12malay Privacy Policy

1. Introduction & Scope

1.1 This Privacy Policy ("Policy") applies to all personal data processed by 12malay in connection with the operation of the 12malay platform accessible at 12malay.co ("Platform") and the delivery of its gaming and sports betting services ("Services") to registered users in Malaysia and other permitted jurisdictions.

1.2 This Policy is incorporated into and must be read alongside the 12malay Terms & Conditions. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

1.3 By registering an Account with 12malay, you confirm that you are at least 21 years of age and that you have read, understood, and consent to the collection and processing of your personal data as described in this Policy.

2. Data Controller

2.1 For the purposes of applicable data protection legislation, 12malay is the data controller in respect of personal data collected and processed through the Platform. All data processing activities by 12malay are conducted in accordance with the requirements of the jurisdiction in which 12malay holds its operating licence and, where applicable, the Malaysian Personal Data Protection Act 2010 ("PDPA") to the extent that its provisions apply to data processed in connection with Malaysian users.

2.2 Any queries regarding the processing of your personal data may be directed to the 12malay Data Protection contact via the support channel at [email protected] (plain text; not a clickable link).

3. Personal Data We Collect

12malay collects the following categories of personal data in connection with your use of the Platform:

• Registration Data: Full legal name, date of birth, residential address, email address, and Malaysian mobile number provided during account registration.
• Identity Verification Data: Copies of government-issued identity documents (such as MyKad) and, where required, proof of address or source of funds documentation submitted during KYC verification.
• Financial Data: Payment method details (e-wallet identifiers, bank account references), deposit amounts, withdrawal requests, and transaction history. Full payment card numbers, if applicable, are not stored by 12malay and are handled by regulated payment processors.
• Account Activity Data: Login timestamps, game session history, betting records, bonus usage, and account settings including responsible gaming preferences.
• Communications Data: Records of your interactions with 12malay's customer support team, including live chat transcripts and email correspondence.
• Technical Data: IP address, device type and identifiers, browser type and version, operating system, and session analytics data collected automatically when you access the Platform.
• Marketing Preference Data: Your opt-in or opt-out status with respect to promotional communications from 12malay.

4. How We Collect Data

4.1 Directly from you: Registration forms, KYC document uploads, deposit and withdrawal requests, support interactions, and marketing preference settings.

4.2 Automatically: Through cookies, session tracking, and server logs when you access or interact with the Platform. See Section 10 (Cookies & Tracking) for further detail.

4.3 From third parties: Identity verification service providers used to confirm the authenticity of KYC documents; payment processors used to facilitate MYR transactions; fraud detection services; and, where required by law, data provided by regulatory authorities.

5. Purposes of Processing

12malay processes your personal data for the following purposes:

• To create, maintain, and manage your 12malay Account;
• To verify your identity and age (minimum 21 years) in compliance with KYC obligations;
• To process deposits, withdrawals, and MYR transactions via your selected payment method;
• To deliver the gaming and sportsbook Services you have requested, including tracking bets, game results, and account balances;
• To administer promotional offers, bonuses, and loyalty programmes;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities;
• To operate responsible gaming tools including deposit limits, session reminders, and self-exclusion — and to comply with responsible gaming obligations;
• To communicate with you regarding your Account, transactions, and support requests;
• To send you promotional and marketing communications where you have opted in to receive them;
• To improve Platform performance, user experience, and game offerings through anonymised analytics;
• To comply with applicable legal and regulatory obligations, including those arising from 12malay's operating licence conditions.

6. Legal Basis for Processing

6.1 Contractual necessity: Processing required to fulfil the Terms & Conditions Agreement between you and 12malay, including account management, transaction processing, and service delivery.

6.2 Legal obligation: Processing required to comply with applicable laws and the conditions of 12malay's operating licence, including KYC, anti-money laundering (AML), and responsible gaming requirements.

6.3 Legitimate interests: Processing for fraud detection and prevention, platform security, and analytical purposes, where these interests are not overridden by your privacy rights.

6.4 Consent: Processing for direct marketing communications, where you have provided explicit opt-in consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

7.1 12malay does not sell, rent, or trade your personal data to third parties for their own commercial purposes.

7.2 Personal data may be shared with the following categories of third-party service providers, who are contractually required to process data only on 12malay's instructions and in accordance with applicable data protection law:

• Payment processors — to facilitate MYR deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, and other accepted Malaysian payment methods;
• KYC and identity verification providers — to verify the authenticity of identity documents submitted during account registration;
• Fraud prevention and AML service providers — to screen transactions and account activity against fraud and financial crime indicators;
• Game content providers — limited technical identifiers required to deliver live casino and RNG game content from certified studios;
• Customer support infrastructure providers — to operate the live chat and email support functions;
• Cloud hosting and IT infrastructure providers — responsible for the secure storage and processing of Platform data.

