100cuci Privacy Policy – Personal Data Protection for Malaysian Players

1 Introduction and Our Privacy Commitment

Welcome to the Privacy Policy 100cuci. This is among the most important documents we have written because it touches on something fundamental — your trust in us to handle your personal information responsibly and ethically. We do not take this responsibility lightly.

When you register an account with 100cuci, you share certain personal information with us. This information is necessary for us to operate our services — processing deposits via Touch 'n Go, DuitNow, GrabPay, or FPX, verifying your identity, sending account-related notifications, and more. We understand that you are placing your trust in us with this information, and we are committed to making sure that trust is never broken.

This Privacy Policy outlines: what types of personal data we collect, why it is collected, how it is stored and protected, who can access it, how long it is retained, and what your rights are as the owner of that data. This is our written commitment to you — not merely a document for legal compliance.

2 Types of Personal Data We Collect

100cuci collects personal data from you through several means: during account registration, during platform use, through financial transactions, and through interactions with our support team. Below are the categories of data we collect and the purpose of each:

2.1 Data We Do Not Collect

100cuci does not directly collect credit or debit card numbers — all card transactions are processed through third-party payment systems that hold their own PCI-DSS certification. We also do not collect biometric data such as fingerprints or facial recognition, and we do not use third-party cookies for third-party advertising purposes.

2.2 Children's Data

The 100cuci platform is intended for individuals aged 18 and above only. We do not knowingly collect personal data from anyone under the age of 18. Should we discover that data belonging to a person under 18 has been collected, we will delete it immediately and close the account in question.

3 How We Use Your Personal Data

Every piece of data we collect has a clear purpose. 100cuci does not collect unnecessary data, nor does it use data for purposes other than those stated. The following are the primary purposes for which your personal data is used:

3.1 Account Management and Identity Verification

Your identity and contact data is used to create and manage your 100cuci account, verify your identity for anti-money laundering (AML) compliance and the minimum age requirement of 18, and ensure that only you can access your account. Identity verification is a legal requirement we must comply with, not merely an operational choice.

3.2 Financial Transaction Processing

Your financial data is used to process deposits and withdrawals through your chosen payment method — whether that's Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, or FPX (Maybank2u, CIMB Clicks, and other member banks). We share the necessary information with the relevant payment providers to complete transactions — this data sharing is required and limited strictly to what is needed.

3.3 Platform Security and Fraud Detection

Device and technical data such as IP addresses and session information are used to detect and prevent unauthorised access, fraudulent activity, duplicate accounts, and other security threats. These are active protective measures that safeguard not only 100cuci but also every Member who uses the platform legitimately.

3.4 Experience Personalisation and Communications

Usage data helps us understand the types of games you enjoy and deliver more relevant recommendations. Contact data is used to send account-related notifications, promotional updates you have opted in to receive, and important policy updates. You can manage your notification preferences in your account settings.

3.5 Responsible Gambling

Game history and activity pattern data are used for responsible gambling monitoring. If our system detects patterns that may indicate a gambling problem, our team may proactively reach out to you. This is a use of data we consider both essential and ethical — it is not about controlling how you play, but about ensuring your experience at 100cuci remains healthy entertainment.

4 How We Protect Your Data

Data protection is about more than technology — it is about organisational culture, operating procedures, and ongoing commitment. At 100cuci, we invest in multiple layers of security to ensure your data is protected from every angle.

4.1 Data Encryption in Transit

All communications between your device and 100cuci's servers are encrypted using TLS 1.3 with a 256-bit SSL certificate — the same technology used by major Malaysian banks including Maybank and CIMB. This means that even if someone were to intercept your network traffic, the intercepted data would be in an encrypted form that cannot be read.

4.2 Data Encryption at Rest

Your password is never stored in plain text. It goes through a hashing process using the bcrypt algorithm with a high cost factor before being stored — meaning that even if our database were ever compromised (something we work hard to prevent), your password cannot be recovered. Sensitive financial data is also stored in encrypted form, with encryption keys kept separately from the data itself.

4.3 Internal Access Controls

Not all 100cuci staff have access to all data. We operate on a least privilege principle — each staff member can only access the data necessary for their specific role. Access to sensitive data requires multi-factor authentication, and all access is automatically logged for audit purposes.

4.4 Continuous Security Monitoring

100cuci's systems are monitored around the clock for suspicious activity — repeated failed login attempts, access from unusual locations, or abnormal traffic patterns. Automated alerts ensure our security team can respond quickly to any detected threats.

4.5 Regular Security Audits

100cuci conducts regular security assessments, including independent penetration testing, to identify and address vulnerabilities before they can be exploited. This is an industry best practice we follow consistently.

5 Data Sharing with Third Parties

We understand that data sharing with third parties is a concern for many users. We therefore want to be completely transparent about who can view your data and under what circumstances.

5.1 Payment Service Providers

To process your deposits and withdrawals, we need to share relevant information with payment providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX processors. The information shared is limited to what is necessary to complete the transaction — typically account numbers, transaction amounts, and unique references. These providers have their own privacy policies governing how they handle that data.

