Privacy Policy cuci2 — Personal Data Protection for Malaysian Players

cuci2 (hereinafter referred to as "we", "Platform" or "cuci2") values the privacy of every user who uses our services. This Privacy Policy transparently explains how we collect, use, store, disclose and protect your personal data when you use the cuci2 website and mobile app.

This policy applies to all registered players and visitors accessing the platform cuci2, including those using the mobile app on Android or iOS. We fully comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and all relevant data protection laws.

Privacy is more than a legal obligation for cuci2 — it is a core value we uphold. We understand that your trust depends on how we handle the personal information you share with us, and we never take that responsibility lightly.

Cuci2 collects several categories of personal data depending on how you interact with our platform. The data we collect can be grouped into three main categories:

We only collect data that is strictly necessary for the stated purposes. We do not collect excessive or irrelevant information beyond what is required to provide cuci2 services.

The personal data you provide to cuci2 is used solely for legitimate and stated purposes. The following are the primary purposes for which your data is used:

• Account management: Creating, managing and maintaining your cuci2 account, including profile settings and personal preferences.
• Transaction processing: Processing deposits, withdrawals and all financial transactions related to your gaming activity.
• KYC Verification: Verifying your identity to comply with legal requirements related to anti-money laundering (AML) and other compliance obligations.
• Security and fraud prevention: Identifying, investigating and preventing any fraudulent activity, account abuse or unauthorised use.
• Customer support: Providing technical assistance and resolving any issues or complaints you report.
• Platform communications: Sending important notices about your account, including security updates, terms changes and transaction information.
• Marketing (with consent): Sending promotional offers, bonuses and information about new games — only if you have given consent to receive such communications.
• Service improvement: Analysing platform usage patterns to improve the interface, performance and overall user experience.

Cuci2 does not sell, rent or disclose your personal data to third parties for marketing purposes without your consent. However, there are limited situations where data sharing is necessary to enable cuci2 to operate effectively:

• Payment providers: Required financial information is shared with the payment service providers we use (such as FPX gateways and digital wallet providers) to process your transactions. All such providers are bound by strict confidentiality agreements.
• Technology providers: Cloud service and technical infrastructure providers that help us operate the cuci2 platform may have limited access to certain data solely in their technical capacity.
• Legal authority: cuci2 will disclose information to competent authorities when required to do so by law, court order or a valid official investigation.
• Auditors and professional advisors: In certain circumstances, independent auditors or legal advisors may need to access limited data for audit and compliance purposes.

In all data-sharing instances mentioned above, cuci2 ensures that only the minimum necessary information is shared, and all receiving parties are bound by confidentiality and data protection obligations equivalent to our own standards.

Cuci2 implements multiple layers of technical and organisational security to protect your personal data from unauthorised access, loss, misuse or accidental disclosure:

• All data in transit is protected by 256-bit SSL/TLS encryption between your device and cuci2 servers.
• Sensitive data stored in our databases is protected with additional encryption at the file and database level.
• Access to player data is restricted using the principle of minimum privilege — only staff who require access for their specific duties may view the relevant data.
• A continuous security monitoring system detects and alerts on any suspicious or unusual access attempts.
• All cuci2 staff who handle personal data undergo regular data protection training.
• Security testing and independent audits are conducted regularly to identify and address any system vulnerabilities.

Cuci2 retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy, or for as long as required by applicable Malaysian law.

• Active account data: Retained for the duration your account is active and in use.
• KYC and identity data: Retained for a minimum of 5 years after account closure, in line with Malaysia's AML legal requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's accounting and tax requirements.
• Security and access logs: Retained for 2 years for investigation purposes if required.
• Marketing data: Deleted when you withdraw your marketing consent.

Once the designated retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered.

Cuci2 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

• Essential cookies: Required for core platform functionality including login session management and security. These cookies cannot be disabled.
• Functional cookies: Saving your preferences such as language, display theme and account settings to make repeat visits more convenient.
• Analytics cookies: Helping us understand how players interact with the platform in order to improve cuci2's design and performance.
• Marketing cookies: Used to display promotions relevant to your interests and gaming activity (only with your consent).

You can control and manage cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of the cuci2 platform. For more information on managing cookies, refer to your web browser's help section.

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by cuci2:

The cuci2 platform is strictly for individuals aged 18 and above. We do not intentionally collect, store or process personal data from anyone under the age of 18.

If we discover that personal data from someone under the age of 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the relevant account. If you are aware that a minor has registered an account at cuci2, please contact our customer support immediately.

Cuci2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or how we operate. When we make material changes, we will:

• Displaying clear notices on the cuci2 website and app before changes take effect.
• Sending notifications to the email address registered to your account.
• Updating the "Last Updated" date at the top of this policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the cuci2 platform after any amendments take effect will be considered your acceptance of the updated policy.

If you have any questions, concerns or requests regarding this Privacy Policy or how cuci2 handles your personal data, please contact us through the following channels:

• In-account live chat: The fastest way to get a response — our support team operates 24 hours a day, 7 days a week.
• Email: Send your written enquiry to [email protected] for issues that require official documentation.

For requests related to your rights under the PDPA such as data access, correction or deletion, please clearly state the type of request and include the required identity verification details. cuci2 will respond within 21 working days from the date a complete request is received.