Privacy Policy — 12malay

1. Introduction

This Privacy Policy ("Policy") is published by 12malay ("the Company", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://12malay.cam. It governs the collection, processing, storage, and disclosure of personal data submitted by or collected about individuals who visit, register on, or otherwise interact with the 12malay platform ("Members", "Users", "you").

12malay is committed to handling personal data responsibly and in accordance with applicable data protection legislation. Our platform is designed primarily for Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions throughout Malaysia. We take our obligations regarding Member privacy seriously and have implemented technical and organisational measures to protect data at every stage.

This Policy must be read alongside our Terms & Conditions, which governs the overall legal relationship between you and 12malay. Together, these documents form the complete framework for your rights and our obligations with respect to your membership and data.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, 12malay.
• "Data Processor" means a third party that processes personal data on behalf of 12malay under a contractual obligation.
• "Cookies" means small text files placed on your device by a website to store information about your session and preferences.
• "KYC" (Know Your Customer) means the identity verification process required by 12malay and applicable regulatory frameworks.
• "Sensitive Data" means a subset of personal data that warrants heightened protection, including financial details, identity documents, and account credentials.

3. Data Controller

12malay is the Data Controller for all personal data collected through the https://12malay.cam platform. As Data Controller, 12malay is responsible for determining why and how your personal data is processed. All data protection inquiries, access requests, and complaints should be directed to our support team using the contact details set out in Section 16 of this Policy.

4. Personal Data We Collect

12malay collects the following categories of personal data from Members and visitors, depending on the nature of their interaction with our platform:

4.1 Registration & Account Data

• Full legal name (as per NRIC/passport)
• Date of birth (to verify 21+ age eligibility)
• Email address
• Mobile phone number
• Residential address
• Username and encrypted password
• Preferred language and currency (MYR)

4.2 Identity Verification (KYC) Data

• Scanned copy or photograph of Malaysian NRIC (MyKad) or passport
• Proof of address documentation (e.g., utility bill, bank statement)
• Selfie or video verification image (where applicable)
• Proof of payment method ownership (e.g., screenshot of Touch 'n Go eWallet, Maybank, or CIMB account registered to the Member's name)

4.3 Financial & Transaction Data

• Deposit and withdrawal transaction records
• Payment method details (e.g., e-wallet phone number, bank account last 4 digits)
• Transaction amounts, timestamps, and reference numbers
• Wagering and game activity history
• Bonus and promotional credit records

4.4 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session logs, page visit records, and click-stream data
• Login timestamps and frequency of access
• Game session data and betting patterns

4.5 Communication Data

• Live chat transcripts with support agents
• Email correspondence with the 12malay team
• Feedback, complaints, and dispute records

5. How We Collect Personal Data

12malay collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact support, or update account settings.
• Automatically via the platform — through cookies, session tracking, and server logs that record technical data when you browse or interact with the website.
• From payment processors — when you conduct transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or USDT TRC20, relevant transaction confirmation data is shared with us by the respective payment provider.
• From third-party identity verification providers — where applicable, KYC verification may be processed through a licensed third-party identity verification service that shares results with 12malay.

6. How We Use Your Data

12malay processes personal data for the following specific purposes. We do not use personal data for purposes beyond those listed below without first obtaining your explicit consent or having a valid legal basis to do so.

Purpose	Data Used
Account registration and management	Registration data, identity documents
Identity verification (KYC)	NRIC/passport, selfie, proof of address
Processing deposits and withdrawals	Financial data, payment method details
Anti-money laundering (AML) compliance	Transaction data, identity documents, IP address
Platform security and fraud prevention	IP address, device data, login logs
Responsible gambling monitoring	Betting patterns, session duration, deposit frequency
Customer support and dispute resolution	Communication data, account history
Regulatory compliance and audit	All categories as required
Service improvement and analytics	Anonymised usage data, technical data
Promotional communications (with consent)	Email address, preferences

12malay does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Personal data is only shared as described in Section 8 of this Policy.

7. Legal Basis for Processing

12malay processes personal data on the following legal grounds:

• Contractual necessity — processing is required to fulfil the membership agreement between you and 12malay, including account management, payment processing, and game access.
• Legal obligation — processing is necessary to comply with applicable regulatory requirements, including KYC, AML, and responsible gambling obligations mandated by our licensing authority.
• Legitimate interests — processing is necessary for the purposes of fraud prevention, platform security, and improvement of services, where these interests are not overridden by your rights and freedoms.
• Consent — where we send optional marketing communications or process data beyond the above grounds, we obtain your explicit prior consent, which you may withdraw at any time.

