Privacy Policy

This Privacy Policy ("Policy") is published by Hengong ("Hengong", "we", "us", "our"), the operator of the online gaming platform accessible athttps://hengong.cam ("the Platform"). This Policy describes how we collect, use, store, share, and protect personal data relating to individuals who visit, register on, or otherwise interact with the Platform ("you", "your", "Player").

Hengong is committed to handling personal data responsibly and in accordance with applicable data protection laws, including the principles articulated under Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection standards. We recognise that privacy is a fundamental right and we have designed our data practices to respect that right at every stage of our relationship with our players.

By registering an account on the Platform, depositing funds, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you must cease using the Platform and contact us to close your account.

In this Policy, the following terms carry the meanings set out below:

Hengong collects the following categories of Personal Data from players, the scope of which varies depending on your level of interaction with the Platform:

3.1 Registration Data

• Full legal name
• Date of birth
• Email address
• Mobile phone number
• Residential address (including postcode, city, and country)
• Username and encrypted password
• Preferred currency (MYR)

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (e.g., Malaysian MyKad, Passport)
• Proof of address documentation (e.g., utility bill, bank statement)
• Proof of payment method (e.g., e-wallet account screenshot, bank account statement)
• Selfie or facial verification image where required for enhanced due diligence

3.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references
• Payment method identifiers (e.g., masked bank account numbers, e-wallet account IDs for Touch'n Go, Boost, GrabPay, DuitNow, Maybank, CIMB, Public Bank, Hong Leong)
• Cryptocurrency wallet addresses used for BTC or USDT transactions

3.4 Gaming Activity Data

• Game titles played, wagers placed, and outcomes
• Sports betting markets, selections, stake amounts, and results
• Session timestamps, duration, and frequency
• Bonus activations and wagering progress

3.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Cookie identifiers and session tokens
• Platform access logs and error reports

3.6 Communications Data

• Records of live chat interactions with our customer support team
• Email correspondence sent to or received from Hengong support
• Responses to surveys or feedback requests where participation is voluntary

Hengong collects Personal Data through the following methods:

• Direct provision: Information you provide directly when completing the account registration form, submitting KYC documents, making a deposit, contacting support, or responding to a promotional communication.
• Automated collection: Technical data collected automatically as you navigate the Platform, including via cookies, session tracking, and server-side access logs. See Section 8 for further detail on cookies.
• Third-party sources: Where permitted, Hengong may receive supplementary verification data from licensed identity verification service providers engaged to assist with KYC obligations.
• Payment processors: Transaction confirmation and status data shared by payment processors upon completion or failure of a deposit or withdrawal instruction.

Hengong processes your Personal Data one or more of the following legal bases, depending on the nature of the processing activity:

Hengong uses Personal Data collected from Players for the following purposes:

6.1 Account Management & Service Delivery

• Creating and maintaining your Player Account on the Platform.
• Processing deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, BTC, and USDT.
• Processing withdrawal requests and verifying bank account or e-wallet ownership.
• Activating and tracking bonus offers and wagering requirements.
• Providing live chat and email customer support.

6.2 Compliance & Fraud Prevention

• Verifying your identity and age (21+ requirement) through KYC procedures.
• Screening transactions for indicators of money laundering, fraud, or other prohibited conduct.
• Detecting and preventing multi-accounting, bonus abuse, and collusion.
• Reporting to relevant authorities where required by applicable law.

6.3 Responsible Gambling

• Monitoring gaming activity to identify indicators of problematic gambling behaviour.
• Enforcing deposit limits, loss limits, session reminders, and self-exclusion requests as activated by the Player.
• Processing self-exclusion enrolments and ensuring that excluded players cannot access the Platform.

6.4 Platform Improvement & Analytics

• Analysing aggregated, anonymised usage data to understand how Players interact with the Platform and to identify areas for improvement.
• Conducting internal research and testing of new features prior to release.

6.5 Marketing (Consent-Based Only)

• Sending promotional emails, bonus offer notifications, and platform update communications — only where you have explicitly opted in to receive such communications.
• Personalising promotional content based on your gaming preferences, where you have consented to this feature.

Hengong does not sell, rent, or trade your Personal Data. We share Personal Data only in the following circumstances and with the following categories of recipients, all of whom are bound by appropriate contractual data protection obligations:

• Payment Processors: Financial data is shared with licensed payment service providers (e.g., FPX operators, e-wallet platforms, bank partners, cryptocurrency settlement services) solely for the purpose of processing your deposit or withdrawal instruction.
• Identity Verification Providers: KYC documentation may be processed by third-party identity verification services engaged by Hengong to validate the authenticity of submitted documents.
• Game Studio Providers: Gaming activity data (game round results, session data) is exchanged with licensed third-party game studio providers to facilitate game functionality, dispute resolution, and RNG auditing.
• Regulatory Authorities: Hengong may disclose Personal Data to governmental, regulatory, or law enforcement authorities where required to do so by applicable law, court order, or lawful regulatory demand. We will notify affected Players of such disclosure where permitted by law.
• Professional Advisors: Legal, accounting, and compliance advisors who require access to certain data in the course of providing professional services to Hengong, subject to strict confidentiality obligations.

