Privacy Policy

This Privacy Policy ("Policy") describes how 2cuci ("the Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://2cuci.cam, collects, processes, stores, and protects personal data belonging to registered users and visitors ("you", "your", "the Player") of our platform.

2cuci operates under an international gaming licence and is committed to handling all personal data in accordance with internationally recognised data protection principles, including those aligned with the General Data Protection Regulation (GDPR) framework and applicable privacy standards. While 2cuci primarily serves players from Malaysia — including those based in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam — this Policy applies to all users of the platform regardless of geographic location.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall contractual relationship between you and 2cuci. In the event of any inconsistency between this Policy and the Terms & Conditions regarding data-related matters, this Policy shall prevail.

Your use of the 2cuci platform constitutes your acknowledgement that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the platform and contact our support team to request account closure.

For the purposes of this Privacy Policy, the following definitions shall apply:

2cuci collects personal data that is strictly necessary for the purposes outlined in this Policy. The categories of data we collect are as follows:

2cuci collects personal data through the following means:

• Direct Submission: Data you provide voluntarily when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or participating in a promotional offer.
• Automated Collection: Technical data collected automatically when you access and use the platform, including through cookies, web beacons, server logs, and similar tracking technologies. This includes IP addresses, device identifiers, and session activity data.
• Third-Party Payment Processors: Financial transaction data shared with us by payment service providers when you initiate deposits or withdrawals using methods such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, or cryptocurrency networks.
• Identity Verification Providers: Where third-party identity verification services are used to assist with KYC processing, limited identity data may be shared with and returned from such providers under contractual data protection obligations.
• Fraud Prevention Services: Data may be cross-referenced with external fraud prevention databases to protect the platform and its users from fraudulent activity.

2cuci processes your personal data only where a valid legal basis exists. The legal bases upon which we rely are as follows:

• Contractual Necessity: Processing is necessary to perform the contract between you and 2cuci — i.e., to operate your account, process transactions, and deliver gaming services. Without this processing, we cannot provide the services you have registered for.
• Legal Obligation: Processing is required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) regulations, age verification mandates, and our obligations under our gaming licence.
• Legitimate Interests: Processing is necessary for legitimate business interests pursued by 2cuci, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided these interests are not overridden by your rights and interests.
• Consent: For certain processing activities — such as sending promotional communications about bonuses, new games, or special offers — we rely on your explicit consent, which you may withdraw at any time by updating your account notification preferences or by contacting our support team.

Your personal data is used by 2cuci solely for the following purposes:

• Account Management: To create, maintain, and administer your 2cuci account, including processing login requests and maintaining account security.
• Payment Processing: To facilitate deposits and withdrawals via your chosen payment methods, including MYR transfers via DuitNow, FPX, and supported Malaysian banks and e-wallets, as well as cryptocurrency transactions.
• KYC & Age Verification: To verify your identity and confirm that you are aged 21 or above, as required by our responsible gambling obligations and licensing conditions.
• Anti-Money Laundering (AML) Compliance: To monitor transactions for suspicious activity and meet our obligations under international AML standards, including reporting requirements where applicable.
• Customer Support: To respond to your queries, resolve disputes, and provide assistance through our multilingual support team in English, Bahasa Melayu, and Chinese.
• Responsible Gambling: To monitor gaming behaviour for indicators of problem gambling and to enforce deposit limits, self-exclusion requests, and cooling-off periods at your request or as required by our welfare obligations.
• Service Improvement: To analyse platform usage patterns, troubleshoot technical issues, and develop new features and products that better serve Malaysian players.
• Marketing Communications: To send you information about promotions, bonuses, new games, and platform updates — but only where you have consented to receive such communications. You may opt out at any time.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, bonus abuse, and other prohibited conduct.

2cuci does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Service Providers: Financial institutions and payment processors — including those operating DuitNow, FPX, and supported e-wallet platforms — receive transaction data necessary to execute your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and AML verification services may receive a subset of your identity documents to assist with account verification. All such providers are bound by strict data processing agreements.
• Gaming Platform Technology Providers: Game and software providers that power the 2cuci platform's slot, live casino, and sportsbook products may receive non-identifiable session data necessary for game delivery and technical support.
• Fraud Prevention Services: Shared databases operated by fraud prevention organisations may receive transactional and behavioural data to identify and prevent fraudulent activity.
• Regulatory Authorities: Where required by our licensing obligations or applicable law, 2cuci may disclose player data to relevant regulatory or law enforcement authorities. Such disclosures are made only to the extent required and in accordance with applicable legal requirements.
• Professional Advisers: Legal, accounting, and auditing firms engaged by 2cuci may access limited personal data in the course of providing professional services, subject to confidentiality obligations.

2cuci uses cookies and similar tracking technologies to support the operation and security of the platform. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session authentication cookies that keep you logged in during your visit. These cannot be disabled without impairing core platform functionality.
• Functional Cookies: Store your preferences such as language selection (English, Bahasa Melayu, or Chinese), deposit limit settings, and notification preferences, so you do not need to reconfigure them on each visit.
• Security Cookies: Used to detect and prevent suspicious login activity, session hijacking, and fraudulent account access attempts. These are integral to our security infrastructure.
• Analytics Cookies: Allow 2cuci to understand how users navigate the platform, which features are most used, and where technical issues occur. This data is used in aggregate form only and does not identify individual users.

