h2m Official Documents

H2m Privacy Policy – Your Personal Data Protection

H2m takes the privacy of every Malaysian member seriously. This policy clearly explains what data we collect, why we need it, how we store it securely, and your rights as a user of our platform.

PDPA 2010 Compliant SSL 256-bit Encryption No Third-Party Data Sales
256
SSL Encryption Bits
0
Data Sold to Third Parties
PDPA
MY Legal Compliance
24/7
Security Monitoring

H2m's Six Data Protection Principles

Before reading the full policy, the six core principles below summarise h2m's approach to privacy and personal data protection for every Malaysian member.

Minimal Data Collection

H2m collects only the information strictly necessary to manage your account, process transactions, and meet legal requirements. No excess data is gathered purely for marketing or analytics unrelated to your use of h2m.

Bank-Grade Encryption

All personal data and financial information transmitted between your device and h2m's servers is protected by 256-bit SSL encryption — the same standard used by Maybank, CIMB, and Malaysia's leading financial institutions. Data stored in h2m's databases is also encrypted separately for an additional layer of protection.

No Sale of Data to Third Parties

H2m has never sold, rented, or exchanged members' personal data to any third party for their own marketing purposes, and never will. Your information belongs to you, and we treat it with the utmost respect. Any data sharing required by law will be clearly stated in this policy.

Compliant with Malaysia's PDPA 2010

H2m's Privacy Policy is built on the foundation of Malaysia's Personal Data Protection Act 2010 (PDPA) — the primary legislation governing how organisations in Malaysia collect and use personal data. Full compliance with the PDPA is both a legal obligation and h2m's ethical commitment to every member.

Your Data, Your Control

Every h2m member has the right to access their personal data, request correction of inaccurate information, apply for data deletion under certain circumstances, and object to the use of their data for specific purposes. Exercising these rights is straightforward and can be done through h2m's customer support.

Full Transparency on Data Use

H2m is committed to being fully transparent about how member data is used. This Privacy Policy is written in plain, easy-to-understand language — not confusing legal jargon — so every Malaysian member can clearly understand what happens to their personal information.

Last Updated: 1 January 2026

Important Note: This Privacy Policy applies to all members and users of the h2m platform in Malaysia. By registering for or using h2m's services, you confirm that you have read and understood this policy. If you have any questions about how h2m handles your personal data, please do not hesitate to reach out to us at support@h2m.wine.

1

Introduction & Scope of h2m's Privacy Policy

H2m is an online betting platform built exclusively for users in Malaysia. We understand that member trust is the foundation of everything we do — and that trust begins with how we handle the personal information entrusted to us.

This Privacy Policy explains in detail how h2m collects, uses, stores, protects, and in certain circumstances shares the personal data of its members. This Policy applies to all information collected through:

  • H2m's official website at the h2m.wine domain and all associated subdomains.
  • Member registration and account management process.
  • Gaming and betting activity on the h2m platform, including Live Casino, Blackjack, lottery, virtual sports, and Sports Betting.
  • Deposit and withdrawal transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
  • Interactions with the h2m customer support team via live chat or email.
  • Use of any official h2m mobile application that may be released from time to time.

H2m operates in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and all related regulations in force. As a data controller, h2m is fully responsible for ensuring that members' personal data is processed lawfully, fairly, and transparently.

Interpretation of This Policy: In this document, "we" or "h2m" refers to the entity operating the h2m.wine platform. "You" or "member" refers to any individual who registers for or uses the h2m platform. "Personal data" refers to any information that can be used to identify you, directly or indirectly.

2

Personal Data Collected by h2m

H2m collects members' personal data through several means — some is provided directly by you when registering or using the platform, while some is collected automatically as you use h2m's services.

Data Category Type of Information How It Is Collected
Identity Full name, Malaysian identity card number, date of birth, gender Registration form
Contact Email address, Malaysian phone number, residential address Registration form
Financial E-wallet account number, bank name, deposit and withdrawal records in MYR Transaction processing
Platform Activity Gaming history, betting records, login logs, active session duration Automatically during use
Technical IP address, device type, browser version, operating system, screen resolution Automatically during use
Communications Live chat records, support emails, submitted complaints Support interactions
Verification Copy of identity card or passport (for KYC) Identity verification request

H2m does not collect sensitive information such as biometric data, medical records, political views, or religious beliefs. Only the minimum data necessary to operate h2m's services safely and responsibly is collected.

