Privacy Policy
cuci21 Data Commitment

This Privacy Policy ("Policy") describes how cuci21 ("the Company", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to individuals ("Users", "Players", "you", "your") who access or use the cuci21 platform at https://cuci21.cam and any associated services, applications, or subdomains (collectively, "the Platform").

cuci21 is an online gaming and sports betting platform serving players across Malaysia, with particular reach across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and surrounding areas. As a platform handling financial transactions and personal account data, we recognise that our responsibilities under applicable privacy and data protection frameworks are substantial, and we take those responsibilities seriously.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. In the event of any conflict between this Policy and our Terms & Conditions with respect to data-related matters, this Privacy Policy shall prevail.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means cuci21, the entity that determines the purposes and means by which Personal Data is processed.
• "Data Subject" means any living individual whose Personal Data is processed by cuci21 — i.e., registered Players and Platform visitors.
• "Consent" means any freely given, specific, informed, and unambiguous indication of a Data Subject's agreement to the processing of their Personal Data for a stated purpose.
• "KYC" means Know Your Customer — the identity verification and age verification process required prior to account activation or withdrawal processing.
• "Cookies" means small data files placed on a user's browser or device by the Platform to enable certain functionality and to collect usage information.
• "Third-Party Processor" means any external service provider engaged by cuci21 to process Personal Data on the Company's behalf under contractual obligations.

cuci21 collects Personal Data through several means: directly from you when you register and use the Platform; automatically through your interaction with the Platform; and, in limited cases, from third-party verification and payment service providers. The categories of data we collect include:

3.1 Registration & Identity Data

When you create a cuci21 Account, we collect: your legal full name, date of birth, email address, residential address, mobile phone number, and the login credentials you choose (username and password). This data is required to establish and maintain your Account.

3.2 KYC Verification Data

To comply with our age verification and identity verification obligations, we may collect copies of government-issued identity documents such as your Malaysian Identity Card (MyKad) or passport, and proof-of-address documentation such as a utility bill or bank statement. This data is processed solely for verification purposes and is stored securely.

3.3 Financial & Transaction Data

We collect records of all financial transactions on your Account including deposits, withdrawals, bonus credits and debits, and wagering activity. We collect payment method identifiers (e.g., bank account numbers, e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect) necessary to process deposits and withdrawals. We do not store full payment card numbers or full banking credentials.

3.4 Gaming & Behavioural Data

We record data relating to your use of the Platform, including games played, bets placed, session durations, game preferences, and interaction with Platform features. This data is used for responsible gambling monitoring, platform improvement, and personalisation purposes.

3.5 Technical & Device Data

We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, and session timestamps. This data is collected through server logs and cookies.

3.6 Communications Data

We retain records of communications between you and cuci21's support team, including live chat transcripts, email correspondence, and any feedback or complaint submissions. These records are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

cuci21 processes your Personal Data for the following specific purposes:

• Account Management: Creating, maintaining, and operating your Account on the Platform, including processing login authentication and managing Account settings.
• Service Delivery: Enabling your participation in games, betting markets, live dealer tables, and all other Platform services, including processing wagers and calculating outcomes.
• Payment Processing: Facilitating deposits and withdrawals through your nominated Malaysian payment methods, verifying transaction legitimacy, and maintaining accurate financial records.
• Identity & Age Verification: Confirming that you meet the minimum age requirement of 21 years and that the details you have provided are accurate, as required under our KYC obligations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, account compromise, and other security threats through transaction monitoring and behavioural analysis.
• Responsible Gambling: Monitoring gaming patterns to identify potential signs of problematic gambling behaviour and to enforce any self-imposed limits or exclusion measures activated by you.
• Customer Support: Responding to your enquiries, complaints, and support requests through live chat and email channels.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to you by email or in-platform messaging, where you have provided consent to receive such communications. You may withdraw consent at any time.
• Platform Improvement: Analysing aggregate and anonymised usage data to identify technical issues, improve user experience, and develop new features.
• Legal & Regulatory Compliance: Meeting our obligations under applicable laws, responding to lawful requests from competent authorities, and maintaining records as required by law.

cuci21 processes your Personal Data only where a valid legal basis exists. The legal bases on which we rely include:

• Contractual Necessity: Processing required to enter into and perform our contract with you — i.e., to operate your Account, process payments, and deliver gaming services as agreed in our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC and anti-money laundering obligations, age verification requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing necessary for cuci21's legitimate business interests, where those interests are not overridden by your rights — including fraud detection, platform security, responsible gambling monitoring, and business analytics.
• Consent: Where we rely on consent as the legal basis (principally for direct marketing communications), you retain the right to withdraw that consent at any time by contacting our support team or using the unsubscribe mechanism in any marketing email.