7.3 12malay may also disclose personal data where required by applicable law, court order, regulatory authority, or as necessary to protect the rights and interests of 12malay, its users, or the public.

8. International Transfers

8.1 Some of 12malay's third-party service providers may process personal data in jurisdictions outside Malaysia. Where such transfers occur, 12malay ensures that appropriate safeguards are in place, which may include standard contractual clauses, binding corporate rules, or adequacy decisions by competent data protection authorities.

8.2 By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions other than Malaysia, and you consent to such transfers where they are necessary for the delivery of the Services.

9. Data Retention

9.1 12malay retains your personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with applicable legal, regulatory, and licence obligations.

9.2 Account registration data, KYC documents, and transaction records are retained for a minimum of five (5) years from the date of Account closure or last transaction, in accordance with standard AML and gaming regulatory retention requirements.

9.3 Marketing preference data and communications history are retained for the duration of your Account's active status and for a reasonable period thereafter to evidence consent and opt-out records.

9.4 Technical and analytical data (including anonymised session data) may be retained for up to two (2) years for platform improvement purposes.

9.5 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with 12malay's internal data disposal procedures.

10. Cookies & Tracking

10.1 12malay uses cookies and similar tracking technologies to operate the Platform and improve user experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for core Platform functionality, including account login sessions and security tokens. Cannot be disabled.
• Performance and analytics cookies: Used to collect anonymised data about how users interact with the Platform, including pages visited, session duration, and error reports. This data is used to improve Platform performance.
• Functional cookies: Used to remember your preferences such as language settings, deposit method selections, and game history.

10.2 12malay does not use third-party advertising or retargeting cookies. Analytical data collected through the Platform is not shared with external advertising networks.

10.3 Most web browsers allow you to manage cookie settings. Disabling strictly necessary cookies may prevent you from accessing certain features of the Platform, including the secure 12malay login function.

11. Your Rights

Subject to applicable law and 12malay's regulatory obligations, you have the following rights in respect of your personal data:

• Right of access: To request a copy of the personal data 12malay holds about you;
• Right to rectification: To request correction of inaccurate or incomplete personal data;
• Right to erasure: To request deletion of your personal data, subject to legal retention obligations;
• Right to restrict processing: To request that 12malay limit the processing of your personal data in certain circumstances;
• Right to data portability: To receive your personal data in a structured, machine-readable format, where technically feasible;
• Right to object: To object to the processing of your personal data for direct marketing or legitimate interest purposes;
• Right to withdraw consent: To withdraw consent for marketing communications at any time, without affecting prior lawful processing.

To exercise any of these rights, contact the 12malay support team via the in-account live chat or by email at [email protected]. 12malay will respond to verified requests within 30 days.

12. Children's Privacy

12.1 The 12malay Platform is strictly for adults aged 21 years and above. 12malay does not knowingly collect personal data from persons under 21. If 12malay becomes aware that an Account has been registered by a person under the minimum age, the Account will be immediately suspended, all pending transactions voided, and the personal data associated with the Account deleted (except to the extent required for regulatory record-keeping).

12.2 If you believe that a minor has registered an Account on 12malay, please report this immediately via the support live chat or email.

13. Security Measures

13.1 12malay implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
• Encryption of sensitive data at rest, including identity documents and payment method references;
• Role-based access controls limiting Platform staff access to personal data on a need-to-know basis;
• Multi-factor authentication required for internal administrative access to data systems;
• Regular security assessments and penetration testing of Platform infrastructure;
• Incident response procedures to detect, report, and remediate data security breaches in a timely manner.

13.2 While 12malay takes reasonable technical precautions, no data transmission over the internet is completely secure. You play a role in protecting your Account by using a strong, unique password and enabling 2FA on your 12malay login.

14. Changes to This Policy

14.1 12malay reserves the right to amend this Privacy Policy at any time. Material changes will be communicated via email to your registered address and/or via a prominent notice on the Platform. The revised Policy will take effect on the date specified in the update notice.

14.2 Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept a revised Policy, you must cease using the Platform and contact support to close your Account.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 12malay, please contact us via:

• Live Chat: Available 24/7 within your 12malay account dashboard after login.
• Email: [email protected] (plain text; not a clickable link).

We aim to respond to all privacy-related enquiries within 30 calendar days of receipt.