12win Privacy Policy – Data Protection & Personal Information

Welcome to the 12win Privacy Policy page. We at 12win understand how important data privacy is to you as a user of our platform. This document has been prepared to clearly and transparently explain how we manage the personal information you share with us when registering and using 12win's services.

This Privacy Policy applies to all users of the 12win platform, including those accessing via the official website at 12win.cx or via the 12win mobile app for Android and iOS. By using any of our services, you acknowledge that you have read and agreed to this privacy policy.

12win operates in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. We are committed to ensuring your personal information is protected, used responsibly, and never sold to third parties for advertising or marketing purposes without your knowledge.

12win collects your personal information through several methods to ensure our platform runs smoothly, remains secure, and delivers the best experience to every member. The following are the categories of data we collect:

A. Account Registration Information

• Full name (as shown on identity document)
• Identity card number (MyKad) or passport number
• Date of birth (for 18+ age verification)
• Active email address
• Mobile phone number
• Account password (stored in encrypted hash form — readable by no one)

B. Financial & Payment Information

• Bank account number or e-wallet (DuitNow, FPX, Touch 'n Go, Boost, GrabPay)
• Bank account holder name
• Deposit and withdrawal transaction records
• Wagering and game activity history

C. Device Technical Information

• IP address of the device used during login
• Web browser type and operating system
• Mobile device ID (Device ID) for app accounts
• Approximate location data based on IP (state/city only)
• Platform usage data such as session duration, pages visited, and in-app actions

D. Identity Verification Documents (KYC)

• Copy of MyKad or passport (front and back)
• Selfie holding your identification document
• Bank statement or proof of residence for address verification

Every piece of information we collect is used for specific and legitimate purposes. 12win does not use your data for any purpose beyond the scope stated below:

• Account Management: Creating, verifying and maintaining your member account so you can log in and use the platform securely.
• Transaction Processing: Processing your deposits and fund withdrawals accurately and efficiently through the appropriate payment channels.
• Identity Verification (KYC): Meeting legal compliance requirements related to anti-money laundering (AML) and member age verification.
• Platform Security: Detecting and preventing fraudulent activity, unauthorised access, multi-accounting and platform abuse.
• Customer Support: Helping you resolve technical issues, account inquiries or transaction-related complaints.
• Legal Compliance: Meeting mandatory reporting requirements to the relevant authorities in accordance with applicable Malaysian law.
• Service Improvement: Analysing usage patterns in aggregate (not individually) to improve the platform's interface and user experience.
• Important Communications: Sending important notifications relating to your account, security, transaction verification and policy updates.

12win employs internationally certified security infrastructure to ensure your personal data is kept secure at all times. We take a multi-layered approach to protecting your information against unauthorised access, data breaches, and cyber threats.

Technical Measures We Employ:

• 256-Bit SSL Encryption: All data transmitted between your device and 12win's servers is protected with AES-256 encryption — the same standard used by leading banks worldwide.
• Encrypted Password Storage: Your password is never stored in plain text — only in an irreversible hash format (bcrypt) that cannot be decrypted.
• Two-Factor Authentication (2FA): We provide 2FA protection via authenticator app or SMS for all financial transactions and changes to sensitive information.
• Real-Time Monitoring: Our 24/7 monitoring system detects any unusual activity in your account and will automatically trigger a security alert if required.
• Data Segregation: Servers storing financial data, personal identification data, and activity log data are physically separated to minimise the risk of cross-contamination.
• Regular Security Audits: The 12win platform undergoes regular security assessments and penetration testing by independent third parties.

Data Retention Period:

• Active account data is retained for the duration your account remains active plus 7 years after account closure (in accordance with legal compliance requirements).
• Financial transaction records are retained for a minimum of 7 years from the date of the transaction.
• Technical access logs are retained for 90 days and then automatically deleted.
• KYC documents are retained for the duration of the active account and 5 years after account closure.

12win does not sell, rent, or disclose your personal information to third parties for commercial purposes. However, in certain limited situations, we may need to share some of your information with the following parties:

• Payment Processors: Payment service providers such as local banks and e-wallet operators receive the transaction information required to process your deposits and withdrawals. They are subject to their own privacy policies and Bank Negara Malaysia regulations.
• Technical Service Providers: Hosting, cybersecurity, and platform analytics providers who sign strict non-disclosure agreements (NDAs) and are only permitted to process data under 12win's instructions.
• Game Providers: Third-party game providers (such as live casino providers) may receive session IDs and game data required for gameplay functions only — not full personal identification information.
• Legal Authorities: 12win will disclose the required information to the police, courts, or regulatory agencies when mandated by court order or applicable Malaysian law.
• Risk Management & Fraud: Recognised credit reference bureaus or fraud prevention agencies may receive limited information for verification and prevention of illegal activity.

12win uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better experience for you. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use:

• Essential Cookies: Required for core platform functions such as login verification, session management, and security. These cookies cannot be disabled.
• Functional Cookies: Remembering your preferences such as display language, display settings and saved login details for a smoother repeat experience.
• Analytics Cookies: Helping us understand how users interact with the platform so we can improve navigation and layout. Data collected is in aggregate form and does not identify individuals.
• Security Cookies: Detecting suspicious login attempts, identifying new devices and protecting accounts from unauthorised access.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect platform functionality and you may be unable to log in or use certain platform features properly.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal information you share with 12win. We are committed to respecting and facilitating the exercise of these rights:

12win is a platform designed exclusively for users who are aged 18 years and above. We do not intentionally collect or process personal information from individuals under the age of 18.

All new account registrations go through a strict age verification process, including a date-of-birth check at registration and full KYC verification for the first withdrawal. This ensures the 12win platform cannot be accessed by children or underage minors.

If we determine that a minor has registered using false information, we will:

• Immediately suspend and close the relevant account.
• Deleting all personal information associated with the account.
• Returning any remaining account balance in accordance with the appropriate procedures.
• Reporting the case to the relevant authorities if required.

12win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or platform service improvements.

When any material amendments are made to this policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on the platform's home page for a minimum of 7 days.
• Sending email notifications to all active registered members if the amendment involves a significant change in how we manage your data.

Continued use of the 12win platform after any privacy policy amendment is published will be considered your acceptance of those changes. If you disagree with any amendment, you have the right to stop using the platform and request closure of your account.

If you have any questions, concerns or complaints about how 12win handles your personal data, our team is ready to assist you. We take every privacy inquiry seriously and will ensure a clear, accurate response within a reasonable timeframe.

• Live Chat: The fastest way — available directly within the 12win platform or website, 24 hours a day, 7 days a week.
• Privacy Email: [email protected] — for official requests relating to data access, correction, or deletion that require supporting documentation.
• Response Time: General enquiries are answered within 24 hours; official PDPA-related requests are processed within 14 business days.

All privacy-related communications are handled in strict confidence. Your identity and request details will not be disclosed to any party other than the staff responsible for resolving your issue.

If you believe that 12win has failed to fulfil our obligations under PDPA 2010, you also have the right to lodge a complaint with Department of Personal Data Protection Malaysia (JPDP) which is the official regulatory body for data protection in Malaysia.