12naga Privacy Policy — Your Data Protection

1Personal Data We Collect

In operating the 12naga platform, we collect various types of personal data to ensure the services we offer run smoothly, securely, and in compliance with applicable legal requirements. The data we collect can be grouped into several main categories:

Data you provide directly:

• Full name as stated on your official identification document.
• Malaysian Identity Card (MyKad) number or equivalent identification document.
• Date of birth for age eligibility verification purposes (18 years and above).
• An active email address and mobile phone number registered in your name.
• Bank account or e-wallet details for processing deposits and withdrawals in MYR.
• The username and password you created during registration.

Data collected automatically:

• The IP address of your device when accessing the 12naga platform.
• Device type, operating system, and web browser version used.
• Login session data including time, duration, and approximate location.
• In-platform navigation history and service usage patterns.
• Complete records of gaming activity, including betting history and settlements.

2Purpose of Personal Data Usage

Every piece of data we collect has a clear and legitimate purpose. 12naga does not collect unnecessary data, and all data usage is subject to the principle of data minimization. The following are the primary purposes for which member personal data is used:

• Account management: Creates, maintains, and manages member accounts including identity verification and KYC processes.
• Transaction processing: Processes deposits, withdrawals, and fund transfers in Malaysian Ringgit (MYR) quickly and securely.
• Platform security: Detects and prevents fraud, multi-account usage, money laundering, and other security threats.
• Customer support: Resolves member inquiries, complaints, and disputes quickly and accurately using verified records.
• Legal compliance: Fulfils reporting and record-keeping obligations under anti-money laundering (AML) regulations and KYC requirements.
• Service improvement: Analyzes usage patterns in aggregate (not individually) to improve the overall platform experience.
• Service communications: Sends important notifications related to your account, security, promotions you have opted into, and system updates.

3Data Security Measures

The security of member personal data is our highest priority. 12naga continuously invests in the latest cybersecurity infrastructure to ensure your data is always protected from unauthorized access, loss, misuse, or improper disclosure.

• Transit encryption: All communication between your browser and 12naga's servers is encrypted using TLS 1.3 protocol with 256-bit SSL encryption.
• Static data encryption: Sensitive data stored in our databases is encrypted using the AES-256 algorithm, which cannot be broken without the correct key.
• Role-based access control: Each staff member has access only to the data required to perform their duties — nothing more, nothing less.
• Real-time threat monitoring: Our SIEM (Security Information and Event Management) system monitors all server activity 24/7 and triggers immediate alerts upon detecting any anomalies.
• Periodic penetration testing: We conduct regular security testing (penetration testing) by independent third parties to identify and patch any vulnerabilities before they can be exploited.
• Secure data backup: Data is automatically backed up to a separate, secure location to ensure service continuity under all circumstances.

4Data Sharing with Third Parties

12naga respects member privacy and maintains a strict policy on data sharing. We do not sell or rent your personal data to any party for commercial purposes. However, there are limited situations where data sharing is necessary and legally permissible:

• Payment service providers: Minimal transaction data is shared with certified payment gateways (DuitNow, FPX, Touch 'n Go, Boost, GrabPay) solely to process your transactions.
• Technical service providers: Hosting companies, CDN providers, and technical infrastructure partners that help operate our platform are bound by strict confidentiality agreements.
• Legal authorities: We are required to disclose data when ordered by a court, law enforcement agency, or regulatory body under valid legal process.
• Fraud prevention: In cases of suspected fraud, limited information may be shared with partner platforms or industry bodies to prevent further losses.

All third parties that receive 12naga member data are contractually bound to protect that data to the same or higher standard that we apply. We conduct due diligence reviews on all service providers before any data sharing takes place.

5Cookies and Tracking Technologies

The 12naga website and app use cookies and similar tracking technologies to enhance user experience, maintain session security, and understand how members interact with our platform. Below is an explanation of the types of cookies we use:

• Essential cookies: Required for core platform functions such as login authentication, session security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: Collects anonymous information about how pages are used to help us improve platform speed and usability.
• Functional cookies: Saves your preferences such as display settings, language, and game preferences so you don't need to reconfigure them each time you access the platform.
• Security cookies: Helps identify suspicious activity such as repeated login attempts or unusual navigation patterns.

You can manage or delete cookies at any time through your web browser settings. However, disabling essential cookies may affect your ability to log in or use certain features of the 12naga platform properly.

6Your Rights as a Member

As the owner of your personal data, you hold certain rights that we fully respect. These rights may be exercised at any time by contacting our support team through your account dashboard:

• Right of access: You have the right to obtain a copy of the personal data we hold about you in a readily readable format.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data in our records.
• Right to erasure: Under certain circumstances, you may request the deletion of your personal data, subject to our legal obligations to retain specific records.
• Right to restriction of processing: You may request that we restrict how we process your data in certain situations while a dispute is being resolved.
• Right to data portability: You have the right to receive your data in a structured, machine-readable format for transfer to another service provider if needed.
• Right to object: You may object to the processing of your data for certain purposes, such as non-essential marketing communications.
• Right to withdraw consent: Where data processing is based on your consent, you may withdraw that consent at any time without affecting the validity of processing carried out prior to withdrawal.

7Data Retention Period

12naga retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following are general guidelines for our data retention periods:

• Active account: For as long as your account remains active and in use, we retain all relevant data to ensure full access to our services.
• After account closure: Identity data and financial records are retained for a minimum of 7 years to meet anti-money laundering and tax legal requirements.
• Transaction records: All deposit records, withdrawals, and financial activity are retained for 5 years in accordance with tax reporting requirements.
• Security logs: Access and technical security logs are retained on a rolling 90-day basis for threat detection and incident investigation purposes.
• Support communications: Communication records with our support team are retained for 3 years for reference and dispute resolution purposes.
• Cookies: Cookie lifespans vary by type — session cookies are deleted when the browser is closed, while persistent cookies have a set expiry date.

Once the retention period has ended or when data is no longer required, we ensure it is securely deleted using methods that make recovery impossible.

8Amendments to This Privacy Policy

12naga reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our operational practices, new legal requirements, or the latest technological developments. All amendments will be handled as follows:

• Advance notice: For significant amendments, we will notify members at least 14 days before the changes take effect via email or in-platform notification.
• Effective date: Each version of the Privacy Policy will carry a clearly visible "Last Updated" date at the top of this page.
• Version records: Older versions of the Privacy Policy are kept for reference and can be requested from our support team.
• Implied consent: Continued use of the 12naga platform after the effective date of any amendment constitutes your acceptance of the latest version of the Privacy Policy.

We encourage you to review this Privacy Policy page periodically to stay informed about how we protect and use your personal data. If you disagree with any amendments, you may close your account before the amendment takes effect.