My 36 Privacy Policy – Personal Data Protection for Malaysian Members

01 Introduction – my 36's Commitment to Your Privacy

my 36 (operating under my36.biz) values the trust you place in us when you register and use our platform. We understand that your personal information is a valuable asset, and we take our responsibility to protect it seriously.

This Privacy Policy is designed to explain transparently how my 36 handles your personal data – from how we collect it, the purposes for which it is used, who may have access to it, and the rights you hold over that information. This document forms part of the overall agreement between you and my 36, together with our Terms & Conditions.

We operate in full compliance with Personal Data Protection Act 2010 (PDPA) Malaysia, which is the primary legislation governing the processing of personal data in the context of commercial transactions in Malaysia. We also adhere to industry best practices in cybersecurity and data protection.

02 Types of Personal Data We Collect

My 36 only collects data that is strictly necessary to provide our services safely and efficiently. The following are the categories of data we collect:

My 36 never collect sensitive data such as health information, sexual orientation, religious beliefs or political views unless there is a specific legal requirement and you have given explicit consent.

03 How my 36 Collects Your Data

My 36 collects your personal data through several different channels:

• Account registration – Information you provide directly when completing the registration form, such as your name, email address, and phone number.
• Identity verification – Documents you submit when verification is required, such as a copy of your MyKad or passport.
• Financial transactions – Data generated when you make deposits via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, or FPX (Maybank2u, CIMB Clicks), as well as during withdrawals.
• Platform usage – Data automatically generated as you browse the my 36 website or use the app, including games played, bets placed, and choices made.
• Devices and technology – Technical information such as IP address, browser type, operating system, and device identifiers collected automatically by our systems.
• Communications with the support team – Records of conversations via live chat, email, or any other support channel you use to contact my 36.
• Third-party sources – In certain cases, we may receive information from payment service providers or identity verification providers working with my 36, solely for security verification purposes.

04 How Your Personal Data Is Used

My 36 uses your personal data only for legitimate and transparent purposes. The following are the primary purposes for which your data is used:

• Account management – To create, verify, and manage your member account on the my 36 platform.
• Transaction processing – Processing deposits, withdrawals, and all financial transactions carried out on the platform, including payment records in MYR via Malaysian payment methods.
• Age and identity verification – Ensuring all my 36 members are individuals aged 18 and above and are legally eligible to use the platform.
• Fraud prevention and security – Detecting, investigating, and preventing fraudulent activity, money laundering, or any other unlawful conduct on the platform.
• Legal compliance – Fulfilling the legal and regulatory obligations imposed on my 36 by the relevant Malaysian authorities.
• Service improvement – Analysing usage patterns to improve the user experience, develop new features and optimise platform performance.
• Marketing communications – Sending you information about my 36's latest promotions, bonuses and offers, provided you have not opted out of such communications.
• Customer support – Responding to enquiries, resolving technical issues and handling any complaints you submit to the my 36 team.
• Responsible gaming – Monitoring gaming patterns to identify signs of problem gambling and offering appropriate support when needed.

05 Sharing Data with Third Parties

My 36 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. However, there are limited circumstances in which we may need to share your data with certain parties:

• Payment service providers – Providers such as Touch 'n Go eWallet, GrabPay, DuitNow, and banks via FPX require certain information to process your financial transactions. Data shared is limited to the minimum necessary to complete the transaction.
• Game software providers – Software providers for slots, live casino, poker, and other games may receive aggregated statistical data that cannot personally identify you, for technical operational purposes.
• Identity verification providers – Third-party services that help us verify the identity and age of new members in accordance with legal requirements.
• Legal authorities – Malaysian law enforcement agencies, courts, or regulatory bodies where we receive a lawful directive or are otherwise required by law to disclose information.
• Cloud services and infrastructure – Technical infrastructure providers that host and operate the my 36 platform are bound by strict confidentiality agreements.

