12malay Privacy Policy

1. Overview & Data Controller Identity

12malay ("we", "us", "our") operates the online gaming platform accessible at 12malay.org. In the context of personal data processing, 12malay acts as the data controller responsible for determining the purposes and means of processing your personal information.

This Privacy Policy ("Policy") describes in detail what personal data 12malay collects from you, why we collect it, how we use it, with whom we share it, how long we retain it, and what rights you have in relation to it. It applies to all interactions with the 12malay platform — including account registration, deposits and withdrawals, gameplay, customer support communications, and marketing activities.

This Policy should be read in conjunction with the 12malay Terms & Conditions, which govern your use of the platform. Where this Policy conflicts with the Terms & Conditions on a data protection matter, this Policy shall prevail.

2. Personal Data We Collect

12malay collects the following categories of personal data from users of the platform:

12malay does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data unless expressly required by applicable law or regulatory authority and disclosed to you at the time of collection.

3. How We Collect Your Data

12malay collects personal data through the following means:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or respond to surveys, you provide data directly to 12malay.
• Automated technical collection: When you access the 12malay platform, we automatically collect technical data including IP address, device identifiers, browser type, and session information through server logs and cookies.
• Payment processors: When you transact via Touch n Go eWallet, Boost, FPX, Visa, Mastercard, or USDT, the relevant payment service provider shares transaction confirmation data with 12malay necessary to credit or debit your account.
• Identity verification services: During KYC, 12malay may use third-party identity verification services to validate documents you submit. These services return a verification result and do not store your documents on 12malay's behalf beyond the period necessary for verification.
• Public sources: In limited cases, 12malay may supplement your data with information from publicly available sources, including fraud prevention databases and sanctions screening lists, as required by our AML obligations.

4. Purposes of Processing

12malay processes your personal data for the following purposes:

1. Account management and platform operation — to create, maintain, and manage your 12malay account, process logins, and deliver the gaming and wagering products you request;
2. Payment processing — to process deposits, withdrawals, refunds, and bonus credits in Malaysian Ringgit (MYR) through your selected payment method;
3. Identity verification and KYC compliance — to verify your identity, age, and eligibility in accordance with our regulatory obligations;
4. Anti-money laundering (AML) and fraud prevention — to detect, investigate, and prevent fraudulent activity, money laundering, and other financial crimes in compliance with applicable laws;
5. Responsible gaming monitoring — to monitor usage patterns that may indicate problem gambling behaviour and to implement and track self-exclusion, deposit limits, and other responsible gaming tools;
6. Customer support — to respond to your enquiries, resolve disputes, and improve the quality of our support services;
7. Legal and regulatory compliance — to meet our obligations under applicable legislation including the Malaysian PDPA 2010, the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), and any applicable gaming regulations;
8. Marketing communications — where you have provided consent, to send you promotional offers, bonus notifications, and product updates via email or in-platform messaging;
9. Platform improvement and analytics — to understand how players interact with the 12malay platform and to improve functionality, design, and game curation.

5. Legal Basis for Processing

Under the Malaysian Personal Data Protection Act 2010, 12malay processes your personal data on one or more of the following legal grounds:

• Consent — where you have freely given, specific, and informed consent, including for marketing communications and optional analytics;
• Contractual necessity — where processing is necessary to perform our obligations under the 12malay Terms & Conditions to which you are a party, including account operation and payment processing;
• Legal obligation — where processing is required to comply with applicable Malaysian law, including AML, KYC, and data retention obligations;
• Legitimate interests — where processing is necessary for our legitimate interests (such as fraud prevention, security, and responsible gaming enforcement) provided those interests are not overridden by your fundamental rights.

6. Data Sharing & Third-Party Disclosure

12malay does not sell, rent, or trade your personal data to third parties for their independent marketing purposes. We may share your personal data with the following categories of recipients, solely for the purposes described in Section 4:

• Licensed game suppliers and software providers — to deliver game content and RNG-certified gaming outcomes (e.g., PG Soft, Pragmatic Play, Habanero). Game providers receive only the minimum data necessary to render the gaming session.
• Payment service providers — including Touch n Go eWallet, Boost, FPX banking partners (Maybank, CIMB, Public Bank), and card networks (Visa, Mastercard), to process financial transactions.
• Identity verification and KYC partners — to validate identity documents and perform age verification checks.
• Fraud prevention and AML screening services — to screen transactions and account activity against relevant financial crime databases.
• IT infrastructure and cloud service providers — hosting, database management, CDN, and security services used to operate the 12malay platform.
• Regulatory and law enforcement authorities — where required by applicable law, court order, or regulatory demand. 12malay will provide only the data legally required and will notify affected users where permitted to do so.
• Professional advisers — lawyers, auditors, and consultants engaged under duties of confidentiality.