2cuci does not deploy third-party advertising or behavioural tracking cookies that would share your browsing data with external advertising networks. You may configure your browser settings to restrict or delete cookies; however, doing so may impair your ability to use certain platform features.

2cuci retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Active Account Data: Personal data associated with an active account is retained for the duration of the account's existence plus a minimum period following closure, as required by our AML and licensing obligations.
• Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of five (5) years from the date of the transaction, in compliance with AML reporting requirements.
• KYC Documents: Identity and address verification documents are retained for the duration of the account plus a minimum of five (5) years from account closure.
• Support Communications: Live Chat transcripts, email correspondence, and support ticket records are retained for a minimum of two (2) years from the date of the interaction.
• Gaming Activity Logs: Detailed records of betting and gaming activity are retained for a minimum of three (3) years to support dispute resolution and responsible gambling monitoring obligations.
• Dormant Account Data: Accounts with no login activity for 12 consecutive months are classified as dormant. Associated personal data continues to be retained in accordance with the retention periods above, not deleted on dormancy classification alone.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

2cuci implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Our security infrastructure includes the following controls:

• Transport Encryption: All data transmitted between your device and the 2cuci platform is protected by 256-bit SSL/TLS encryption, ensuring that your personal information and financial transactions cannot be intercepted in transit.
• Data Storage Encryption: Personal data stored on 2cuci servers is encrypted at rest using industry-standard encryption protocols, ensuring that stored data cannot be accessed without proper authorisation.
• Access Controls: Access to personal data within 2cuci's systems is restricted on a strict need-to-know basis. All staff with access to personal data are bound by confidentiality obligations and receive data protection training.
• Two-Factor Authentication (2FA): Players may enable 2FA on their accounts as an additional layer of protection against unauthorised access. 2cuci staff accounts that access player data also require 2FA.
• Intrusion Detection & Monitoring: Our security team continuously monitors platform infrastructure for anomalous activity, potential intrusions, and data breach indicators.
• Incident Response: In the event of a data security incident affecting your personal data, 2cuci will notify affected players and relevant regulatory authorities in accordance with applicable data breach notification obligations.

While 2cuci employs commercially reasonable security measures, no data transmission over the internet or electronic storage system is entirely immune to risk. You are responsible for maintaining the security of your account credentials and for notifying 2cuci promptly of any suspected unauthorised account access.

As a registered user of the 2cuci platform, you hold the following rights in relation to your personal data. These rights may be exercised by contacting our support team via Live Chat or by emailing [email protected]:

All rights requests will be acknowledged within 5 business days and resolved within 30 calendar days from the date of receipt, subject to identity verification. Where a request cannot be fully acted upon due to legal retention obligations, we will explain the applicable constraint in our response.

The 2cuci platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21.

Age verification is enforced as a mandatory step in the account registration and KYC process. If we become aware that personal data has been collected from or on behalf of a person under the age of 21, we will take immediate steps to permanently close the associated account and securely delete all related personal data, except where retention is required by applicable legal obligations.

If you are a parent or guardian and believe that a person under your care may have registered on the 2cuci platform, please contact our support team immediately at [email protected] (plain text — not a clickable link). We will investigate and act promptly.

As an internationally licensed online gaming platform serving players across Malaysia and other regions, 2cuci may process and store personal data on servers located outside of Malaysia. Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to that afforded under the laws of your country of residence, 2cuci ensures that appropriate safeguards are in place.

These safeguards may include contractual clauses requiring data processors to maintain data protection standards consistent with internationally recognised frameworks, technical security measures applicable regardless of the storage jurisdiction, and access restriction controls ensuring that only authorised personnel with a legitimate business need may access transferred data.

By registering an account and accepting this Privacy Policy, you acknowledge and consent to the cross-border transfer of your personal data as described in this section, subject to the safeguards outlined above.

2cuci reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, regulatory requirements, or platform operations. The "Last Updated" date at the top of this page will be revised accordingly whenever material changes are made.

For significant changes — particularly those that affect how we collect or use your personal data — we will endeavour to provide advance notice through a platform notification or email communication, where we hold a valid contact email address for your account.

Your continued use of the 2cuci platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you may request account closure by contacting our support team prior to the effective date.

We recommend reviewing this Policy periodically to remain informed of how 2cuci protects and handles your personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or the exercise of your data protection rights, please contact the 2cuci Data Protection team through the following channels:

• Live Chat: Available 24/7 directly on the 2cuci platform — the fastest channel for all support and privacy-related queries
• Email (plain text, not a link): [email protected] — please include "Privacy Request" or "Data Protection" in the subject line
• Languages Supported: English, Bahasa Melayu, Mandarin Chinese
• Response Time: Data subject requests will be acknowledged within 5 business days and resolved within 30 days

For all formal data protection inquiries, written communication via email is preferred to ensure a documented audit trail. Please include your registered account email address in all correspondence to facilitate verification of your identity before any personal data is actioned or disclosed.