Privacy Policy —
suka2cuci Platform

This Privacy Policy ("Policy") is published by suka2cuci ("we", "usour", "the Operator", "the Platform") and applies to all personal data collected from users ("you", "User "Player") who access, register, or otherwise interact with the suka2cuci website located at https://suka2cuci.cam, its mobile interface, and all related services.

suka2cuci is an online gaming and sports betting platform serving players across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions throughout the country. We process personal data in connection with the operation of these services, the administration of Player Accounts, the processing of financial transactions via Malaysian payment methods (including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong), and our obligations under internationally recognised gaming compliance standards.

This Policy is intended to give you a clear and transparent account of how we handle your personal information. We take our data protection obligations seriously and we process personal data only in ways that are necessary, proportionate, and compliant with applicable data protection law.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes, but is not limited to, name, date of birth, identity document number, residential address, email address, telephone number, IP address, device identifiers, financial account information, and gameplay records.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, suka2cuci is the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Subject" — The natural person to whom the Personal Data relates — i.e., you, the Player.
• "KYC" — Know Your Customer — the identity verification process required by gaming compliance standards to confirm a Player's identity, age, and residential address.
• "Cookies" — Small data files stored on your device by the Platform's web server, used to maintain session state, remember preferences, and gather analytics data.
• "Third Party" — Any entity other than the Player and suka2cuci, including payment processors, identity verification providers, and analytics service providers.

We collect Personal Data through a number of channels during your use of the Platform. The categories of Personal Data we collect, and the circumstances under which each is collected, are set out below.

We do not collect sensitive personal data categories (such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification, or health data) unless explicitly required by law or where you have provided such information voluntarily in the context of a responsible gambling self-exclusion request.

suka2cuci processes Personal Data only where a lawful basis for doing so exists. The primary legal bases on which we rely are as follows:

• Contractual Necessity: We process Registration Data, Financial Data, and Gameplay Records because such processing is necessary to perform the contract between suka2cuci and the Player — i.e., to operate the Account, accept deposits, process withdrawals, and deliver gaming services.
• Legal Obligation: We process KYC and identity verification data because doing so is required to comply with gaming compliance standards, anti-money laundering (AML) obligations, and counter-terrorist financing (CTF) requirements applicable to operators in our licensing jurisdiction.
• Legitimate Interests: We process Technical & Device Data and Communications Data on the basis of our legitimate interest in maintaining Platform security, detecting and preventing fraud, investigating prohibited conduct (as defined in our Terms & Conditions), and improving the quality of our services.
• Consent: Where we send marketing communications (promotional offers, bonus notifications), we do so only where you have provided explicit consent. You may withdraw this consent at any time by updating your communication preferences in your Account settings or by contacting support.

The Personal Data we collect is used for the following purposes:

• Account Management: Creating, maintaining, and administering your Player Account, including password resets, account history, and preference management.
• Payment Processing: Facilitating deposits via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong) and processing withdrawal requests to your registered payment accounts.
• Identity Verification (KYC): Verifying your identity, age, and address to comply with gaming compliance requirements and to ensure the Platform is not used for money laundering or other financial crimes.
• Fraud Prevention & Security: Detecting and investigating suspicious activity, multiple account creation, identity fraud, and the misuse of bonuses or promotional offers.
• Customer Support: Responding to queries, resolving complaints, investigating disputes, and providing assistance through our multilingual support channels (English, Bahasa Melayu, Mandarin).
• Responsible Gambling: Monitoring gameplay patterns to identify indicators of problem gambling, administering self-exclusion requests, and enforcing deposit or loss limits set by Players.
• Legal & Regulatory Compliance: Meeting record-keeping, reporting, and audit obligations imposed by gaming compliance standards, AML/CTF frameworks, and applicable data protection law.
• Service Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and user experience.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications, and Platform updates where you have opted in to receive such communications.

We do not share your Personal Data with third parties except in the following specific, limited circumstances:

• Payment Processors: We share financial data with our payment processing partners (including FPX gateway operators, e-wallet providers, and banking institutions) to the extent necessary to complete your deposit or withdrawal transactions. These partners are contractually bound to process your data only for payment fulfilment purposes.
• KYC & Identity Verification Providers: We may use licensed third-party identity verification services to assist with document verification during the KYC process. Such providers are engaged under strict data processing agreements and may not use your data for any purpose beyond verification.
• Regulatory Authorities: We are required to disclose certain data to regulatory bodies, licensing authorities, law enforcement agencies, or courts when legally compelled to do so. We will disclose only the minimum data necessary to satisfy such requirements.
• Fraud Prevention & AML Networks: In cases of suspected fraud, money laundering, or other financial crime, we may share relevant data with industry fraud prevention networks or financial intelligence units as required under applicable compliance frameworks.
• IT & Infrastructure Providers: Our hosting and infrastructure providers may have technical access to data stored on our servers. Such providers are engaged under data processing agreements that require them to maintain appropriate technical and organisational security measures.
• Business Succession: In the event of a merger, acquisition, or sale of substantially all assets of suka2cuci, Personal Data held by us may be transferred to the successor entity, subject to equivalent data protection commitments.

In all cases where we engage third parties to process Personal Data on our behalf, we ensure that appropriate contractual safeguards are in place.

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention periods apply:

• Active Account Data (Registration Data, Financial Data, Gameplay Records): Retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, to satisfy AML record-keeping requirements.
• KYC Documentation (identity documents, proof of address, verification records): Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later, in accordance with applicable gaming and financial compliance standards.
• Financial Transaction Records (deposit and withdrawal history, payment method details): Retained for a minimum of seven (7) years to comply with applicable financial record-keeping requirements.
• Communications Data (support correspondence, live chat transcripts): Retained for three (3) years from the date of the last communication, for the purposes of dispute resolution and service quality review.
• Marketing Preference Data: Retained until you withdraw consent or request erasure, subject to overiding legal retention obligations.

Where retention is no longer legally required, Personal Data will be securely deleted or anonymised in accordance with our data destruction procedures.

suka2cuci implements appropriate technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard 256-bit SSL/TLS protocols. Look for the padlock icon in your browser address bar when accessing https://suka2cuci.cam.
• AES-256 Data Encryption at Rest: Sensitive data stored on our servers — including KYC documents, financial records, and account credentials — is encrypted using AES-256 encryption.
• Access Controls: Personal Data is accessible only to suka2cuci staff who require it for legitimate operational purposes. Access is governed by role-based permissions and is logged for audit purposes.
• Regular Security Audits: We conduct independent security assessments and penetration testing on a periodic basis to identify and remediate vulnerabilities.
• Fraud Monitoring: Automated systems monitor for suspicious login attempts, unusual transaction patterns, and other indicators of unauthorised account access.

While we take all reasonable steps to protect your Personal Data, no data transmission over the internet is entirely risk-free. You are responsible for maintaining the confidentiality of your Account credentials and for promptly notifying us if you suspect any unauthorised access to your Account.

The Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. The categories of cookies used on the Platform are as follows:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your logged-in session, store your account language preference, and remember your responsible gambling limit settings. They cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how Players use the Platform — pages visited, time spent, error messages encountered — to help us identify and improve underperforming areas. The data collected is aggregated and does not identify individual users.
• Functional Cookies: These cookies remember your preferences (e.g., preferred game lobby view, notification settings) to provide a more personalised experience on subsequent visits.
• Security Cookies: These cookies support our fraud detection and session integrity systems. They help us identify and prevent malicious login attempts and account takeover activity.

You may manage cookie preferences through your browser settings. Blocking certain cookies may affect the functionality of the Platform. Strictly necessary and security cookies cannot be disabled without impairing your ability to use the service.

Subject to applicable data protection law and any overiding legal obligations on our part (such as AML and KYC record-keeping requirements), you have the following rights in relation to your Personal Data:

• Right of Access: You may request a copy of the Personal Data we hold about you at any time. We will respond to verified access requests within 30 days.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. Contact Customer Support to submit a correction request.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your Personal Data. We will comply with erasure requests where no overiding legal obligation requires us to retain the data. Note that AML, KYC, and financial record-keeping requirements may prevent full erasure for the applicable retention periods set out in Section 7.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data while a rectification or erasure request is being reviewed.
• Right to Data Portability: Where processing is based on your consent or contractual necessity, you may request a structured, machine-readable copy of the Personal Data you have provided to us.
• Right to Object to Marketing: You may withdraw consent for marketing communications at any time. Opt-out requests will be actioned within 5 business days.
• Right to Lodge a Complaint: If you believe we have processed your Personal Data in a manner inconsistent with this Policy or applicable data protection law, you have the right to raise a complaint with us directly or with a relevant supervisory authority.

To exercise any of the above rights, please contact our Data Support team (details in Section 14). We will verify your identity before processing any data subject request to protect against fraudulent or unauthorised requests.

The Platform is strictly intended for persons aged21 (twenty-one) years and above. We do not knowingly collect or process Personal Data from persons under the age of 21.

As part of our KYC verification process, all Players are required to provide valid proof of age prior to completing their first withdrawal. We use identity document verification to confirm that registered players meet the minimum age requirement. Where we identify or have reasonable grounds to suspect that a Player is under 21, we will immediately suspend the Account, halt any withdrawals, and initiate an investigation.

If a parent or guardian believes that a minor has accessed or registered an Account on the Platform, we ask that they contact our Customer Support team immediately. We will take prompt action to investigate and, where confirmed, close the Account and return any deposit amounts as required by applicable law.

In the course of operating the Platform, your Personal Data may be transferred to, stored in, or processed in jurisdictions outside Malaysia. Such transfers occur in connection with the use of third-party service providers — including KYC verification providers, payment processors, and cloud infrastructure services — who may be located in jurisdictions with different data protection standards.

Where Personal Data is transferred internationally, suka2cuci ensures that appropriate safeguards are in place. These include:

• Contractual clauses requiring the recipient to maintain data protection standards equivalent to those applied by suka2cuci.
• Engaging only service providers who are certified or audited under internationally recognised security and data protection frameworks.
• Transfering only the minimum Personal Data necessary for the specific purpose of the transfer.

By using the Platform and providing your Personal Data, you acknowledge that such international transfers may occur and consent to them being conducted under the safeguards described above.

suka2cuci reserves the right to update or amend this Privacy Policy at any time. When we make material changes to the Policy — i.e., changes that may affect how we collect, use, or share your Personal Data in a way that is materially different from what was described at the time you registered — we will notify you by email or through a prominent in-Platform notice at least 7 days before the changes take effect.

For non-material updates (such as clarifications of existing practices or minor editorial corrections), we will update the effective date at the top of this document without prior notice. We recommend that you review this Policy periodically to stay informed of how your data is being handled.

Your continued use of the Platform after any Policy update constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you must cease using the Platform and may request Account closure and data erasure as described in Section 10and Section 14.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or want to submit a formal privacy complaint, please contact our Customer Support team. We handle all data-related enquiries in English, Bahasa Melayu, and Mandarin Chinese.

When submitting a data subject access request or erasure request, please include your registered Account username and email address so that we can verify your identity and locate the relevant records. We will acknowledge data subject requests within 5 business days and respond in full within 30 days.