crown2u Privacy Policy for Malaysian Players

Introduction

crown2u respects the privacy of every person who accesses its platform. This Privacy Policy sets out the basis on which personal information collected from Malaysian players — whether in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam or elsewhere — is processed, retained and protected.

By registering, depositing, playing or using any crown2u feature, you confirm that you have read this policy and accept the practices described within it. If you do not accept these practices, you must stop using crown2u and may request account closure.

This policy should be read alongside the crown2u Terms & Conditions. Defined terms carry the same meaning in both documents unless context clearly states otherwise. Where a provision of this policy conflicts with a general terms clause, this policy governs privacy matters.

Definitions

The following definitions apply throughout this Privacy Policy:

• Personal Data — any information relating to an identified or identifiable natural person, including name, address, identity document number, email address, phone number, device identifier, IP address and payment account details.
• Processing — any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, alteration, retrieval, use, disclosure, restriction, erasure or destruction.
• Data Controller — the crown2u entity responsible for determining the purposes and means of processing Personal Data collected through the platform.
• KYC — Know Your Customer. The identity and verification process requiring submission of acceptable government-issued identity documents, proof of address and, where applicable, evidence of payment ownership.
• Cookies — small text files placed on a device when a player visits crown2u. Cookies may be session-based (deleted when the browser closes) or persistent (retained for a defined period).
• Third Party — any organisation or individual other than the player and crown2u, including payment processors, fraud-detection providers and regulatory authorities.

Information we collect

crown2u may collect Personal Data in three broad categories:

1. Registration and account data — full legal name, date of birth, residential address, nationality, email address and phone number provided during account creation and KYC submission.
2. Transaction and payment data — deposit amounts in MYR, withdrawal requests, payment method identifiers for Malaysian services such as Maybank2u, CIMB Clicks, DuitNow, FPX, Touch'n Go eWallet, Boost and GrabPay, transaction timestamps and reference numbers.
3. Technical and behavioural data — IP address, device type, operating system, browser version, session duration, pages visited within crown2u, game and betting activity logs, and cookie identifiers.

crown2u does not knowingly collect Personal Data from any person under21 years of age. If a minor's data is inadvertently obtained, it will be deleted upon discovery and the account will be permanently closed.

Lawful basis and purposes of processing

crown2u processes Personal Data only where a recognised lawful basis exists. The principal bases and associated purposes are as follows:

• Contractual necessity — to verify identity, process MYR deposits and withdrawals, administer the account, settle bets, apply bonus conditions and handle responsible gambling measures.
• Legal obligation — to comply with anti-money-laundering requirements, age verification obligations, fraud prevention mandates and requests from competent regulatory and law enforcement authorities.
• Legitimate interests — to protect the security and integrity of crown2u, detect and prevent cheating and collusion, improve platform performance, and maintain accurate records of account activity.
• Consent — for non-essential cookies, targeted communication preferences and optional promotional materials where separate consent has been collected. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Cookies and tracking technologies

crown2u uses cookies and similar tracking technologies to maintain session integrity, remember display preferences, measure website performance and support fraud detection. The following categories of cookie may be active on crown2u pages:

• Strictly necessary cookies — required for core platform functions such as login sessions, balance display and navigation. These cannot be disabled.
• Performance cookies — collect aggregated, anonymised data on page load times, error rates and user journeys. This data helps crown2u improve service quality.
• Functional cookies — remember language settings, notification preferences and recent activity to reduce repeat configuration steps.
• Analytics cookies — support statistical analysis of platform usage patterns to inform content decisions and responsible gambling monitoring.

Players who wish to limit non-essential cookies may adjust browser settings. Disabling certain cookies may reduce platform functionality or prevent some features from displaying correctly.

Data sharing and third-party disclosure

crown2u does not sell Personal Data to third parties. Personal Data may be shared in the following circumstances:

• Payment processors — transaction data is shared with licensed payment providers such as FPX-connected banks, Maybank, CIMB, DuitNow and supported e-wallet operators solely to execute and confirm MYR transactions.
• Identity and fraud verification providers — KYC documents and identity data may be shared with contracted third-party verification services operating under confidentiality obligations.
• Regulatory and law enforcement bodies — crown2u may disclose data where required by a court order, applicable law, regulatory directive or to prevent, detect or investigate serious criminal activity including financial fraud and money laundering.
• Group companies and service providers — operational service providers acting as data processors under binding data processing agreements may access limited Personal Data to perform contracted services such as customer support, IT infrastructure and security monitoring.

