We1 Privacy Policy – Malaysia Personal Data Protection

We1 ("we", "platform", "us") is an online casino platform operating in Malaysia, fully committed to protecting the privacy of every member who uses our services. This Privacy Policy has been drawn up in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and global best practices in data protection.

We understand that your trust is the most valuable asset we1 holds. When you register an account, make deposits via Touch 'n Go eWallet, DuitNow, GrabPay, or FPX, play slots, baccarat, poker, or bet on Malaysia Super League and EPL matches — you are entrusting us with your personal information. We take that trust seriously and handle it with full responsibility.

This Privacy Policy applies to all personal data we collect through the we1.click website, our mobile application, and all communication channels between you and the we1 team. This document transparently sets out: what data we collect, why we collect it, who can access it, how long we retain it, and what rights you have in relation to that data.

We1 collects the following categories of personal data from our members:

• Identity Data: Full name, Malaysian identity card number (MyKad), date of birth, gender, and a photo of your identification document (where KYC verification is required).
• Contact Data: Malaysian phone number, email address, and residential address (state and postcode).
• Financial Data: Bank account or e-wallet details used for transactions (account holder name, account type, and partial account number — we do not store full account numbers), deposit and withdrawal history, and win/loss records.
• Technical Data: IP address, device type and operating system, browser type and version, timezone settings, cookie data and similar tracking technologies.
• Usage Data: Game history, game types played, session duration, bet details, Sports Betting records, and platform usage patterns.
• Communication Data: Records of communications with the we1 customer support team via live chat, WhatsApp, or email — including conversation content and timestamps.

We1 collects your personal data through several methods:

• Direct registration: When you complete the we1 account registration form, you provide your phone number and password, and explicitly agree to our Terms.
• Identity verification (KYC): During the identity verification process, you may be asked to upload documents such as a copy of your MyKad or bank statement. These documents are used solely for verification purposes and are stored with full encryption.
• Financial transactions: Data is collected automatically when you make a deposit via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u, or CIMB Clicks, and when you submit a withdrawal request.
• Platform usage: Our system automatically records your gaming activity, bets, and platform usage patterns each time you log in and play.
• Cookies and tracking technologies: Cookies and tracking pixels are used to collect technical data about your device and usage patterns. Further details are explained in Section 7.
• Support communications: When you contact the we1 support team via live chat or email, the content of those communications is stored for issue resolution and service improvement purposes.

We1 uses the personal data we collect solely for legitimate and necessary purposes, as follows:

• Account management: To create, verify, and manage your member account on the we1 platform.
• Transaction processing: Processing deposits, withdrawals, and all financial transactions associated with your we1 account.
• Identity verification (KYC): Fulfilling legal obligations to verify member identities as part of fraud prevention and anti-money laundering compliance.
• Service delivery: Enabling you to access and use all features of the we1 platform — games, bonuses, the VIP programme, and Sports Betting.
• Legal compliance: Fulfilling legal and regulatory requirements applicable in Malaysia, including reporting obligations to the relevant authorities.
• Fraud prevention: Detecting and preventing fraudulent activity, money laundering, bot usage, collusion in poker games, and any violations of we1's Terms & Conditions.
• Service improvement: Analysing usage patterns to improve platform performance, enhance the user interface, and develop better new features.
• Service communications: Sending important notifications related to your account, transactions, policy changes, or security matters. This is distinct from marketing communications.
• Marketing communications: Sending information about promotions, new bonuses, and exclusive offers — only if you have given your consent to receive them. You may withdraw this consent at any time.
• Customer support: Resolving queries, complaints, and technical issues submitted through we1's support channels.

We1 will not use your personal data for any purpose beyond those listed above without obtaining your consent first.

We1 does not sell, rent, or trade your personal data to any third party for their marketing purposes. However, there are limited circumstances in which we1 may need to share your data with specific parties:

• Technical service providers: Companies that help operate the we1 platform — such as cloud service providers, payment solution providers (Touch 'n Go, DuitNow, and GrabPay gateways), and gaming software providers — may access the data necessary to deliver their services. All such providers are bound by strict confidentiality agreements and are only permitted to use that data for the purposes we specify.
• Legal authorities: we1 is obligated to disclose data to the relevant authorities when required by Malaysian law — for example, in financial crime investigations, pursuant to court orders, or upon direction from a legitimate enforcement agency.
• Audit and compliance: Independent auditors conducting RNG or system security audits may access the technical data required to do so. They are bound by professional confidentiality agreements.
• Business transfers: In the event of a merger, acquisition, or sale of we1's assets, member data may be transferred as part of that transaction. We will notify members of any significant change in ownership.

