12play Privacy Policy – Malaysian Player Data Protection

1 Introduction and Scope of This Policy

Welcome to the 12play Privacy Policy. This document forms part of our platform's Terms and Conditions and is designed to transparently explain how your personal information is handled by 12play.

This policy applies to all users who access or use the 12play platform through any channel — the official website, mobile app, or any related services provided by us. It also applies to prospective users who visit our website even without registering an account.

We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and continuously strive to apply industry best practices in personal data handling. If you have any questions about this policy, you may contact our privacy team using the details provided at the end of this document.

2 Types of Data We Collect

12play only collects data that is strictly necessary to provide you with a safe, seamless, and high-quality service. Below are the categories of data we collect:

We do not collect sensitive information such as biometric data, medical records, or religious beliefs unless explicitly required by law. All data you voluntarily provide through our platform — such as game preferences or account settings — is also stored securely and subject to this policy.

3 How We Use Your Data

Every piece of information we collect has a clear and legitimate purpose. 12play uses your personal data for the following purposes:

• Account Management: Creating, verifying, and maintaining your account so you can log in and use the platform securely.
• Transaction Processing: Ensuring all deposits and withdrawals are processed accurately, promptly, and securely to the correct account.
• Identity Verification (KYC): Complying with anti-money laundering (AML) legal requirements and protection against fraud.
• Service Communications: Sending important notifications related to your account, transactions, security updates, and changes to terms.
• Customer Support: Helping you resolve any issues, enquiries, or complaints efficiently and effectively.
• Personalise Your Experience: Personalising content, promotions, and game recommendations based on your habits and preferences.
• Platform Security: Detecting and preventing fraudulent activity, money laundering, or platform abuse.
• Analytics & Improvement: Analysing usage patterns in aggregate to improve service quality and user experience.
• Legal Compliance: Meeting reporting and compliance obligations to the relevant authorities when required.

We will not use your data for purposes unrelated to our services without first obtaining your separate consent.

4 Data Storage and Security

Your data security is our absolute priority at 12play. We implement multiple layers of defence to ensure your information remains protected at all times:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using the latest TLS protocol, making it unreadable to unauthorised parties during transmission.
• Encrypted Data Storage: Sensitive data stored in our databases is also encrypted using reinforced encryption algorithms.
• Strict Access Controls: Only authorized personnel with a legitimate business need are permitted to access personal data — and all access is recorded in audit logs.
• 24/7 Monitoring: Our security systems monitor suspicious activity around the clock and respond automatically to any detected threats.
• Regular Security Testing: We conduct regular security audits and independent penetration testing to identify and address any vulnerabilities.

While we take all reasonable measures, no security system is 100% impenetrable. We encourage you to play your part by using a strong password, not sharing your login details, and reporting any suspicious activity to us promptly.

5 Data Sharing with Third Parties

12play respects your privacy and will not sell or disclose your personal data to third parties for marketing purposes. However, there are limited situations where data sharing is necessary:

• Payment Providers: Required transaction details are shared with authorised payment providers (such as FPX, eWallet, and banks) solely for processing your deposits and withdrawals.
• Technology Service Providers: Technical partners that support our platform operations — such as server hosts and analytics services — may process certain data on our behalf within strict contractual limits.
• Legal Authority: We are required to disclose data to competent authorities when lawfully requested through proper legal process.
• Identity Verification Providers: Trusted third-party KYC services are used to verify your identity — this process is subject to their own strict privacy policies.

All third parties we work with are subject to binding data confidentiality agreements and are only permitted to use your data for specified purposes. We do not share data with advertisers, data brokers, or any entity unrelated to the delivery of our services.

6 Cookies and Tracking Technologies

12play uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for basic platform operations such as login verification and session security. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Saving your preferences such as language selection, display settings, and account settings for a seamless experience.
• Analytics Cookies: Helping us understand how users interact with the platform — this data is collected in aggregate and does not personally identify individuals.
• Security Cookies: Helping detect fraudulent activity and protecting your account from unauthorised access.

You can manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality or user experience of the 12play platform.

7 Your Rights as a User

Under Malaysia's PDPA and our privacy policy, you have the following rights regarding your personal data. We respect and facilitate the exercise of each of these rights:

To exercise any of the above rights, please contact our privacy team. We will respond to your request within 30 working days. In complex cases, this period may be extended to 60 days with prior notification to you.

8 KYC Process and Identity Verification

As a responsible platform, 12play implements a comprehensive Know Your Customer (KYC) process to comply with anti-money laundering (AML) legal requirements and ensure the safety of all users.

Documents that may be required during the KYC process include:

• Malaysian Identity Card (MyKad) — front and back.
• Valid passport (for foreign nationals).
• Latest bank statement (for bank account verification for withdrawals).
• Selfie holding your identity card (in certain situations for additional verification).

All KYC documents you submit are handled with the highest level of protection. They are only accessed by our trained compliance team and stored in a secure environment. Once the verification process is complete, physical documents or digital copies are not retained beyond the period required by law.

9 Child Protection

The 12play platform is exclusively for users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we discover that we have unknowingly collected data from underage individuals, we will immediately:

• Immediately suspending the account in question.
• Removing all related data from our systems.
• Taking appropriate action in accordance with applicable child protection laws.

Parents or guardians who discover that their minor child has registered an account on 12play are requested to contact our support team immediately for a prompt resolution.

10 Changes to This Privacy Policy

12play reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. Any changes will be indicated by the "Last Updated" date at the top of this document.

For material and significant changes, we will notify you via:

• A clear notice on the platform's home page at least 14 days before the changes take effect.
• Notification emails to your registered email address.
• In-app notifications (if you are using our mobile app).

Your continued use of the platform after the effective date of any changes constitutes your acceptance of the amended Privacy Policy. We encourage you to review this page periodically.

11 Contact Our Privacy Team

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, the 12play privacy team is ready to assist you.

You can reach us via:

• Email: [email protected] (state "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the corner of the platform.
• Response Time: We are committed to responding to all privacy inquiries within 3 business days.

For rights exercise requests (access, correction, deletion), please include your account information and the specific type of request to expedite the process. Your identity may need to be verified before we can process the request to ensure the security of your data.