18cash Privacy Policy – Transparent & Responsible Personal Data Protection for Malaysian Users

Introduction & Scope of Privacy Policy

Welcome to the 18cash Privacy Policy. This document sets out in full transparency how 18cash ("Platform", "we") collects, processes, stores, shares and protects your personal information as a member or visitor of our platform at 18cash.bet.

18cash operates in compliance with Malaysia's Personal Data Protection Act (PDPA) 2010 and all applicable regulations. We take data protection responsibilities extremely seriously and are committed to safeguarding your privacy in every interaction with our platform.

This Privacy Policy applies to all users of the 18cash platform, including registered members, website visitors, mobile app users, and anyone who interacts with any 18cash service. By using our platform, you agree to the practices described in this document.

Types of Personal Data We Collect

18cash collects various types of information to deliver safe, high-quality services. Below are the categories of data we collect:

18cash adheres to the principle of data minimisation – we only collect information that is strictly necessary for its stated purpose. We do not collect sensitive data such as your medical records or religious beliefs.

How We Collect Your Personal Data

18cash collects your personal data through several different methods:

• Account Registration: When you register for a 18cash account, you provide your name, phone number, date of birth, and other information directly.
• Deposit & Withdrawal Process: When you carry out financial transactions via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX (Maybank2u, CIMB Clicks), or other methods, transaction information is collected for processing and security purposes.
• Identity Verification (KYC): For withdrawals exceeding certain limits, we may request a copy of your MyKad or other identification document for anti-money laundering (AML) compliance purposes.
• Platform Activity: Betting records and games played (slots, baccarat, Sports Betting, digital lottery and more) are collected automatically to maintain platform integrity.
• Customer Support Conversations: When you contact our support team via live chat or email, conversation records are retained for service improvement purposes.
• Cookies & Tracking Technologies: As described in Section 9, we use cookies to enhance the user experience and analyse platform usage.

How We Use Your Personal Data

18cash uses your personal data for the following purposes only, and we will not use your data for any other purpose without your consent:

• Account Management: Creating, managing and securing your 18cash account, including identity verification and login security.
• Transaction Processing: All your deposits and withdrawals are processed quickly and securely via your preferred Malaysian payment method.
• Service Provision: Enables access to all 18cash products – Sports Betting, Live Casino, digital lottery, slots and e-sports.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, money laundering and platform abuse.
• Legal Compliance: Meeting legal obligations, including Malaysia's PDPA 2010 requirements and anti-money laundering regulations.
• Responsible Gaming: Identifying concerning gaming patterns and reaching out to members who may need support with problem gambling.
• Service Communications: Sending important notifications about your account, transactions, and changes to our Terms or Policies.
• Marketing (with consent): Sending information about promotions, bonuses, and the latest offers only where you have given your consent.
• Platform Enhancement: Analysing aggregated usage data to improve the functionality and user experience of the 18cash platform.

Data Sharing with Third Parties

18cash does not sell, rent or trade your personal data to third parties. However, we may share your data with certain parties under the limited circumstances set out below:

• Payment Processing Provider: Transaction data is shared with payment service providers such as Touch 'n Go, GrabPay, DuitNow and Malaysian banking institutions involved in processing your transactions.
• Technology Service Providers: Selected technology vendors who assist us in operating the platform – including cloud services, cybersecurity and analytics – are bound by strict data protection agreements.
• Regulatory Authority: Data is shared with Malaysian authorities when required by law, court order, or official investigations related to fraud or money laundering.
• Identity Verification Provider: During the KYC process, identity information may be verified through Malaysia-recognised verification systems.

Data Security & Protection Measures

18cash invests seriously in security infrastructure to protect your personal data. The security measures we have in place include:

• 256-bit SSL Encryption: All communications between your browser/app and 18cash servers are encrypted using the latest TLS 1.3 protocol.
• Encrypted Data Storage: Sensitive data is stored in encrypted form using industry-recognised encryption algorithms – never in plain text.
• Internal Access Controls: Internal access to member data is restricted to staff who genuinely require it, based on the principle of least privilege.
• Two-Factor Authentication (2FA): 18cash provides and encourages the use of 2FA for all member accounts.
• Continuous Monitoring: Our systems are monitored 24/7 to detect suspicious activity and security threats.
• Regular Security Audits: Independent security audits are conducted on a regular basis to identify and address system vulnerabilities.

While we take all reasonable precautions, no system can be guaranteed 100% secure. In the event of a data breach that affects your rights and freedoms, 18cash will notify you within the timeframe required by applicable law.

Data Retention Period

18cash retains your personal data only for as long as necessary for the stated purposes or as required by law:

• Active Account Data: Retained for the full duration that your account remains active and in use.
• Data After Account Closure: After account closure, basic data is retained for 7 years to meet Malaysia's legal and tax requirements.
• Financial Transaction Records: Retained for 7 years in accordance with Malaysia's anti-money laundering legal requirements.
• Customer Support Records: Retained for 2 years from the date of the last conversation.
• Marketing Data: Retained until you withdraw your consent to receive marketing communications.
• Technical Data & Logs: Retained for 12 months for security purposes and technical troubleshooting.

Upon expiry of the retention period, data will be securely deleted or anonymised so that it can no longer be linked to you personally.

Your Personal Data Rights

As a member of 18cash and as an individual protected under Malaysia's PDPA 2010, you have the following rights regarding your personal data:

Cookies & Tracking Technologies

18cash uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

• Essential Cookies: Required for core platform operations such as login session verification and security. These cookies cannot be disabled.
• Performance Cookies: Helping us understand how members use the platform so we can improve speed and responsiveness.
• Functional Cookies: Saving your preferences such as preferred language, display theme and other settings for your convenience.
• Analytics Cookies: Collecting aggregated, anonymised usage data to help us understand platform usage trends.

You can control or disable cookies (except mandatory cookies) through your web browser or app settings. Please note that disabling certain cookies may affect the functionality of some parts of the 18cash platform.

Cross-Border Data Transfers

In operating the 18cash platform, your personal data may be processed on servers located outside Malaysia, primarily for cloud infrastructure and security services. When this occurs, we ensure that:

• All cross-border data transfers are carried out in accordance with applicable legal requirements, including Malaysia's PDPA 2010.
• The recipient country or region provides a level of data protection equivalent to or greater than that of Malaysia.
• Appropriate data transfer agreements are in place with all parties that receive data.
• Your data will not be transferred to parties in countries with inadequate data protection standards without additional safeguards in place.

We always endeavour to process and store your data within Malaysia where it is practical and technically reasonable to do so.

Privacy Policy Changes & Contact Us

18cash reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or platform enhancements. When material changes are made:

• We will update the "Last Updated" date at the top of this document.
• Members will be notified via in-account notification or email at least 14 days before any changes take effect.
• Continued use of the 18cash platform after the effective date constitutes acceptance of the updated Policy.