M2cuci Privacy Policy – Data Protection for Malaysian Members

1Information We Collect

M2cuci collects your personal information through several channels when you interact with our platform. This collection takes place during the registration process, day-to-day use of our services and communications with our support team. The types of information we collect are as follows:

Information you provide directly:

• Full name as stated on your Malaysian identity card or passport.
• Date of birth for minimum age verification purposes (18+).
• An active email address for account communications and security notifications.
• A Malaysian phone number for OTP verification and customer support.
• Residential address for KYC compliance purposes where required.
• A copy of your identity document (MyKad or passport) for the KYC process.
• Registered payment method details — account holder name and bank account or digital wallet number.

Automatically collected information:

• The IP address of your device each time you log in or use the platform.
• Device information — device type, operating system, browser version.
• Activity log data — pages visited, session duration, and actions taken within the platform.
• Cookie data and tracking technologies associated with your usage session.

2How We Use Your Information

Every piece of information collected by m2cuci is used for legitimate and transparent purposes. We do not use your data for any purpose other than those stated below:

• Service provision: Enabling you to register an account, log in, make deposits, withdraw funds, play games and access all features of the m2cuci platform.
• Identity verification: Conducting KYC processes to verify members' identity, age, and eligibility in line with platform operational requirements.
• Account security: Detecting and preventing unauthorised access, fraud, money laundering and suspicious activity on the platform.
• Transaction processing: Facilitating deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, ShopeePay and other supported payment methods.
• Service communications: Sending important account notifications, transaction confirmations, security updates, and promotional information (with your consent).
• Customer support: This enables the m2cuci support team to assist you effectively when you reach out via live chat or email.
• Responsible gambling: Monitoring usage patterns to identify signs of problem gambling and suggesting appropriate limit features or support to members who may need it.
• Platform enhancements: Analyzing aggregated usage patterns (without individual identification) to improve user experience and platform features.
• Legal compliance: Fulfilling legal obligations, regulatory requirements, and directives from relevant authorities.

3Sharing Data With Third Parties

M2cuci affirms that we does not sell, rent, or transfer members' personal information to any third party for marketing or commercial purposes. However, there are specific situations where we may need to share certain data with selected third parties, solely to enable us to provide services to you:

• Payment gateway providers: To process deposit and withdrawal transactions via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, and ShopeePay. Only the minimum information required to complete a transaction is shared.
• KYC service providers: Sharing identity documents for identity verification purposes, carried out by authorised third parties bound by strict confidentiality agreements.
• Game providers: Game session information required to enable the integration of games from slots, Live Casino and sports providers to function within the m2cuci platform.
• Legal authorities: In circumstances where the law requires disclosure, or where a valid directive is received from an authorised law enforcement agency.
• Technical infrastructure provider: Server hosting and cloud infrastructure services required for platform operations, subject to strict data protection agreements.

All third parties we work with are bound by data protection agreements that prohibit them from using m2cuci member information for any purpose beyond what is specified in those agreements.

4Data Security Measures

M2cuci continually invests in best-in-class security infrastructure and practices to protect member data from unauthorised access, loss, alteration, or accidental disclosure. The key security measures we have in place include:

5Cookies & Tracking Technologies

M2cuci uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. There are several types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session management, security, and transaction processing. These cookies cannot be disabled as they are critical to platform operations.
• Performance Cookies: Collects information on how you use the platform — most frequently visited pages, time spent in each section, and any error messages encountered. This information is used in aggregate form to improve platform performance.
• Functional Cookies: Remembering your preferences such as selected language, display settings and other information that allows us to provide a more personalised experience.
• Analytics Cookies: Helps us understand how members interact with the platform as a whole. This data is used to make product improvement decisions based on actual usage patterns.

You can manage your cookie settings through your web browser's preferences. However, disabling essential cookies may affect platform functionality and cause certain features to not work as intended. Continued use of the m2cuci platform after receiving notice of our cookie usage will be taken as your consent to that use.

6Your Privacy Rights as an m2cuci Member

As an m2cuci member, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

• Right to access: You have the right to request a copy of the personal data we hold about you. We will provide this information in a readable format within 30 days of receiving your request.
• Right to rectification: If any information in your account is inaccurate or out of date, you have the right to request a correction. You can update most information directly through your account settings page.
• Right to erasure: Under certain circumstances, you may request the deletion of your personal data from our systems. Please note that some data may need to be retained for a specified period for legal compliance reasons.
• Right to restrict processing: You may request that we restrict how we process your data in certain situations — for example, while a dispute regarding data accuracy is being resolved.
• Right to object: You may object to the processing of your data for direct marketing purposes at any time. We will stop using your data for that purpose immediately upon receiving your objection.
• Right to data portability: You have the right to receive your personal data in a structured, machine-readable format for transfer to another service of your choice.

To exercise any of the above rights, please contact the m2cuci privacy team by email at support@m2cuci.biz clearly stating the type of request you are making. We will process requests within a reasonable timeframe, not exceeding 30 days.

7Data Storage & Deletion

M2cuci retains members' personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general data retention policy is as follows:

• Active account data is retained for the duration that your account remains active and in use.
• After account closure, financial transaction data is retained for 7 years to comply with legal requirements and financial audit obligations.
• Gaming activity data and betting records are retained for 3 years for dispute resolution and security audit purposes.
• Technical logs and IP data are retained for 90 days before being automatically deleted.
• Customer support communication records are retained for 2 years from the date of the last interaction.

Once the retention period expires, data will be securely deleted using methods that ensure it cannot be recovered. For accounts closed at a member's own request, the deletion of non-financial data will be initiated within 30 days of the closure date.

8Cross-Border Data Transfers

In the context of online platform operations, some members' personal data may be processed or stored on servers located outside Malaysia — for example, in connection with cloud services or integrations with international game providers. m2cuci takes the following measures to ensure your data remains protected even when such transfers occur:

• We only engage third-party providers that can demonstrate a level of data protection equivalent to or exceeding the standards set out under Malaysia's Personal Data Protection Act.
• Legally binding data processing agreements are signed with all third-party providers before any data is transferred.
• All data transfers are conducted through encrypted channels to ensure data security in transit.
• We conduct regular reviews of third-party data protection practices to ensure ongoing compliance.

If you have concerns about cross-border data transfers, please contact us at support@m2cuci.biz for more information on the safeguards we have in place.

9Children's Privacy

The m2cuci platform is a digital entertainment service that strictly limited to individuals aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If you believe a minor under the age of 18 has registered an m2cuci account or provided us with their personal information without your knowledge, please contact us immediately at support@m2cuci.biz. We will take immediate steps to:

• Verifying the individual's age through an appropriate verification process.
• Closing the relevant account if it is found to have been registered by an underage individual.
• Delete all personal data collected from that individual as promptly as possible.
• Refunding any deposited funds, subject to the required verification process.

M2cuci employs multiple mechanisms to prevent registration by underage individuals, including an age verification process at registration and KYC checks conducted before the first withdrawal is processed.

10Privacy Policy Amendments

M2cuci reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, evolving legal requirements, or changes to the services we offer.

When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Notifying all registered members via email or in-platform notification at least 7 days before changes take effect.
• For significant changes, we may seek members' renewed consent before continuing to process their data.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Continued use of the m2cuci platform after any changes take effect will be considered your acceptance of the updated policy.

This Privacy Policy was last updated on January 2026.