Privacy Policy — 21cuci

1. Introduction

This Privacy Policy ("Policy") is issued by 21cuci ("21cuci", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://21cuci.app and its associated interfaces (the "Platform"). This Policy applies to all users of the Platform, including registered players, visitors, and prospective members.

21cuci is committed to handling personal data responsibly and in compliance with applicable data protection laws. We recognise that Malaysian players entrust us with sensitive personal and financial information, and we take the obligations that come with that trust seriously. This Policy sets out in plain terms what data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to your personal information.

This Policy should be read alongside our Terms & Conditions, which form the overall legal framework governing your use of the 21cuci Platform.

2. Personal Data We Collect

21cuci collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and in some cases from third-party verification services.

2.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, national identity card number or passport number (for verification purposes).
• Contact data: Malaysian phone number, email address.
• Account credentials: Username and hashed (not plaintext) password.
• Financial data: Payment method details (e-wallet identifiers, bank account information) necessary to process deposits and withdrawals. Full card numbers are never stored by 21cuci.
• Correspondence data: Content of communications you send to our customer support team via live chat or email.
• Responsible gaming data: Self-exclusion requests, deposit limits, session time preferences, and any information you voluntarily disclose to our support team in relation to your gaming behaviour.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution.
• Usage data: Pages visited, features used, session duration, game history, betting history, login timestamps and locations.
• Cookie data: As described in Section 6 of this Policy.

2.3 Data from Third Parties

When you request a deposit or withdrawal, our payment processors (Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and USDT gateways) may share transaction confirmation data with us. We may also receive identity verification results from third-party Know Your Customer (KYC) service providers when conducting mandatory identity checks.

3. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

21cuci does not use your personal data for the purpose of selling it to third-party advertisers or marketing platforms. Any promotional communications from 21cuci relate exclusively to our own Platform services and are sent only where you have not opted out.

4. Legal Basis for Processing

21cuci processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms & Conditions — including account management, payment processing, and provision of gaming services.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, identity verification requirements, and data retention obligations imposed by gaming authorities.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, and business analytics, where these interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes such as marketing communications, where we have obtained your explicit consent. You may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Sharing of Personal Data

21cuci does not sell, rent, or trade your personal data. We share your personal data only in the following limited circumstances:

5.1 Service Providers

We engage third-party service providers who process personal data on our behalf under strict data processing agreements. These include: payment processors (Touch n Go eWallet, Boost, Malaysian banking partners), KYC and identity verification providers, game software studios (who receive only anonymised game session data), customer support platform providers, and cloud hosting infrastructure providers. All such providers are contractually required to use your data only as instructed by 21cuci and to maintain appropriate security standards.

5.2 Legal and Regulatory Disclosure

We may disclose personal data to regulators, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the legal rights of 21cuci or other players on the Platform. Such disclosures are made only to the extent required and in compliance with applicable data protection law.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of 21cuci's business, personal data held by us may be transferred to the acquiring entity as part of the transaction. We will notify affected players via email and a Platform notice before such a transfer, and players will have the option to close their accounts if they do not wish their data to be transferred.

6. Cookies and Tracking Technologies

21cuci uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate and improve the Platform. Cookies are small text files stored on your device that help us recognise your session, maintain your login state, and understand how you use the Platform.

6.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function. They maintain your login session, secure your account, and enable core features. These cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as language settings, display preferences, and last-played games to personalise your experience.
• Analytics cookies: Collect anonymised data about how players interact with the Platform, helping us identify and resolve issues and improve the overall experience. This data does not identify you individually.
• Security cookies: Used to detect and prevent fraudulent activity, including bot activity and account takeover attempts.

21cuci does not use third-party advertising cookies or permit external ad networks to track you through our Platform. You may manage or disable non-essential cookies through your browser settings; however, disabling strictly necessary cookies may prevent you from logging in or using key Platform features.

7. Data Retention

21cuci retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum periods:

• Account and identity data: Retained for the duration of your account plus a minimum of five (5) years after account closure, in compliance with anti-money laundering and gaming regulatory retention requirements.
• Transaction and financial data: Retained for a minimum of seven (7) years from the date of the transaction, consistent with Malaysian financial record-keeping standards.
• Customer support correspondence: Retained for three (3) years from the date of the communication, unless the matter relates to an unresolved dispute.
• Usage and analytics data: Aggregated and anonymised within thirteen (13) months; raw session data deleted after thirteen months unless retained for fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you.

8. Data Security

21cuci implements appropriate technical and organisational security measures designed to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, and destruction. These measures include:

• TLS/SSL encryption for all data in transit between your device and the Platform;
• Encryption at rest for sensitive data stored in our databases, including identity and financial information;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for privileged administrative access;
• Automatic session expiration and re-authentication for account inactivity.

No security system is impenetrable. While we take reasonable precautions, we cannot guarantee that our security measures will prevent all unauthorised access. In the event of a material data breach affecting your personal information, we will notify you as soon as practicable and provide guidance on steps you can take to protect yourself.

9. Your Data Protection Rights

Subject to applicable law and the exceptions described below, you have the following rights in relation to your personal data held by 21cuci:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of rectification: You may request correction of inaccurate or incomplete personal data. Many details can be updated directly through your account settings.
• Right of erasure ("right to be forgotten"): You may request deletion of your personal data where retention is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Right to object: You may object to processing of your personal data for direct marketing purposes at any time, with immediate effect.
• Right to restrict processing: You may request that we limit how we use your personal data in certain circumstances, for example while a dispute about accuracy is being resolved.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to withdraw consent: Where we process data on the basis of your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our support team via live chat or by emailing [email protected] (see Section 13). We will respond within thirty (30) days of receiving a verifiable request. Identity verification will be required before acting on any data rights request to protect your information from unauthorised disclosure.

10. Children's Privacy

The 21cuci Platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account. If you believe that we have inadvertently collected information from a minor, please contact us immediately at [email protected] so we can take appropriate action.

11. Third-Party Links

The 21cuci Platform does not include links to external third-party websites for commercial or promotional purposes. Where we reference external resources — for example in our Responsible Gaming page in the context of player support organisations — those references are for informational purposes only. 21cuci is not responsible for the privacy practices, content, or security of any third-party websites. This Policy applies exclusively to the 21cuci Platform.

12. Changes to This Privacy Policy

21cuci may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. When we make material changes, we will notify registered players via their registered email address and display a prominent notice on the Platform at least seven (7) days before the revised Policy takes effect. The "Last Updated" date at the top of this page will always reflect the most recent revision. Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgement of the changes.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by 21cuci, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 on the Platform
• Email: [email protected]
• Location: Kuala Lumpur, Malaysia

We aim to respond to all privacy-related enquiries within five (5) business days. For data rights requests (Section 9), the statutory response period of thirty (30) days applies. For responsible gaming support, please visit the Responsible Gaming page.