1 Introduction
This Privacy Policy ("Policy") is issued by cuci22 ("cuci22", "we", "us", "our"), the operator of the online gaming platform accessible at https://cuci22.casa (the "Platform"). This Policy describes how cuci22 collects, uses, stores, discloses, and protects the personal data of individuals ("Users", "Players", "you") who access or use the Platform.
cuci22 is committed to handling personal data responsibly and in accordance with applicable data protection principles. We serve players across Malaysia, including in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam, and we take our obligations to protect the privacy of Malaysian users seriously.
By registering an account on the Platform, completing the KYC process, making a deposit via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or any supported banking channel, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the data processing practices described herein.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the full suite of agreements governing your use of the Platform.
2 Definitions
The following definitions apply throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, email address, phone number, identity document details, IP address, and transaction records. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, and deletion. |
| "Data Controller" | cuci22, the entity that determines the purposes and means of processing your personal data. |
| "Data Processor" | A third-party service provider that processes personal data on cuci22's behalf and under cuci22's instruction (e.g., payment processors, KYC verification providers). |
| "KYC" | Know Your Customer — the identity and age verification process required before a player's first withdrawal. |
| "Cookies" | Small text files placed on your device by the Platform to store session information, preferences, and usage analytics data. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose. |
3 Personal Data We Collect
cuci22 collects the following categories of personal data, depending on how you interact with the Platform:
3.1 Registration Data
When you create an account on cuci22, we collect your full legal name, date of birth, email address, mobile phone number, and chosen username. This information is required to establish your account identity and ensure you meet the minimum age requirement of 21 years.
3.2 Identity Verification (KYC) Data
To comply with our Know Your Customer obligations, we collect copies of your government-issued identity documents, such as your Malaysian Identity Card (MyKad) or passport. For address verification, we may also collect utility bills, bank statements, or other official correspondence. For payment method verification, we may collect screenshots or statements confirming ownership of the payment method used.
3.3 Financial & Transaction Data
We record details of all deposits, withdrawals, and wagers placed on the Platform. This includes transaction amounts in MYR, dates and times, payment methods used (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank online banking, CIMB, Public Bank, Hong Leong Bank, FPX, DuitNow, and cryptocurrency wallet addresses for USDT TRC20, BTC, or ETH transactions), and transaction status.
3.4 Device & Technical Data
When you access the Platform, we automatically collect technical data including your IP address, device type and model, operating system, browser type and version, screen resolution, and network connection information. This data is used to optimise the Platform for your device and to detect potential security threats or fraudulent access.
3.5 Usage & Behavioural Data
We collect data about your activity on the Platform, including pages visited, games played, wagers placed, session duration, features used, and navigation patterns. This data is used to improve the Platform experience and for responsible gambling monitoring purposes.
3.6 Communication Data
When you contact cuci22 customer support via live chat, WhatsApp, or email, we collect and retain records of those communications, including the content of messages, timestamps, and resolution notes. This data is retained for service quality assurance and dispute resolution purposes.
3.7 Voluntary Data
You may choose to provide additional information voluntarily, such as your city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru), preferred language, or feedback submitted through surveys or support channels. This data is processed solely for the purpose for which it was submitted.
4 How We Collect Your Data
cuci22 collects personal data through the following means:
- Directly from you: During account registration, KYC submission, payment transactions, support interactions, and voluntary survey responses;
- Automatically: Through cookies, web beacons, log files, and analytics tools when you access and interact with the Platform;
- From third parties: Identity verification providers (for KYC), payment processors (for transaction confirmation and fraud screening), and fraud prevention partners may provide data to cuci22 in the course of their services;
- Publicly available sources: Where permitted by law, cuci22 may supplement profile data with publicly available information for fraud prevention or compliance purposes.
