Privacy Policy 26m — Personal Data Protection for Malaysian Players

1Introduction

Welcome to the 26m Privacy Policy. This document details how 26m ("we", "Platform", or "26m") collects, processes, stores, and protects your personal data when you use the 26m.onl website and the 26m mobile app.

26m understands that your trust is our most valuable asset. This Privacy Policy is built not merely to satisfy legal requirements, but as a mark of our respect for you as a valued player. Every data-related decision is made with your interests and privacy as the top priority.

This Privacy Policy applies to all registered players, website visitors, and any individual who interacts with the 26m platform or communication channels. By continuing to use our platform after reading this policy, you agree to how we handle your personal data as described herein.

2Data We Collect

26m only collects data that is strictly necessary to deliver a safe, fair, and efficient service. The following are the categories of data we collect:

2.1 Data You Provide Directly

• Registration information: full name, date of birth, gender, phone number, email address
• Current residential address
• Identity verification information (KYC): copies of MyKad, passport or other valid identification documents
• Financial information: bank account numbers, e-wallet details for payment processing
• Communications with the 26m customer support team

2.2 Automatically Collected Data

• IP address and approximate location information
• Device type, operating system and web browser version
• Game session data: login time, session duration, games played, and total betting amount
• Deposit and withdrawal transaction logs
• Cookie data and similar tracking technology data (further explained in Section 5)

2.3 Data from Third Parties

In certain situations, we may receive additional information about you from payment service providers, identity verification agencies, and fraud prevention service providers working with 26m. This data is used solely for verification, security, and regulatory compliance purposes.

3How We Use Your Data

26m uses your personal data for the following purposes, all of which are grounded in a valid legal basis under the PDPA 2010:

• Account Management: Creating and maintaining your player account, processing registrations and verifying identity through the KYC process required by regulations.
• Transaction Processing: Securely and efficiently processing all deposits, withdrawals and other financial transactions using the payment information you provide.
• Platform Security: Detecting and preventing fraud, money laundering, bonus abuse and other suspicious activities that could compromise the security of the platform and other players.
• Customer Support: Responding to enquiries, resolving complaints and providing the technical assistance you need while using the 26m platform.
• Experience Personalization: Tailoring game displays, bonus recommendations and platform content based on your preferences and gameplay habits.
• Legal Compliance: Fulfilling legal obligations, including reporting requirements to relevant authorities where required by law.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing appropriate support where needed.

4Data Sharing with Third Parties

26m does not sell your personal data to anyone. However, we share data on a limited basis with the following parties for the purposes of operating our services:

4.1 Service Providers

We work with selected and trusted third-party service providers to help us operate the platform, including payment service providers, licensed gaming platforms, cloud service providers and identity verification companies. All such providers are contractually required to protect your data and process it solely under 26m's instructions.

4.2 Legal Authorities

26m will disclose your personal data to government authorities, regulators, or law enforcement bodies when required to do so by law, court order, or valid legal process. In each such case, we will disclose only the minimum data necessary and will endeavour to notify you where permitted by law.

4.3 Business Transfers

If 26m is involved in any merger, acquisition, or asset sale, players' personal data may be transferred as part of that transaction. In such circumstances, we will ensure that the receiving entity agrees to protect your data to a standard at least equivalent to this Privacy Policy.

5Cookies & Tracking Technologies

26m uses cookies and similar tracking technologies to enhance your experience, ensure account security, and analyze usage patterns for continuous improvement.

5.1 Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use the platform to help us identify areas for improvement.
• Functional Cookies: Saving your preferences such as language, display settings and game choices to personalise your experience.
• Analytics Cookies: Helping us understand aggregated and anonymised usage patterns for product improvement.

5.2 Managing Cookie Preferences

You can manage or delete cookies through your web browser settings at any time. Please note that disabling essential cookies may affect the functionality of the 26m platform. For more information on managing cookies in your browser, refer to your browser's help documentation.

6Data Security

Protecting your personal data is a responsibility we take seriously. 26m implements a range of technical and organisational security measures to ensure your data remains safe at all times:

• 256-bit SSL encryption for all data transmitted between your device and our servers
• Passwords and sensitive information are stored using strong, irreversible hashing algorithms
• Role-based access control ensuring only authorised staff can access player data
• Internal and external security audits conducted on a regular basis
• Intrusion detection and threat monitoring systems operating 24 hours a day, 7 days a week
• Penetration testing conducted by independent security firms at least twice a year
• Security awareness training program for all 26m staff who handle player data

7Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by 26m:

To exercise any of the above rights, contact the 26m data protection team by email at [email protected]. We will process your request within 14 business days and may require identity verification before processing any data-related requests.

8Data Retention Period

26m retains your personal data for as long as your account is active and for the period required thereafter to fulfil our legal obligations. Generally:

• Active account data is retained for the duration of your membership and updated on an ongoing basis
• Financial transaction records are retained for a minimum of 7 years to meet Malaysia's tax and financial regulatory requirements
• KYC records and identity verification documents are retained for 5 years after account closure
• Customer support communication logs are retained for 3 years
• Anonymised analytics data is retained for the period required for service improvement purposes

When data is no longer needed, we will securely delete or anonymise it using data disposal procedures that meet industry standards.

9Cross-Border Data Transfers

In operating a global platform, some of your personal data may be processed or stored on servers located outside Malaysia. This occurs primarily when using our cloud services and international gaming provider infrastructure.

26m ensures that all cross-border data transfers are carried out with adequate safeguards, including legally binding data processing agreements with all data recipients outside Malaysia. The protection afforded to your data remains at a level at least equivalent to that provided under the PDPA 2010.

10Children's Privacy

The 26m platform is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data from minors. If we discover that data belonging to a minor has been collected, we will take immediate steps to delete that data and close the account in question.

If you believe a minor has registered an account on the 26m platform, please contact us immediately at [email protected] so that we may take appropriate action without delay.

11Privacy Policy Amendments

26m reserves the right to update or amend this Privacy Policy at any time to reflect changes in our business practices, current legal requirements, or improvements in how we protect your data.

Any material changes to this Privacy Policy will be communicated to you via in-platform notifications and email at least 14 days before the changes take effect. The "Last Updated" date at the top of this document will be updated whenever an amendment is made.

Your continued use of the 26m platform after the effective date of any such amendments constitutes your acceptance of the updated Privacy Policy. If you do not agree with any amendments, you have the right to close your account in accordance with the procedures set out in our Terms and Conditions.

12Contact Our Data Protection Officer

26m has appointed a Data Protection Officer (DPO) responsible for ensuring our compliance with data protection laws and for addressing privacy-related enquiries from players.

If you have any questions, concerns or complaints regarding how we handle your personal data, or if you wish to exercise any of your rights as outlined in Section 7, please contact us via:

We are committed to responding to all privacy-related enquiries within 2 business days and resolving data rights requests within 14 business days. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.