Kupu178 Privacy Policy – Personal Data Protection for Malaysia Members

01Introduction & kupu178's Privacy Commitment

Kupu178 is an online gaming platform serving members across Malaysia. We understand that your trust depends not only on the quality of our games and the speed of withdrawals, but also on how responsibly and transparently we handle your personal information.

This Privacy Policy ("Policy") describes the types of personal data we collect, why we need it, how it is used, who it is shared with, and how you can manage your own data. This Policy applies to all users of the kupu178 platform, including website visitors, registered members, and anyone who interacts with our services.

Kupu178 complies with Malaysia's Personal Data Protection Act 2010 (PDPA) and all applicable data protection regulations. We have appointed an internal data compliance officer responsible for ensuring that our data processing practices remain in full compliance with current legal requirements.

02Types of Personal Data We Collect

Kupu178 only collects the personal data necessary to provide a safe, fair, and efficient service. Below are the categories of data we collect and their primary purposes:

We do not collect sensitive data such as health information, religious beliefs, or biometric information, except in very limited circumstances and with your explicit consent.

03How We Collect Your Personal Data

Kupu178 collects your personal data through a variety of transparent channels. We want you to know exactly when and how your data is collected:

• During account registration: When you complete the kupu178 registration form, you provide basic details such as your name, phone number, email address, and password. This information is collected directly from you.
• During the KYC process (identity verification): When you submit verification documents such as a copy of your MyKad or bank statement, we collect data from those documents to meet our legal compliance requirements.
• During deposits and withdrawals: Bank account details, Touch 'n Go eWallet numbers, GrabPay, Boost, ShopeePay, DuitNow, or FPX information are automatically collected when you carry out financial transactions.
• While using the platform: Technical data such as IP address, device type, operating system, and activity logs are automatically collected through our servers when you browse or play on the kupu178 platform.
• Through cookies and similar technologies: Our platform uses cookies, web pixels, and similar tracking technologies to collect information about how you use our website. Further details are provided in Section 8.
• Through support communications: When you contact the kupu178 support team via live chat, email, or WhatsApp, the content of those communications is recorded for troubleshooting and service improvement purposes.
• From trusted third parties: In certain cases, we may receive information about you from payment service providers, identity verification agencies, or regulatory bodies that are legally authorised to share such information.

04How We Use Your Personal Data

Kupu178 uses the personal data collected for the following purposes, all of which are necessary to provide you with a safe and quality service:

• Account management: Creating, verifying, and maintaining your member account. This includes processing your registration, conducting age eligibility checks, and managing your user profile.
• Transaction processing: Processing deposits via FPX, DuitNow, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, as well as processing withdrawals to your Malaysian bank account within the stipulated timeframe.
• Legal compliance and fraud prevention: Fulfilling legal obligations under PDPA 2010, the Anti-Money Laundering Act 2001 (AMLA), and KYC requirements. Detecting and preventing fraud, money laundering, and platform abuse.
• Platform security: Monitoring account activity to detect suspicious logins, cyberattacks, or unusual behaviour that may compromise your account security.
• Customer support: Responding to enquiries, resolving complaints, and providing technical assistance through kupu178's support channels.
• Responsible gambling: Monitoring gameplay patterns to identify signs of problem gambling and helping members make use of the self-exclusion and control tools available on the kupu178 platform.
• Experience personalisation: Tailoring promotional offers, recommending suitable games, and presenting relevant content based on your preferences — all with your consent.
• Analytics and improvement: Analysing platform usage patterns in aggregate (not at an individual level) to improve the performance, design, and functionality of the kupu178 website.

05Sharing Data with Third Parties

Kupu178 recognises that data sharing is a sensitive matter. We only share your personal data in limited, controlled circumstances as outlined below:

• Payment service providers: To process your deposits and withdrawals, certain financial information must be shared with approved payment processors, including Malaysian local banks, FPX operators, DuitNow, and licensed e-wallet providers. This sharing is limited strictly to the information required to complete each transaction.
• Game providers: Third-party game providers that supply slots, Live Casino, baccarat, poker, and Sports Betting on the kupu178 platform may receive limited session data to ensure games function correctly. They are bound by strict data protection agreements with kupu178.
• Lawful authorities: kupu178 will disclose your personal data to government authorities, regulators, or law enforcement agencies when required to do so under applicable Malaysian law, such as the Malaysian Communications and Multimedia Commission (MCMC) or the Financial Intelligence Unit (FIU).
• IT and security service providers: Technical partners providing cloud computing, cybersecurity, and fraud detection services. All partners are bound by strict confidentiality agreements and are not permitted to use your data for their own purposes.
• Auditors and professional advisors: Law firms, auditors, and consultants formally appointed by kupu178 may need to access certain data within the scope of their engagement, but are bound by professional confidentiality obligations.

In the event of a merger, acquisition, or sale of kupu178's business assets, members' personal data may be transferred to the successor entity. We will notify members before their data becomes subject to a different privacy policy.

