Cucu2 Privacy Policy — Our Commitment to Protecting Your Personal Data in Malaysia

1Introduction — cucu2's Privacy Commitment

Cucu2 understands that your personal data is both sensitive and valuable. When you register to play football, Live Casino, slots, or virtual sports on cucu2, you are entrusting us with your personal information. We take that trust seriously.

This policy is written in plain, straightforward language — not confusing legal jargon — so that every cucu2 member from Perlis to Sabah can understand exactly what happens to their data. This is not merely a legal obligation; it is part of cucu2's commitment to being a transparent and honest platform for Malaysia's gaming community.

As a responsible data processor, cucu2 fully complies with Malaysia's Personal Data Protection Act 2010 (PDPA) and all regulations and guidelines issued under it. If you have any questions about how we handle your data that are not addressed in this policy, please contact us directly at support@cucu2.best.

2Personal Data We Collect

Cucu2 only collects data necessary to provide platform services in a secure, efficient and legally compliant manner. Below are the categories of data we collect, along with their descriptions and primary purposes:

2.1 Data We Do NOT Collect

Cucu2 does not collect sensitive data unrelated to platform operations, including biometric data, medical records, political views or religious beliefs. We also do not store full credit card numbers — any sensitive payment information is handled directly by licensed and certified payment providers.

3How We Use Your Data

The personal data cucu2 collects is used solely for the following purposes — nothing more, nothing less:

• Platform Service Provision: Processing your registration, deposits, bets and withdrawals. Without this data, cucu2 cannot operate as a secure betting platform.
• Identity Verification (KYC): Verifying that you are an eligible member — aged 21 and above, a valid Malaysian citizen or resident, and not on the self-exclusion list.
• Account Security: Detecting and preventing unauthorised access, fraud attempts, and suspicious activity that could compromise your account.
• Legal Compliance: Fulfilling cucu2's obligations under Malaysia's PDPA 2010, anti-money laundering laws (AMLA), and reporting requirements to the relevant authorities where legally required.
• Customer Support: To provide relevant and effective assistance when you contact the cucu2 support team.
• Responsible Gambling: Monitoring betting patterns to identify early signs of problem gambling and reaching out to members who may need support.
• Platform Improvement: Analysing aggregated (non-individual) usage data to improve the design, performance and features of the cucu2 platform.
• Service Communications: Sending important account-related notices such as transaction confirmations, security alerts, and changes to our terms. These are not marketing communications.

4Legal Basis for Data Processing

Under Malaysia's PDPA 2010, cucu2 has a valid legal basis for each type of data processing we carry out. These bases are:

• Consent: For processing that requires your explicit consent — such as marketing communications. You provide this consent during registration and may withdraw it at any time.
• Contract Performance: For data required to fulfil the agreement between you and cucu2 — such as processing deposits and withdrawals, settling bets and managing your account. Without this data, the service contract cannot be executed.
• Legal Obligation: For processing required by Malaysian law — including the retention of financial records for audit purposes, AMLA compliance, and the reporting of suspicious activity to the relevant authorities where legally required.
• Legitimate Interest: For processing required for cucu2's legitimate interests that do not override your privacy rights — such as fraud analysis, network security and product improvements based on aggregated usage data.

5Data Sharing with Third Parties

Cucu2 does not sell your personal data to anyone. This is an absolute, unwavering commitment. That said, in the course of operating the platform, cucu2 may need to share your data with the following strictly limited categories of third parties:

5.1 Licensed Payment Providers

To process your deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, Maybank2u and CIMB Clicks, the necessary transaction information will be shared with the respective payment providers. All these providers are licensed entities regulated in Malaysia and maintain their own privacy policies and security standards in compliance with Malaysian law.

5.2 Technical Service Providers

Cucu2 works with several technical service providers to operate the platform — including server hosting services, platform analytics systems and casino game providers. All providers are bound by strict data processing agreements that prohibit them from using your data for any purpose other than those specified.

5.3 Competent Authorities

Cucu2 may be required under Malaysian law to disclose certain data to government or law enforcement authorities in specific circumstances — such as financial crime investigations, court orders, or requests from the Inland Revenue Board (LHDN), Bank Negara Malaysia, or relevant law enforcement agencies. Such disclosures are made only when required by valid legal obligation, and cucu2 will endeavour to notify you where permitted by law to do so.

