21huat Privacy Policy

1. Introduction

This Privacy Policy ("Policy") sets out the basis on which 21huat ("21huat", "we", "us", "our") collects, processes, stores, and shares personal data relating to individuals who register for or use the 21huat platform accessible at https://21huat.org ("Platform"). This Policy applies to all users of the Platform regardless of the device or method of access used.

21huat is committed to protecting the privacy and security of its players' personal data. We handle all personal information in accordance with the data protection obligations imposed under our international gaming licence and applicable privacy regulations. The data controller for personal data collected through the Platform is 21huat.

This Policy is to be read in conjunction with our Terms & Conditions. By accepting the Terms & Conditions, you also accept the terms of this Privacy Policy.

2. Personal Data We Collect

2.1 Registration Data

When you create a 21huat account, we collect: full legal name, date of birth, email address, phone number, residential address, and preferred currency. This information is required to create and administer your account and to verify that you meet the platform's minimum age requirement of 21+.

2.2 Identity Verification (KYC) Data

As required under our international gaming licence, 21huat conducts Know Your Customer ("KYC") verification. For this purpose, we may collect copies of: government-issued identification documents (Malaysian MyKad, passport, or equivalent), proof of residential address (utility bill, bank statement), and payment method verification documents. This data is held securely and used solely for regulatory compliance purposes.

2.3 Financial Transaction Data

We collect records of all financial transactions conducted through your 21huat account, including: deposit amounts and timestamps, withdrawal requests and processing status, payment method identifiers (masked account or wallet numbers — we do not store full card or banking credentials), and bonus credit and debit records.

2.4 Gaming Activity Data

21huat maintains records of all gaming activity conducted through your account. This includes: game session history, bet amounts, game outcomes, and aggregate win/loss data. This information is used for platform integrity monitoring, responsible gaming oversight, and dispute resolution purposes.

2.5 Technical and Device Data

When you access the 21huat platform, we automatically collect certain technical information, including: IP address, device type and operating system, browser type and version, session duration and navigation paths within the Platform, and geolocation data (country and region level only, derived from IP address). This data is used for fraud prevention, security monitoring, and platform performance optimisation.

2.6 Communications Data

Where you contact 21huat support — by email or live chat — we retain records of those communications for customer service quality assurance, dispute resolution, and regulatory compliance purposes.

3. How We Use Your Personal Data

21huat uses personal data collected from players for the following purposes:

• Account Management: Creating, maintaining, and securing your 21huat account; processing login requests; and providing account recovery services;
• Payment Processing: Facilitating deposits and withdrawals via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and cryptocurrency channels;
• Regulatory Compliance: Meeting KYC, anti-money laundering (AML), and responsible gaming obligations imposed by our gaming licence;
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, and other prohibited activities;
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and to administer self-exclusion, deposit limit, and cooling-off requests;
• Customer Support: Responding to account queries, technical support requests, and formal disputes;
• Platform Improvement: Analysing aggregate usage data to improve the 21huat platform's performance, design, and game offering;
• Marketing Communications: Sending promotional offers and platform updates to players who have opted in to receive such communications. You may opt out at any time.

4. Legal Basis for Processing

21huat processes personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions entered into with you at registration — including account management, payment processing, and game provision;
• Legal Obligation: Processing required to comply with our international gaming licence obligations, including KYC verification, AML monitoring, age verification, and responsible gaming requirements;
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregate analytics — conducted in a manner that does not override your fundamental privacy rights;
• Consent: Processing for marketing communications, for which we require explicit opt-in consent and which may be withdrawn at any time without affecting other processing.

5. Data Sharing & Third Parties

21huat does not sell, rent, or trade your personal data to third-party marketers. We share your personal data only in the following circumstances and only to the extent necessary:

• Payment Service Providers: To process deposits and withdrawals, relevant transaction data is shared with the applicable payment processor (e.g., Touch n Go Digital, Boost, or banking partners). These processors are contractually bound to handle your data securely and use it only for payment processing purposes;
• KYC and Identity Verification Services: Document data submitted for identity verification is processed by our licensed KYC verification partner. This data is held under strict confidentiality obligations;
• Game Software Providers: Game session data is shared with third-party game providers to the extent necessary to render and audit game sessions. Providers do not receive data beyond what is technically required;
• Regulatory and Law Enforcement Authorities: We may disclose personal data where required to do so by law, court order, or in response to a valid request from our gaming licence authority or a competent law enforcement agency;
• Fraud Prevention Databases: In cases of suspected fraud or AML violations, relevant data may be shared with industry fraud prevention services as permitted by applicable law.

