My 36 Privacy Policy – Malaysia Player Data Protection

Welcome to the my 36 Privacy Policy. This document forms part of our commitment to the transparency and trust we uphold with every Malaysian player who entrusts our platform with their personal information.

My 36 ("we", "the platform") is the data controller responsible for all personal information collected through our official website at my36.click. This Privacy Policy explains:

• Types of personal information we collect from players
• The purpose and legal basis for collecting that data
• Who may access or receive your data
• How long your data is retained
• Your rights as a data subject
• How you can reach us regarding privacy

This policy applies to all users of the my 36 platform, including unregistered visitors, registered members, and former members whose data remains within a valid retention period. This policy is to be read together with Terms & Conditions my 36, which together form the complete agreement between you and our platform.

My 36 only collects data that is strictly necessary to provide a safe, fair service that meets legal compliance requirements. Below are the categories of data we collect and the purposes for which they are collected:

We also collect data automatically through the use of cookies and related tracking technologies when you browse the my 36 platform. Further information about cookies can be found in Section 08 of this document.

Every piece of data collected by my 36 has a specific and legitimate purpose. We do not use player data for purposes not stated in this policy without first obtaining fresh consent from the player concerned.

The primary purposes for which my 36 uses player data are as follows:

• Account Management: Creating, managing and securing player accounts, including registration processing, login verification and account recovery.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX, as well as handling withdrawals of winnings to players' accounts.
• Identity Verification (KYC): Complying with mandatory Know Your Customer (KYC) requirements to prevent money laundering and ensure players meet the minimum age criteria.
• Fraud Prevention: Identifying and preventing fraudulent activity, multi-account usage, and bonus system abuse.
• Responsible Gaming: Monitoring playing habits to detect signs of problem gambling and offering appropriate support to players who may need assistance.
• Service Communications: Sending important notifications related to your account, security, promotions you have subscribed to, and policy updates.
• Platform Improvement: Analysing aggregated usage patterns to improve the design, performance, and overall user experience of the my 36 platform.
• Legal Compliance: To fulfil legal obligations, respond to requests from lawful authorities and defend legal claims where necessary.

My 36 does not use player data for third-party advertising, commercial profiling for resale, or any purpose not stated above. Should we wish to use your data for a new material purpose, we will seek your consent beforehand.

My 36 does not sell or share players' personal data with third parties for their own advertising or marketing purposes. However, there are limited situations where my 36 needs to share information with certain parties in order for the platform to operate safely and lawfully:

• Payment Service Providers: Payment gateways that process your transactions — including e-wallet providers and banks via FPX — receive only the minimum data required to complete each transaction. They are bound by strict data processing agreements.
• Identity Verification Provider: Licensed third-party KYC services assist us in verifying player identities. Data shared is strictly limited to information required for verification purposes only.
• Game Providers: Gaming companies such as Evolution Gaming and Pragmatic Play receive the player identifiers necessary to deliver their games. They do not receive your full identity information.
• Legal Authorities: my 36 will disclose information to Malaysian authorities where required by law, court order, or to prevent criminal activity.
• Group of Companies: Within the my 36 group of companies, internal data sharing takes place for legitimate operational and corporate compliance purposes.

All third parties who receive my 36 player data are bound by data protection agreements requiring them to handle that information in accordance with standards equal to or higher than those set out in our own privacy policy.

My 36 consistently invests in cybersecurity infrastructure to ensure Malaysian player data is protected at all times. The technical and organisational security measures we have in place include:

• End-to-End Encryption: All communications between your browser and my 36's servers are encrypted with 256-bit SSL/TLS, without exception.
• Internal Access Controls: Only staff who require access to specific data to carry out their duties are permitted to view it. All access is logged and monitored.
• Two-Factor Authentication (2FA): Available to all players and mandatory for my 36 staff who handle sensitive data.
• Security Audits: Penetration testing and security audits are conducted regularly by independent parties to identify and address vulnerabilities.
• Ongoing Monitoring: Our threat detection system operates 24/7 to identify and respond to suspicious activity in real time.
• Data Backup: Player data is securely and regularly backed up to ensure service continuity and disaster recovery.