Where 12malay engages third-party processors, we require by contract that they implement appropriate data protection and security measures equivalent to those maintained by 12malay.

7. Data Retention

12malay retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to applicable legal retention requirements. The following general retention periods apply:

• Account and transaction data: Retained for a minimum of seven (7) years from the date of account closure, in compliance with AML and financial record-keeping obligations under Malaysian law.
• KYC documents: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Gaming session and wagering records: Retained for five (5) years for regulatory audit purposes.
• Customer support communications: Retained for three (3) years from the date of the relevant interaction.
• Marketing preference data: Retained until you withdraw consent or until twelve (12) months following your last login, whichever is earlier.
• Technical and log data: Retained for up to ninety (90) days for security and fraud investigation purposes, except where longer retention is required for an active investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 12malay's data disposal procedures.

8. Data Security

12malay implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and 12malay servers;
• Bcrypt hashing for account passwords — raw passwords are never stored in any 12malay system;
• Role-based access controls limiting staff access to personal data strictly to those with a documented need;
• Two-Factor Authentication available for all user accounts and mandatory for all internal staff access to production systems;
• Regular penetration testing and vulnerability assessment of the 12malay platform by independent security professionals;
• Encrypted storage for all financial records and KYC documents at rest;
• IP anomaly detection and login monitoring to identify and respond to suspected unauthorised access.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. In the event of a data breach that poses a risk to your rights, 12malay will notify affected users and relevant regulatory authorities as required under applicable law.

9. Cookies & Tracking Technologies

12malay uses cookies and similar tracking technologies on the platform. Cookies are small text files stored on your device that help us recognise you on return visits, maintain your session, and understand how you use the platform.

The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These include session management, authentication tokens, and security cookies. These cannot be disabled without preventing core platform functionality.
• Functional cookies: Remember your preferences such as language settings, last-played game category, and display configurations.
• Analytics cookies: Collect anonymised data on how users navigate the platform, which game categories are most visited, and where technical errors occur. This data is used exclusively for internal improvement purposes.
• Session security cookies: Track session integrity and detect anomalous activity patterns consistent with session hijacking or automated access.

You may configure your browser to refuse cookies or delete existing cookies. Note that disabling strictly necessary cookies will impair your ability to log in to and use the 12malay platform. 12malay does not use third-party advertising cookies or cross-site tracking technologies.

10. Your Data Protection Rights

Subject to the provisions of the Malaysian Personal Data Protection Act 2010 and applicable exemptions, you have the following rights in relation to your personal data held by 12malay:

• Right of access: You may request a copy of the personal data 12malay holds about you and information about how it is processed.
• Right to correction: You may request correction of inaccurate or incomplete personal data held about you.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to limit processing: In certain circumstances, you may request that 12malay restricts the processing of your data while a query is being resolved.
• Right to data portability: Where technically feasible and legally applicable, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to the processing of your data for direct marketing purposes at any time without providing a reason.

To exercise any of these rights, please contact the 12malay support team via live chat or email at [email protected]. 12malay will respond to all verified data rights requests within thirty (30) calendar days. Requests may be subject to identity verification before action is taken.

11. Minors & Age Restriction

The 12malay platform is strictly restricted to individuals who are 21 years of age or older. 12malay does not knowingly collect or process the personal data of minors. If 12malay becomes aware that personal data has been collected from an individual under the age of 21 without appropriate verification, that data will be deleted and the associated account closed without delay. Where there are grounds to believe an underage person has accessed the platform, 12malay will take all reasonable steps to investigate and prevent future access.

If you are a parent or guardian and believe your child has registered on the 12malay platform, please contact us immediately via live chat. See our Responsible Gaming page for guidance on preventing underage access.

12. Changes to This Privacy Policy

12malay reviews and updates this Privacy Policy periodically to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, 12malay will provide advance notice via registered email to account holders and/or a prominent in-platform notification. The effective date of the current version is displayed at the top of this page. Your continued use of the 12malay platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy regularly.

13. Contact & Data Enquiries

For any questions, complaints, or requests relating to this Privacy Policy or the processing of your personal data by 12malay, please contact us through the following channels:

• Live Chat: Available 24/7 on 12malay.org — fastest response channel, typically under 2 minutes.
• Email: [email protected] — for formal data subject access requests and written complaints.

If you are not satisfied with 12malay's handling of a privacy complaint, you may have the right to lodge a complaint with the relevant Malaysian data protection authority. Details of the relevant regulatory contact can be obtained from the official Malaysian government communications portal.