6. Cookies & Tracking Technologies

The 21huat platform uses cookies and similar tracking technologies to support platform functionality, security, and analytics. The types of cookies used include:

• Strictly Necessary Cookies: Essential to platform operation — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core platform functionality;
• Performance and Analytics Cookies: Used to collect aggregate data on how players navigate the platform, which pages are visited most frequently, and where errors occur. This data is used in anonymised form to improve platform performance;
• Functional Cookies: Store your preferences such as language settings, display preferences, and remembered login status (where "Remember Me" is selected);
• Marketing Cookies: Used only where you have provided consent, to track the effectiveness of 21huat promotional communications and to serve relevant content within the platform.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to use the 21huat platform. Disabling performance or marketing cookies will not affect core platform functionality.

7. Data Retention

21huat retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention guidelines:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, as required by our gaming licence's record-keeping obligations;
• KYC Documentation: Retained for a minimum of five (5) years following the end of the customer relationship, in accordance with applicable AML regulations;
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years for audit and regulatory compliance purposes;
• Support Communications: Retained for three (3) years following the date of the communication;
• Marketing Consent Records: Retained for the period of active consent plus one (1) year following withdrawal, as evidence of consent or its withdrawal.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised.

8. Data Security

21huat implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmissions between player devices and 21huat servers;
• Encryption of sensitive personal data at rest, including KYC documentation and payment identifiers;
• Role-based access controls limiting employee access to personal data to those with a genuine operational need;
• Regular third-party security audits and penetration testing as required by our international gaming licence;
• Intrusion detection and monitoring systems operating on a 24/7 basis;
• Secure data backup and disaster recovery protocols.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. In the event of a data breach that is likely to result in risk to player rights, 21huat will notify affected individuals and the relevant authority as required by applicable law.

9. Your Data Rights

Subject to applicable privacy law and our regulatory obligations, registered players have the following rights regarding their personal data held by 21huat:

• Right of Access: You may request a copy of the personal data 21huat holds about you;
• Right of Rectification: You may request correction of inaccurate personal data;
• Right to Erasure: You may request deletion of your personal data in certain circumstances — note that regulatory data retention obligations may limit our ability to fulfil erasure requests in full;
• Right to Restrict Processing: You may request that we limit the way we use your data in certain circumstances;
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to us;
• Right to Object: You may object to processing conducted on the basis of legitimate interests, including direct marketing;
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the 21huat data team at [email protected]. We will respond within 30 days. Requests may be subject to identity verification before action is taken.

10. Children & Minors

21huat does not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by an underage person, the account will be suspended immediately, all associated data will be deleted (subject to any regulatory retention obligations), and any deposited funds will be returned to the original payment source following identity verification.

If you believe that a minor has registered on the 21huat platform, please contact us immediately at [email protected].

11. International Data Transfers

In order to operate the 21huat platform — including payment processing, game software provision, and KYC verification — some personal data may be processed by third-party service providers located outside Malaysia. Where personal data is transferred internationally, 21huat ensures that appropriate safeguards are in place, including contractual data protection clauses binding the recipient to privacy standards equivalent to those applied within Malaysia.

12. Changes to This Privacy Policy

21huat reserves the right to update this Privacy Policy at any time to reflect changes in platform operations, regulatory requirements, or applicable privacy law. Material changes will be communicated to registered players via email or in-platform notification before taking effect. The "Last Updated" date at the top of this Policy reflects the most recent revision.

Your continued use of the 21huat platform following the publication of a revised Privacy Policy constitutes your acceptance of the changes. If you do not accept a revised Policy, you should close your account and withdraw any remaining balance.

13. Contact & Data Requests

For all privacy-related enquiries, data subject access requests, or concerns about how 21huat handles your personal information, please contact our data team in writing. All formal requests must be submitted by email to receive an official response.