Any third party receiving Personal Data from crown2u is required to handle it in a manner consistent with this Privacy Policy and applicable data protection standards.

International data transfers

crown2u operates within an international context. Personal Data may be transferred to, stored or processed in jurisdictions outside Malaysia, including countries where the operator's servers or technology partners are located. Such transfers occur only where adequate safeguards are in place, including contractual protections, security certifications or equivalent data protection measures recognised under applicable law.

Where Personal Data is transferred internationally, crown2u applies technical and organisational safeguards to maintain confidentiality and integrity, consistent with the data protection principles described in this policy.

Data retention

crown2u retains Personal Data only for as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, resolve disputes and enforce contractual rights. Retention periods vary according to data category:

• Account and KYC records — typically retained for a defined period after account closure, consistent with anti-money-laundering record-keeping requirements that may extend to five or more years in applicable jurisdictions.
• Transaction and payment records — retained in accordance with financial record-keeping obligations and fraud monitoring requirements.
• Session and technical data — retained for the period necessary to support security monitoring, dispute resolution and performance analysis, after which it is anonymised or deleted.

When Personal Data is no longer required for any legitimate purpose, crown2u will securely delete or anonymise it so that it cannot reasonably be re-identified.

User rights and data access

Subject to applicable law and legitimate operational constraints, players whose Personal Data is processed by crown2u hold the following rights:

• Right of access — to receive a copy of the Personal Data crown2u holds about you, together with information on how it is processed.
• Right to rectification — to request correction of inaccurate or incomplete Personal Data held your crown2u account record.
• Right to erasure — to request deletion of Personal Data where it is no longer necessary for the original purpose, provided no legal retention obligation overides this right.
• Right to restriction — to request that processing of your Personal Data is limited in certain circumstances, for example while an accuracy dispute is being investigated.
• Right to data portability — to receive Personal Data provided by you in a structured, machine-readable format, where processing is based on consent or contractual necessity and is carried out by automated means.
• Right to object — to object to processing carried out on the basis of legitimate interests, including profiling, except where compelling legitimate grounds for processing override your interests.
• Right to withdraw consent — to withdraw consent for processing activities based solely on consent, at any time, without affecting the lawfulness of prior processing.

To exercise a right, submit a written request to the crown2u support email shown in the Contact Us section below. Requests are typically handled within 30 days. Complex or multiple requests may take longer, and crown2u will notify you of any extension in advance.

Security measures

crown2u applies technical and organisational security measures proportionate to the risk associated with each category of Personal Data. These measures include:

• Encryption of data in transit using industry-standard transport layer security (TLS) protocols.
• Access controls limiting Personal Data access to authorised personnel who require it for their defined operational role.
• Regular security reviews, vulnerability assessments and system monitoring to detect and respond to threats.
• Staff training on data protection responsibilities and confidentiality obligations.

No electronic transmission or storage system can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own crown2u account credentials. If you suspect unauthorised account access, notify support immediately using the plain-text contact address in the Contact Us section.

Children and minors

crown2u gambling services are strictly limited to adults aged 21 and above. This Privacy Policy does not apply to minors. crown2u does not knowingly collect, store or process Personal Data from any person under the age of 21. If crown2u becomes aware that a minor has submitted Personal Data, the relevant data will be deleted promptly and the account will be closed without further notice.

Account holders must never share their crown2u login credentials with a minor or allow person under 21 to access an account on their behalf.

Changes to this Privacy Policy

crown2u may update this Privacy Policy from time to time to reflect changes in legal requirements, operational practices, new features or updated data processing activities. The revised policy will be published on the crown2u platform with an updated effective date.

Where an update is material — for example, a change in the purpose for which Personal Data is processed or the introduction of new data-sharing arrangements — crown2u will take reasonable steps to notify registered players. Continued use of crown2u following a policy update constitutes acceptance of the revised terms to the extent permitted by applicable law.

Players who do not accept a material change are entitled to request account closure and, subject to verification, a return of eligible withdrawable balances.

Contact Us

For questions about this Privacy Policy, to exercise a data right, or to report a privacy concern, contact the crown2u data protection team at the support email address below. The address is displayed as plain text only and is not a clickable link. Please copy it manually into your mail client.

Include your registered account identifier, the nature of your request and any supporting information. crown2u will acknowledge receipt and respond within a reasonable period, typically within 30 days for straightforward requests.