12play21 Privacy Policy

1. Introduction

12play21 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all users ("you", "your") who access or register on https://12play21.org. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, with whom it may be shared, and what rights you have in relation to your data.

By registering an account on 12play21 or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle personal data as described herein, you should not use the Platform.

This Policy should be read together with our Terms & Conditions. In the event of any conflict between this Policy and the Terms & Conditions on a privacy-related matter, this Privacy Policy shall prevail.

2. Personal Data We Collect

2.1 Registration Data

When you create a 12play21 account, we collect the following information:

• Full legal name (as per government-issued identity document)
• Date of birth (to verify the minimum age requirement of 21 years)
• Email address and/or mobile phone number
• Residential address (including city, state, and postcode)
• Preferred username and encrypted password
• Nationality and country of residence

2.2 Identity Verification (KYC) Data

As required by our international gaming authority licence obligations, we may collect copies of:

• Government-issued identity documents (e.g., Malaysian MyKad, passport)
• Proof of address documents (e.g., utility bill, bank statement)
• Proof of payment method (e.g., screenshot of eWallet, bank statement excerpt)
• Selfie or liveness verification image where required by compliance procedures

2.3 Financial Transaction Data

We record all financial activity on your account, including deposit amounts, withdrawal requests, payment method identifiers (e.g., Touch n Go eWallet account reference, FPX bank account masked number), transaction timestamps, and transaction statuses.

2.4 Gaming Activity Data

All bets placed, games played, wins, losses, bonus usage, and session durations are recorded as part of your account's gaming history. This data is used for account management, regulatory compliance, and responsible gaming monitoring purposes.

2.5 Technical & Device Data

We automatically collect technical information when you access the Platform, including: IP address, device type and operating system, browser type and version, session timestamps, pages visited, and referral source. This data is collected via server logs and, where cookies are used, via cookie technology (see Section 5).

2.6 Communications Data

Records of communications between you and 12play21 customer support — including live chat transcripts, support ticket content, and email correspondence — are retained for quality assurance and dispute resolution purposes.

3. How We Use Your Personal Data

4. Legal Basis for Processing

12play21 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the services described in our Terms & Conditions — account management, gaming services, payments.
• Legal obligation: Processing required to comply with our international gaming licence regulatory requirements, including KYC, AML (anti-money laundering), and responsible gaming obligations.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications, where you have explicitly opted in. You may withdraw consent at any time by updating your account communication preferences.

5. Cookies & Tracking Technologies

The 12play21 Platform uses cookies and similar tracking technologies to maintain your session, remember your preferences, and understand how users interact with the Platform. The categories of cookies we use are:

• Strictly necessary cookies: Required for the Platform to function — session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, preferred game view, and "remember me" login state.
• Analytics cookies: Used to collect aggregated, anonymised data about how users navigate the Platform — page visit frequency, session duration, feature usage. This data helps us improve the user experience.
• Marketing cookies: Where you have consented, used to deliver personalised promotional communications based on your activity on the Platform.

You may manage cookie preferences via your browser settings. Disabling strictly necessary cookies will affect your ability to use the Platform. For analytics and marketing cookies, you may opt out via your account settings or browser controls.

6. Data Sharing & Disclosure

12play21 does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment service providers: Touch n Go eWallet, Boost, FPX participating banks (including Maybank, CIMB, Public Bank), and other payment processors — solely to process your deposit and withdrawal transactions.
• Identity verification service providers: Third-party KYC platforms used to verify identity documents and conduct age verification, operating under data processing agreements with 12play21.
• Game software providers: Game studios whose titles appear on the Platform may receive session identifiers and bet data required to deliver game functionality. No directly identifying personal data is shared beyond what is technically necessary.
• Regulatory and law enforcement authorities: Where required by our gaming licence obligations or by applicable law, we may disclose data to regulatory bodies, financial intelligence units, or law enforcement agencies.
• Technology and hosting providers: Infrastructure and security service providers operating under data processing agreements, subject to confidentiality obligations.

Any third party with whom data is shared is required to handle your personal data in accordance with applicable data protection standards and may not use your data for their own independent purposes.

7. Data Retention

12play21 retains your personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable regulatory obligations. Specific retention periods include:

• Account and KYC data: Retained for a minimum of five (5) years from account closure, as required by anti-money laundering regulatory obligations applicable to gaming licence holders.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity logs: Retained for a minimum of three (3) years from the date of activity.
• Customer support communications: Retained for two (2) years from the date of the communication.
• Technical access logs: Retained for twelve (12) months on a rolling basis.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.

8. Your Data Protection Rights

Subject to applicable law and our regulatory obligations, you have the following rights in relation to your personal data held by 12play21:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purpose collected, subject to our legal retention obligations (see Section 7).
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive a copy of data you provided to us in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time without affecting lawfulness of prior processing.

To exercise any of the above rights, contact the 12play21 privacy team via email at [email protected] (plain text, not a link). We will respond within thirty (30) calendar days. Where requests are complex or numerous, we may extend this period by a further sixty (60) days with notice to you.

9. Data Security

12play21 implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encryption of sensitive data fields (including passwords) at rest using industry-standard hashing algorithms
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need
• Regular security assessments and penetration testing of Platform infrastructure
• Incident response procedures for detecting, assessing, and reporting data security incidents
• Segregated environments for personal data and financial data processing

Notwithstanding these measures, no system is entirely immune from security risks. You are encouraged to use a strong, unique password for your 12play21 account and to enable two-factor authentication. In the event of a security incident that materially affects your personal data, 12play21 will notify you in accordance with applicable notification obligations.

10. Children's Privacy

The 12play21 Platform is strictly restricted to individuals aged 21 years and older. We do not knowingly collect or process personal data from individuals under 21 years of age. If we become aware that personal data has been collected from a person under the minimum age requirement, we will immediately suspend the relevant account, delete the associated personal data, and forfeit any associated balance pending investigation.

If you believe that a minor has registered on the Platform, please contact [email protected] immediately.

11. International Data Transfers

12play21 may transfer your personal data to servers or service providers located outside Malaysia, including within the jurisdiction of our international gaming authority licence. Where such transfers occur, we ensure that appropriate safeguards are in place — including data processing agreements incorporating standard contractual clauses — to protect your data to a standard equivalent to that required under applicable data protection law.

Payment processing through Malaysian payment networks (Touch n Go eWallet, Boost, FPX) is conducted within Malaysia-based payment infrastructure. KYC verification may involve processing by verification partners operating in approved jurisdictions under contractual data protection obligations.

12. Changes to This Privacy Policy

12play21 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features. Where changes are material, we will notify you via an in-Platform notification or by email to your registered address prior to the changes taking effect. The "Last Updated" date at the top of this Policy reflects when the most recent changes were made.

We encourage you to review this Policy periodically. Your continued use of the Platform following notification of changes constitutes your acceptance of the updated Privacy Policy.

13. Contact & Complaints

For any privacy-related enquiries, data subject rights requests, or complaints regarding 12play21's handling of your personal data, please contact:

12play21 Privacy & Data Protection
Email: [email protected]
Subject line: "Privacy Enquiry – [Your Account Username]"
Platform: https://12play21.org
Response time: Within 30 calendar days

If you are not satisfied with our response, you may have the right to lodge a complaint with a relevant data protection supervisory authority in your jurisdiction.