6Data Security — How We Protect Your Information

Cucu2 continually invests in its security infrastructure to ensure your personal and financial data is protected to the highest standard. The key security measures we employ include:

• 256-bit SSL Encryption: All communications between your device and cucu2's servers are encrypted using TLS 1.3 with 256-bit keys — the same standard used by Malaysia's leading financial institutions.
• Encryption of Data at Rest: Sensitive data stored in cucu2's databases is encrypted at the storage level using strong encryption algorithms.
• Role-Based Access Control: Only cucu2 staff with a legitimate operational need are permitted to access specific data. All access is logged and audited on a regular basis.
• 24/7 Security Monitoring: cucu2's security monitoring system operates around the clock to detect suspicious activity, intrusion attempts, and access anomalies.
• Regular Penetration Testing: cucu2 conducts regular penetration testing carried out by independent third parties to identify and address security vulnerabilities before they can be exploited.
• Incident Management: cucu2 has a clear incident response protocol in place. In the event of a data breach that affects you, cucu2 will notify you within the timeframe stipulated by PDPA 2010 and take immediate action to contain the impact of the incident.

7Data Retention Period

Cucu2 retains your personal data only for as long as necessary for the purposes stated in this policy or as required by Malaysian law. Below are the general guidelines for retention periods:

• Active Account Data: For as long as your cucu2 account remains active, we retain all data necessary for account management and service delivery.
• Data After Account Closure: After an account is closed, cucu2 retains certain data (such as identity and transaction records) for a minimum of 7 years, as required under Malaysia's financial and Anti-Money Laundering laws (AMLA).
• Communication Records: Customer support conversation records are retained for 2 years for quality control purposes and to facilitate the resolution of any disputes that may arise at a later date.
• Technical Logs: Technical access and security logs are retained for 12 months for the purpose of threat detection and incident investigation where required.
• Marketing Data: If you have given consent for marketing communications, this data is retained until you withdraw that consent. Once consent is withdrawn, your marketing data will be deleted within 30 days.

Once the retention period has expired and there is no legal requirement compelling us to keep the data any longer, cucu2 will securely delete or anonymise your data so that it can no longer be linked back to you.

8Your Rights as a Data Subject

Under Malaysia's PDPA 2010, you have certain rights regarding the personal data cucu2 holds about you. We respect and facilitate the exercise of all these rights:

9Cookies, Tracking & Similar Technologies

Like most online platforms, cucu2 uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions properly. Here is an honest breakdown of the cookies we use:

9.1 Essential Cookies (Cannot Be Disabled)

These cookies are required for the core functionality of the cucu2 platform. They store your login session information, language preferences, and security settings. Without them, the platform cannot function properly and you will be unable to log in or place bets.

9.2 Analytics Cookies (Can Be Disabled)

Analytics cookies help cucu2 understand how members use the platform — which pages are visited most, how long play sessions last, which features are used, and where users encounter difficulties. All data is processed in aggregate and cannot be used to identify any specific individual. You can opt out of analytics tracking through the cookie settings on our website.

9.3 Preference Cookies (Can Be Disabled)

These cookies store your preferences — such as language, time zone and display settings — so you don't have to reconfigure them every time you visit cucu2. Disabling these cookies means cucu2 will not remember your preferences between sessions.

10Cross-Border Data Transfers

Cucu2 operates with a primary focus on the Malaysian market and stores Malaysian member data on servers located within the region. In certain technical instances, data may need to be processed by service providers operating outside Malaysia — such as cloud service providers or international casino game providers.

When cross-border data transfers occur, cucu2 ensures that:

• The recipient country maintains a level of data protection equivalent to or higher than Malaysia.
• Appropriate and detailed data processing agreements have been signed with the relevant providers.
• All such transfers comply with the applicable requirements of Malaysia's PDPA 2010 regarding international data transfers.
• Data transferred is kept to the minimum necessary — the data minimisation principle is fully observed.

11Children & Young Persons

The cucu2 platform is intended exclusively for individuals aged 21 and above. cucu2 does not knowingly collect or process personal data from individuals under the age of 21.

If cucu2 discovers that data has been inadvertently collected from an underage individual, we will take immediate steps to delete that data and close the account in question. Any winnings obtained through an underage account will be voided.

If you are a parent or guardian and believe that your underage child has registered a cucu2 account, please contact us immediately at support@cucu2.best so we can take the appropriate action without delay.

12Updates to This Privacy Policy

Cucu2 reviews this Privacy Policy on a regular basis — at least once a year, or whenever there are significant changes to how we process data, updates to Malaysian privacy laws, or material changes to cucu2's products and services.

When we make significant changes to this policy, we will:

• Sending an email notice to your registered email address at least 14 days before the changes take effect.
• Displaying a clear notice within the cucu2 platform regarding upcoming changes.
• Updating the "Last updated" date at the top of this policy.
• Retaining previous versions of this policy, which members may request if needed.

Continued use of the cucu2 platform after the effective date of any policy changes will be considered your acceptance of the updated policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data.

13How to Contact Us About Privacy

If you have any questions, concerns, or complaints about how cucu2 handles your personal data, we encourage you to contact us directly in the first instance. We are committed to resolving any privacy issues promptly and fairly.