8. Data Sharing & Third Parties

12malay may share your personal data with the following categories of third parties, strictly as necessary and subject to confidentiality obligations:

• Payment processors and financial institutions — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network providers — to facilitate deposits and withdrawals.
• KYC and identity verification providers — licensed third-party services contracted to assist with identity document verification and age confirmation.
• IT infrastructure and hosting providers — cloud and server providers that host the 12malay platform under strict data processing agreements.
• Game studios and content providers — limited technical data (e.g., session tokens) may be passed to integrated game providers solely for the purpose of delivering game sessions.
• Regulatory authorities and law enforcement — where we are legally required to disclose data in response to a valid legal order, court order, or regulatory request.
• Fraud prevention services — where data is shared with specialist providers to detect and prevent fraud, money laundering, and account abuse.

9. Data Retention

12malay retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and operational requirements. General retention periods are as follows:

• Active accounts — personal data is retained for the duration of the membership relationship.
• Closed accounts — following account closure, records are retained for a minimum of five (5) years in accordance with AML and financial services regulatory requirements.
• KYC documents — retained for a minimum of five (5) years from the date of submission or account closure, whichever is later.
• Transaction records — retained for a minimum of five (5) years following each transaction.
• Support and communication records — retained for a minimum of two (2) years from the date of last communication.
• Technical and usage data — typically retained for up to twelve (12) months, unless required for ongoing investigations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the individual.

10. Cookies & Tracking Technologies

The 12malay platform uses cookies and similar tracking technologies to operate the website, remember your preferences, and improve the overall user experience. The following categories of cookies are used:

10.1 Essential Cookies

These cookies are strictly necessary for the website to function. They enable core features such as session management, login authentication, and security controls. Essential cookies cannot be disabled without significantly affecting platform functionality.

10.2 Functional Cookies

Functional cookies remember your preferences — such as language settings and display preferences — to provide a more personalised experience on return visits.

10.3 Analytics Cookies

Analytics cookies collect anonymised information about how visitors interact with the platform — such as pages visited, time on site, and navigation paths. This data is used to improve platform performance and user experience. Analytics data is aggregated and does not identify individual users.

10.4 Managing Cookies

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the 12malay platform, including your ability to log in or complete transactions. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

11. Your Rights

Subject to applicable law, you have the following rights with respect to your personal data held by 12malay:

• Right of Access — you may request a copy of the personal data 12malay holds about you. We will respond to verified access requests within 30 calendar days.
• Right to Rectification — if your personal data is inaccurate or incomplete, you may request that we correct it. You may also update basic account information directly through your account settings.
• Right to Erasure ("Right to be Forgotten") — you may request deletion of your personal data. This right is subject to our overriding legal obligations — we are required to retain certain data for regulatory compliance and cannot delete it before the mandatory retention period expires.
• Right to Restriction of Processing — in certain circumstances, you may request that we restrict how we process your data while a dispute or review is in progress.
• Right to Data Portability — you may request that we provide your personal data in a structured, commonly used machine-readable format.
• Right to Object — you may object to processing based on legitimate interests, including profiling for direct marketing. Where you object to marketing, we will cease such communications immediately.
• Right to Withdraw Consent — where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our support team at [email protected] with the subject line "Data Privacy Request". We may require you to verify your identity before processing your request. We do not charge a fee for handling data rights requests.

12. Data Security

12malay implements robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encrypted storage of all sensitive personal data and financial records at rest.
• Access controls ensuring that employee access to personal data is restricted on a strict need-to-know basis.
• Two-factor authentication (2FA) available for all Member accounts to prevent unauthorised access.
• Regular security audits and penetration testing of the platform infrastructure.
• Incident response procedures to detect, investigate, and report data breaches in accordance with applicable notification requirements.

While 12malay takes data security seriously and applies industry-standard protective measures, no online platform can guarantee absolute security against all threats. You are responsible for maintaining the confidentiality of your login credentials and notifying us immediately if you suspect any unauthorised access to your account.

13. Minors

The 12malay platform is strictly for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory part of our KYC process, and any account found to belong to an individual under 21 will be immediately closed with all data purged in accordance with applicable law.

If you have reason to believe that a minor has registered on the 12malay platform or has accessed it using your credentials, please contact our support team immediately at [email protected].

14. International Data Transfers

In the course of providing its Services, 12malay may transfer personal data to systems and servers located outside of Malaysia, including jurisdictions where our licensed technology partners, cloud infrastructure providers, and third-party processors are based. Where such transfers occur, 12malay ensures that appropriate safeguards are in place — including contractual protections binding the receiving party to data protection standards equivalent to those applied in Malaysia — before any transfer is made.

12malay does not transfer personal data to territories that do not offer an adequate level of data protection without first implementing the contractual safeguards described above.

15. Changes to This Privacy Policy

12malay reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, operational requirements, or applicable law. When material changes are made, we will notify registered Members via email or an in-platform notification at least 7 days before the changes take effect.

The "Last Revised" date at the top of this Policy will always reflect the most recent update. We encourage you to review this Policy periodically. Your continued use of the 12malay platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

16. Contact Us

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the 12malay data team through the following channels: