Privacy Policy NKCUCI — How We Protect Your Personal Data

1. Personal Data We Collect

NKCUCI only collects data necessary to operate the platform and fulfil legal obligations. We do not collect excessive or irrelevant data beyond the scope of our services.

Identity Data

• Full name as stated on your identity card.
• Identity card number (MyKad) or passport number for non-citizen users.
• Date of birth for mandatory age verification.
• Current residential address.
• A selfie holding your identity document (for advanced KYC verification).

Contact Data

• An active and reachable email address.
• A valid Malaysian mobile phone number.

Financial Data

• Bank account number and bank name for withdrawal purposes.
• Registered e-wallet account number (TNG, GrabPay, Boost).
• Deposit and withdrawal transaction records.
• Bank statements (if required by the compliance team for specific cases).

Platform Usage Data

• Login records including IP address, timestamp, and device used.
• Gaming activity and wagering history.
• Records of interactions with the customer support team.
• Account settings and communication preferences within the platform.

2. How We Collect Your Data

Your personal data is collected through several distinct channels throughout your use of the NKCUCI platform:

Directly from You

Data you enter directly during account registration, KYC document submission, withdrawal request creation, account profile completion and communications with our customer support team.

Automatically via the Platform

When you use the NKCUCI platform, our systems automatically record certain technical data including IP address, browser type and version, device operating system, pages visited and session duration. This data is collected via cookies, tracking pixels and server logs.

From Legitimate Third Parties

In specific cases required for identity verification or anti-money laundering compliance, NKCUCI may receive additional data from licensed identity verification service providers and relevant authorities pursuant to a legal order.

3. Purpose of Personal Data Processing

NKCUCI processes your personal data on valid legal grounds and only for the stated purposes. The table below outlines the primary processing purposes and their corresponding legal bases:

4. Data Sharing with Third Parties

NKCUCI does not share your personal data with third parties except in the circumstances described below. In all cases, data sharing is limited to the minimum information necessary.

Trusted Service Providers

We work with carefully selected third-party service providers to support platform operations — including cloud infrastructure providers, licensed payment gateways, identity verification services, and analytics tools. All providers are bound by strict data processing agreements and are not permitted to use your data for their own purposes.

Legal Obligations

NKCUCI will disclose personal data when required by law, court order, or a competent authority — including anti-money laundering units and relevant enforcement agencies. In such cases, we will endeavour to notify you unless prohibited from doing so by law.

Business Transfers

Should nkcuci be involved in a merger, acquisition, or asset sale, user data may be transferred to the relevant parties. You will be notified via email and an in-platform notice at least 30 days before any such transfer takes place.

5. Data Security Measures

NKCUCI takes security infrastructure seriously to ensure your personal data is always protected against unauthorised access, use, or disclosure.

While we take all reasonable measures, no system is 100% secure. In the event of a data breach involving your information, we will notify you within 72 hours of detection in accordance with legal requirements.

6. Data Retention Period

NKCUCI retains your personal data only for as long as necessary to fulfil the purposes stated in this policy or to comply with legal obligations. The following are general retention period guidelines:

• KYC and identity verification records: Retained for 7 years after account closure, in line with anti-money laundering legal requirements.
• Financial transaction records: Retained for 7 years for audit and tax compliance purposes.
• Gaming activity data: Retained for 2 years from the date of the last transaction.
• Support communication logs: Retained for 2 years after the case is closed.
• Active account data: Retained for the duration of the active account and 90 days after closure.

Once the retention period expires, data will be securely deleted or anonymised in accordance with industry-standard procedures.

7. Your Rights Under PDPA

As a data subject, you have the following rights regarding your personal data held by nkcuci. All requests will be processed within 30 calendar days.

To exercise any of the above rights, contact our data protection team through the customer support section in your account. You will need to verify your identity before your request can be processed.

8. Use of Cookies and Tracking Technologies

The nkcuci platform uses cookies and similar tracking technologies to enhance your experience and gather analytics data that helps us understand how the platform is used.

Types of Cookies We Use

• Essential Functional Cookies (Mandatory): Required for the platform to operate correctly — including login verification, session security and language preferences. These cookies cannot be disabled.
• User Preference Cookies: Saves your personal preferences such as display settings and game preferences for a consistent experience.
• Analytics Cookies (Consent Required): Collects anonymised data on usage patterns to help us improve the platform. Can be disabled.
• Marketing Cookies (Consent Required): Used to display relevant promotions to you. Entirely optional and consent can be withdrawn at any time.

You can manage your cookie preferences through your web browser settings or via the cookie management panel available at the bottom of every page on our platform.

9. Protection of Children's Data

The nkcuci platform is intended for individuals aged 18 and above. We do not knowingly collect personal data from minors. Should we discover that a minor's data has been collected without our knowledge, we will take immediate action to delete it and close the associated account.

If you are a parent or guardian who believes your child has registered on our platform, please contact our support team immediately via 24/7 live chat.

10. International Data Transfers

NKCUCI may process or store your data on servers located outside Malaysia. In all such cases, we ensure that:

• The recipient country maintains a level of data protection equivalent to or exceeding Malaysia's standards.
• Appropriate data processing agreements are signed with all involved service providers.
• Data transfers are kept to a minimum and limited strictly to legitimate operational requirements.

11. Amendments to the Privacy Policy

NKCUCI reserves the right to update this Privacy Policy from time to time to reflect changes in operational practices, legal requirements, or platform improvements. When material amendments are made:

• The "Updated" date at the top of the document will be revised.
• A notice will be displayed in your account at least 14 days before the amendment takes effect.
• For significant amendments, a notification email will be sent to your registered address.

Continued use of the platform after the amendment's effective date constitutes your acceptance of the latest version of this Privacy Policy.

12. How to Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please reach out to our data protection team through the following channels:

• 24/7 Live Chat: Via the chat icon in the NKCUCI app or website — the fastest way to get a response.
• Email: [email protected] — for written requests requiring a record reference.
• In Account: The "Help Centre" → "Privacy & Data" section in your account.

We are committed to responding to all privacy enquiries within 5 business days and fulfilling data rights requests within 30 calendar days.