5 Purposes of Data Processing
cuci22 processes your personal data for the following specific purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, maintaining, and securing your cuci22 account; processing login authentication; managing account preferences and settings. |
| Payment Processing | Processing MYR deposits and withdrawals via supported channels including Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, and bank transfers; issuing receipts and transaction records. |
| KYC & Compliance | Verifying player identity and age (minimum 21 years); fulfilling anti-money laundering (AML) and anti-fraud obligations. |
| Platform Operation | Delivering games, calculating odds, settling bets, and providing the full suite of cuci22 services including sports betting, live casino, slots, and lottery products. |
| Customer Support | Responding to support queries via live chat, WhatsApp, and email; investigating and resolving account disputes; maintaining communication records. |
| Security & Fraud Prevention | Detecting and preventing unauthorised account access, bonus abuse, collusion, money laundering, and other fraudulent or prohibited activities. |
| Responsible Gambling | Monitoring for signs of problem gambling behaviour; administering deposit limits, self-exclusion, and cooling-off requests; maintaining self-exclusion records. |
| Marketing Communications | Sending promotional offers, bonus notifications, and platform updates via email or in-platform messaging where you have provided consent or where permitted by applicable law. |
| Platform Improvement | Analysing aggregated and anonymised usage data to improve platform performance, game selection, and user experience. |
| Legal Compliance | Fulfilling obligations under applicable laws; responding to lawful requests from regulatory bodies and law enforcement authorities. |
6 Legal Bases for Processing
cuci22 processes your personal data on the following legal bases:
- Contractual necessity: Processing required to fulfil the agreement between you and cuci22 under our Terms & Conditions, including account management, payment processing, and service delivery;
- Legal obligation: Processing required to comply with applicable laws, including KYC verification, AML obligations, and responses to lawful authority requests;
- Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where such interests do not override your fundamental rights;
- Consent: Processing for direct marketing communications and certain non-essential cookies, where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
7 Data Sharing & Disclosure
cuci22 does not sell, rent, or trade your personal data. We may share your data with third parties only in the following circumstances:
7.1 Service Providers (Data Processors)
cuci22 engages third-party service providers who process personal data on our behalf to enable platform operations. These include KYC verification providers, payment gateway processors (for Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, and bank channels), fraud detection providers, cloud hosting services, and analytics platforms. All data processors are contractually bound to process your data only as instructed by cuci22 and to maintain appropriate security standards.
7.2 Legal and Regulatory Authorities
cuci22 may disclose personal data to government authorities, law enforcement agencies, or regulatory bodies where required by applicable law, court order, or to protect the rights and safety of cuci22, its users, or the public. cuci22 will notify affected users of such disclosures where permitted by law.
7.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of cuci22's business, personal data held by cuci22 may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer and of any material change to data processing practices that results from it.
7.4 With Your Consent
cuci22 may share your personal data with third parties in circumstances not described above, where you have provided explicit informed consent to such sharing.
8 Cookies & Tracking Technologies
cuci22 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your browser or device when you visit the Platform. We use the following categories of cookies:
- Strictly Necessary Cookies: Essential for the Platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without affecting core Platform functionality;
- Functional Cookies: Remember your preferences such as language settings, display preferences, and previously visited game categories to personalise your experience;
- Analytics Cookies: Collect anonymised data about how players use the Platform — which pages are visited most, where players drop off, and how features are used. This data helps us improve the Platform;
- Marketing Cookies: Used to deliver relevant promotional content and measure the effectiveness of marketing campaigns. These are only activated with your consent.
You may manage cookie preferences through your browser settings. Disabling non-essential cookies may affect some Platform functionality but will not prevent you from accessing core gaming services.
9 Data Retention
cuci22 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law. The following general retention periods apply:
- Account Data: Retained for the duration of your account registration plus a period of five (5) years following account closure, to fulfil legal and regulatory obligations;
- Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with anti-money laundering record-keeping requirements;
- KYC Documents: Retained for a minimum of five (5) years from the date of submission or the date of the last transaction, whichever is later;
- Support Communications: Retained for two (2) years from the date of the last interaction, for service quality and dispute resolution purposes;
- Marketing Preferences: Retained until you withdraw consent or unsubscribe, plus a reasonable period to honour the opt-out.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification of the individual.
10 Data Security
cuci22 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and cuci22's servers;
- Encrypted storage of sensitive personal data and financial records at rest;
- Two-factor authentication (2FA) available for all registered accounts and mandatory for administrative access;
- Strict role-based access controls ensuring only authorised cuci22 personnel with a legitimate need can access personal data;
- Regular security audits, penetration testing, and vulnerability assessments;
- Incident response procedures to detect, contain, and notify affected users of any data breach within appropriate timeframes.