06kupu178 Data Security Measures

The security of your personal data is a top priority at kupu178. We implement multiple layers of technical and organisational safeguards to ensure your data remains protected at all times:

• 256-bit SSL/TLS Encryption: All communications between your device and kupu178's servers are encrypted using industry-standard SSL/TLS protocols. This ensures that your information cannot be intercepted during transmission.
• Encryption of data at rest: Sensitive personal data such as MyKad numbers, banking details, and passwords are stored in encrypted form using the latest encryption algorithms. Passwords are stored as irreversible hashes.
• Layered access controls: Only kupu178 staff with a legitimate business need are permitted to access members' personal data. All access is logged and monitored automatically.
• Two-factor authentication (2FA): kupu178 encourages all members to enable two-factor authentication on their accounts as an added layer of protection.
• 24/7 threat monitoring: Our automated security monitoring system operates around the clock to detect and respond to any security threats, intrusion attempts, or suspicious activity.
• Regular penetration testing: Independent security experts conduct regular penetration testing on kupu178's infrastructure to identify and address vulnerabilities before they can be exploited.
• Incident response plan: kupu178 has a clear incident response procedure in place. In the event of a data breach affecting your information, we will notify you within 72 hours of the breach being detected, in line with industry best practices.

07Data Retention Period

Kupu178 retains your personal data only for as long as necessary for the purposes outlined in this Policy, or as required by Malaysian law. The following are our data retention guidelines:

• Active account data: Retained for the duration your account is active with kupu178, plus 7 years after account closure, in line with the requirements of AMLA 2001.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date, as required under the Banking and Financial Institutions Act 1989 and related legislation.
• KYC records and identity verification: Retained for 7 years from the date of verification or account closure, whichever is later.
• Support communication logs: Retained for 3 years from the date of interaction for complaint resolution and service improvement purposes.
• Cookie and analytics data: Session data is deleted upon session expiry. Aggregated analytics data is retained for a maximum of 2 years.
• Marketing data (where permitted): Retained until you withdraw your consent to receive marketing communications from kupu178.

Once the retention period expires, your personal data will be securely deleted using methods that ensure the data cannot be recovered. You may request early deletion of your data (within the limits permitted by law) through the channels specified in Section 12.

08Cookies and Tracking Technologies

Kupu178 uses cookies and similar technologies to enhance your experience on our platform. Here are the types of cookies we use and how you can manage them:

• Strictly necessary cookies: These cookies are required for the platform's core functions — such as keeping you logged in and maintaining account security. They cannot be disabled, as the platform will not function properly without them.
• Performance and analytics cookies: We use internal analytics tools to understand how members use the kupu178 platform, which pages are most popular, and where technical issues arise. All data is analysed in aggregate and is not linked to any individual's identity.
• Functional cookies: These cookies remember your preferences — such as your chosen language, display size, and other settings — so you don't have to reconfigure them every time you visit.
• Session cookies: Temporary cookies that are automatically deleted when you close your browser. These are used to identify your gaming session and prevent unauthorised access.

09Your Privacy Rights as a kupu178 Member

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and kupu178's internal policies, you have the following rights regarding your personal data. We fully respect and support the exercise of these rights:

• Right of access: You have the right to request a copy of the personal data we hold about you. We will provide this information within 21 working days from the date your request is received.
• Right to rectification: If you find that personal data we hold about you is inaccurate or out of date, you have the right to request a correction. Basic account data can be updated directly through your profile settings.
• Right to erasure ("right to be forgotten"): You may request the deletion of your personal data under certain circumstances. Such requests are subject to our data retention obligations under applicable law, particularly AMLA 2001.
• Right to restrict processing: In certain situations, you may request that we restrict how we use your data while a particular issue is being resolved.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time. You may unsubscribe from our marketing communications by clicking the "unsubscribe" link in any marketing email.
• Right to withdraw consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.
• Right to complain: If you are not satisfied with how kupu178 handles your data, you have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner.

To exercise any of the rights above, please contact the kupu178 privacy team using the details provided in Section 12. We may need to verify your identity before processing your request.

10Protection of Children's Data

The kupu178 platform is strictly for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. Our registration process includes rigorous age verification, including MyKad checks, to ensure all members meet the minimum age requirement.

Should we discover that we have inadvertently collected personal data from someone under the age of 18, we will take immediate steps to:

• Immediately suspending and closing the account in question.
• Deleting all personal data associated with the account.
• Returning any net balance to the original payment method within a reasonable timeframe.

11Amendments to This Privacy Policy

Kupu178 reserves the right to update or amend this Privacy Policy from time to time in line with changes to legislation, industry practices, or business requirements. We are committed to informing you of any significant changes in a clear and timely manner.

When we make amendments to this Policy:

• Updated versions will be published on this page with a new effective date indicated at the top.
• For significant amendments that affect your privacy rights, we will send a notification to your registered email address or via an in-platform notification at least 7 days before the changes take effect.
• For minor amendments that are purely clarificatory in nature, we may not send a separate notification, but the last updated date will always be indicated.

Your continued use of the kupu178 platform after any amendments take effect will be considered your acceptance of the revised Policy. We encourage you to review this page periodically to stay informed about how we protect your information.

12Contact the Kupu178 Privacy Team

If you have any questions, concerns, or complaints about how kupu178 handles your personal data, or if you wish to exercise any of your privacy rights, our team is here to help:

• Privacy email: support@kupu178.my (please include "Privacy Inquiry" in the email subject line)
• 24/7 live chat: Available on the kupu178 platform at all times
• Response time: We aim to respond to all privacy enquiries within 3 working days and to fulfil all privacy rights requests within 21 working days.