Privacy Policy Kaca21 – Personal Data Protection for Malaysian Members

Kaca21 is the responsible data controller for all personal information collected through the kaca21.my platform. As data controller, kaca21 is responsible for ensuring that all personal data we hold is processed lawfully, fairly, and transparently in accordance with applicable law in Malaysia.

This kaca21 Privacy Policy forms part of our suite of legal documents, which includes the Terms & Conditions and the Responsible Gambling Policy. All three documents should be read together for a full understanding of your rights and responsibilities as a kaca21 member.

• Data Controller: kaca21 (kaca21.my)
• Jurisdiction: Malaysia
• Governing law: Personal Data Protection Act 2010 (PDPA) Malaysia
• DPO (Data Protection Officer) Email: [email protected]

Kaca21 collects personal data through several different channels throughout your journey with us. Below is a detailed explanation of the types of data collected and how they are obtained:

Data you provide directly to kaca21:

• During registration: full name, Malaysian phone number, email address, date of birth, and account password.
• During the KYC (identity verification) process: MyKad number, image of your identity card, and possibly a recent bank statement or utility bill as proof of address.
• During financial transactions: information related to your chosen payment method — whether DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, or FPX via Maybank2u or CIMB Clicks. Sensitive account or card details are processed directly by PCI-DSS certified payment gateways and are not stored by kaca21.
• When contacting support: the content of any live chat conversations, emails, or help tickets you submit to the kaca21 team.

Data collected automatically when you use the kaca21 platform:

• Technical data: IP address, device type (Android/iOS smartphone or computer), operating system, browser version (Chrome, Safari, Firefox), and screen resolution.
• Usage data: pages visited on kaca21.my, time spent, clicks and actions within the platform, and navigation flow.
• Gaming data: history of games played (slots, live casino, keno, and others), total wager amounts in RM, wins and losses, session duration, and use of features such as Autoplay or Turbo Spin.
• Cookie data: information stored by session and analytics cookies while you browse kaca21.my.

The personal data kaca21 collects is used for the following purposes, all of which are directly related to providing platform services to Malaysian members:

• Account management: Creating and managing your kaca21 account, verifying your identity at login, and keeping your account secure at all times.
• Processing of financial transactions: Processing deposits in Malaysian Ringgit (RM) via your chosen local Malaysian payment method, and processing withdrawals of your winnings to a valid account in your name.
• Identity verification (KYC): Meeting legal obligations related to anti-money laundering (AML) and ensuring the kaca21 platform is not misused for unlawful activities in Malaysia.
• Platform security: Detecting and preventing fraud, multi-account usage, bonus abuse, and any other suspicious activity that could compromise the safety of other kaca21 members.
• Responsible gambling: Monitoring members' playing patterns to identify early signs of problem gambling and recommend or apply appropriate self-control tools in a timely manner.
• Service improvement: Analysing aggregated (not individual) usage data to understand how Malaysian members interact with the kaca21 platform and to make relevant improvements.
• Service communications: Sending important notifications regarding your account, changes to terms, security alerts, and promotional information (where you have given consent to receive marketing communications).
• Legal compliance: Meeting reporting and compliance obligations required under applicable Malaysian law, including court orders or requests from lawful authorities.

Kaca21 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. However, in the course of operating the platform, kaca21 may share data with the following categories of third parties — and only to the extent necessary:

• Technical service providers: Server infrastructure providers, analytics service providers, and cybersecurity tool providers that assist kaca21 in operating the platform. All such providers are bound by strict data protection agreements and are not permitted to use kaca21 data for their own purposes.
• Payment gateways and financial institutions: Transaction data is shared with PCI-DSS accredited payment processors to facilitate deposits and withdrawals in MYR via DuitNow, Touch 'n Go eWallet, GrabPay, FPX (Maybank2u, CIMB Clicks), Boost, and ShopeePay.
• Game providers: Game session information may be shared with game providers such as Evolution Gaming, Play'n GO, and Pragmatic Play to ensure game integrity and resolve technical disputes.
• Malaysian authority: kaca21 will disclose personal data to the relevant authorities in Malaysia — including the police, MACC, Bank Negara Malaysia, or the courts — when required by law or a valid court order. This is not discretionary for kaca21; it is a legal obligation.
• Professional advisors: Lawyers, accountants, and auditors bound by professional confidentiality obligations may access certain data in the context of services they provide to kaca21.

In all cases where data is shared with legitimate third parties, kaca21 ensures a level of data protection equal to or greater than that required under this Privacy Policy and Malaysia's PDPA 2010.

Protecting the personal data of kaca21 members is an operational priority that cannot be compromised. kaca21 continuously invests in robust security infrastructure and follows industry best practices to keep your data safe at all times:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and kaca21's servers is protected with encryption protocols on par with those used by leading banks in Malaysia.
• Secure data storage: Sensitive data is stored in encrypted databases with layered access controls. Member passwords are never stored in plain text — only as an irreversible hash that cannot be decrypted.
• Role-based access control: kaca21 staff only have access to the data required for their specific role. The principle of "least privilege" is strictly enforced across the entire kaca21 organisation.
• 24/7 security monitoring: Intrusion detection systems and anomaly monitoring operate around the clock to identify and respond to any security threats promptly.
• Regular penetration testing: kaca21 conducts regular security testing by independent third-party security experts to identify and address vulnerabilities before they can be exploited.
• Staff training: All kaca21 staff who handle personal data undergo regular data protection training to ensure ongoing awareness of and compliance with kaca21's privacy policies.

Kaca21 uses cookies and similar tracking technologies to enhance your experience on the platform. Below is a transparent explanation of the types of cookies kaca21 uses and their functions:

• Essential Cookies (Required): These cookies are required for the core operation of the kaca21 platform — including maintaining your login session, remembering your language preferences, and enabling financial transaction processing. Without them, kaca21 cannot function properly. These cookies do not require your consent as they are essential to the service you have requested.
• Preference Cookies: These cookies remember your preferences and settings within the kaca21 platform — such as your preferred bet size, Turbo Spin settings, and favourite game selections. They help kaca21 deliver a more personalised and comfortable experience each time you log in.
• Analytics Cookies: These cookies help kaca21 understand how members interact with the platform — which pages are visited most often, which features are most popular, and where the user experience can be improved. Analytics data is processed in aggregate and anonymised — kaca21 does not use analytics cookies to track the personal activity of individual users.
• Security Cookies: These cookies help detect and prevent fraudulent activity, suspicious login attempts, and cyberattacks targeting kaca21 member accounts. Security cookies form part of the multi-layered protection system kaca21 uses to keep your account safe.

You can manage or delete cookies through your browser settings. However, please note that disabling or blocking essential cookies may affect your ability to use the kaca21 platform fully.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a kaca21 member have the following rights regarding your personal data. kaca21 fully respects these rights and makes it straightforward for you to exercise them:

• Right to Access: You have the right to request a copy of the personal data kaca21 holds about you. Submit your request by email to [email protected] and kaca21 will fulfil it within 21 business days.
• Right to Rectification: If any personal data we hold is inaccurate, incomplete, or out of date, you have the right to request a correction. You can update much of your information directly through your kaca21 account profile settings or by contacting our support team.
• Right to Withdraw Consent: If you have previously given consent for your personal data to be used for a specific purpose (such as marketing communications), you may withdraw that consent at any time by contacting the kaca21 support team.
• Right to Object: You have the right to object to the processing of your personal data for specific purposes that are not required for the provision of kaca21's core services. kaca21 will take every objection seriously and provide a clear response.
• Right to Restrict Processing: In certain circumstances, you have the right to request that the processing of your data be restricted — for example, while you are awaiting the correction of inaccurate data.
• Right to Data Portability: You have the right to receive the personal data you have provided to kaca21 in a structured, machine-readable format, and to request that such data be transferred directly to another party where technically feasible.

To exercise any of the rights above, contact the kaca21 Data Protection Officer by email at [email protected]. Please include your full name and kaca21 account number to help us process your request efficiently.

Kaca21 does not retain your personal data for longer than is necessary for the purpose for which it was collected, or longer than required by applicable Malaysian law:

• Active account data: For as long as your kaca21 account remains active, your personal data will be retained to enable the continued provision of our services.
• After account closure: When your kaca21 account is closed — whether at your request or by kaca21 — your personal data will be retained for a minimum of 7 years as required by Malaysian financial and tax laws. This is a legal obligation that kaca21 cannot waive.
• Financial transaction data: Transaction records in Malaysian Ringgit (RM) are retained for 7 years from the date of the transaction, in accordance with Malaysia's anti-money laundering (AML) legal requirements.
• Support communication logs: Live chat logs and emails with the kaca21 support team are retained for 2 years following the last interaction, for quality training and dispute resolution purposes.
• Cookie data: Session cookies expire when you close your browser. Persistent cookies have varying validity periods as defined in their respective cookie settings — typically ranging from 30 days to 2 years.

Once the defined retention period has lapsed, your personal data will be permanently deleted or anonymised from kaca21's systems in accordance with documented secure deletion procedures.

Kaca21 does not provide services to individuals under the age of 18. The kaca21 platform is exclusively for eligible adults in Malaysia. Accordingly, kaca21 does not knowingly collect any personal data from children or minors under the age of 18.

• At registration, kaca21 requires age verification and reserves the right to request proof of age via MyKad at any time.
• Should kaca21 discover that personal data belonging to an individual under the age of 18 has been inadvertently collected, that data will be deleted immediately and the associated account will be closed.
• Parents or guardians who believe their child under the age of 18 has registered on kaca21 should contact the kaca21 support team immediately at [email protected] for prompt action.

Kaca21 may update this Privacy Policy from time to time to reflect changes in our operations, evolving Malaysian legal requirements, or developments in technology that affect how your personal data is processed.

• Change notifications: When kaca21 makes significant changes to this Privacy Policy, we will notify you by email to the address registered to your kaca21 account and/or via an in-platform notification at least 14 days before the changes take effect.
• Effect of changes: Continued use of the kaca21 platform after the effective date of an updated Privacy Policy constitutes acceptance of those changes. If you do not agree with the changes, you have the right to close your kaca21 account before the effective date.
• Archive of previous versions: kaca21 maintains an archive of all previous versions of our Privacy Policy. If you wish to obtain a specific version, please contact the kaca21 support team.

If you have any questions, concerns, or complaints regarding kaca21's Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Data Protection Officer Email: [email protected] (for all enquiries relating to privacy and data rights)
• General Support Email: [email protected] (for general enquiries related to your kaca21 account)
• Live Chat: Available 24/7 on the kaca21.my platform — the fastest way to get immediate assistance
• Telegram: Via the official kaca21 Telegram channel listed on the platform

Kaca21 is committed to responding to all privacy-related enquiries within 5 business days. For more complex data rights requests, the response period may extend to 21 business days as provided for under Malaysia's PDPA 2010.