24h2 Privacy Policy – Personal Data Protection for Malaysian Players

24h2 is an online betting and entertainment platform operating in Malaysia that takes the privacy of its members seriously. This Privacy Policy outlines our practices regarding the collection, use, storage, protection, and disclosure of personal information you provide to us when registering for and using the platform 24h2.

This policy applies to all users of the platform 24h2 including the official website at 24h2.my, the mobile application for iOS and Android, and all services provided through our platform. Personal information as referred to in this policy means any information that can be used to identify you as an individual – whether directly or indirectly.

24h2 acts as a responsible Data Processor as defined under Malaysia's Personal Data Protection Act 2010 (PDPA). We respect the individual rights established under that legislation and are committed to upholding them in every aspect of our operations that involves members' personal data.

24h2 collects various types of data depending on your level of interaction with our platform. In detail, the following are the categories of data we collect:

Registration & Identity Data:

• Full name as stated on your official Malaysian identification document
• Identity card number (MyKad) or passport number
• Date of birth and gender
• A valid email address
• An active Malaysian mobile phone number
• Current residential address in Malaysia

Financial & Transaction Data:

• EWallet account details (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay) used for deposits and withdrawals
• Bank details for FPX transactions (Maybank2u, CIMB Clicks) – bank name and account number only
• Deposit and withdrawal history in Malaysian Ringgit (RM)
• Gaming transaction records, including bets placed, winnings, and losses

Technical & Usage Data:

• IP address of the device used to access the platform
• Device type, operating system, and web browser version
• Platform usage timestamps and duration logs
• Approximate location data (state/city) based on IP address
• Cookie data and similar tracking technologies

24h2 collects and processes your personal data for the following specific and legitimate purposes:

• Service Provision: Creating and managing your account, processing deposits and withdrawals in MYR via local Malaysian payment methods, and enabling you to access all games on the platform 24h2.
• Identity Verification (KYC): Verifying that you meet the minimum age requirement of 21 years, confirming your identity for security purposes, and preventing fraud and misuse of the platform.
• Financial Crime Prevention: Complying with legal requirements related to anti-money laundering (AML) and counter-terrorism financing (CFT) applicable in Malaysia.
• Customer Support: Enabling the support team 24h2 accurately identify you when you reach out to us via live chat, email or Telegram for assistance.
• Platform Security: Detecting and preventing fraudulent activity, multi-account usage, bonus system abuse, and any suspicious behaviour on the platform 24h2.
• Service Improvement: Analysing usage patterns on an aggregate basis (without identifying individuals) to better understand player needs and improve platform quality 24h2.
• Service Communications: Sending important account-related information, transaction updates, policy changes, and promotional offers relevant to your preferences at 24h2.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing timely support to players who need it.

24h2 does not sell, rent or disclose your personal information to third parties for their marketing purposes. However, in the course of operating our services, your information may be shared with the following selected parties within a limited and controlled scope:

• Payment Service Providers: Payment gateways that process your deposit and withdrawal transactions, including Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay and FPX operators. Data shared is limited to the minimum necessary to process transactions and is subject to strict confidentiality agreements.
• Game Providers: Game providers that supply slots and other games on the platform 24h2 may receive game session data necessary to run the games. This data does not include your financial information or full identity details.
• Technology Service Providers: Server hosting companies, cloud service providers, and analytics tool providers we use to operate the platform 24h2. All these providers are bound by data processing agreements that meet PDPA standards.
• Malaysian Statutory Authorities: 24h2 will disclose information to the relevant authorities when required by Malaysian law, including for the purposes of criminal investigation, court orders or requests from legitimate regulatory bodies.

All third parties we work with are bound by data confidentiality agreements and are required to uphold data protection standards at least equivalent to Malaysia's PDPA 2010. 24h2 is responsible for ensuring these parties handle your data safely and responsibly.