While my 36 takes all reasonable steps to protect your data, no security system can guarantee absolute 100% protection. We therefore also encourage players to take personal precautions, such as using strong passwords and not sharing login credentials.

My 36 does not retain players' personal data longer than necessary. The following are our data retention period guidelines:

• Active Account Data: For the duration your account remains active and for a specified period after account closure, subject to compliance requirements.
• Financial Transaction Records: Minimum 7 years after the transaction, in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• KYC Records (Identity Verification): Minimum 5 years after the business relationship ends, in line with PDPA and anti-money laundering compliance requirements.
• Activity & Game Logs: 2 years for the majority of platform activity records.
• Communication Data: 1–3 years depending on the type of communication and complaint resolution requirements.
• Non-Essential Cookie Data: From session duration up to 2 years, depending on the type of cookie.

Once the retention period expires or data is no longer needed for a legitimate purpose, my 36 will securely delete or anonymise that data using methods that ensure it cannot be recovered or re-linked to a player's identity.

As a my 36 player, you have certain rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). my 36 respects and facilitates the exercise of these rights:

To exercise any of the rights above, please contact our Data Protection Officer at privacy@my36.click stating the right you wish to exercise and your identifying information. We will respond within 30 calendar days.

My 36 uses cookies and similar tracking technologies to ensure the platform functions correctly, enhance the user experience, and analyse usage patterns on an aggregated basis.

Types of cookies used on my 36:

• Session Cookies: Required to maintain your login status during a gaming session. Deleted when you close your browser.
• Preference Cookies: Stores settings such as your preferred language and display preferences. Active for up to 1 year.
• Security Cookies: Helps identify suspicious sessions and protect your account. Cannot be disabled.
• Analytics Cookies: Collecting information on how players use the platform (on an anonymous basis) to help us improve our services.

You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies may affect platform functionality. Analytics and preference cookies can be disabled without impacting core functions.

The my 36 platform is strictly for individuals aged 18 and above. my 36 does not knowingly collect, store or process the personal data of anyone under the age of 18.

Should we discover that personal data belonging to a child has been collected without our knowledge, we will take the following steps immediately:

1. Immediate suspension of the account in question
2. Delete all associated personal data
3. Refunding any remaining balance in the account
4. Investigating how this occurred and taking preventive measures

Parents or guardians who suspect their child has registered on my 36 without their knowledge are urged to contact our team immediately at support@my36.click with the relevant details.

In the course of platform operations, certain data processing activities may involve transferring information to parties operating outside Malaysia — for example, international game providers or cloud infrastructure services.

My 36 ensures that all such cross-border data transfers comply with Malaysia's PDPA requirements and are safeguarded by:

• Standard contractual clauses ensuring an equivalent level of data protection
• Assessment of the data protection standards in the recipient country prior to any transfer
• End-to-end encryption applied to all data in transit
• Strict limits on the types of data that may be transferred outside Malaysia

Our international game providers receive technical identifiers only — not full identity information — to enable gameplay functionality. This minimises the exposure of sensitive data belonging to Malaysian players in the context of international transfers.

My 36 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new technologies, legal requirements or other legitimate reasons. Each new version will fully supersede the previous one.

When there are material changes to how we handle players' personal data, we will:

• Updating the "Last Updated" date at the top of this document
• Sending email notifications to all registered players
• Displaying a clear notice on the platform for a minimum period of 14 days

Continued use of the my 36 platform following notification of changes will be considered acceptance of the updated Privacy Policy. If you do not agree with the changes, please contact us to close your account and request deletion of your data.

If you have any questions, concerns or complaints regarding how my 36 handles your personal data, we encourage you to contact us directly in the first instance:

• Privacy Email: privacy@my36.click
• General Support Email: support@my36.click
• Live Chat: Available on the platform 24/7
• Privacy Issue Response Time: Within 5 business days for general enquiries; 30 days for formal data rights requests

If you are not satisfied with our response to your privacy complaint after going through our internal channels, you have the right to refer the matter to the Department of Personal Data Protection Malaysia (JPDP), which is the relevant supervisory authority in Malaysia.