5.2 Third-Party Game Providers

The 100cuci platform features games from providers such as Pragmatic Play, PG Soft, Evolution Gaming, and JILI Games. These providers receive the game session data necessary to run the games on a technical level. Your actual identity — such as your full name or MyKad number — is never shared with game providers; only an anonymous account identifier is used.

5.3 Legal Requirements

100cuci may be required by law to disclose personal data to Malaysian authorities in certain circumstances — for example, as part of a criminal investigation or in compliance with a valid court order. In such situations, we will comply with the applicable legal requirements while protecting your rights to the fullest extent permitted by law.

5.4 What We Do Not Do

We do not sell your personal data. We do not share your data with advertisers or data brokers. We do not grant other companies access to your data for their own marketing purposes. This is a firm line we will never cross.

6 Cookies and Tracking Technologies

100cuci uses cookies and similar technologies to keep the platform running smoothly and to deliver a better experience for you. The following are the types of cookies we use:

6.1 Essential Cookies

These cookies are required for the platform to function — they store your login session information so you don't need to log in again each time you navigate to a new page, save your language preferences, and manage session security. Without these cookies, the platform cannot function properly and they cannot be disabled.

6.2 Analytics Cookies

We use internal analytics to understand how players use the platform — which pages are visited most, where players encounter difficulties, and general usage patterns. This analytics data is collected in aggregate and does not contain information that directly identifies any individual. It helps us improve the platform over time.

6.3 Preference Cookies

These cookies store your preferences such as interface language, the last game view accessed, and certain platform settings. They are designed to make your experience smoother and more personalised. You may delete these cookies at any time through your web browser settings without affecting the core functionality of the platform.

6.4 Cookie Controls

Most web browsers allow you to manage cookies through browser settings — you can view, delete, or block specific cookies. However, if you delete all cookies from 100cuci, you may need to log in again each time you visit the platform and some settings may be lost.

7 Data Retention Period

100cuci does not retain your data indefinitely. We have a clear data retention policy that balances operational needs, legal requirements, and your right to privacy.

Active account data is retained for as long as your account remains active. Once an account is closed — whether at your request or due to a terms violation — your personal data will be entered into a staged deletion process:

• Active operational data (such as game balance and interface preferences) — deleted within 30 days of account closure
• Transaction record data — retained for 7 years in accordance with Malaysian financial reporting legal requirements, then deleted
• Security log data — retained for 2 years for investigation purposes if needed, then deleted
• Support communication data — retained for 2 years after the case is resolved, then deleted

Once the retention period expires, data is permanently deleted using secure erasure methods that ensure it cannot be recovered. We do not keep "backup copies" of data that has already been scheduled for deletion.

8 Your Rights as a Data Owner

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices, you have the following rights regarding the personal data held by 100cuci:

8.1 How to Exercise Your Rights

To exercise any of the rights above, contact the 100cuci support team by email at support@100cuci.express or via live chat on the platform. Please specify which right you wish to exercise and provide sufficient information for us to verify your identity before processing your request. We will respond within 14 business days.

Please note that some erasure requests may not be fully fulfilled if the data in question is required to meet legal obligations (such as financial transaction records that must be retained for 7 years under Malaysian law). In such cases, we will explain the reasons to you.

9 Cross-Border Data Transfers

In the course of its operations, 100cuci may store or process your data on servers located outside Malaysia. This may occur when we use international cloud infrastructure services or interact with third-party game providers operating across multiple countries.

When cross-border data transfers occur, 100cuci ensures that protection equivalent to Malaysian standards is applied through binding data processing agreements with the relevant providers. We only work with infrastructure providers that hold recognised international security certifications and a proven track record in data protection.

The most sensitive information — including full identity verification data — is stored in tightly controlled infrastructure with strictly limited access that is regularly audited.

10 Data Breach Notification

While we invest seriously in security, no system can be completely immune to every threat. In the unlikely event of a data breach affecting your personal information, 100cuci is committed to responding swiftly and transparently.

In the event of a data breach involving Members' personal data, 100cuci will:

• Contain and investigate the breach promptly
• Notifying affected Members within a reasonable timeframe once a breach has been confirmed and its scope understood
• Notifying the relevant authorities as required under applicable Malaysian law
• Provide clear information about what happened, what data was involved, and the steps you can take to protect yourself
• Taking the necessary remedial steps to prevent the same breach from recurring

We believe in full transparency when something goes wrong. Staying silent about security incidents is not how we operate — you have the right to know if your data may have been affected so you can take the appropriate protective steps.

11 Changes to This Privacy Policy

100cuci reserves the right to update this Privacy Policy from time to time in response to changes in legislation, changes to our operations, or to clarify how we handle data. When changes are made, the "Updated" date at the top of this document will be revised accordingly.

For significant changes — such as changes to how we use your data or new types of data sharing — we will notify all registered Members by email or in-platform notification at least 14 days before the changes take effect. This gives you time to review the changes and decide whether you wish to continue using the platform.

Continued use of the 100cuci platform after a change takes effect will be considered acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account and request data erasure in accordance with the procedure set out in Section 8.