11 International Data Transfers
cuci22's primary platform infrastructure is operated in the Asia-Pacific region. Where it is necessary to transfer your personal data to service providers or infrastructure located outside Malaysia, cuci22 will ensure that such transfers are protected by appropriate safeguards, including contractual data processing agreements that impose equivalent data protection obligations on the recipient.
cuci22 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate legal transfer mechanisms.
12 Your Rights
As a user of cuci22, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us using the details provided in Section 17.
Request a copy of the personal data cuci22 holds about you, including what data is stored, how it is used, and with whom it has been shared.
Request correction of any personal data that is inaccurate or incomplete. For account details, you may update some information directly through your account settings.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations (e.g., AML record-keeping requirements).
Request that cuci22 temporarily or permanently stop processing your personal data, for example while the accuracy of data is being investigated.
Request a copy of your personal data in a structured, machine-readable format, where technically feasible, to transfer to another service provider.
Object to processing of your personal data where cuci22 relies on legitimate interests, including objection to direct marketing communications at any time.
Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
If you believe your data rights have been infringed, you have the right to complain to the relevant data protection authority in your jurisdiction.
cuci22 will respond to all valid data rights requests within thirty (30) calendar days. In complex cases, we may extend this period by a further thirty (30) days, in which case we will notify you in writing of the extension and the reasons for it.
13 Children, Minors & Age Verification
The cuci22 Platform is strictly restricted to individuals aged 21 years and above. cuci22 does not knowingly collect or process personal data from individuals under the age of 21. Age is verified through the KYC process, and accounts found to belong to persons under the minimum age are immediately suspended.
If you believe that a minor has registered on the Platform or that cuci22 has inadvertently collected personal data from an individual under 21 years of age, please contact us immediately at the address provided in Section 17. Upon notification and verification, cuci22 will take prompt steps to delete the relevant data and close the associated account.
14 Responsible Gambling Data Processing
cuci22 processes certain personal data specifically for responsible gambling purposes. This includes monitoring player behaviour for indicators of problem gambling (such as rapid escalation of bet sizes, extended uninterrupted sessions, or repeated failed withdrawal attempts), and administering self-exclusion, cooling-off, and deposit limit requests.
Data processed for responsible gambling purposes — including self-exclusion records and problem gambling flags — is handled with heightened sensitivity. This data is accessed only by authorised personnel responsible for player protection and is retained for the duration required to give effect to the relevant restriction, plus any legally mandated period thereafter.
If you wish to exercise a self-exclusion or impose a deposit limit, please contact our support team or visit our Responsible Gambling page. Responsible gambling data is not shared with third parties except where required by law or where necessary to give effect to an exclusion request on a shared platform network.
15 Third-Party Services & Links
The cuci22 Platform may reference third-party game providers, payment processors, and service partners in the course of delivering our services. While cuci22 selects service providers carefully and requires them to maintain appropriate data protection standards, we are not responsible for the privacy practices of third-party entities. This Policy applies solely to data processing conducted by cuci22 as data controller.
For information about how specific payment providers (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, or Public Bank) handle your data, please refer to their respective privacy policies.
16 Amendments to This Policy
cuci22 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or platform operations. Material changes will be communicated to registered users via email notification and/or a prominent notice on the Platform at least fourteen (14) days prior to the changes taking effect.
The date of the most recent revision is shown at the top of this document. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated practices. If you do not agree with any amended Policy, you should cease using the Platform and may request account closure.
17 Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the personal data cuci22 holds about you, please contact our Data Protection team through the following channels:
- Live Chat: Available 24/7 on the cuci22 Platform — fastest channel for general queries, average response under 5 minutes;
- WhatsApp: Available 24/7 in English, Bahasa Melayu, and Chinese;
- Email: [email protected] (plain text — not a clickable link). For data rights requests, please use "Privacy Request" in your subject line to ensure prompt routing to the correct team.
Data rights requests submitted via email will receive an acknowledgement within three (3) business days and a substantive response within thirty (30) calendar days.
For matters relating to account closures, responsible gambling tools, or self-exclusion, please visit our Responsible Gambling page or contact support directly.