12huat Privacy Policy

1. About This Policy

1.1  This Privacy Policy is issued by the operator of the 12huat platform accessible at https://12huat.win ("12huat", "we", "us", "our"). It governs the collection, processing, storage, and disclosure of personal data relating to individuals who access or use the 12huat Platform, including registered Members and unregistered visitors.

1.2  By accessing the 12huat Platform, registering an Account, or using any of the services offered — including the Sportsbook, 12huat Casino, live casino games, and slots — you acknowledge that you have read this Privacy Policy and consent to the processing of your personal data as described herein.

1.3  This Policy should be read alongside the 12huat Terms and Conditions. In the event of any inconsistency between this Policy and the Terms and Conditions on a data protection matter, this Policy shall prevail.

1.4  12huat is committed to protecting the personal data of its Members in compliance with applicable data protection legislation, including but not limited to Malaysia's Personal Data Protection Act 2010 (PDPA 2010) and any subsequent amendments or regulations made thereunder.

2. Personal Data We Collect

2.1  12huat collects the following categories of personal data from Members and Platform visitors:

2.2  Where data is listed as mandatory, failure to provide it will prevent 12huat from providing the relevant service — including account registration, KYC approval, or withdrawal processing.

3. How We Collect Personal Data

3.1  Directly from you: When you register a 12huat Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotion.

3.2  Automatically: Through your interaction with the Platform, including server logs, session tracking technologies, cookies, and our gaming management system, which records all account activity including bets placed, games accessed, and session data.

3.3  From third parties: From payment service providers (including Touch n Go eWallet, Boost, Maybank, CIMB, and Public Bank) for the purpose of verifying and processing financial transactions; from fraud detection and KYC verification service providers; from regulatory or law enforcement bodies pursuant to lawful requests.

3.4  From public sources: Publicly available government and court records where relevant to AML (anti-money laundering) and sanctions screening obligations.

4. Purpose and Legal Basis for Processing

4.1  12huat processes personal data for the following purposes and on the following legal bases:

• Account registration and management — necessary for the performance of the contract between 12huat and the Member.
• KYC identity verification and age verification — necessary for compliance with applicable regulatory and licensing obligations, and to fulfil the 21+ age restriction requirement under responsible gaming commitments.
• Processing of deposits and withdrawals — necessary for the performance of the contract and to comply with financial transaction reporting obligations.
• Anti-money laundering (AML) and fraud screening — necessary for compliance with legal obligations under applicable AML legislation.
• Provision of betting and casino services — necessary for the performance of the contract.
• Customer support and complaint handling — necessary for the performance of the contract and legitimate interests of 12huat in maintaining service quality.
• Responsible gaming monitoring and intervention — necessary for compliance with responsible gaming obligations and the legitimate interests of 12huat and its Members.
• Marketing communications — based on consent, where you have opted in to receive promotional communications from 12huat. You may withdraw consent at any time.
• Platform analytics and improvement — based on the legitimate interests of 12huat in understanding how the Platform is used and improving its features and performance.
• Legal claims and regulatory cooperation — necessary for compliance with legal obligations and the legitimate interests of 12huat in protecting its rights.

5. Disclosure to Third Parties

5.1  12huat does not sell, rent, or trade personal data to third parties for their own marketing purposes. Personal data is disclosed only in the following circumstances:

• Service providers: Third-party vendors engaged by 12huat to provide operational services, including payment processing (Touch n Go eWallet, Boost, Malaysian banking partners), KYC and identity verification services, fraud detection, game content providers, IT infrastructure and cloud hosting, and customer support software. These providers process data solely on 12huat's instructions and are bound by data processing agreements.
• Licensing and regulatory authorities: Where required by the terms of our gaming licence or applicable law, we may disclose Member data to licensing authorities, gaming regulators, or designated auditors.
• Law enforcement and legal process: Where required by a valid court order, subpoena, or lawful request from a law enforcement or government authority.
• AML and financial intelligence bodies: Where disclosure is required under anti-money laundering legislation, including suspicious transaction reporting obligations.
• Corporate transactions: In connection with a merger, acquisition, or sale of substantially all of 12huat's assets, in which case Member data may be transferred to the acquiring entity subject to this Privacy Policy continuing to apply.

5.2  12huat will not disclose sensitive responsible gaming data — including self-exclusion elections and problem gambling correspondence — to any third party other than where required by law or by our regulatory obligations.