3

How h2m Uses Your Personal Data

H2m uses members' personal data strictly for the following purposes. Each purpose has a clear legal basis under PDPA 2010:

  • Account Management: Creating and maintaining member accounts, verifying identity, processing logins, and managing account settings such as deposit limits and responsible gaming preferences.
  • Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or FPX, and handling withdrawal requests to accounts registered in the member's name.
  • Service Delivery: Grants access to all h2m games and services, including live casino, blackjack, lottery, virtual sports, EPL and Malaysia Super League football betting, badminton, and e-sports.
  • Platform Security: Detecting and preventing fraud, unauthorised access, multiple account registrations, and any activity that violates h2m's Terms & Conditions.
  • Responsible Gaming: Monitoring gaming patterns to identify members who may need support, enforcing member-set limits, and meeting regulatory requirements related to consumer protection.
  • Service Communications: Sending important notifications regarding accounts, transactions, changes to terms, or security matters that require a member's attention.
  • Platform Enhancement: Analysing aggregated, anonymised usage data to understand how the platform is used and to make technical and user experience improvements.
  • Legal Compliance: Fulfilling legal obligations, including requirements under the PDPA 2010, anti-money laundering (AML) laws, and directives from relevant authorities.

Marketing: h2m may send information about the latest promotions and bonuses to members who have consented to receive marketing communications. You can opt out of marketing emails at any time by clicking the "Unsubscribe" link in any promotional email, or by updating your communication preferences in your h2m account settings.

4

Legal Basis for Data Processing

Under Malaysia's PDPA 2010, h2m processes members' personal data on valid legal bases. The following outlines the basis applied to each processing category:

  • Contract Performance: Processing required to manage member accounts, handle deposit and withdrawal transactions, and deliver the gaming services requested by members.
  • Legal Obligation: Processing required to comply with PDPA 2010, AML legislation, identity verification (KYC) requirements, and any other legal obligations applicable to h2m.
  • Legitimate Interests: Processing necessary for platform security, fraud prevention, service improvement, and responsible gambling monitoring — where h2m's interests and the protection of other members outweigh the individual privacy interests concerned.
  • Consent: Processing for marketing communications and advanced analytics — where you have given explicit consent, which you may withdraw at any time.

Should h2m need to process your data for a new purpose that differs from the original purpose communicated to you, h2m will notify you in advance and, where required, seek your fresh consent before such processing begins.

5

Personal Data Sharing

H2m does not sell, rent, or disclose members' personal data to third parties without authorisation, except in the limited situations set out below. All data sharing is subject to strict data protection agreements.

Parties that may receive members' personal data under limited and specific circumstances:

  • Payment Service Providers: Required transaction information is shared with approved payment providers such as TNG Digital (Touch 'n Go eWallet), Grab Financial, Boost, ShopeePay, DuitNow, and FPX-participating banks — solely to process your deposits and withdrawals.
  • Game Providers: The minimum data required to deliver live casino games, virtual sports, or other game categories is shared with approved game content providers who are bound by strict confidentiality agreements.
  • Relevant Authorities: h2m is legally required to disclose information to authorities including the Royal Malaysia Police, the Companies Commission of Malaysia, or other regulatory bodies when lawfully ordered to do so through proper legal procedures.
  • Professional Consultants: External lawyers, accountants, or auditors providing professional services to h2m who are bound by their professional confidentiality obligations.

H2m does not share members' personal data with advertising companies, social media platforms, data brokers, or any third party for external marketing purposes. Usage data shared with analytics providers is in aggregated form and does not identify any individual.

6

Data Security at h2m

H2m continually invests in security infrastructure to protect members' personal data from unauthorised access, loss, misuse, or accidental disclosure. The technical and organisational security measures we practise include:

  • Data Encryption in Transit: All communications between your device and h2m's servers are protected by TLS 1.3 with automatically renewed 256-bit SSL certificates. This ensures your login credentials, transaction data, and account details cannot be intercepted in transit.
  • Encryption of Stored Data: Sensitive data stored in h2m's databases, including financial information and identity verification documents, is encrypted using AES-256 standards prior to storage.
  • Strict Access Control: Only h2m staff with a clear business need and who have undergone rigorous background checks are permitted to access members' personal data. Access is granted strictly on a need-to-know basis.
  • Two-Factor Authentication: h2m's internal systems require multi-factor authentication for all staff access to systems containing members' personal data.
  • 24/7 Monitoring: The security monitoring system operates 24 hours a day, 7 days a week to detect suspicious activity, unauthorized access attempts, and any anomalies in data usage patterns.
  • Regular Security Audits: h2m conducts regular penetration testing and security audits by qualified third parties to identify and address any potential vulnerabilities.

