Privacy Policy 12cuci — Your Data, Our Responsibility

Welcome to the 12cuci Privacy Policy page. This document is a formal agreement between you as the user and 12cuci as the platform operator, governing how we manage your personal data. By using any part of the 12cuci platform — whether through the website, mobile app, or any other associated channel — you agree that your data will be processed in accordance with the terms set out in this policy.

This Privacy Policy applies to all users of the 12cuci platform, including unregistered visitors, registered members, and individuals who interact with us through customer support channels. The scope of this policy covers all categories of personal data we collect, whether directly from you or automatically through the technologies used in our platform.

12cuci reserves the right to update this Privacy Policy from time to time to reflect changes in laws, technology, and best business practices. The latest update date will always be displayed at the top of this page. We encourage you to review this policy periodically.

12cuci collects your personal data through various means depending on your interactions with our platform. The following are the main categories of data we collect:

Data you provide directly:

• Registration information: Full name, date of birth, email address, mobile number and encrypted password.
• KYC verification documents: A copy of your MyKad, passport, or other valid identification document for identity verification purposes.
• Financial information: Bank account number, bank name, and e-wallet details (Touch 'n Go eWallet, GrabPay) used for deposits and withdrawals.
• Communication information: Live chat conversation content, support emails and any feedback you submit to us.

Automatically collected data:

• Usage data: Pages visited, games played, session duration, login frequency and general usage patterns.
• Device data: Device type, operating system, browser version, screen resolution and unique device identifier.
• Network data: IP address, internet service provider (ISP), and approximate location data based on IP.
• Cookies and tracking technologies: Session data, preference cookies, and secure authentication tokens.

We only collect data that is strictly necessary for the stated purposes. Data minimisation is central to our privacy approach.

The personal data we collect is used solely for lawful, pre-defined purposes. 12cuci will not use your data for any unrelated purpose without first obtaining your consent.

• Account management: Securely create, verify and maintain your member account.
• Transaction processing: Process deposits, withdrawals and all financial activities within your account.
• Security and fraud prevention: Detect suspicious activity, prevent unauthorised access and protect platform integrity.
• Legal compliance: Fulfil KYC (Know Your Customer) and AML (Anti-Money Laundering) obligations as required by law.
• Customer support: Address inquiries, resolve disputes and provide technical assistance to members.
• Platform improvements: Analyse usage patterns to improve overall platform performance, design and user experience.
• Service communications: Send important notifications relating to your account, security, transactions and terms changes.
• Marketing (with consent): Deliver promotional information, bonuses and exclusive offers where you have given your consent.

12cuci does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, there are limited situations where data sharing is necessary for our platform to function properly and securely:

• Payment providers: Banking institutions, FPX providers and e-wallet platforms that process your financial transactions. They receive only the minimum data required to complete each transaction.
• Gaming service providers: Gaming software companies that provide casino, slot, and sports game content within the 12cuci platform. Data sharing is limited to session technical information only.
• Cloud service providers: Server infrastructure and data storage that keeps the platform running 24/7. All providers are bound by strict data processing agreements.
• Regulatory authorities: Government agencies, regulatory bodies, or law enforcement authorities when we are legally required to do so by law or a valid court order.
• Analytics service providers: Platform analytics tools that help us understand usage patterns. Shared data is in aggregated, non-personally identifiable form.

All third parties working with 12cuci are bound by strict data confidentiality agreements. They are prohibited from using your data for any purpose other than what is specified in their agreement with us.

12cuci uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored in your browser when you visit our website. They help us recognise you on return visits and tailor the platform display to your preferences.

Types of cookies we use:

• Session Cookies: Temporary cookies that are automatically deleted when you close your browser. Used to maintain your login during an active session.
• Persistent Cookies: Stored on your device for a set period. Helps us remember your language preferences, display settings, and login details (if you select "remember me").
• Security Cookies: Used to detect and prevent fraudulent activity and to ensure only you can access your account.
• Analytics Cookies: Collect information on how you use the platform to help us improve our services. This data is aggregated and non-personally identifiable.

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality of the 12cuci platform and your overall user experience.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold:

• Right of Access: You have the right to request a copy of the personal data we hold about you at any time.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate, incomplete, or outdated.
• Right to Erasure: In certain circumstances, you have the right to request that we delete your personal data from our systems.
• Right to Restriction of Processing: You have the right to request that we restrict how we process your data in certain circumstances.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the validity of processing carried out prior to withdrawal.

To exercise any of the rights above, please contact our customer support team via live chat or email at [email protected]. We will process your request within 7 working days and may require identity verification before fulfilling the request to ensure the security of your data.

12cuci retains your personal data only for as long as necessary for the purposes set out in this policy, or as required by applicable law. Retention periods vary by data type:

• Active account data: Retained for the duration of your active account and up to 7 years after account closure, in line with financial record requirements under Malaysian law.
• Financial transaction records: Retained for a minimum of 7 years in accordance with AML compliance and applicable tax law requirements.
• KYC documents: Retained for the duration of the active account period plus 5 years after account closure.
• Support communication logs: Retained for 3 years for reference and dispute resolution purposes.
• Analytics data: Anonymised data is retained for a maximum of 2 years.
• Session cookie data: Automatically deleted when the session ends or the browser is closed.

When data is no longer needed and there is no legal obligation to retain it, 12cuci will securely delete or anonymise that data using industry-recognised methods.

While 12cuci takes all reasonable steps to protect your data, no system can be guaranteed 100% secure against cyber threats. In the unlikely event of a data breach affecting your personal information, we have a clear and structured response procedure in place:

• Detection and Assessment (0–24 hours): Our security team will identify the scope and nature of the breach and assess the risk to the data involved.
• Immediate Containment (0–4 hours): Immediate containment measures are implemented to stop or limit further breach activity.
• Authority Notification (72 hours): We will notify the Personal Data Protection Department within 72 hours as required by PDPA if the breach is high-risk.
• Affected User Notification: Members whose data may be affected will be notified as soon as possible via email and in-account notifications, including information on the steps they need to take.
• Investigation and Recovery: A thorough investigation will be conducted and a full report prepared. Additional preventive measures will be implemented to prevent similar incidents from occurring.

We encourage you to report to us if you suspect any suspicious activity on your account or any potential security vulnerabilities you discover. Reports can be sent via email to [email protected] or directly through our platform's live chat.

If you have any questions, concerns or complaints about how 12cuci handles your personal data, our team is ready to help. Here are the channels available to you:

• 24/7 Live Chat: The fastest channel — our team will respond in under 2 minutes.
• Privacy Email: [email protected] — for detailed written enquiries regarding your personal data.
• Processing Time: All privacy and data requests are processed within 7 business days.

If you are not satisfied with our response, you have the right to file a complaint with the Malaysian Personal Data Protection Department or the relevant regulatory body in your jurisdiction.