We1 continually invests in security infrastructure to safeguard your personal data. The technical and organisational measures we employ include:

• 256-bit SSL Encryption: All communications between your device and we1's servers are protected with 256-bit Transport Layer Security (TLS) encryption — the same standard used by Malaysia's leading banking institutions.
• Data-at-rest encryption: Sensitive data stored in our database — including financial details and identification documents — is kept in an encrypted format that cannot be read even by we1 staff who do not have the required access permissions.
• Password hashing: Your account password is never stored in plain text. We use the bcrypt algorithm to generate a one-way password hash that cannot be reversed — even by our own technical team.
• Layered access controls: Access to sensitive data within we1 is restricted to staff who genuinely require it to perform their duties — based on the principle of least privilege.
• Continuous monitoring: Our systems are monitored around the clock to detect unauthorised access attempts, cyberattacks, or any suspicious activity that could compromise data security.
• Regular security audits: we1 conducts regular independent security audits to identify and remediate system vulnerabilities before they can be exploited.
• Disaster recovery: Member data is securely backed up across data centres in separate locations to ensure service continuity and data recovery in the event of a technical failure.

While we1 takes all reasonable steps to protect your data, no security system is 100% impenetrable. We encourage you to take precautions on your end as well — such as using a strong password, not sharing your login credentials, and keeping your device secure.

We1 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. The following are the types of cookies we use:

You can manage and delete cookies through your web browser settings. However, disabling essential cookies may affect certain functions on the we1 platform. For guidance on managing cookies across different browsers, please refer to your browser's help documentation.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by we1:

• Right of access: You have the right to request a copy of the personal data we hold about you. We will provide this information within 21 business days of receiving your request.
• Right to correction: If your personal data is inaccurate or incomplete, you have the right to request a correction. Key details such as your name and phone number can be updated through your account dashboard or by contacting our support team.
• Right to erasure: You may request the deletion of your personal data from our systems, subject to our legal obligations to retain certain records for periods specified under Malaysian law.
• Right to restrict processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while a data-related issue is under investigation.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time. We will stop all marketing communications immediately upon receiving your request.
• Right to withdraw consent: Where data processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the validity of any processing carried out prior to that point.

To exercise any of the above rights, please contact our team via 24/7 live chat within the we1 platform or by email at support@we1.click. Please include your we1 account number and the type of request to help us process it faster.

We1 retains your personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by Malaysian law. The following are general guidelines on retention periods:

• Active account data: Retained for as long as your account remains active on the we1 platform.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date, in accordance with Malaysia's financial regulatory requirements.
• Identity verification records (KYC): Retained for a minimum of 5 years after account closure, in accordance with anti-money laundering compliance requirements.
• Support communication records: Retained for 2 years for reference and dispute resolution purposes.
• Technical log data: Retained for 12 months for security purposes and technical troubleshooting.
• Account closed: After account closure, the minimum data required for legal purposes is retained for the prescribed period. Data that is no longer required will be deleted or anonymised within 90 days.

Once the applicable retention period has expired, your data will be securely deleted or anonymised so that it can no longer be linked to you personally.

As a digital platform, some of the technical service providers used by we1 may store or process data outside Malaysia — for example, cloud service providers or international game software providers. In all such cases, we1 ensures that:

• Data transfers are carried out only to countries or entities that provide a level of data protection equivalent to or higher than Malaysia's.
• Legally binding data processing agreements are in place between we1 and all third-party providers.
• These providers may only use your data for the purposes we specify and are not permitted to use it for their own purposes.
• You will be notified of any significant cross-border data transfers that affect your sensitive personal data.

The we1 platform is strictly for individuals aged 18 and above. We do not knowingly collect, process, or store any personal data from individuals under the age of 18.

Should we discover that personal data belonging to a minor has been collected inadvertently, we will take immediate action to delete that data and close the associated account. Parents or guardians who are concerned that their child or ward may have registered on we1 without authorisation should contact our team immediately at support@we1.click.

We1 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or service improvements. When we make significant amendments, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying notices within the we1 platform to inform members of important amendments.
• In the event of a significant amendment, a notification will be sent directly to members via their registered email address or phone number.

It is your responsibility to review this Privacy Policy periodically. Your continued use of the we1 platform after any amendments take effect constitutes your acceptance of the updated terms.