While h2m takes all reasonable steps to protect your personal data, no security system is 100% foolproof. In the unlikely event of a data breach affecting members' rights and freedoms, h2m will comply with the notification obligations set out under PDPA 2010 and inform affected members within a reasonable timeframe.

7

Data Retention Period

H2m retains members' personal data only for as long as necessary for the purposes it was collected, or as required by applicable Malaysian law. The general retention schedule is as follows:

  • Active Account Data: For the duration the account remains active and for 5 years after account closure — to meet audit and legal compliance requirements.
  • Financial Transaction Records: A minimum of 7 years from the transaction date, in line with Malaysia's tax and accounting legal requirements as well as AML obligations.
  • Identity Verification Documents (KYC): For the same period as the associated account record — a minimum of 5 years after account closure.
  • Platform Activity Log: 2 years from the date of the activity, retained for security purposes and dispute resolution.
  • Support Communication Records: 3 years from the date of communication, for reference in the event of any service-related disputes.

Once the applicable retention period expires, h2m will securely delete or anonymise the data using methods that comply with industry standards for data destruction. Anonymised data — where all identifying information has been irreversibly removed — may be retained for longer periods for aggregate analytics purposes.

8

Your Rights as an h2m Member

Under Malaysia's PDPA 2010, you have the following rights regarding your personal data held by h2m:

Right of Access

You have the right to request a copy of the personal data h2m holds about you. Requests will be processed within 21 business days. A small administrative fee may apply for frequent requests.

Right to Rectification

If you find that personal data held by h2m is inaccurate or incomplete, you have the right to request a correction. Corrections will be carried out within 14 business days of verification.

Right to Erasure

In certain circumstances, you may request the deletion of your personal data. This right is not absolute — h2m may need to retain certain data to fulfil legal obligations that cannot be overridden.

Right to Object

You may object to the processing of your data for direct marketing purposes at any time. For other types of processing based on legitimate interests, you may object if you have compelling grounds relating to your particular situation.

Right to Data Portability

You have the right to receive the personal data you have provided to h2m in a structured, machine-readable format, and to transfer it to another data controller under certain circumstances.

Withdrawal of Consent

Where data processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to the withdrawal.

To exercise any of the rights above, please contact the h2m support team by email at support@h2m.wine by stating the right you wish to exercise and providing sufficient information to verify your identity. h2m will process your request within the timeframe prescribed under PDPA 2010.

9

Cookies, Logs & Tracking Technologies

H2m uses cookies and similar tracking technologies to enhance the platform experience, maintain session security, and understand how the platform is used. The types of cookies used are as follows:

  • Essential Cookies: Required for core platform functions such as login verification, session management, and security. These cookies cannot be disabled as the platform cannot function properly without them.
  • Performance Cookies: Collecting information on how members use the platform — pages visited, time spent, and any errors encountered — to help h2m improve the user experience. Data collected is aggregated and does not identify individuals.
  • Functional Cookies: Saving your preferences — such as selected language, display settings, and notification preferences — so you do not have to reconfigure them each time you log in.
  • Security Cookies: Used to detect suspicious activity, prevent unauthorized access, and protect your account from security threats such as CSRF attacks.

You can manage your cookie preferences through your web browser. However, disabling essential cookies may affect the functionality of the h2m platform. h2m does not use third-party cookies for targeted advertising or cross-site tracking.

10

Child Protection

H2m does not target and does not accept registrations from individuals under the age of 18. The h2m platform, including all live casino games, lottery, virtual sports, and Sports Betting, is strictly for adults.

H2m does not knowingly collect personal data from minors. If h2m becomes aware or has reason to believe that personal data of a child under 18 has been collected without valid parental or guardian consent, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe your child under the age of 18 has registered an h2m account, please contact us immediately at support@h2m.wine with the relevant information. We will respond within 24 hours and take immediate action to resolve the issue.

