Privacy Policy MenangCuci — Malaysian User Data Protection

MenangCuci is committed to protecting the privacy and security of the personal data of all users on our platform. This Privacy Policy explains our practices regarding the collection, use, processing and protection of your personal data when you use the MenangCuci platform — whether through the official website, iOS or Android mobile app, or any of our other service channels.

This policy is drafted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection standards. By registering an account or using MenangCuci's services, you acknowledge that you have read, understood, and agreed to the terms set out in this Privacy Policy.

If you have any questions about this policy or how we handle your data, please contact our privacy team — details are provided in section 12 of this document.

We collect personal data from several sources and across several categories. Here is an overview of the data collected:

The personal data we collect is used for the following purposes:

• Account management — create and maintain your account, verify identity, process logins
• Transaction processing — process deposits, withdrawals and any related financial transactions
• Customer Support — respond to enquiries, resolve issues and provide technical support
• Security & fraud prevention — detect and prevent fraudulent activity, money laundering and account abuse
• Legal compliance — fulfil KYC, AML (anti-money laundering) and reporting requirements as prescribed by law
• Platform improvements — analyse usage patterns to improve the user experience
• Service communications — send important notifications relating to your account, transactions and service changes
• Marketing — send promotional offers and relevant information (subject to your consent)

We do not use your data for any purposes beyond those stated above without first obtaining your separate consent.

Under Malaysia's PDPA, all personal data processing must have a valid legal basis. MenangCuci processes your data on the following legal bases:

• Contract performance — data is required to provide the services you agreed to upon registration
• Consent — for marketing communications and preference-based purposes, we require your explicit consent
• Legitimate interest — for fraud prevention, system security and service improvement
• Legal obligation — for KYC, AML and financial reporting compliance

menangcuci does not sell users' personal data to any third party. However, we share data in the following limited situations with appropriate safeguards in place:

• Service providers — payment providers, game providers, cloud infrastructure providers and KYC services that help us operate the platform. They are contractually required to protect your data and may not use it for any other purpose.
• Regulatory authority — when required by Malaysian law or the directive of a competent authority, including Bank Negara Malaysia for AML purposes.
• Law enforcement — when there is a valid court order or in cases involving fraud, money laundering or other serious crimes.

In all data sharing situations, we ensure that recipients are bound by strict data protection agreements and use data only for permitted purposes. We do not transfer your personal data outside Malaysia without ensuring equivalent protections exist in the receiving country.

We invest seriously in security infrastructure to protect your data. Below are the technical and organisational measures we employ:

• 256-bit SSL/TLS Encryption — all data transmitted between your device and our servers is protected by industry-grade encryption
• Data-at-rest encryption — sensitive data is stored in encrypted form in our database
• Two-factor authentication (2FA) — available to all users to protect account access
• 24/7 Monitoring — a real-time threat detection system monitors the platform at all times
• Internal access controls — only staff who require access to specific data to perform their duties are granted authorisation
• Regular security audits — our platform undergoes regular penetration testing and security audits by independent third parties

We retain your personal data only for as long as it is needed for the stated purposes or as required by law. Below are our general guidelines:

• Active account data — retained for the duration your account is active and for 7 years after account closure (financial compliance requirement)
• Transaction records — retained for 7 years in accordance with Malaysian legal requirements
• KYC Documents — retained for 5 years after the business relationship ends
• Technical logs — retained for 90 days for security and troubleshooting purposes
• Marketing data — deleted when you withdraw your consent

Once the retention period expires, data will be securely deleted or anonymised so it can no longer be linked to any individual.

The menangcuci platform uses cookies and similar tracking technologies to ensure the platform functions correctly and to provide you with a better experience.

• Essential Cookies — required for core platform functions such as login verification and session security. These cookies cannot be disabled.
• Analytics Cookies — helps us understand how users interact with the platform so we can improve it.
• Preference Cookies — store your preferences such as language and display settings.

You can manage cookie settings through your browser. Please note that disabling essential cookies may affect the overall functionality of the platform.

Under Malaysia's PDPA, you have the following rights regarding your personal data held by MenangCuci:

• Right of AccessYou have the right to request a copy of the personal data we hold about you. We will respond to access requests within 21 days.
• Right to RectificationIf any of your data is inaccurate or outdated, you may request that we correct it. Some corrections can be made directly in your account settings.
• Right to ErasureYou may request the deletion of your personal data, subject to legal retention requirements. Financial and KYC data may need to be retained for a specified period.
• Right to ObjectYou may object to the processing of your data for direct marketing purposes at any time, and we will comply immediately.
• Right to Data PortabilityYou have the right to receive your data in a machine-readable format for the purpose of transferring it to another platform.
• Right to Restrict ProcessingIn certain circumstances, you may request that we restrict the processing of your data while an issue is being resolved.

To exercise any of the above rights, contact our privacy team via email at [email protected] or via live chat. We will process your request within 21 business days.

The menangcuci platform is exclusively for users aged 18 years and above. We do not knowingly collect or process personal data from individuals under the age of 18.

We implement a strict age verification process during registration and throughout the KYC process. Should we discover that data has been collected from an underage user, we will delete that data immediately and close the relevant account.

MenangCuci reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our operations, legal requirements or industry best practices.

For material amendments — meaning changes that significantly affect how we collect or use data — we will:

• Sending email notifications to all registered users at least 14 days before the amendments take effect
• Displaying a clear notice on the platform's home page for 30 days
• Updating the "Last Updated" date at the top of this page

Continued use of the platform after the notice period is considered acceptance of the amended terms. If you do not agree with the amendments, you may close your account before they take effect.

For any enquiries, requests or complaints relating to your personal data and this Privacy Policy, please contact us through the following channels:

• Privacy Email: [email protected]
• Support Email: [email protected]
• Live Chat: Available 24/7 on the MenangCuci platform

We will endeavour to respond to all privacy-related inquiries within 14 working days. For formal data rights requests, the response period is 21 working days from the date of receipt.

If you are not satisfied with our response, you have the right to file a complaint with the Department of Personal Data Protection (JPDP) Malaysia, the relevant regulatory authority.