21cuci Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") is issued by 21cuci ("the Company", "we", "us", or "our") and applies to all personal data processed in connection with your use of the 21cuci platform, including the website at 21cuci.net, all games, the sportsbook, live dealer services, payment facilities, customer support channels, and any related communications.

21cuci is committed to handling personal data responsibly and in accordance with applicable data protection principles. We collect only the data necessary to provide our services, keep it secure, and do not sell it to third parties for marketing purposes. This Policy sets out clearly what data we hold about you and what we do with it — because you have every right to know.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which form part of the agreement governing your use of 21cuci.

21cuci collects personal data in the following categories, depending on how you interact with the Platform:

We do not collect special category data (such as biometric data, health information, or racial/ethnic origin data) except where strictly required to fulfil a legal obligation, for example, verifying a self-exclusion request.

21cuci uses your personal data for the following purposes:

• Account Administration: Creating and maintaining your 21cuci account, verifying your identity and age, and communicating account-related information to you;
• Service Delivery: Enabling access to games, the sportsbook, live dealer tables, and the cashier, and recording gaming and transaction activity for your account history;
• Payment Processing: Processing deposits and withdrawals via your chosen MYR payment channel — Touch 'n Go eWallet, Boost, Maybank2u, CIMB Clicks, Public Bank, or FPX;
• Regulatory Compliance: Performing Know Your Customer (KYC) checks, Anti-Money Laundering (AML) monitoring, age verification, and responding to requests from regulatory authorities;
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling behaviours and administering self-exclusion, deposit limits, and cooling-off requests;
• Platform Security: Detecting and preventing fraud, account takeover, automated abuse, and other harmful activities;
• Customer Support: Responding to your queries, complaints, and support requests via live chat and email;
• Platform Improvement: Analysing aggregate usage data to improve the 21cuci Platform's performance, stability, and user experience.

21cuci does not use your personal data for unsolicited third-party marketing without your explicit consent. Where promotional communications are sent, you may opt out at any time by contacting our support team.

21cuci processes your personal data on the following legal bases:

• Contractual Necessity: Processing necessary to perform the contract between you and 21cuci — including account registration, payment processing, and game access;
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, AML, and age verification obligations;
• Legitimate Interests: Processing necessary for the legitimate interests of 21cuci, including fraud prevention, platform security, and service improvement, provided such interests are not overridden by your rights and interests;
• Consent: Where no other legal basis applies, 21cuci will seek your explicit consent before processing your data — for example, for optional marketing communications. Consent may be withdrawn at any time.

21cuci does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data only with the following categories of recipients, and only to the extent necessary for the specified purpose:

• Payment Processors: Verified MYR payment service providers (including e-wallet operators and FPX-connected banks) who process your deposit and withdrawal transactions;
• Game Studio Providers: Licensed game studios whose products are hosted on the 21cuci Platform may receive limited technical data necessary for game operation and RNG certification;
• KYC and AML Compliance Providers: Third-party identity verification and transaction monitoring services engaged to fulfil our regulatory obligations;
• Regulatory and Law Enforcement Authorities: Where required by law, regulation, court order, or a legitimate request from a competent authority, 21cuci will disclose personal data to the relevant body;
• IT Infrastructure Providers: Cloud hosting and platform service providers operating under binding data processing agreements that prohibit independent use of your data.

21cuci retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of the Member's active account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements;
• Financial transaction records: Retained for a minimum of seven (7) years from the date of the transaction;
• Gaming records (bets, game history): Retained for a minimum of three (3) years from the date of the gaming activity;
• Customer support communications: Retained for three (3) years from the date of the last communication in each case;
• Cookie and technical data: Retained in accordance with our Cookie Policy as described in Section 7 below.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Where anonymisation is applied, the resulting data may be retained indefinitely for analytical and statistical purposes without identifying you.

The 21cuci Platform uses cookies and similar tracking technologies to ensure correct platform functionality, maintain your login session, and improve the overall user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without preventing core platform functionality;
• Functional Cookies: Remember your preferences, such as language settings and previously visited game categories;
• Analytics Cookies: Collect anonymised data on how Members use the Platform — which pages are visited, how long sessions last, and where errors occur — to help us improve 21cuci's performance;
• Security Cookies: Help detect and prevent fraudulent logins and unusual account activity by associating your session with trusted devices and locations.

You may adjust cookie settings through your browser preferences. Disabling cookies beyond strictly necessary ones may affect certain Platform features but will not prevent access to core gaming services.

21cuci implements technical and organisational security measures proportionate to the risk associated with the data we hold. These measures include:

• 256-bit TLS (Transport Layer Security) encryption on all data transmitted between your device and the 21cuci Platform;
• Bcrypt password hashing with unique per-account salts — plain-text passwords are never stored or accessible to 21cuci staff;
• Two-factor authentication (2FA) available to all Members;
• Login monitoring and automated alerts for suspicious access patterns, including unusual geographic locations;
• Role-based internal access controls limiting staff access to personal data to only what is required for their specific function;
• Regular security audits and penetration testing of the 21cuci Platform infrastructure.

While 21cuci takes all reasonable precautions to protect your personal data, no internet transmission is entirely risk-free. Members are encouraged to use strong, unique passwords, enable 2FA, and log out fully after each session — particularly on shared devices.

As a 21cuci Member, you have the following rights with respect to your personal data, subject to applicable law and any overriding legal obligations on the Company:

• Right of Access: You may request a copy of the personal data 21cuci holds about you;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data;
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where we no longer have a lawful basis for processing it — subject to our legal obligations to retain certain records;
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances, such as while a dispute is being resolved;
• Right to Data Portability: You may request a copy of your personal data in a structured, machine-readable format;
• Right to Object: You may object to processing of your data on the basis of legitimate interests.

To exercise any of these rights, submit a written request to [email protected]. We will respond within a reasonable timeframe and in any case within 30 days. We may request proof of identity before processing a data rights request.

The 21cuci Platform is strictly for persons aged 21 and above. 21cuci does not knowingly collect or process personal data from persons under the age of 21. If at any point we discover or are notified that data has been collected from a person under 21, we will immediately and permanently close the associated account, delete all collected data to the extent legally permissible, and return any funds to the deposit source.

If you believe that a minor has accessed the 21cuci Platform or provided us with personal data, please notify us immediately at [email protected] so that appropriate action can be taken without delay.

21cuci reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, the services we provide, or applicable legal requirements. Where changes are material, we will notify Members by displaying a prominent notice on the Platform prior to the changes taking effect.

The effective date of the current version of this Policy is displayed at the top of this page. Your continued use of the 21cuci Platform following any update to this Policy constitutes acceptance of the revised terms. We encourage all Members to review this Policy periodically.

If you have any questions, concerns, or complaints regarding 21cuci's handling of your personal data, or if you wish to exercise any of your data rights as set out in Section 9, please contact our Data Protection team:

If you are not satisfied with our response to a complaint, you have the right to escalate the matter to the relevant data protection supervisory authority or the licensing authority under which 21cuci operates. 21cuci will cooperate fully with any such supervisory process.