11

Privacy Policy Amendments

H2m may update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or changes in the technologies we use. Any material amendments will be communicated to members through:

  • An email notification to your registered email address, at least 14 days before the amendments take effect.
  • A notice displayed prominently on the main page of the h2m platform.
  • Updates take effect on the "Last Updated" date shown at the top of this page.

Continued use of the h2m platform after the effective date of any amendment constitutes acceptance of the updated policy. If you do not agree with the changes made, you have the right to close your account in accordance with the procedures set out in h2m's Terms & Conditions. The latest version of this Privacy Policy is always available on the h2m.wine/privacy-policy.

12

Contact h2m's Privacy Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or how h2m handles your personal data, please reach out to us via:

  • Privacy Email: support@h2m.wine — please use "Privacy Inquiry" as your email subject to ensure it reaches the right team promptly.
  • Live Chat: Available on the h2m platform 24 hours a day, 7 days a week — our Bahasa Malaysia-speaking support team is ready to help.

H2m is committed to responding to all privacy enquiries within 14 working days. For complaints involving rights under PDPA 2010 that h2m is unable to resolve to your satisfaction, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia through their official channels.

PDPA Compliance: h2m is fully committed to Malaysia's PDPA 2010 and all regulations issued under it. We regard member privacy not merely as a legal obligation, but as an ethical responsibility that informs every business decision involving personal data. Your trust is the most valuable asset entrusted to h2m.

Questions About h2m's Privacy Policy

h2m only shares the necessary transaction information with approved payment service providers — such as TNG Digital for Touch 'n Go eWallet, Grab Financial for GrabPay, and FPX-participating banks like Maybank and CIMB — solely for the purpose of processing your deposits and withdrawals. This information is not shared with any other party except as required by law, as stated in this Privacy Policy. h2m does not disclose your winnings, betting records, or any gaming activity information to anyone without your consent, unless directed by the relevant authorities through valid legal proceedings.

You have the right to request deletion of your personal data, but this right is not absolute. h2m may need to retain certain data even after account closure to comply with Malaysian legal obligations — including financial transaction records that must be kept for a minimum of 7 years for tax and AML compliance purposes, and account records for a minimum of 5 years for audit and regulatory requirements. Data eligible for deletion is limited to that which is not subject to any legal retention obligation. Contact support@h2m.wine to submit a deletion request, and we will clearly advise which data can be deleted and which must be retained, along with the reasons.

When you make a deposit using Touch 'n Go eWallet, GrabPay, Boost, or ShopeePay, the payment process takes place over an encrypted connection between the h2m platform and the respective e-wallet provider. h2m does not store your full e-wallet account details — we only receive payment confirmation and the information required to record the transaction. Your e-wallet details remain protected under each provider's own privacy policy. All communication between h2m and e-wallet providers is conducted via industry-standard security protocols with SSL 256-bit encryption, ensuring no sensitive information can be intercepted.

In the event of a data breach affecting members' rights and freedoms, h2m has a comprehensive incident response procedure in place. Within 72 hours of confirming a breach, h2m will report the incident to the relevant authorities in accordance with PDPA 2010 requirements. For members whose data may have been affected, h2m will send a direct notification to your registered email address within a reasonable timeframe, describing the nature of the breach, the data involved, the steps h2m has taken, and the measures you can take to protect yourself. h2m will also take immediate action to contain the breach, investigate the cause, and prevent recurrence.

No. h2m does not use your gaming activity data or betting history to sell targeted advertising to third parties. Your gaming activity data is used solely for internal purposes — such as managing your account, processing winnings, monitoring responsible gambling, and improving platform services. If h2m sends you marketing communications about promotions or bonuses, this is based on the consent you provided at registration, and you may unsubscribe at any time. h2m does not share your usage profile with any third-party advertising networks or social media platforms.

Your Data is Safe at h2m. Join Us Today.

Over 500,000 Malaysian players have trusted h2m as their go-to betting platform. Privacy and data security are our top priorities — play with complete peace of mind.

SSL 256-bit Encryption PDPA 2010 Compliant No Data Sales 24/7 Privacy Support
Bahasa Melayu