24h2 invests heavily in security infrastructure to protect your personal data from unauthorised access, modification, disclosure or destruction. The technical and organisational measures we implement include:

• Transit Encryption: All communications between your device and our servers 24h2 is encrypted using TLS 1.3 with a 256-bit SSL certificate — the same standard used by Malaysian banking institutions.
• Storage Encryption: Sensitive data stored on our servers is encrypted using AES-256, an industry-standard encryption method adopted by the Malaysian government for classified data.
• Strict Access Controls: Only staff 24h2 who require access to your data in order to carry out their duties are permitted to do so. All access is logged and audited on a regular basis.
• 24/7 Secure Monitoring: Cybersecurity team 24h2 monitor our infrastructure around the clock using advanced threat detection systems to identify and respond to any suspicious activity without delay.
• Regular Security Audits: 24h2 conducts regular penetration testing and security audits by independent experts to identify and remediate any vulnerabilities in our systems before they can be exploited.
• Incident Management: We have a tested incident response plan in place to ensure we can act swiftly and effectively in the event of any security breach.

24h2 retains your personal data for as long as your account remains active and for the period required after account closure to fulfil our legal and operational obligations. Specifically:

• Active Account Data: Retained for as long as your account remains active on the platform 24h2. Should an account remain inactive for more than 2 years, we will contact you to confirm whether you wish to keep the account or have it deleted.
• Financial Transaction Data: Retained for a minimum of 7 years from the transaction date, as required under the Companies Act 2016 and Malaysia's anti-money laundering regulations.
• Identity Verification (KYC) Data: Retained for a minimum of 5 years following account closure, as mandated by the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001.
• System Logs: Retained for 12 months for security and technical troubleshooting purposes, then automatically deleted.
• Customer Support Data: Records of interactions with the support team are retained for 3 years to enable us to deliver better and more consistent service.

Once the applicable retention period has elapsed, your data will be securely deleted or anonymised using methods that ensure it can no longer be linked back to you as an individual.

As a data subject under Malaysia's PDPA 2010, you have the following rights regarding your personal data held by 24h2:

To exercise any of the above rights, submit a written request to the data protection team 24h2 at [email protected] by specifying the type of right you wish to exercise along with your account details for identity verification purposes. We may require proof of identity before processing your request to ensure the security of your data.

24h2 uses cookies and similar tracking technologies to enhance the user experience on our platform. Cookies are small data files stored on your device when you visit our website or use our application.

We use three main categories of cookies:

• Essential Cookies: Required for core platform functions such as maintaining your login session and processing transactions. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Helping us understand how players use the platform 24h2 – which pages are visited most frequently, how long players spend playing and which features are most popular. This data is collected in aggregate and does not identify individuals.
• Functional Cookies: Remembering your preferences such as language, text size and display settings to provide a more personalised experience on your next visit.

You can manage your cookie settings through your web browser at any time. Please note, however, that disabling essential cookies may affect your ability to log in or carry out transactions on the platform 24h2.

24h2 takes the protection of children and minors extremely seriously. Our platform is strictly for individuals aged 21 and above, with no exceptions. We do not knowingly collect personal data from minors.

If we find that a member under the age of 21 has registered using inaccurate information, we will immediately:

• Suspend the account in question immediately
• Freeze all funds in the account
• Securely delete all personal data relating to the minor upon completion of the account closure process
• Reporting the incident to the relevant authorities in Malaysia if required

If you become aware that someone under the age of 21 has registered an account with 24h2, please contact our support team immediately at [email protected] with the subject line "Underage Account Report" and we will take prompt action.

If you have any questions, concerns or requests regarding this Privacy Policy or the way 24h2 handling your personal data, you may contact our Data Protection Officer (DPO) through the following channels:

• Email: [email protected] (please state "Privacy Enquiry" in the email subject line)
• Live Chat: Available in-platform 24h2 24 hours a day, 7 days a week
• Telegram: Official support channels 24h2

We are committed to responding to all privacy-related enquiries within 3 working days. For more complex requests such as data access or deletion applications, please allow up to 14 business days for processing. We will notify you if any request requires additional time and provide the reason for the delay.

24h2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or to clarify any matter. All material amendments to this policy will be communicated to active members via:

• An email notice sent to your registered email address at least 14 days before the changes take effect
• A prominent notice on the platform's main page 24h2
• Updates will be reflected on the "Last Updated" date shown at the top of this document

Continued use of the platform 24h2 after the effective date of any amendment will be deemed as your acceptance of the revised policy. If you do not agree with any changes, you have the right to close your account and discontinue use of the platform 24h2.

Previous versions of this Privacy Policy are available upon request by emailing our data protection team, should you need them for reference purposes.