Data Protection for cari2u Users

1. Definitions and Scope of Application

This Privacy Policy applies to all individuals who interact with the cari2u platform through the official website cari2u.net, including those who browse without a registered account, users with an active account, and former users whose accounts have been closed.

For the purposes of this document, "Personal Data" means any information that directly or indirectly identifies an individual, including but not limited to name, identification number, email address, mobile phone number, bank account information, and online activity data.

"Processing" refers to any operation carried out on personal data, including collection, recording, organisation, storage, modification, disclosure, transfer or deletion. All processing is carried out in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

The cari2u platform only accepts users aged 21 and above. If we find that a user is below the required age, that account will be suspended immediately and any data collected will be deleted in accordance with our internal procedures.

2. Categories of Data We Collect

cari2u collects users' personal data through three main channels:

2.1 Data You Provide Directly

• Registration information: full name as shown on your identification card (MyKad), username, password (encrypted), email address, mobile phone number and date of birth.
• Identity verification information (KYC): a copy of your identification card, a verification selfie, and proof of residential address to meet anti-money laundering (AML) compliance requirements.
• Financial information: e-wallet account numbers (Touch 'n Go eWallet, ShopeePay), DuitNow details, FPX data, or crypto wallet details (USDT, BTC, ETH) for processing deposits and withdrawals.
• Support communications: records of live chat sessions, emails sent to customer support, and any attachments you provide when dealing with our customer service team.

2.2 Data Collected Automatically

• Technical data: IP address, web browser type and version, device operating system, screen resolution and device identifier.
• Activity log data: date and time of login, pages visited, time spent in each section of the platform, and records of deposit and withdrawal transactions.
• Game data: betting history, types of games played, bet values and outcomes of each session, stored for regulatory compliance purposes and to detect problem gambling.

2.3 Data from Authorised Third Parties

• Results from database checks by relevant authorities for AML compliance and fraud prevention.
• Verification information from the payment service providers we use, to confirm transaction details.

3. Purpose of Data Processing

All personal data we collect is processed on a valid legal basis, namely consent, contractual necessity, or legal obligation. The specific purposes are as follows:

• Account management: registration, identity verification, password management and account recovery.
• Financial processing: verifying and executing deposits and withdrawals through available payment methods, ensuring the minimum deposit of RM10 and minimum withdrawal of RM50 are observed.
• Legal compliance: fulfilling obligations under the Anti-Money Laundering Act (AMLA), international licensing directives, and lawful requests from authorities.
• Platform security: detecting and preventing fraudulent activity, multiple account use, and other security threats.
• Responsible gambling: monitoring betting patterns to identify signs of problem gambling and enforcing limits set by users themselves.
• Service improvement: analysing aggregated usage data to enhance user experience and platform performance.
• Service communications: sending transaction notifications, terms updates, security alerts and other important notices related to your account.

4. Data Sharing and Disclosure

cari2u does not sell or trade users' personal data to any party for commercial purposes. However, there are certain situations where data may be shared with a limited set of third parties:

• Payment service providers: transaction processors for Touch 'n Go eWallet, DuitNow, FPX, ShopeePay and crypto exchanges, solely for the purpose of executing legitimate deposits and withdrawals.
• Game software providers: details required for verifying betting eligibility, in accordance with game licensing agreements.
• Regulatory bodies and law enforcement: where required by law, court order, or direction from a legitimate authority — without requiring user consent in such circumstances.
• Technical service providers: server hosting companies, cybersecurity providers and internal analytics services, all of which are bound by strict non-disclosure agreements (NDA).

All third parties that receive cari2u user data are required to comply with security and confidentiality standards that are equal to or higher than our own. cari2u remains responsible for any data processing carried out on our behalf.

5. Cookies and Tracking Technologies

The cari2u platform uses cookies and similar tracking technologies to keep the platform running smoothly and to provide a personalised experience for users.

• Essential cookies: required for the basic operation of the platform, including login session management, account security and transaction functionality. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: collect usage data anonymously for internal analytics purposes, helping us understand which pages are frequently visited and where users encounter difficulties.
• Preference cookies: store personal settings such as language, display theme and game preferences, so you do not need to reconfigure them each time you log in.

You can manage or delete cookies through your web browser settings. Please note that disabling essential cookies may affect your ability to use certain platform features.

6. Data Security Measures

cari2u continually invests in security infrastructure to protect user data from unauthorised access, loss, destruction or disclosure. The technical and organisational measures we apply include:

• Data encryption during transmission using the latest version of the TLS (Transport Layer Security) protocol.
• Data encryption during storage using the AES-256 standard for all sensitive information.
• Role-based access control (RBAC) — only staff who require specific data to carry out their duties are granted access.
• Round-the-clock security monitoring by our internal information security team.
• Regular penetration testing by independent security auditors.
• A clear incident response procedure to ensure users are notified within the required timeframe in the event of a data breach.

While we take all reasonable steps, no digital system can guarantee absolute security one hundred percent of the time. We encourage users to use strong passwords, not share their login credentials, and contact us immediately if they suspect any suspicious activity on their account.

7. Your Rights as a Data Subject

Under the Personal Data Protection Act 2010 and cari2u's policy, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right of rectification: you may request correction of data that is inaccurate or out of date. Data related to active accounts can be updated through your profile settings.
• Right to restriction of processing: in certain circumstances, you may request that we limit the way we use your data.
• Right to object: you may object to the processing of your data for certain purposes such as direct marketing.
• Right to erasure: you may request the deletion of your personal data, subject to our legal obligations to retain certain records.
• Right to data portability: you may request your data in a machine-readable format for transfer to another party.

To submit any of the above requests, please contact the cari2u customer service team via live chat or support email. We will process requests within a reasonable timeframe and provide a written response on the outcome.

8. Data Retention and Deletion

cari2u adheres to the principle of storage limitation — we do not retain personal data for longer than is necessary for its original purpose. The following are our data retention guidelines:

• Active account data: retained for the duration of the active account, plus a defined post-closure period.
• Financial transaction records: retained for a minimum of seven (7) years from the date of the transaction, in line with AMLA requirements and Malaysian accounting regulations.
• KYC verification documents: retained for the period specified by our licensing body and applicable laws.
• Customer support communication logs: retained for three (3) years after the last session, for reference and dispute resolution purposes.
• Technical log data: retained for twelve (12) months before being automatically deleted or anonymised.

Once the retention period has ended and there is no legal requirement to retain the data further, it will be securely deleted or anonymised so that it can no longer be linked to any individual.

9. Changes to This Privacy Policy

cari2u reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable legal requirements.

Any material changes — meaning those that significantly affect user rights or the way we process data — will be communicated to registered users via in-platform notifications and/or notification emails. Minor changes such as language corrections or additional clarifications may be implemented without specific notice.

The "Last Updated" date at the top of this document will always be updated to reflect the current version. We encourage users to review this Privacy Policy periodically. Continued use of the cari2u platform after any changes take effect signifies your acceptance of the updated Privacy Policy.

10. How to Contact Us

For any enquiries, concerns or requests relating to this Privacy Policy or the handling of your personal data by cari2u, please contact our team through the following channels:

• Live chat: available 24/7 directly within the cari2u platform, in Malay and English.
• Support email: [email protected]

Our customer service team operates around the clock — 24/7 — and is ready to assist you in both Malay and English. We aim to respond to every written enquiry within a reasonable timeframe.

If you are not satisfied with the response provided, you have the right to lodge a complaint with the Department of Personal Data Protection under the Ministry of Communications Malaysia, as provided under PDPA 2010.