Privacy Policy ffa4u — Data Protection & Information Security

Ffa4u collects your personal information solely to provide the best service, ensure the security of your account, and comply with applicable legal requirements. We only collect data that is strictly necessary — nothing more.

When you register an account or use the ffa4u platform, we may collect several categories of information depending on your activity on the platform.

Every piece of data we collect is used for a clear and legitimate purpose. ffa4u does not use your data for purposes beyond the scope stated in this Privacy Policy without first obtaining your explicit consent.

• Processing your account registration, deposits and withdrawals securely and accurately.
• Verifying your identity as part of the KYC process required by international standards.
• Detecting and preventing fraudulent activity, money laundering and unauthorized access to your account.
• Complying with legal obligations and applicable regulatory requirements.
• Sending you important notifications related to your account, transactions and policy updates.
• Enhancing user experience by analyzing usage patterns in aggregate and anonymized form.
• Providing responsive and effective customer support whenever you need assistance.
• Sending you relevant promotional offers — you may opt out of marketing communications at any time.

Ffa4u does not sell, lease, or trade your personal data to any third party for commercial purposes. However, there are limited situations where data sharing may be necessary in the interest of security and legal compliance.

• Payment Service Providers: Transaction information is shared with registered payment gateways such as DuitNow and FPX solely to process your deposits and withdrawals.
• Regulatory Authority: ffa4u fully complies with lawful requests from authorities and regulatory bodies in accordance with applicable laws.
• Identity Verification Services: Identity verification data is shared with accredited KYC service providers for verification purposes only.
• Cybersecurity Services: Technical data such as IP addresses may be processed by our fraud detection systems to protect the accounts of all members.

Ffa4u continuously invests in cybersecurity infrastructure to ensure your personal data is always protected at the highest level. Our security approach is multi-layered — spanning the network layer all the way through to the application and database layers.

Our security system is designed to detect, prevent and respond to cyber threats in real time. The ffa4u technical security team monitors the platform around the clock, 24 hours a day, 7 days a week.

• Encryption of data at rest and in transit using AES-256 and TLS 1.3 algorithms.
• Web application firewall (WAF) continuously updated to defend against the latest threats.
• Periodic penetration testing by independent third parties to identify system vulnerabilities.
• Tested incident response procedures to ensure rapid recovery in the event of a data breach.
• Role-based access control (RBAC) ensuring only authorised personnel can access sensitive data.
• Encrypted data backups stored at secure offsite locations for disaster recovery.

Ffa4u uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help us recognise you on return visits and tailor content to your preferences.

You can manage or delete cookies through your browser settings at any time. However, deleting essential cookies may affect your login functionality and account security. ffa4u does not use third-party cookies for advertising or cross-site tracking purposes.

As a ffa4u member, you have full rights over your personal data. ffa4u respects and facilitates the exercise of all these rights — we believe that control over personal data is a fundamental right of every individual.

Ffa4u retains your personal data for as long as your account is active and for any additional period required by law or legitimate business needs. We do not retain data longer than necessary.

• Active account data: Retained for the duration your account is active plus 5 years after account closure, in compliance with international financial legal requirements.
• Financial transaction records: Retained for a minimum of 7 years in line with international anti-money laundering (AML) standards.
• Security and access log: Retained for 12 months for security incident investigation and fraud detection purposes.
• Support communication data: Retained for 2 years for quality control and service history reference purposes.
• Marketing data: Retained until you unsubscribe from marketing communications or close your account.

Upon expiry of the relevant retention period, your data will be permanently deleted or safely anonymized so it can no longer be linked to your identity. ffa4u conducts regular reviews to ensure outdated data is deleted on the scheduled timeline.

Ffa4u may update this Privacy Policy from time to time in line with changes to legislation, technology, or our business practices. Any material changes will be communicated to you via an in-platform notification or your registered email at least 14 days before the changes take effect.

The latest version of this Privacy Policy is always available on this page with a clear update date. We encourage you to review this page periodically so you are always informed of how we protect your information.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the ffa4u data protection team is ready to assist you at any time.

We take every privacy complaint seriously and are committed to resolving each issue transparently, fairly, and in a timely manner. Our team, well-versed in data protection regulations, will handle your request with the highest priority.

• Typical response time: within 48 business hours for general enquiries.
• Data access rights requests: processed within 7 business days of receipt.
• Security incidents involving your data: you will be notified within 72 hours of detection.
• Available service languages: Malay and English.