Cup8 Privacy Policy – Malaysia User Personal Data Protection

This Privacy Policy is published by cup8 to explain our personal data protection practices to all users accessing the cup8.app platform and the cup8 mobile app. This document forms part of the overall service agreement between you and cup8, and should be read together with our Terms and Conditions and Responsible Gaming Policy.

Cup8 operates with full commitment to the data protection principles set out in Malaysia's Personal Data Protection Act 2010 (PDPA). We believe that user trust is our most valuable asset, and that trust can only be built through transparent, responsible and consistent data management practices.

This policy applies to all individuals who interact with the cup8 platform, including registered users, website visitors, applicants in the registration process, and former users whose data is still retained in our systems within the legally prescribed retention period. By continuing to use the cup8 platform after the effective date of this policy, you are deemed to have read, understood, and agreed to all terms contained herein.

Cup8 collects users' personal data through various interaction points on our platform. We only collect data that is strictly necessary to provide a safe, fair and responsible service. The following are the types of data we collect and the purposes for their collection:

Cup8 does not collect sensitive data such as health information, religious beliefs or political views unless required by applicable law for specific purposes.

Every use of personal data by cup8 has a valid legal basis under Malaysia's PDPA 2010. The following are our primary purposes for using your personal data:

• Account Management: Creating, verifying and maintaining your user account, including the KYC process and age verification to ensure you meet the platform's eligibility requirements.
• Transaction Processing: Processing deposits, withdrawals and all other financial transactions you make on the cup8 platform securely and efficiently.
• Platform Security: Detecting and preventing fraud, money laundering, duplicate accounts and any activity that violates our platform's terms of use.
• Legal Compliance: Fulfilling legal obligations under the PDPA 2010, anti-money laundering (AML) requirements and any other regulations applicable to cup8's operations.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and reaching out to users who need support before the situation worsens.
• Service Communications: Sending important account-related notifications, security updates, promotional information (where you have consented) and responses to customer support enquiries.
• Service Improvement: Analysing usage data in aggregate and anonymised form to understand platform usage patterns and continuously improve the user experience.

Cup8 will not use your personal data for any purpose other than those stated above without first obtaining your specific consent.

Cup8 does not sell, rent or commercialise users' personal data to any third party. However, in the course of platform operations, there are certain circumstances where we need to share user data with the following parties, all of whom are bound by strict confidentiality agreements:

• Payment Providers: Required transaction information is shared with e-wallet providers (Touch 'n Go eWallet, GrabPay, Boost) and banking institutions to securely process your deposits and withdrawals.
• Game Providers: Minimum data required to verify membership and enable access to games is shared with game content providers integrated with the cup8 platform.
• Statutory Authorities: cup8 will disclose user data when required by a court order, legal mandate, or a lawful request from Malaysian law enforcement authorities.
• Technical Service Providers: Third-party service providers that assist in platform operations, such as cloud and analytics services, are only granted access to strictly necessary data and are bound by rigorous data processing agreements.

Cup8 does not retain users' personal data longer than is necessary for the stated purposes or as required by law. The following are general guidelines for our data retention periods:

• Active account data is retained for as long as the account remains active and for 7 years after account closure, in line with Malaysia's financial record-keeping requirements.
• Financial transaction records are retained for a minimum of 7 years in compliance with the Companies Act and applicable AML regulations.
• Technical activity logs (server logs, access records) are retained for 12 months for security and incident investigation purposes.
• Cookie and analytics data is deleted in accordance with the set cookie expiry period, typically between 30 days and 2 years depending on the cookie type.
• KYC documents (MyKad copy, passport) are retained for 6 years after the business relationship ends, in accordance with Malaysian legal requirements.

Once the retention period expires, personal data will be deleted or anonymised in a manner that makes recovery technically impossible.

The cup8 platform uses cookies and similar tracking technologies to enhance the user experience, maintain session security and understand how users interact with our platform. The following are the types of cookies we use:

• Essential Cookies: These cookies are required for basic platform functions such as login authentication, session management and security. You cannot disable these cookies without affecting platform functionality.
• Performance Cookies: Collecting information on how users interact with the website, such as most frequently visited pages and error messages. All information is aggregated and anonymised.
• Functional Cookies: Storing user preferences such as language and display settings to provide a more personalised experience during your visit.
• Analytics Cookies: Helps us understand overall platform usage patterns for continuous improvement purposes. This data is not linked to any individual user's identity.

You can manage your cookie preferences through your web browser settings. However, disabling certain cookies may affect the functionality of some cup8 platform features. For more information on managing cookies, please refer to your web browser's help section.

Under Malaysia's Personal Data Protection Act 2010 and cup8's privacy policy, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact the cup8 Personal Data Officer via live chat or email at [email protected]. We will respond within 30 days of receiving your request.

Cup8 implements a comprehensive range of technical and organisational measures to protect users' personal data from unauthorised access, loss, destruction or disclosure. The key security measures we implement include:

• Data encryption in transit using 256-bit SSL/TLS for all communications between the platform and users' devices.
• Encryption at rest for all sensitive data, including financial information and identity documents.
• Two-factor authentication (2FA) is available for all user accounts to add an extra layer of security.
• 24/7 security system monitoring with AI-driven intrusion detection.
• Regular penetration testing conducted by independent security experts to identify system vulnerabilities.
• Tested and verified incident response procedures to ensure rapid action in the event of a data breach.
• Mandatory cybersecurity awareness training for all cup8 staff with access to user data systems.

Cup8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements or changes in platform operations. When changes are made, we will update the "Last Updated" date at the top of this document.

For material changes — such as changes to how we use your personal data or new rights granted to you — cup8 will provide at least 7 days' advance notice before the changes take effect, via one or more of the following methods:

• In-app or on-site notifications on cup8 while you are logged in.
• Email to your registered email address.
• A prominent banner or alert pop-up on the platform's main page.

Continued use of the cup8 platform after changes to the Privacy Policy take effect will be considered your acceptance of the latest version of the policy. If you do not agree with the changes made, you have the right to close your account by contacting our support team.

If you have any questions, concerns or complaints regarding this Privacy Policy or how cup8 handles your personal data, you may contact our Personal Data Officer through the following channels:

We are committed to addressing all privacy enquiries and complaints seriously and within a reasonable timeframe. If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection.