12cuci Privacy Policy – Personal Data Protection for Malaysia's Platform Users

1Personal Data We Collect

12cuci collects several categories of personal information from users. Below is a full breakdown of the data collected, organised by how it is gathered:

Data You Provide Directly:

• Registration Information: Full name, identification card (IC) number, date of birth, an active Malaysian phone number, and email address upon registering a 12cuci account.
• Identity Verification Information: A copy of your identification card or other identity document when required for the Know Your Customer (KYC) process.
• Payment Information: Touch 'n Go eWallet account details, DuitNow phone numbers, FPX account numbers (Maybank2u, CIMB Clicks), GrabPay, Boost, or ShopeePay details used for deposits and withdrawals. We do not store full credit or debit card numbers.
• Support Communications: The content of conversations with our customer support team via live chat or email.

Automatically Collected Data:

• Log Data: Your IP address, web browser type, device operating system, pages visited, time and duration of visits, and referring page.
• Device Data: Device type (mobile or desktop), unique device identifier, and language settings.
• Gaming Activity Data: Betting history, games played, amounts wagered, wins and losses, and general gameplay patterns for security and fraud detection purposes.
• Cookie Data: Session information and preferences stored via cookies — explained in greater detail in Section 5.

2How We Use Your Personal Data

12cuci using your personal data for the following purposes, and only for these purposes:

• Account Management: Creating and maintaining your account, verifying your identity at login, and keeping your account secure.
• Transaction Processing: Processing deposits via Touch 'n Go, DuitNow, FPX, GrabPay, Boost, and ShopeePay, as well as processing withdrawal of winnings to your account.
• KYC & AML Compliance: To fulfil the Know Your Customer and Anti-Money Laundering requirements mandated by Malaysian financial regulations.
• Gaming Services Provision: Provides access to all games including football, cricket, Live Casino, poker, Virtual Sports, and Featured Games that you use.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical support in Bahasa Melayu.
• Security & Fraud Detection: Identifying and preventing fraud, bot usage, collusion, money laundering, and other illegal activities on the platform.
• Platform Improvements: Analysing usage patterns on an aggregated (not individual) basis to improve the interface, performance, and content of the 12cuci platform.
• Marketing Communications: Sending information about promotions, poker tournaments, football offers, and casino bonuses — only if you have consented to receive such communications.
• Responsible Gaming: Monitors gaming patterns to identify signs of problem gambling and offer appropriate support when needed.

3Disclosure of Data to Third Parties

12cuci does not sell or trade your personal data. However, in certain circumstances, we may need to share information with selected third parties:

• Payment Processors: Transaction information is shared with payment providers such as Touch 'n Go, DuitNow, and banks offering FPX services (Maybank, CIMB) solely for the purpose of processing your deposits and withdrawals. These providers maintain their own privacy policies and are subject to Malaysian financial regulations.
• Game Providers: Basic account information is shared with gaming software providers such as Evolution Gaming and Pragmatic Play to enable your access to Live Casino tables and other games. Only the minimum necessary information is shared.
• Legal Authorities: 12cuci complies with all lawful requests from Malaysian authorities including the police, courts, or financial regulatory bodies when required by law. We will not disclose your data beyond what is legally mandated.
• Cloud Services & Infrastructure: Data is stored on servers managed by carefully selected cloud service providers who have signed strict data protection agreements with 12cuci.

4Your Personal Data Security

12cuci implementing a range of technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse:

• Encryption in Transit: All communications between your browser and 12cuci's servers are encrypted using TLS 1.3 protocol with a 256-bit SSL certificate verified by DigiCert.
• Encryption at Rest: Sensitive data, including payment information and passwords, is stored in encrypted form using robust hashing algorithms. Your password is never stored in a readable format — not even by 12cuci staff.
• Access Control: Access to user data is restricted to 12cuci staff who require it to perform their duties, following the principle of least privilege.
• 24/7 Monitoring: Our security monitoring system operates around the clock to detect and respond to any unauthorised access attempts or suspicious activity.
• Regular Security Audits: Penetration testing and independent security audits are conducted regularly to identify and address any vulnerabilities.
• Two-Factor Authentication (2FA): Users are encouraged to enable 2FA on their 12cuci account as an additional layer of security.

While 12cuci takes all reasonable precautions, no security system can be guaranteed to be 100% foolproof. In the event of any material data breach affecting your information, we are committed to notifying you within the timeframe required by law.

5Cookies & Tracking Technologies

Platform 12cuci uses cookies and similar tracking technologies to enhance your experience. Below are the types of cookies we use:

You can manage your cookie settings through your web browser's preferences. However, disabling essential cookies may affect the functionality of the 12cuci platform. For guidance on managing cookies in common browsers (Chrome, Safari, Firefox), please refer to your browser's help documentation.

6Your Rights as a User

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold about you:

To exercise any of the rights above, contact us by email at support@12cuci.run with the subject line "Privacy Rights Request" and clearly state the right you wish to exercise along with your account number. We will respond within the timeframe required by law.

7Data Retention & Deletion

12cuci retaining your personal data only for as long as necessary for the purposes stated in this policy, or as required by Malaysian law:

• Active Account Data: Retained for as long as your account remains active on the 12cuci platform.
• Financial Transaction Data: Transaction records are retained for a minimum of 7 years from the date of the transaction, in line with Malaysian financial and tax legal requirements.
• KYC Data (Identity Verification): Retained for a minimum of 5 years after account closure, or longer if required by anti-money laundering legislation.
• Security Logs: Access logs and security activity are retained for 2 years for fraud detection and incident investigation purposes.
• Support Communication Data: Records of conversations with our support team are retained for 2 years to ensure continuity of service.
• Marketing Data: Data used for marketing communications is deleted promptly once you withdraw your consent.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to you personally. Our secure deletion process ensures that deleted data cannot be recovered.

8Privacy Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way 12cuci handling your personal data, please contact us through the following channels:

We take all privacy-related complaints seriously and are committed to resolving them fairly and transparently. Every complaint will be thoroughly investigated, and you will be kept informed of the progress and outcome.

If you are not satisfied with our response, you have the right to escalate your complaint to the Department of Personal Data Protection under Malaysia's Ministry of Communications and Digital.

9Changes to This Privacy Policy

12cuci reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new technologies, or updated legal requirements. When we make material changes:

• The "Updated" date at the top of this page will be revised to reflect the date of the latest update.
• We will send a notification to your registered email address regarding any significant changes.
• An in-platform notification will be displayed upon your first login after the changes take effect.
• For highly material changes, we may require your active re-consent before you can continue using the platform.

Continued use of the platform 12cuci after the changes take effect constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, please stop using the platform and contact us to close your account.

10Legal & Regulatory Compliance

12cuci operates in accordance with applicable data protection legal requirements, in particular:

• Personal Data Protection Act 2010 (PDPA) Malaysia: All our data processing practices comply with this Act, which governs the collection, processing, and use of personal data in commercial transactions in Malaysia.
• Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA): We comply with the KYC and AML requirements set out in this act, which obligates us to collect and retain user identity information.
• Bank Negara Malaysia Guidelines: Payment transactions are processed in accordance with guidelines set by Bank Negara Malaysia for online payment systems.

Compliance with this legislation is an absolute priority at 12cuci. In the event of any conflict between this Privacy Policy and mandatory legal requirements, the mandatory legal requirements shall prevail.