Data

As the owner of your personal data, you hold the following rights, which you may exercise at any time:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of personal data — subject to data retention obligations under applicable law.
• Right to restriction of processing: Request that we restrict how we use your data under certain conditions.
• Right to data portability: Receive your personal data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest, including the sending of marketing communications.
• Right to withdraw consent: Withdraw consent previously given for specific processing at any time without penalty.

To exercise any of the above rights, contact the hana4d support team via live chat. All requests will be processed and resolved within 7 business days. If a request requires additional identity verification, we will reach out to you before proceeding.

10 Children's Data Protection

Hana4d's services are exclusively intended for individuals aged 18 and above. Hana4d does not knowingly collect or process personal data from anyone under the age of 18.

If we discover that data collected belongs to a minor, we will immediately delete that data, close the associated account, and return any balance to the legally verifiable responsible party.

11 Cross-Border Data Transfers

In operating globally, hana4d may need to transfer personal data to servers or service providers located in countries other than your country of residence. All such transfers are carried out with adequate safeguards in place:

• Transfers are made only to countries or service providers that meet an equivalent or higher standard of data protection.
• Standard contractual clauses are enforced with all service providers that receive data outside the originating jurisdiction.
• International security certifications such as ISO 27001 are a minimum requirement for cloud service providers handling hana4d member data.

12 Privacy Policy Updates

Hana4d may update this Privacy Policy from time to time to reflect changes in operational practices, regulatory requirements, or service improvements. The latest version is always available on this page with a clear update date.

For material changes — meaning changes that significantly affect members' privacy rights — we will notify you via in-app notification and email to your registered address at least 14 days before the changes take effect.

Continued use of hana4d services after the effective date of any update constitutes acceptance of the communicated changes. If you disagree with the changes, you have the right to close your account and withdraw your balance before they take effect.