12play21 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes the data-handling practices of 12play21 ("we", "us", "our", "the Platform"), accessible at https://12play21.cam. It governs how we collect, process, store and, where applicable, disclose the personal information of all individuals ("you", "your", "the User") who visit, register on or actively use the 12play21 platform.

12play21 is an online gaming and sports betting information platform serving adult users, with a focus on the Malaysian market. Our user base includes players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya and Shah Alam, who engage with casino games, live sports betting markets and payment services denominated in Malaysian Ringgit (MYR / RM).

By accessing 12play21, creating an account or using any feature of the platform, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside the 12play21 Terms & Conditions and Responsible Gambling policy.

Definitions

The following terms have the meanings set out below throughout this Policy.

• "Personal Data" Any information that directly or indirectly identifies a living individual, including name, contact details, financial information, device identifiers and behavioural activity records.
• "Processing" Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Controller" The entity that determines the purposes and means of processing personal data — in this case, 12play21.
• "Processor" A third party that processes personal data on behalf of 12play21 under a contractual arrangement.
• "Consent" A freely given, specific, informed and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "KYC" Know Your Customer — identity verification and age-confirmation procedures required before certain account activities are permitted.
• "Cookies" Small data files stored on a user's device by a web browser to retain session information and support platform functionality.

Data We Collect

12play21 collects personal data in a number of ways depending on how you interact with the platform. The categories below set out the main types of data we may hold about registered and prospective users.

Registration and Account Data

• Full legal name and date of birth (required for age and identity verification).
• Email address and, where provided, a contact telephone number.
• Chosen username and encrypted account password credentials.
• Residential address, including city and postcode, as provided during registration or KYC.
• Copies of government-issued identity documents submitted for KYC verification.

Financial and Payment Data

• Details of the payment method used for deposits, such as bank name (Maybank, CIMB, Public Bank, Hong Leong), e-wallet provider (Touch 'n Go eWallet, Boost, GrabPay) or transfer network (DuitNow, FPX), together with masked account references where applicable.
• Transaction history including deposit amounts, withdrawal requests, MYR balances and associated timestamps.
• Bonus credit records and wagering activity linked to promotional terms.

Technical and Usage Data

• IP address, device type, browser name and version, and operating system.
• Pages visited, features accessed, session duration and navigation path within the platform.
• Geolocation data at the country and region level derived from IP address.
• Cookie identifiers and similar tracking technologies as described in Section 7.

Support and Communication Data

• Content and metadata of support conversations, including live chat transcripts and email correspondence submitted to [email protected].
• Records of responsible-gambling tool requests, self-exclusion applications and deposit-limit submissions.

How We Use Your Data

12play21 processes personal data only for the purposes identified at the point of collection or where a recognised legal basis exists. The table below summarises the primary processing activities carried out in connection with registered users.

Legal Basis for Processing

12play21 relies on one or more of the following legal grounds when processing personal data, depending on the nature of the activity:

• Contractual necessity: Processing required to register your account, fulfil deposit and withdrawal requests, and deliver platform services as outlined in the Terms & Conditions.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorist financing (CTF), age verification and licensing obligations.
• Legitimate interests: Processing for fraud prevention, security monitoring and the responsible gambling obligations that protect both users and the platform.
• Consent: Processing for optional marketing communications, where you have actively opted in to receive promotional material from 12play21. Consent may be withdrawn at any time.

Data Sharing and Disclosure

12play21 does not sell personal data to third parties. We may share your information in the limited circumstances described below, and only to the extent necessary for each identified purpose.

Payment Service Providers

To process deposits and withdrawals, 12play21 shares relevant transaction data with the payment processor handling your selected method. This may include services such as Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost and GrabPay. Each provider operates under its own data-protection terms.

Identity Verification Partners

KYC and age-verification checks may be carried out by contracted third-party verification services. Only the minimum necessary information is shared, and such processors are bound by confidentiality obligations.