6. International Data Transfers

6.1  Some of the third-party service providers used by 12huat may be located outside Malaysia. Where personal data is transferred outside Malaysia, 12huat takes steps to ensure that the transfer is subject to appropriate safeguards, including contractual protections equivalent to those required under Malaysia's Personal Data Protection Act 2010.

6.2  In particular, game content providers — including those providing live casino studio feeds to the 12huat Casino — may process session and betting data on servers located in their country of operation. Such processing is governed by data processing agreements and is limited to the data required for the provision of the contracted service.

7. Data Retention

7.1  12huat retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following indicative retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years from the date of account closure, or longer where required by AML legislation or active regulatory investigation.
• Financial transaction records: Retained for a minimum of seven (7) years from the transaction date, in accordance with standard financial record-keeping requirements.
• Betting and game session data: Retained for a minimum of five (5) years from the date of the session or wager.
• Marketing consent records: Retained for the duration of the consent and for a reasonable period after withdrawal to evidence compliance.
• Support correspondence: Retained for three (3) years from the date of the last communication in a support thread, unless the matter involves a live dispute or regulatory inquiry.

7.2  When data is no longer required and no legal basis for retention exists, 12huat will securely delete or anonymise it in accordance with its data destruction procedures.

8. Cookies and Tracking Technologies

8.1  The 12huat Platform uses cookies and similar tracking technologies to operate, secure, and improve the Platform experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session authentication tokens and security cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Remember your preferences such as language settings, remembered login (where opted in), and display preferences.
• Analytics cookies: Collect anonymised data about how visitors interact with the Platform, including pages visited, time on page, and navigation paths. This data is used in aggregate form to improve Platform design and content.
• Performance cookies: Monitor Platform load times, error rates, and server response times to support operational stability.

8.2  You can manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the 12huat Platform, including the ability to remain logged in across sessions.

9. Data Security

9.1  12huat implements technical and organisational measures proportionate to the risk of processing personal data on an online gambling platform. These measures include:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between Members' devices and the 12huat Platform.
• Hashing of passwords at rest using industry-standard algorithms; plaintext passwords are never stored.
• Role-based access controls on internal systems limiting personal data access to staff with a legitimate business need.
• Multi-factor authentication for administrative access to systems that hold personal data.
• Regular security audits and penetration testing of the Platform infrastructure.
• Incident response procedures for the detection, containment, and notification of personal data breaches.

9.2  Notwithstanding the above, no internet-based service can guarantee absolute security. Members are encouraged to use strong, unique passwords for their 12huat account and to enable two-factor authentication to reduce the risk of unauthorised access.

10. Children's Data

10.1  The 12huat Platform is strictly for persons aged 21 and above. 12huat does not knowingly collect or process personal data of individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately close the associated Account, return any deposits to the payment source, and securely delete the data in question.

10.2  If you are a parent or guardian and believe that a person under 21 has registered a 12huat Account or submitted personal data to the Platform, please contact us immediately using the contact details in Section 13.

11. Your Rights

11.1  Subject to applicable law, including Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to the personal data 12huat holds about you:

• Right of access: You may request a copy of the personal data 12huat holds about you.
• Right of correction: You may request correction of inaccurate or incomplete personal data. For KYC-verified data fields, updated supporting documents may be required.
• Right to withdraw consent: Where processing is based on your consent (for example, marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to request cessation of processing: You may request that 12huat ceases or limits its processing of your personal data, subject to overriding legal obligations that require continued processing.
• Right to complain: If you believe your personal data has been processed in violation of applicable law, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction.

11.2  To exercise any of the above rights, please submit a written request to the 12huat support team using the contact details in Section 13. We will respond within thirty (30) days of receiving a complete and verifiable request. We may require identity verification before processing a data subject access request.

12. Changes to This Privacy Policy

12.1  12huat reserves the right to update or amend this Privacy Policy at any time. All amendments will be published on the 12huat Platform with an updated "Last updated" date. For material changes — such as a new category of data collection or a new purpose for processing — 12huat will endeavour to notify registered Members by email or by an in-platform notice displayed upon login.

12.2  Your continued use of the Platform after the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you must cease using the Platform and request Account closure.

13. Contact Us

For questions, concerns, data subject access requests, or complaints relating to this Privacy Policy or 12huat's handling of your personal data, please contact the 12huat Data Protection team. Our contact email is displayed in the footer of this page. We aim to respond to all data protection enquiries within ten (10) business days.

For urgent data protection matters — including suspected unauthorised access to your Account or a potential personal data breach involving your information — please contact 12huat support immediately via live chat for priority handling.