22 Club Privacy Policy – Data Protection for Malaysian Members

This Privacy Policy ("Policy") is published by 22 Club ("we", "the Company") and applies to all users who access or use the 22 Club platform via the website 22club.biz along with all associated applications, services, and content.

As an online Sports Betting and casino platform operating in Malaysia, 22 Club is bound by Personal Data Protection Act 2010 (PDPA) Malaysia. We are fully committed to complying with the provisions of this Act in every aspect of how we manage our members' personal data.

This policy clearly and transparently outlines:

• The types of personal data we collect from you.
• Why and how we use that data.
• Who we may share your data with under certain circumstances.
• The security measures we have in place to protect your data.
• The rights you hold over your personal data and how to exercise them.

By registering or continuing to use the 22 Club platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, we advise you to discontinue use of our services.

22 Club collects members' personal data through various means. Below are the categories of data we collect and their sources:

22 Club uses members' personal data solely for legitimate and transparent purposes. Every use of data has a clear legal basis:

• Account Management: Creating and maintaining member accounts, processing registrations, verifying identities, and managing secure logins.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX; as well as processing withdrawals to members' bank accounts or e-wallets.
• Service Provision: Enables members to access all Live Casino games, slots, Sports Betting on the Malaysia Super League and EPL, badminton, e-sports, and other sports on the 22 Club platform.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Legal Compliance: Fulfilling legal obligations, including Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.
• Customer Support: Responding to enquiries, complaints, and support requests submitted via live chat or email.
• Marketing (with consent): Sending promotional information, bonus offers, and platform updates to members who have given consent to receive marketing communications.
• Platform Improvements: Analysing usage patterns in aggregate to improve the user experience, platform performance, and the range of games offered.

22 Club will not use your personal data for any purpose other than those stated above without first obtaining your consent.

22 Club does not sell or trade members' personal data. However, in certain circumstances, we may need to share your data with the following parties:

• Payment Providers: Transaction information that must be shared with payment processors such as DuitNow, FPX, and Malaysian e-wallet providers to process your deposits and withdrawals.
• Game Software Providers: The minimum technical data required by Live Casino and slots game providers to ensure a smooth and fair gaming experience.
• Statutory Authorities: Information required by law to be disclosed to Malaysian government agencies, law enforcement authorities, or relevant regulatory bodies.
• Professional Advisors: Lawyers, accountants, or auditors bound by professional confidentiality obligations in circumstances requiring expert advice.

Protecting members' personal data is a top priority at 22 Club. We implement multiple layers of technical and organisational security to ensure your data remains safe at all times:

• 256-bit SSL Encryption: All communications between your device and 22 Club's servers are encrypted using the latest TLS/SSL technology.
• Two-Factor Authentication (2FA): Members are encouraged to enable 2FA for an additional layer of protection on their accounts.
• 24/7 Monitoring: Our security team continuously monitors our systems to detect any suspicious activity or intrusion attempts.
• Internal Access Controls: Only authorised 22 Club personnel with a legitimate business need are permitted to access members' personal data.
• Regular Security Audits: We conduct regular security assessments and penetration testing by independent third parties to identify and address vulnerabilities.
• Secure Data Backup: Data is backed up regularly and stored in a secure, encrypted location to ensure service continuity.

While we take all reasonable steps to protect your data, no security system can be guaranteed to be completely foolproof. We encourage members to play their part in keeping their accounts secure by using strong passwords and not sharing their login credentials.

22 Club uses cookies and similar tracking technologies to enhance the user experience on our platform. The following are the types of cookies we use:

You can manage or disable non-essential cookies through your web browser settings at any time. Please note, however, that disabling essential cookies may affect certain functions of the 22 Club platform.

Under Malaysia's Personal Data Protection Act 2010, you as a 22 Club member have the following rights regarding your personal data:

To exercise any of the above rights, please contact our privacy team at support@22club.biz with the subject line "Privacy Rights Request". We will process your request within 14 working days.

22 Club retains members' personal data for as long as necessary for the purposes set out in this Privacy Policy or as required under applicable Malaysian law:

• Active Account Data: Retained for the duration that your 22 Club account remains active.
• Data Following Account Closure: Financial transaction records and identity information are retained for a minimum of 7 years following account closure, in compliance with anti-money laundering legal requirements.
• Communication Data: Customer support conversation records are retained for 3 years for reference and dispute resolution purposes.
• Technical Log Data: Access logs and technical data are retained for 12 months for security and debugging purposes.
• Marketing Data: Retained until you withdraw consent or request deletion.

Once the retention period has expired, data will be securely deleted or anonymised so that it can no longer be linked to you personally.

The 22 Club platform may contain links to or integrations with third-party services, such as live casino game providers and payment providers. This Privacy Policy applies solely to the 22 Club platform and does not cover those third-party websites or services.

We encourage members to read the privacy policy of any third party before providing their personal data. 22 Club is not responsible for the privacy practices or content of third-party websites.

22 Club reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the technologies we use. The "Last Updated" date at the top of this page will always reflect the latest version of this policy.

For material and significant amendments, we will notify members via:

• In-platform notification upon next login.
• Email to your registered address.
• Display of a prominent notice on the platform's main page.

Your continued use of the 22 Club platform after any amendments are published constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how 22 Club handles your personal data, please contact our Privacy Officer via:

• Privacy Email: support@22club.biz (subject: "Privacy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week via the 22 Club platform.

We are committed to addressing all privacy-related enquiries seriously and will respond within 3 working days. For more complex data rights requests, we will inform you of a more precise processing timeframe.