Regulatory and Legal Authorities

12play21 may disclose personal data to regulators, law enforcement agencies or courts where required by applicable law, regulation or a valid legal order. We will notify affected users where legally permitted to do so.

Responsible Gambling Registers

Where a self-exclusion request is processed, relevant account identifiers may be shared with affiliated exclusion schemes or registers, to the extent required by the applicable programme.

Cookies and Tracking Technologies

12play21 uses cookies and similar technologies to operate the platform correctly, maintain session continuity, detect fraud and understand how users navigate the site. The main categories of cookies we use are described below.

• Strictly necessary cookies: Required for the platform to function, including session management, login authentication and security token validation. These cannot be disabled without affecting core functionality.
• Functional cookies: Remember your preferences such as language settings, regional options and display choices, so you do not need to reset them on each visit.
• Analytics cookies: Collect aggregated, pseudonymised data about page visits and feature usage to help us improve the platform. Individual users are not identified in analytics reports.
• Security cookies: Help detect and prevent fraudulent access attempts, including bot activity and credential-stuffing attacks.

Most browsers allow you to manage cookie settings through their privacy or security options. Blocking all cookies may affect the performance of certain platform features.

Data Retention

12play21 retains personal data only for as long as necessary to fulfil the purposes outlined in this Policy or to comply with applicable legal, regulatory and contractual obligations.

• Account and identity data is generally retained for a minimum of five (5) years following account closure, consistent with anti-money laundering record-keeping obligations.
• Transaction and financial records may be retained for up to seven (7) years for compliance and audit purposes.
• Support communications are typically retained for two (2) years from the date of the last interaction.
• Analytics and technical data collected in pseudonymised form may be retained for up to three (3) years for platform improvement purposes.
• Where you withdraw consent for marketing communications, your preference is recorded and your details removed from active marketing lists promptly.

Data Security

12play21 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include, but are not limited to, encrypted data transmission, access controls, authentication requirements and regular security reviews.

Your Rights

Subject to applicable data protection laws, you have the following rights in relation to your personal data held by 12play21. To exercise any of these rights, contact our support team using the details in Section 14.

• Right of access: You may request a copy of the personal data we hold about you and information about how it is being processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held in your account.
• Right to erasure: In certain circumstances you may request deletion of your personal data, subject to legal retention obligations that may override this right.
• Right to restrict processing: You may request that we limit processing of your data in specific circumstances, such as while a rectification request is under review.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request your data in a structured, commonly used and machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including direct marketing. Upon receiving a valid objection to marketing, we will stop processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

12play21 will respond to verified rights requests within a reasonable period, generally within 30 days of receipt, unless the request is complex or you submit multiple requests simultaneously.

Minors and Age Restriction

12play21 is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by a person under the minimum age, we will delete that information promptly and close the associated account.

Age verification may be requested at any stage of the registration or withdrawal process. If you believe a minor has accessed 12play21, please contact our support team immediately so the account can be reviewed and closed.

Third-Party Services and Links

The 12play21 platform may reference the names of third-party services such as Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX in the context of describing available payment options. Such references are factual descriptions of publicly available services and do not imply a formal partnership or endorsement relationship.

12play21 is not responsible for the privacy practices or data-handling policies of any third-party service provider. Users who interact with payment processors, e-wallets or banking services should review the privacy policies of those services directly.

Policy Amendments

12play21 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform functionality or data practices. Where material changes are made, we will notify registered users via an in-platform notice or email at least seven (7) days before the change takes effect, where reasonably practicable.

The "Effective date" displayed at the top of this page reflects the date of the most recently published version. Continued use of the 12play21 platform after any update constitutes acceptance of the revised Policy.

Contact Us

For any questions, concerns or requests relating to this Privacy Policy, or to exercise any of the rights described in Section 10, please contact the 12play21 support team using the details below. We do not accept privacy-related queries via social media channels.