22maju Privacy Policy – Our Commitment to Protecting Malaysian Players' Personal Data

22maju understands how important privacy is to every Malaysian player who trusts our platform for their online entertainment. The trust of our more than 500,000 registered members is something we never take lightly — and protecting your personal data is among the most important responsibilities we carry as an accountable entertainment platform operator.

This Privacy Policy is designed to give you complete clarity on 22maju's data management practices — what information we collect, why we need it, how we use it, who may have access to it, and your rights in relation to that personal data. We believe transparency is the foundation of trust, and your trust is the foundation of 22maju's operations.

This policy has been drafted in accordance with the provisions of Malaysia's Personal Data Protection Act 2010 (PDPA 2010), the primary legal framework governing the processing of personal data in Malaysia. 22maju is committed to full compliance with all requirements under this law and regards such compliance as a minimum standard — not a ceiling — for our privacy practices.

If you have any questions about how 22maju handles your personal data that are not addressed in this document, please do not hesitate to reach out to our support team, who are available to assist you 24 hours a day, 7 days a week.

22maju collects various categories of information necessary to deliver our platform services in a secure, fair, and efficient manner. We only collect what is genuinely needed for clear and legitimate purposes — nothing more, nothing less.

Information you provide directly to us:

• Registration information: username, password, phone number, and any additional information required during the 22maju account registration process.
• Identity verification information (KYC): full name, identity card or passport number, date of birth, and supporting documents required to meet our compliance obligations.
• Payment information: details of your chosen payment method, such as your Touch 'n Go, GrabPay, Boost, ShopeePay, or DuitNow e-wallet account number, or FPX information required to process your deposits and withdrawals.
• Communication information: any messages, complaints, or enquiries you submit to the 22maju support team through any of our available communication channels.

Automatically collected information:

• Technical data: IP address, device type, operating system, browser type, and language settings.
• Usage data: pages visited, games played, session duration, in-platform actions, and general usage patterns.
• Transaction data: a complete record of all deposits, withdrawals, bets, and winnings in your 22maju account.
• Location data: approximate location information based on your IP address for security and compliance purposes.

22maju uses the information we collect solely for legitimate and transparent purposes. Below is a detailed explanation of how your personal data is used in the day-to-day operations of the 22maju platform:

• Providing and managing services: processing your account registration, verifying your identity, handling MYR deposits and withdrawals, and ensuring all games on 22maju run smoothly and fairly for you.
• Account security and fraud detection: monitoring account activity to detect any unauthorised access, fraudulent attempts, or suspicious behaviour that could compromise your account or the integrity of the 22maju platform.
• Legal and regulatory compliance: to fulfil our legal obligations under Malaysia's PDPA 2010, anti-money laundering (AML) requirements, and any other applicable legislation binding 22maju's operations.
• Customer support: addressing your enquiries, complaints, and support requests efficiently and effectively, including maintaining communication records for reference and service improvement purposes.
• Responsible gambling: analysing your gameplay patterns to identify early signs of problem gambling and offering appropriate assistance or self-control tools when needed, as part of 22maju's genuine commitment to player well-being.
• Marketing and promotions (with your consent): sending information about bonus offers, special promotions, and the latest games at 22maju only to those of you who have consented to receive such communications.
• Continuous platform improvement: analysing aggregated and anonymised usage data to understand how Malaysian players use 22maju and to make meaningful improvements to the platform's interface, functionality, and overall experience.

22maju does not use your personal data to make automated decisions that materially affect your rights without appropriate human involvement. Where any automated decision-making is required, you have the right to request a human review of that decision.

22maju does not sell, rent, or transfer your personal information to third parties for their own marketing purposes under any circumstances. However, there are limited situations where 22maju may need to share your information with certain parties in order to deliver our services to you safely and in accordance with the law:

• Payment service providers: information required to process your transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u / CIMB Clicks) is shared with the respective providers solely for the purpose of processing those transactions.
• Technology and infrastructure providers: third-party service providers who assist us in operating the 22maju platform — such as cloud computing, analytics, and cybersecurity services — may have access to certain data solely to enable them to deliver those services to us. All such providers are bound by strict data protection agreements.
• Game developers: game data required to record your winnings, bets, and game outcomes is shared with the relevant game developers — such as Pragmatic Play and SmartSoft Gaming — to ensure record accuracy and the resolution of any disputes.
• Legal authorities: 22maju will disclose your personal information to the relevant authorities when required to do so by law, court order, or a lawful directive, or where such disclosure is necessary to protect the rights, property, or safety of 22maju, our members, or the public.

In all instances of data sharing, 22maju shares only the minimum information necessary for the stated purpose. All third parties that receive data from 22maju are bound by strict confidentiality and data protection agreements, and are not permitted to use that data for any purpose beyond what has been agreed.

Protecting your personal data is an absolute priority in the design and operation of the 22maju platform. We continuously invest in the latest security infrastructure to keep your data safe from cyber threats that grow more sophisticated every day.

The technical security measures we have implemented at 22maju include:

• 256-bit SSL encryption: all data in transit between your device and 22maju's servers is encrypted using 256-bit SSL/TLS standards – the same standard used by leading banking institutions in Malaysia.
• Encryption of data at rest: sensitive data stored in our databases is encrypted to ensure it remains unreadable even in the event of unauthorised physical access to our storage systems.
• Multi-level access controls: access to members' personal data is restricted to specifically authorised personnel and protected by multi-factor authentication and detailed audit logs.
• 24/7 security monitoring: our automated monitoring system is constantly vigilant, detecting and responding to any suspicious access attempts or security anomalies in real time.
• Regular penetration testing: 22maju conducts regular security testing and vulnerability assessments to identify and address any weaknesses before they can be exploited.
• Incident response plan: in the event of any data security breach, 22maju has a clear incident response procedure in place to contain the threat, assess the impact, and notify affected members as quickly as possible in accordance with legal requirements.

While we take every reasonable step to protect your data, no security system can guarantee absolute 100% protection. We therefore encourage you to take your own precautions as well — such as using a strong and unique password for your 22maju account, not sharing your login credentials, and notifying us immediately if you suspect any suspicious activity on your account.

22maju uses cookies and similar tracking technologies to enhance your experience on our platform and to ensure certain features function correctly. Cookies are small text files stored on your device when you visit the 22maju platform.

Types of cookies used by 22maju:

• Essential cookies (required): these cookies are required for the basic functions of the 22maju platform, such as login session management, account security, and transaction processing. Without them, the 22maju platform cannot function properly and you will be unable to use it.
• Performance cookies: these cookies collect information about how players use the 22maju platform – the most visited pages, time spent, and any errors encountered. This information is used in aggregate and anonymised form to improve performance and the overall user experience.
• Functional cookies: these cookies allow 22maju to remember your preferences — such as language, game settings, and display options — so we can deliver a more personalised experience every time you use the platform.
• Analytics cookies: we use analytics tools to understand overall usage patterns across the 22maju platform, guiding our product improvement decisions. This analytics data is processed anonymously and is not linked to your personal identity.

You can manage or delete cookies through your browser settings at any time. Please note, however, that removing or blocking essential cookies may affect your ability to log in and use certain features of the 22maju platform.

22maju retains your personal data for as long as your account remains active and for as long as necessary for the purposes set out in this Privacy Policy. We follow the principle of data minimisation — we do not keep data for longer than is required.

Data retention guidelines at 22maju:

• Active account data: for as long as your account remains active with 22maju, we will retain your personal information to ensure you can access all platform services without interruption.
• Data following account closure: after account termination, certain data may be retained for periods required by law – for example, financial transaction records may need to be kept for up to seven years in accordance with Malaysia's financial and tax compliance requirements.
• Identity verification data (KYC): identity verification documents are retained in accordance with the requirements of applicable anti-money laundering legislation.
• Security logs: activity and security logs are retained for as long as required for security investigation and audit compliance purposes.

Once the relevant retention period has elapsed, your data will be securely deleted or fully anonymised so that it can no longer be linked to your identity. We follow secure deletion procedures to ensure that deleted data cannot be recovered.

As a 22maju member and data subject under Malaysian data protection law, you have several important rights regarding your personal data that we fully respect:

To exercise any of the rights above, please contact the 22maju support team by email at [email protected]. We will process your request within a reasonable timeframe, typically within 30 working days of receiving a complete request. Some requests may require additional identity verification before they can be processed, to ensure the security of your account.

22maju strictly prohibits individuals under the age of 18 from registering or using our platform under any circumstances. Protecting minors is a social responsibility we take extremely seriously as a responsible entertainment platform operator in Malaysia.

Measures we have put in place to protect children and young people:

• A rigorous age verification process at registration — every applicant must confirm they are 18 years of age or older before their account is approved.
• A KYC (Know Your Customer) process requiring identity verification to confirm a member's actual age when necessary.
• Any account suspected of belonging to an underage individual will be suspended immediately while an investigation is carried out.

22maju does not knowingly collect or process any personal data from individuals under the age of 18. Should we discover that we have inadvertently collected data from a minor, we will take immediate steps to delete that data and close the relevant account.

We encourage parents and guardians to monitor the online activities of children in their care and to make use of parental control tools available on devices used by minors, to prevent access to entertainment platforms such as 22maju that are not suitable for underage users.

The security of your financial information is among 22maju's highest priorities. All transactions on our platform are conducted in MYR and processed through trusted Malaysian local payment methods – Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u / CIMB Clicks).

How 22maju protects your financial data:

• Full transaction encryption: all financial transaction information is encrypted using the same security protocols employed by leading Malaysian banks. Your payment details are never transmitted as readable plain text.
• No full card or e-wallet details are stored: 22maju does not store your full e-wallet account details or sensitive payment information in our systems. Payment processing is handled by certified payment providers operating under strict industry security standards.
• Real-time fraud monitoring: our systems monitor all transactions in real time to detect suspicious patterns — such as access attempts from unusual locations or irregular transactions — and will take immediate protective action whenever necessary.
• Multi-layered payment verification: for withdrawals exceeding certain limits, 22maju may require additional verification to safeguard your funds and prevent unauthorised withdrawals.

If you suspect any unauthorised transactions on your 22maju account, please contact our support team immediately. We will treat every such report as high priority and take the necessary steps to protect your interests.

22maju reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or changes in how the 22maju platform operates. Each updated version of the Privacy Policy will be published on this page with a clear revision date at the top of the document.

For material changes — those that significantly alter how we process your personal data — 22maju will make every effort to notify you in advance, either through an in-platform notification or via your registered email. This gives you the opportunity to make an informed decision about whether you wish to continue using the 22maju platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal information. Your continued use of the 22maju platform following the publication of any changes to this Privacy Policy will be deemed as your acceptance of those changes.

If you have any questions, concerns, or complaints regarding how 22maju handles your personal data, or if you wish to exercise any of your privacy rights as described in this document, please do not hesitate to contact us.

Contact channels for privacy enquiries at 22maju:

• Email: [email protected] — please include "Privacy Enquiry" in the subject line of your email. We aim to respond within 24 hours.
• Live Chat: available 24/7 directly through the 22maju platform once you are logged in to your account.

For information on our platform's terms of use, please refer to Terms & Conditions us. For responsible gambling guidance, please visit the Responsible Gaming us. For frequently asked questions, please refer to FAQ our comprehensive