We may share your Personal Data with the following categories of third parties in the specific circumstances described:

• Payment Service Providers: We share necessary transaction data with Malaysian payment processors including those supporting DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect, solely for the purpose of processing your deposits and withdrawals.
• Identity Verification Providers: We may engage third-party KYC verification services to assist in confirming the identity and age of registered Players. These providers process only the data strictly necessary for verification.
• Game Studio Partners: Game studios whose titles are hosted on the Platform may receive limited gameplay data (e.g., session identifiers, bet values) necessary to operate their games within our platform. They are contractually prohibited from using this data for any purpose beyond game delivery.
• Fraud Prevention & Security Services: We may share IP addresses, device fingerprints, and transaction patterns with fraud detection and cybersecurity service providers to protect the Platform and our users from fraudulent activity.
• Regulatory & Law Enforcement Authorities: We will disclose Personal Data to competent regulatory or law enforcement authorities where required by law, court order, or where disclosure is necessary to protect the rights, property, or safety of cuci21, our users, or the public.
• Business Successors: In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of the Company's assets, your Personal Data may be transferred to the successor entity, subject to the same protections described in this Policy.

The cuci21 Platform uses cookies and similar tracking technologies (including local storage and session tokens) to operate core Platform functions, maintain your login session, remember your preferences, analyse Platform usage, and detect fraudulent activity.

The categories of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies cannot be disabled. They include session authentication tokens, security cookies, and cookies required to process transactions.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and previously selected payment methods, improving your experience on return visits.
• Analytics Cookies: Used to collect anonymised data about how users interact with the Platform — pages visited, session duration, navigation paths — to help us improve Platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent access, bot activity, and other security threats by analysing device and behavioural patterns.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from accessing certain features including account login and payment processing.

cuci21 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. Our standard retention periods are as follows:

• Account Data: Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, for legal and regulatory compliance purposes.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later, in accordance with anti-money laundering record-keeping requirements.
• Transaction Records: Financial and gaming transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Communications Records: Support chat transcripts and email correspondence are retained for three (3) years from the date of the communication.
• Technical & Log Data: Server logs and device data are retained for up to twelve (12) months from the date of collection.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

cuci21 implements a comprehensive suite of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit Secure Socket Layer (SSL) encryption applied to all data transmitted between your browser or device and our servers;
• Encrypted storage of sensitive data including identity documents and payment identifiers using industry-standard encryption algorithms;
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access Personal Data;
• Two-factor authentication (2FA) options available to all registered Players for account access;
• Real-time transaction monitoring and anomaly detection systems to identify and respond to suspicious activity;
• Regular security assessments and penetration testing of our Platform infrastructure.

Notwithstanding these measures, no method of transmission over the internet or electronic storage is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, cuci21 will notify affected individuals and relevant authorities in accordance with applicable legal requirements.

As a Data Subject whose Personal Data is processed by cuci21, you hold the following rights with respect to your data. These rights may be exercised by contacting us at [email protected]:

• Right of Access: You have the right to request a copy of the Personal Data cuci21 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. You may also update certain Account details directly through your Account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict the processing of your Personal Data while a dispute is resolved or a request is investigated.
• Right to Data Portability: You may request a copy of the Personal Data you have provided to us in a structured, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You have the right to object to the processing of your Personal Data based on our legitimate interests, and to withdraw consent for marketing communications at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

cuci21 employs mandatory age verification as part of the account registration and KYC process. Any Account found to belong to a person under the age of 21 will be immediately suspended, all pending games or bets will be voided, and any funds will be returned to the payment source after applicable verification checks.

If you become aware that a minor has registered an Account on cuci21 or has used the Platform, please notify us immediately at [email protected]. We will take immediate action to close the Account and delete any Personal Data associated with the minor from our systems.

The cuci21 Platform may contain integrations with third-party service providers including payment gateways, game content delivery networks, and customer support platforms. These third-party services operate under their own privacy policies and cuci21 is not responsible for the privacy practices of third-party providers.

All third-party processors engaged by cuci21 are bound by contractual data processing agreements that require them to handle Personal Data in accordance with applicable privacy standards and to process such data only on our documented instructions. We conduct periodic due diligence on critical third-party processors to confirm their continued compliance.

As an online platform, cuci21 may store and process your Personal Data on servers located outside of Malaysia. Where such international transfers occur, we ensure that appropriate safeguards are in place to provide equivalent levels of data protection, including contractual data protection clauses with receiving entities and, where applicable, transfers only to jurisdictions recognised as providing adequate data protection standards.

If you would like further information about the specific safeguards applied to international transfers of your Personal Data, please contact us at [email protected].

cuci21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of our services. Material changes to this Policy will be communicated to registered Players via email notification or a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page reflects when the current version of this Policy came into effect. We recommend that you review this Policy periodically to remain informed of how cuci21 handles your Personal Data. Your continued use of the Platform following any update constitutes your acknowledgment of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by cuci21, please contact us through the following channels:

• Email: [email protected] — please mark the subject line "PRIVACY REQUEST" to ensure your message is routed promptly to our data protection team. Responses within 2 business hours for standard queries; within 30 days for formal data subject rights requests.
• Live Chat: Available 24 hours a day, 7 days a week, directly through the Platform. Our live chat team can assist with general privacy queries and direct formal requests to the appropriate team.

cuci21 is committed to resolving all privacy-related queries promptly and transparently. We serve players across Malaysia including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, Bangsar, and the broader peninsula, and we hold ourselves to the same privacy standards regardless of where our players are located.