Scrplay1 Privacy Policy – Personal Data Protection for Malaysian Members

This Privacy Policy describes how scrplay1 ("we", "Platform" or "Company") collects, uses, discloses and protects your personal information when you use our platform, website and services.

Scrplay1 is fully committed to protecting the privacy of our members. This document has been prepared in accordance with the requirements of Personal Data Protection Act 2010 (PDPA) Malaysia and reflects our careful approach to personal data management.

Scrplay1 collects the personal data necessary to provide our members with a secure, efficient, and high-quality service. The data we collect falls into several categories:

A. Data You Provide Directly:

• Full name as shown on your MyKad or Malaysian passport.
• An active Malaysian mobile phone number.
• A valid email address.
• Date of birth (for age verification – minimum 18 years old).
• Account password (stored in encrypted form – we cannot read your password).
• Malaysian bank account or eWallet details for deposit and withdrawal purposes.
• Copy of identity document (MyKad / passport) when required for the KYC (Know Your Customer) process.

B. Automatically Collected Data:

• Your device's IP address.
• Type and version of web browser used.
• Device information including operating system and screen resolution.
• Activity log records including login times, logout times and in-platform actions.
• General geolocation data (state/city within Malaysia) based on IP address.
• Gaming and betting pattern data for security and fraud detection purposes.

C. Financial Transaction Data:

• Deposit and withdrawal history in MYR (RM).
• Transaction records via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u, and CIMB Clicks.
• Records of wins, losses, and overall betting activity.

Scrplay1 uses collected personal data solely for the following purposes:

• Account management: Creating and managing your member account, including identity verification and mandatory KYC processes.
• Transaction processing: Processing deposits and withdrawals in MYR (RM) securely and efficiently via Malaysian eWallets and FPX.
• Platform security: Detecting and preventing fraudulent activity, money laundering, duplicate accounts, and any other suspicious behaviour.
• Legal compliance: Fulfilling compliance obligations including AML (Anti-Money Laundering), KYC requirements, and reporting to relevant authorities where required by law.
• Service communications: Sending important notifications regarding your account, transactions, changes to terms and policies, and security-related information.
• Marketing (with consent): Sending information about scrplay1 promotions, bonuses, and special offers — but only where you have given your consent to receive them.
• Platform improvements: Analysing aggregated (not individual) usage patterns to improve the scrplay1 user experience.
• Customer support: Handling your enquiries, complaints and support requests more effectively.

Scrplay1 takes a highly cautious approach to sharing personal data. We do not sell or rent your data to any party. However, there are limited situations in which we may need to share your data:

• Approved service providers: Companies that assist us in operating the platform – such as Malaysian eWallet payment providers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow), server infrastructure providers, and identity verification service providers. All third parties are bound by strict confidentiality agreements.
• Legal requirements: When required by Malaysian law or upon instruction from relevant authorities such as Bank Negara Malaysia, the Royal Malaysia Police (PDRM) or judicial bodies.
• Game providers: Minimum technical data required by licensed game providers partnering with scrplay1, strictly for game operation purposes.
• Business transfer: In the event of a merger, acquisition or transfer of scrplay1's assets, your personal data may be transferred as part of that transaction. You will be notified in advance.

Scrplay1 continually invests in information security to ensure your personal data is always protected. Key security measures we employ include:

• Data encryption in transit: All communications between your browser/app and scrplay1's servers are protected with 256-bit TLS/SSL protocol.
• Encryption of data at rest: Sensitive information such as passwords is stored in hashed form (unreadable) using the latest industry-standard encryption algorithms.
• Strict access controls: Only authorised scrplay1 personnel with a legitimate operational need may access member personal data. All access is logged and audited regularly.
• Regular security testing: The scrplay1 platform undergoes regular penetration testing and security audits conducted by independent cybersecurity firms.
• Two-factor authentication (2FA): scrplay1 offers two-factor authentication to provide an additional layer of protection for your account.
• 24/7 monitoring: Our security monitoring system operates around the clock to detect and respond to any threats or suspicious activity.

While we take all reasonable precautions, no system is 100% immune to cyber threats. You also play an important role in keeping your account secure – please never share your password with anyone, and always use a strong, unique password for your scrplay1 account.

Scrplay1 uses cookies and similar tracking technologies to enhance your user experience and ensure the platform functions properly.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication, session management and security. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use scrplay1 (for example, the most frequently visited pages) to help us improve the platform. All data is collected anonymously.
• Functional Cookies: Enables the platform to remember your preferences such as language, display settings, and login information.

You can control or delete cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the scrplay1 platform. For more information on managing cookies, please refer to your browser's documentation (Chrome, Safari, Firefox, or Edge).

Scrplay1 retains your personal data only for as long as it is needed for the purpose for which it was collected, or as required by Malaysian law.

• Active account data: Retained for the duration your account remains active and for 7 years following account closure – in accordance with Malaysian financial and anti-money laundering legal requirements.
• Financial transaction data: Deposit and withdrawal records in MYR (RM) are retained for 7 years in accordance with the Income Tax Act and Malaysian financial regulations.
• Log and security data: Retained for 2 years for security investigation and fraud detection purposes.
• Marketing data: Retained until you withdraw consent or request deletion.

When data is no longer required, it will be securely deleted or anonymised in accordance with secure data disposal procedures. Deletion is carried out using methods that ensure the data cannot be recovered.

The scrplay1 platform is exclusively for individuals aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18.

If you are a parent or guardian who believes your minor child has registered an account on scrplay1 or provided us with their personal data, please contact us immediately at privacy@scrplay1.ws. We will take immediate steps to remove the relevant information and close the account.

Scrplay1 also employs an age verification system during registration and reserves the right to request age verification documents (Malaysian MyKad or passport) at any time to ensure compliance with this policy.

Scrplay1 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, legal requirements, or improvements to our services.

When we make material changes, we will notify you through one of the following methods:

• In-platform notifications on scrplay1 while you are logged in.
• Email to the address registered on your account.
• A clear statement on the homepage of the scrplay1.ws website.

The "Updated" date at the top of this page indicates when this Privacy Policy was last revised. Your continued use of the scrplay1 platform following any amendments constitutes acceptance of the updated Privacy Policy.

If you believe that scrplay1 has violated any provision of PDPA 2010 or this Privacy Policy, you have the right to lodge a complaint. Please follow the procedure below:

1. Submit your complaint in writing to scrplay1 via email at privacy@scrplay1.ws including full details and supporting evidence.
2. Our privacy team will acknowledge receipt of your complaint within 3 business days.
3. An investigation will be conducted and a full response provided within 14 business days.
4. If you are not satisfied with our response, you may refer your complaint to Malaysia's Department of Personal Data Protection (JPDP).

For any enquiries, requests, or complaints relating to this Privacy Policy or the handling of your personal data by scrplay1, please contact our Data Protection Officer:

• Privacy Email: privacy@scrplay1.ws
• Support Email: support@scrplay1.ws
• Live Chat: Available 24/7 on the scrplay1 platform
• Response Time: Within 3 business days (acknowledgement); 14 business days (resolution)

The scrplay1 privacy team is committed to handling every enquiry and request thoroughly, professionally, and within the stipulated timeframe. We value the trust you place in us to manage your personal data.