In all cases, data shared with third parties is limited to the minimum necessary for the stated purpose. Hengong maintains written data processing agreements with all third-party processors to ensure compliance with applicable data protection standards.

Hengong uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent access to the Platform. Disabling other cookie categories will not affect your ability to use core gaming features but may reduce personalisation.

Hengong retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, including for the duration of your Account's active status and for the periods required by applicable legal, regulatory, and compliance obligations.

Specific retention periods applicable to key data categories are as follows:

• Account registration and KYC data: Retained for a minimum of 5 years after Account closure, in accordance with anti-money-laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 7 years to satisfy financial record-keeping obligations.
• Gaming activity logs: Retained for a minimum of 3 years to support dispute resolution and game fairness auditing.
• Support communications: Retained for a minimum of 2 years after the relevant support case is closed.
• Marketing consent records: Retained for the duration of consent and for1 year after consent is withdrawn, as evidence of lawful processing.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be attributed to any individual.

Hengong implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data exchanged between your device and our servers is encrypted via TLS 1.3.
• Encryption at rest: Sensitive data stored on our servers — including KYC documents, financial records, and account credentials — is encrypted using AES-256.
• Access controls: Access to Personal Data is restricted on a need-to-know basis. Internal systems employ role-based access controls and multi-factor authentication for all staff access.
• Network security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and regular third-party penetration testing.
• Incident response: Hengong maintains a documented data breach response procedure. In the event of a security incident affecting your Personal Data, we will notify you and relevant authorities in accordance with applicable legal obligations.

Hengong's primary operations and data storage infrastructure are designed to serve the Malaysian market. However, some of the third-party service providers we use — including identity verification platforms and game studio providers — may process data on servers located outside of Malaysia.

Where Personal Data is transferred to countries that do not provide an equivalent level of data protection to that applicable in Malaysia, Hengong ensures that appropriate safeguards are in place, including:

• Standard contractual clauses in data processing agreements with third-party processors;
• Transfers to recipients in jurisdictions recognised as providing adequate data protection by applicable regulatory standards; or
• Other legally recognised transfer mechanisms appropriate to the circumstances.

For further information about the safeguards applicable to any specific international transfer of your Personal Data, please contact us at the address in Section 16.

Subject to applicable law, you hold the following rights in respect of your Personal Data processed by Hengong. To exercise any of these rights, please submit a written request to our support team (see Section 16):

Hengong will respond to all verifiable rights requests within 30 days of receipt. We may need to verify your identity before processing a request. In complex cases, we may extend the response period by a further 30 days and will notify you of any such extension.

The Hengong Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. Age verification is conducted as part of the account registration and KYC process.

If Hengong becomes aware that Personal Data has been collected from a person under the age of 21 — whether through an error in the registration process or circumvention of age verification controls — the relevant Account will be immediately suspended, all associated funds will be frozen pending investigation, and the Personal Data will be deleted once any legally required investigation process is complete.

If you have reason to believe that a minor has registered an account on the Platform, please contact our support team immediately at the address provided in Section 16. We take underage access extremely seriously and will act promptly on all credible reports.

The Hengong Platform incorporates games and content delivered by licensed third-party game studio providers. While Hengong maintains data processing agreements with these providers, your use of any game or feature powered by a third-party provider may involve the transfer of certain gameplay data directly to that provider's systems. This Policy does not govern the privacy practices of third-party providers beyond what is regulated by our data processing agreements.

Hengong does not embed links to external websites on the Platform beyond what is set out in our published navigation structure. Where any such links exist informational content, you access those links at your own risk and Hengong accepts no responsibility for the privacy practices of any third-party website.

Hengong reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the scope of our services. Material changes to this Policy will be communicated to registered Players by email (to the address registered on your Account) and/or by a prominent notice on the Platform, provided at least 14 days before the amended Policy takes effect.

Minor or non-material changes (such as formatting updates, clarifications that do not affect your rights, or corrections of typographical errors) may be made without prior notice. The "Last Updated" date at the top of this page will be revised to reflect any such change.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the amended Policy, you must cease using the Platform and request Account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy — including requests to exercise your data rights under Section 12 — please contact our Data Protection team through the following channel: