Privacy Policy 12track – Your Data, Our Responsibility

01 Introduction

12track understands that your trust is our most valuable asset. When you register and play on our platform, you entrust us with your personal information — and we do not take that responsibility lightly.

This Privacy Policy details how 12track collects, processes, stores, and protects your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international standards. It also clarifies the rights you hold regarding your personal data and how to exercise those rights.

This policy applies to all users who access the 12track platform via our website, mobile app, or any digital channel we provide. By using our platform, you agree to the terms set out in this Privacy Policy.

02 Data We Collect

12track collects several categories of personal data depending on how you interact with our platform. The following is a full breakdown of the data we collect and the reasons for doing so:

A. Data You Provide Directly

B. Automatically Collected Data

• Device data: Device type, operating system, phone model, screen resolution and unique device identifier.
• Network data: IP address, IP-based geographic location, internet service provider (ISP).
• Session data: Login and logout times, session duration, in-platform navigation activity.
• Gaming data: Wagering records, game history, wins, losses and gameplay patterns.
• Cookie data: Session cookies, preference cookies and analytics cookies as described in Section 7.

C. Data from Third Parties

• Payment processor: Transaction confirmation and payment status from FPX providers, e-wallets and banking institutions.
• Identity Verification Services: Document verification information from trusted third-party KYC providers.
• Game provider: Technical data relating to gaming sessions and betting results from our game software providers.

03 How We Use Your Data

12track uses your personal data for legitimate and limited purposes. We will not use your data for any purpose beyond those stated below without first obtaining your consent.

• Account Management: Create and maintain your account, process registration, login verification and profile management.
• Transaction Processing: Process deposits, withdrawals and all financial transactions on the platform securely and swiftly.
• Identity Verification (KYC): Meet legal compliance requirements to verify player identity in order to prevent fraud and money laundering.
• Customer Support: Handle enquiries, complaints and technical support requests via Live Chat, email and other support channels.
• Platform security: Detect and prevent fraud, hacking, multi-account usage and other security threats.
• Platform Improvement: Analyse usage patterns to improve the interface, technical performance and overall user experience.
• Marketing communications: Send information about promotions, bonuses and new offers – only to users who have consented to receive them.
• Legal compliance: Meet reporting obligations to the relevant authorities when required by law.

04 Legal Basis for Data Processing

12track processes your personal data on a solid legal basis under Malaysia's Personal Data Protection Act 2010 (PDPA). We rely on the following bases depending on the purpose of processing:

• Contract fulfilment: Processing necessary to fulfil the agreement between you and 12track – including account management, payment processing and delivery of gaming services.
• Legal obligation: Processing required to comply with applicable laws, including KYC requirements, financial reporting and anti-money laundering obligations.
• Legitimate interest: Processing for platform security, fraud prevention and service improvement purposes that does not affect your fundamental rights.
• Consent: Processing for optional marketing and analytics purposes, which is only carried out after you have provided clear and free consent.

Should 12track wish to use your data for a new purpose not covered by the existing legal basis, we will notify you and obtain your fresh consent before such processing begins.

05 Data Sharing with Third Parties

12track does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, there are limited situations where we need to share your data with trusted parties to enable platform operations:

• Payment processor: FPX providers, e-wallets and banking institutions require the necessary transaction information to process your deposits and withdrawals securely.
• KYC provider: Third-party identity verification services that assist us in verifying your documents to comply with legal requirements.
• Game software provider: Game providers operating within the 12track platform may receive limited technical data relating to your game session.
• Infrastructure provider: Cloud hosting and cybersecurity companies that support our platform's technical operations, subject to strict confidentiality agreements.
• Legal authorities: Government agencies, regulatory bodies, or law enforcement when required by law or court order.

All third-party partners we engage are bound by data processing agreements that require them to protect your data to a standard no less than that set out in this Privacy Policy.

