Privacy Policy Club22 —
Security Your Data Our Priorities

01 Introduction

This Privacy Policy describes the information handling practices of Club22 ("we", "Platform") regarding personal data collected from members and visitors to our website at club22.onl. This document is prepared in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA) and international data protection standards.

We believe privacy is more than a legal obligation — it is the foundation of trust between club22 and every member who uses our platform. We are therefore committed to being transparent about the data we collect, why we need it, and how we use it to deliver a better gaming experience for you.

By registering or continuing to use the Club22 platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please stop using the platform and contact us to close your account.

02 Personal Data We Collect

Club22 collects your personal data in various ways depending on your interaction with the platform. The following are the categories of data we collect:

A. Data You Provide Directly:

• Registration information: full name, date of birth, ID card/passport number, email address, phone number.
• Address information: full residential address including postcode and state.
• KYC verification documents: copies of identity card, utility bills, or other required official documents.
• Financial information: payment method details, deposit and withdrawal transaction records.
• Communications with us: conversation history with the support team, complaints, and feedback.

B. Data Collected Automatically:

• Technical data: IP address, device type, operating system, web browser type and version.
• Usage data: pages visited, time spent, navigation patterns, and game preferences.
• Session data: login information, game session duration, and in-account activity.
• Cookie data: website preferences, session tokens, and analytics identifiers that do not personally identify you.

03 How We Use Your Data

The personal data we collect is used for legitimate and transparent purposes. The table below outlines the primary uses of your data:

We will not use your personal data for any purpose other than those stated above without first obtaining your explicit consent.

04 Legal Basis for Data Processing

All personal data processing carried out by club22 has a valid legal basis under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Contract Performance: Data required to provide the services you request, including account management and transaction processing.
• Legal Obligation: Data that must be collected to meet regulatory requirements such as KYC, anti-money laundering (AML), and financial reporting.
• Legitimate Interest: Data we process to protect platform security, prevent fraud, and improve our services — where these interests do not override your privacy rights.
• Consent: For optional marketing communications and other non-mandatory data processing — you may withdraw this consent at any time.

05 Data Sharing & Disclosure

Club22 does not sell, rent, or trade members' personal data for any commercial purpose. Your data is only shared in the following limited circumstances:

• Service Providers: Third parties that assist in operating our platform — such as payment processors, KYC software providers, and cloud services — are all bound by strict data protection agreements.
• Game Providers: To enable access to third-party games, the minimum required account information is shared with the relevant game providers, who are also bound by their own privacy policies.
• Legal Requirements: When required by Malaysian law, court order, or directive from an authorised regulatory body.
• Fraud Prevention: In situations where it is necessary to investigate or prevent fraud, money laundering, or other illegal activities involving our platform.
• Business Transfer: In the event of a merger, acquisition, or sale of company assets — you will be notified in advance and your privacy rights will be protected.

All third parties we work with are required to meet data protection standards equal to or higher than those of club22. We do not permit our partners to use your data for their own marketing purposes.

06 Cookies & Tracking Technologies

Club22 uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

• Essential Cookies: Required for basic website operations such as login session authentication, security, and basic preferences. These cookies cannot be disabled.
• Performance Cookies: Collects anonymous information about how you use the website to help us understand usage patterns and improve platform performance.
• Functional Cookies: Stores your preferences such as language selection, display settings, and login information to provide a more personalised experience.
• Analytics Cookies: Used to analyse website traffic and navigation patterns for the purpose of continuous platform improvement.

You may manage cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality of parts of the platform.

07 Data Retention Period

Club22 retains your personal data for as long as your account is active or as long as necessary to provide our services. After an account is closed, we retain your data according to the following periods:

• KYC & Identity Verification Records: Minimum 7 years after account termination, in line with anti-money laundering legal requirements.
• Financial Transaction Records: Minimum 7 years for audit, tax reporting, and regulatory compliance purposes.
• Game History: 3 years after the relevant transaction date, used for dispute resolution and game fairness reviews.
• Support Communication Logs: 2 years from the date of last interaction for quality control and complaint resolution purposes.
• Analytics Data: 2 years in anonymised form for platform improvement purposes.
• Marketing Data: Until you withdraw your consent or close your account.

Once the retention period expires, your data will be securely deleted or anonymised in accordance with certified data disposal procedures.

08 Your Rights as a Member

Under the Malaysian Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold about you:

09 Data Security Measures

Club22 implements a range of technical and organisational security measures to protect your personal data from unauthorised access, loss, misuse, or disclosure:

• Data in Transit Encryption: All communications between your device and our platform are secured with TLS 1.3 protocol and SSL 256-bit encryption.
• Stored Data Encryption: Sensitive information such as passwords and payment details is stored in encrypted format using the latest encryption algorithms.
• Internal Access Controls: Access to members' personal data by our staff is restricted on a need-to-know basis, with comprehensive audit logs maintained.
• 24/7 Monitoring: A continuous security monitoring system that detects and responds to suspicious activity in real time.
• Penetration Testing: Security audits and penetration testing are conducted periodically by independent third parties to identify and address system vulnerabilities.
• Staff Training: All staff who handle personal data undergo regular data protection and information security training.

While we take all reasonable measures to protect your data, no system can guarantee 100% security. We encourage you to do your part by using a strong password and enabling two-factor authentication (2FA) on your account.

10 Changes to Privacy Policy

Club22 reserves the right to update this Privacy Policy from time to time to reflect changes in our business practices, technological requirements, or new legal obligations.

When we make significant changes to this policy, we will notify you via:

• In-platform notification on club22 the next time you log in.
• A notification email will be sent to the email address registered to your account.
• Updates the "Last Updated" date shown at the top of this page.

We encourage you to review this page regularly. Your continued use of the club22 platform after any changes to this Privacy Policy are published will be considered acceptance of those changes.

11 Contact Our Data Protection Officer

Club22 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with this privacy policy and responding to enquiries relating to your personal data.

• DPO Email: [email protected]
• Live Chat: Available 24/7 on the club22 platform
• Response Time: Within 3 business days for general enquiries; 21 days for formal data rights requests.

You may also visit the FAQ for answers to frequently asked questions about privacy and account security. For issues relating to the overall platform usage agreement, please refer to our Terms and Conditions our.

If you are not satisfied with our response to any privacy-related complaint, you have the right to lodge a complaint with the Personal Data Protection Department of Malaysia or the relevant regulatory authority in your jurisdiction.