2poker Malaysia Privacy Policy – Player Data Protection

1Personal Data We Collect at 2poker

To provide a complete and secure service, 2poker collects various types of information from players. Below is a detailed explanation of the data we collect and why it is needed:

Account Registration Data:

• Full name – required for identity verification and withdrawal processing
• Date of birth – to verify that you are 18 years of age or older
• Email address – for account communications, notifications and password recovery
• Mobile phone number – for two-factor authentication and SMS notifications
• Password – stored in a non-reversible hashed form, never as plain text

Identity Verification (KYC) Data:

• MyKad Copy (front and back) – to meet anti-money laundering requirements
• Proof of address – a utility bill or bank statement confirming your current address
• Proof of payment method – screenshot or proof of the Touch 'n Go, GrabPay, DuitNow, or bank account used

Platform Usage Data:

• Records of all deposit and withdrawal transactions, including amounts, timestamps and payment methods
• Gaming history – games played, wager amounts, outcomes, and session duration
• Technical data – IP address, device type, operating system, web browser used
• In-platform behavioural data — pages visited, time spent, navigation patterns

2How 2poker Uses Your Personal Data

The data we collect is used solely for the following purposes, all of which are directly related to delivering 2poker's services to you:

2poker will not use your data for any purpose beyond those listed above without obtaining your consent first. If at any point you no longer wish to receive marketing communications from us, you may unsubscribe via the link provided in every marketing email or by contacting the 2poker support team directly.

3Data Sharing with Third Parties

2poker takes its commitment to data privacy very seriously. We does not sell, rent, or share your personal data for third-party marketing purposes. However, there are limited situations where we need to share your data with certain parties in order to operate our services:

• Payment Service Providers – Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX providers need to receive certain transaction information to process deposits and withdrawals in MYR. This data is limited to what is strictly required for transaction purposes.
• Game Providers – Our game partners (slots providers, live casino) may receive limited gameplay session data in order to operate the games. These providers are bound by strict data protection agreements with 2poker.
• Relevant Authorities – Where required by law, we may be obligated to disclose data to law enforcement agencies or regulatory bodies. This includes anti-money laundering (AML) reporting requirements, which are a standard industry obligation.
• Technical Service Providers – Hosting providers, analytics platforms and technical support services that help us operate the 2poker platform. All such providers are bound by data processing agreements ensuring they handle your data in accordance with the privacy standards set by 2poker.

In every instance of data sharing described above, we ensure that only the minimum necessary data is shared, and that the recipients have adequate data protection controls in place to safeguard your information.

4Security & Data Protection at 2poker

Data security is a core investment for 2poker – not simply an operational cost. The following are the technical and organisational measures we implement to protect your personal data:

• Encryption in transit: All data is transmitted using TLS 1.3 (the protocol underlying SSL) – the latest and most secure version available. Our SSL certificates are renewed automatically to ensure there are no security gaps.
• Encryption at rest: All sensitive data in our database, including KYC information, is stored in encrypted form. Player passwords are stored using a non-reversible hashing function (bcrypt).
• Role-based access control: Each 2poker staff member only has access to the data necessary to carry out their role – a "least privilege" principle. Access to sensitive data requires two-factor authentication.
• Continuous threat monitoring: Our systems are monitored 24/7 to detect any suspicious activity or unauthorised access attempts. Incident response is triggered automatically when unusual activity is detected.
• Regular penetration testing: We conduct regular security tests (penetration testing) to identify and address any vulnerabilities in our systems before they can be exploited.
• Secure data backups: Critical data is backed up regularly to geographically separate locations, with all backups encrypted to ensure rapid recovery in the event of any technical incident.

While no system can guarantee 100% security, 2poker takes all reasonably practicable technical and organisational measures to protect your data from unauthorised access, use, disclosure, alteration or destruction.

5Cookies & Tracking Technologies at 2poker

2poker uses cookies and similar tracking technologies to keep the platform running smoothly and to give you a better experience. Below is an explanation of the types of cookies we use:

• Essential Cookies – Required for the platform to function. This includes login session cookies, security tokens, and cookies that store your basic preferences. These cookies cannot be disabled as the platform will not work without them.
• Performance Cookies – Helps us understand how players use the platform so we can improve it. Data collected is anonymised and aggregated – we cannot identify you individually from this data.
• Functional Cookies – Saves your preferences such as language, display settings, and game preferences so you don't have to reconfigure them every time you log in.
• Marketing Cookies (with consent) – Used to display more relevant advertisements where you have consented to their use. You may withdraw this consent at any time through the cookie settings in your account.

You can manage cookie usage through your web browser settings. However, disabling essential cookies will affect the functionality of the 2poker platform. For more information on how to manage cookies in your browser, refer to your browser's help section.

6Your Privacy Rights as a 2poker Member

As a 2poker member, you have the following rights regarding your personal data. All rights can be exercised by contacting us at support@2poker.onl:

• Right of Access: You may request a copy of all personal data 2poker holds about you in a readable format. This request will be processed within 30 days.
• Right to Rectification: If any information in your account is inaccurate or incomplete, you can correct it directly through your account profile, or request that 2poker make the correction on your behalf.
• Right to Erasure ("Right to be Forgotten"): You may request that 2poker delete your personal data. This request will be processed subject to legal requirements – for example, we are obligated to retain financial transaction records for a minimum period under Malaysian law.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time. You may also object to processing based on our legitimate interests if you have compelling grounds to do so.
• Right to Data Portability: You have the right to receive the personal data you provided to 2poker in a structured, machine-readable format (such as JSON or CSV) and to transfer it to another platform should you choose to do so.
• Right to Restriction of Processing: In certain circumstances, you may ask us to restrict how we process your data – for example, while we are investigating a rectification or objection request.
• Right to Withdraw Consent: Where the processing of your data is based on consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of any processing that took place prior to withdrawal.

7Data Storage & Deletion at 2poker

2poker retains your personal data for as long as necessary to fulfil the purposes outlined in this privacy policy, or as required by applicable law. The following are general guidelines on data retention periods:

• Active account data: Retained for as long as your account is active, plus any additional period required after account closure to meet legal obligations.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian accounting and anti-money laundering legal requirements.
• KYC Documents: Retained for the period required under anti-money laundering legislation – typically 5 to 7 years after the business relationship ends.
• Customer support communication records: Retained for 3 years for reference and dispute resolution purposes.
• Log and security data: Retained for 12 months for fraud detection and security investigation purposes.
• Marketing data (where consent has been given): Retained until you withdraw consent or request deletion.

Once the applicable retention period has expired, your data will be securely deleted or anonymised so that it can no longer be linked to you. The deletion process is permanent and cannot be reversed once carried out.

If you close your 2poker account, all data not required to be retained will be deleted within 90 days. Data that must be kept for legal reasons will be stored in a restricted environment with strictly limited access until the mandatory retention period expires.

8Changes to 2poker's Privacy Policy

2poker may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. When changes are made, the following notification procedure will be followed:

• A change notice will be sent to your registered email address at least 14 days before non-material changes take effect.
• For changes that material or significant – for example, changes to how we use your data or new rights we claim over it — a notice period of at least 30 days applies.
• A notification will also appear on the platform the next time you log in after a change has been made.
• The "Last updated" date at the top of this page will be updated to reflect the current version in effect.

Continued use of the 2poker platform after any privacy policy changes take effect will be considered acceptance of the updated terms. If you disagree with the changes, you have the right to close your account before the effective date, and all eligible balances will be refunded. We will not use privacy policy updates to reduce your privacy protections without first obtaining your explicit consent where required.