06 Data Security

Protecting your data from unauthorised access, loss or accidental disclosure is 12track's highest priority. We implement multiple layers of technical and operational security to ensure comprehensive protection:

• Data encryption in transit: All communications between your browser or app and 12track servers are protected with TLS 1.3 / 256-bit SSL encryption, ensuring no third party can intercept your data.
• Data encryption at rest: Sensitive data such as passwords and financial information is stored in encrypted form using AES-256 encryption algorithms in our database.
• Strict access controls: Only 12track staff who require access to your data for work purposes are granted permission, and all access is logged and audited regularly.
• Two-Factor Authentication (2FA): All administrative accounts and critical systems are protected with 2FA, and this feature is also available to player accounts for added security.
• Continuous monitoring: Our automated security monitoring system operates 24/7 to detect and respond to any threats or suspicious activity.
• Penetration testing: 12track infrastructure undergoes regular security testing by independent cybersecurity experts to identify and address any vulnerabilities.
• Data backup: Your data is regularly backed up to a separate secure location to ensure data recovery in the event of a system failure.

However, we wish to remind you that no security system is one hundred percent perfect. In the event of a data breach affecting your information, 12track is committed to notifying you within the timeframe required by law and taking the necessary remedial steps promptly.

07 Cookies and Tracking Technologies

The 12track platform uses cookies and similar tracking technologies to enhance your experience, ensure smooth platform functionality and analyse usage patterns in aggregate.

• Session cookies (required): These cookies are required for basic platform operations, including maintaining your login session and processing transactions securely. The platform cannot function without them.
• Preference cookies: Save your personal settings such as preferred language, display region and game preferences so you do not need to reconfigure them every time you log in.
• Analytics cookies: Helps us understand how players use the platform, which pages are visited most often and where users encounter difficulties, so we can continuously improve the user experience.
• Security cookies: Used to detect suspicious activity, prevent fraud, and maintain the integrity of user sessions.

You can manage your cookie preferences through your browser settings. Please note, however, that disabling essential cookies may affect platform functionality. Analytics and marketing cookies can be disabled without impacting basic platform use.

08 Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and 12track's internal policies, you have several important rights regarding your personal data:

To exercise any of the above rights, contact the 12track Data Protection Officer by email at [email protected]. We will respond to your request within 30 business days.

09 Data Retention Period

12track retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by Malaysian law.

• Active account data: Retained for the duration your account is active plus the legally required retention period following account closure.
• Transaction records: Retained for a minimum of 7 years from the transaction date, in line with Malaysian financial and tax legal requirements.
• KYC documents: Retained for a minimum of 5 years after the business relationship ends, in accordance with the Anti-Money Laundering Act 2001.
• Support communication records: Retained for 3 years for reference and dispute resolution purposes.
• Security logs: Retained for 12 months for security investigation and audit purposes.
• Marketing data: Deleted within 30 days after you withdraw your marketing consent.

Upon expiry of the stipulated retention period, your data will be securely deleted or anonymised using methods that ensure it can no longer be used to identify you.

10 International Data Transfers

In certain circumstances, your personal data may be processed or stored outside Malaysia, particularly when we use cloud service providers or international game providers.

Any transfer of personal data outside Malaysia is only carried out when:

• The recipient country has a level of data protection equivalent to or higher than that required under Malaysian law.
• Adequate safeguards are in place, such as standard contractual clauses or data processing agreements that comply with PDPA.
• The transfer is necessary to perform the contract between you and 12track, such as processing international payments.

12track always ensures that any international data transfers are carried out with adequate safeguards and in full compliance with all applicable legal requirements.

11 Child Protection

The 12track platform is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data of individuals under 18 years of age.

All registration applicants are required to confirm that they are aged 18 and above at the point of registration, and our KYC process will verify the applicant's age using valid identification documents.

12 Privacy Policy Amendments

12track reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technology. The "Last Updated" date at the top of this page will always be revised whenever changes are made.

For significant changes, we will notify you via in-platform notifications or your registered email at least 14 days before the changes take effect. This gives you sufficient time to review the changes and make decisions regarding your use of the platform.

Your continued use of the 12track platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you disagree with any amendment, you have the right to close your account in accordance with the procedures set out in our Terms & Conditions.

For any enquiries regarding this Privacy Policy or how we handle your personal data, please contact the 12track Data Protection Officer by email [email protected] or via Live Chat available 24/7 on our platform.