06 my 36 Data Security Measures

My 36 implements a range of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption – All data transmitted between your device and my 36's servers is encrypted using the highest industry-standard security protocols.
• Multi-layered access controls – Only employees who require access to specific data to carry out their duties are permitted to do so. All access is logged and monitored.
• 24/7 Monitoring – my 36's security systems operate continuously to detect and respond to any threats or suspicious activity.
• Regular security audits – my 36 conducts regular security assessments, including penetration testing and code reviews, to identify and address vulnerabilities.
• Sensitive data encryption – Financial information and identity verification data are stored in encrypted format within secure databases.
• Incident response protocol – my 36 has clear procedures in place to handle any data breaches, including notifying affected users in accordance with PDPA 2010 requirements.

While we take all reasonable steps to protect your data, please note that no security system is entirely foolproof. You are also responsible for keeping your my 36 account password secure and ensuring it is not shared with anyone.

07 Cookies & Tracking Technologies

My 36 uses cookies and similar tracking technologies to enhance the user experience and analyse platform performance. The following are the types of cookies we use:

• Essential Cookies – Required for the platform to function properly. This includes login session cookies and security cookies. Disabling these cookies will affect core platform functionality.
• Performance Cookies – Collecting information on how you use the my 36 platform to help us improve the user experience. All data is gathered in aggregate and does not identify you personally.
• Functional Cookies – Remembers your preferences such as language, display settings, and login information to deliver a more personalised experience.
• Analytics Cookies – Used to understand usage patterns, the most frequently visited pages, and the most popular features on the platform.

You can manage your cookie settings through your web browser's preferences. However, disabling certain cookies may affect the functionality or your experience on the my 36 platform. For more information on managing cookies, refer to the help section of your browser.

08 Data Retention & Deletion Period

My 36 retains your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or for as long as required under applicable Malaysian law:

• Active account data – Retained for as long as your account remains active and in use on my 36.
• Financial transaction data – Records of deposits, withdrawals, and betting history in MYR are retained for at least 7 years in accordance with financial regulation and anti-money laundering requirements in Malaysia.
• Identity verification data – Copies of identity documents are retained for the period required for legal compliance, typically 5–7 years after account closure.
• Inactive account data – Accounts inactive for more than 24 months may be deleted following notification to the registered email address, after any remaining balance has been returned to the account holder.
• Communication logs – Records of communications with our customer support team are retained for 3 years for reference and service improvement purposes.

When data is no longer required, my 36 will delete or destroy it securely to ensure the information cannot be recovered or accessed by any unauthorised party.

09 Your Rights as a my 36 User

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data we hold about you. my 36 respects and facilitates the exercise of these rights:

10 Children's Privacy & Protection of Young Persons

My 36 strictly prohibits anyone under the age of 18 from registering or using our services. This platform is for adults only.

We do not knowingly collect or store any personal data from minors. Should we discover that personal data belonging to a child or individual under 18 has been collected without our knowledge, we will promptly delete that data and close the associated account.

11 Amendments to This Privacy Policy

My 36 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or operational improvements. The "Updated" date at the top of this page will always reflect the latest version.

When we make material changes to this Privacy Policy, we will notify you via:

• Notifications displayed within the my 36 platform upon your next login.
• Email to the address registered to your account for significant changes.
• Notice displayed on the my 36 website homepage.

Your continued use of the my 36 platform following any amendments to this Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this page periodically to stay informed about how we protect your data.

12 Contact Us About Your Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how my 36 handles your personal data, our privacy team is here to help:

• Privacy Email: support@my36.biz (Please mark the subject: "Data Privacy Inquiry")
• Live Chat: Available 24/7 via the chat icon at the bottom right corner of the my 36 platform
• Response Time: We are committed to responding to all privacy-related enquiries within 5 business days

You also have the right to lodge a complaint with Malaysia's Department of Personal Data Protection if you believe that my 36 has violated your rights under PDPA 2010, though we encourage you to contact us first so that we may resolve any issues directly and promptly.