cucirm Privacy Policy

1. Introduction

This Privacy Policy ("Policy") sets out the data processing practices of cucirm ("we", "us", "our"), the operator of the online casino and sports betting platform available at cucirm.cam and associated subdomains or mobile-optimised versions thereof (collectively, the "Platform").

cucirm operates primarily for players resident in Malaysia and recognises the sensitivity of personal data collected in the context of an online gambling platform. This Policy is written in plain English and explains, in concrete terms, what personal information we collect, on what lawful basis we process it, how it is used and protected, how long we retain it, and what rights you hold as a data subject.

By creating an account on cucirm, making a deposit, or using any feature of the Platform, you acknowledge that you have read and understood this Policy. This Policy is incorporated by reference into our Terms & Conditions. If you do not agree with any part of this Policy, you should not use the Platform.

2. Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means cucirm, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of cucirm under a contractual agreement and in accordance with cucirm's instructions.
• "KYC" means Know Your Customer identity verification, the process of confirming a player's identity and, where required, source of funds.
• "Cookies" means small text files placed on your device by the Platform to maintain session state, store preferences, and collect usage analytics.
• "Sensitive Personal Data" means a sub-category of Personal Data requiring heightened protection, including government-issued identification numbers, financial account details, and any data relating to health or criminal history.
• "Platform" has the same meaning as defined in Section 1 above.

3. Personal Data We Collect

cucirm collects Personal Data in three principal ways: directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party verification and payment service providers.

3.1 Data Provided Directly by You

• Full legal name, date of birth, and nationality;
• Residential address (including city — Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or otherwise);
• Email address and contact telephone number;
• Government-issued identification documents (e.g., Malaysian MyKad, passport);
• Bank account details and e-wallet identifiers (e.g., Touch 'n Go eWallet phone number, Boost account, GrabPay linked account) used for deposit and withdrawal processing;
• Source of funds documentation where required by our compliance team; and
• Any communications you send to our support team via live chat or email.

3.2 Data Collected Automatically

• IP address and approximate geographic location;
• Device type, operating system, browser type and version;
• Session timestamps, login history, and duration of Platform use;
• Game activity logs, bet history, and transaction records; and
• Cookie data and similar tracking technologies as described in Section 9.

3.3 Data Received from Third Parties

• Identity verification results from KYC service providers;
• Transaction confirmation and fraud-scoring data from payment processors (including DuitNow, FPX, and cryptocurrency payment rails); and
• Sanctions screening and politically exposed persons (PEP) check results from compliance data providers.

4. Legal Basis for Processing

cucirm processes your Personal Data on one or more of the following lawful bases:

5. How We Use Your Personal Data

cucirm uses the Personal Data collected for the following specific purposes:

1. Account Administration: Creating, maintaining, and managing your registered account on the Platform, including processing login sessions and account settings changes.
2. Payment Processing: Facilitating deposits and withdrawals in Malaysian Ringgit (MYR) through Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels.
3. Identity Verification (KYC): Verifying your identity, age (21+), and source of funds in compliance with applicable anti-money laundering and counter-terrorism financing obligations.
4. Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, multi-accounting, collusion, and other prohibited conduct as defined in our Terms & Conditions.
5. Responsible Gambling: Monitoring gameplay patterns to identify signs of problem gambling, enforcing self-exclusion and deposit limit requests, and fulfilling our duty of care obligations.
6. Customer Support: Responding to your queries, processing complaints, and providing assistance through our 24/7 live chat and email support channels.
7. Legal & Regulatory Compliance: Fulfilling reporting obligations to relevant financial intelligence units, regulatory bodies, and law enforcement authorities where required by applicable law.
8. Platform Improvement: Analysing aggregated and anonymised usage data to improve the performance, reliability, and user experience of the Platform.

cucirm will not use your Personal Data for any purpose materially different from those listed above without providing prior notice and, where required, obtaining your consent.

6. Data Sharing & Third-Party Disclosure

cucirm does not sell, rent, or trade your Personal Data to third parties for commercial or marketing purposes under any circumstances. We share Personal Data with third parties only in the following limited situations:

• Payment Service Providers: Your payment details and transaction data are shared with the payment processors necessary to complete your deposit or withdrawal (e.g., DuitNow/FPX operators, e-wallet providers, cryptocurrency payment rails). These processors act as Data Processors under binding contractual agreements.
• Identity Verification Providers: KYC document data is transmitted to third-party identity verification services for the purpose of confirming your identity and compliance with age and sanctions requirements. These providers are contractually prohibited from using your data for any other purpose.
• Fraud & Risk Screening Providers: Transaction metadata may be shared with fraud prevention and sanctions screening services to protect the Platform and its players from financial crime.
• Regulatory & Law Enforcement Authorities: cucirm will disclose Personal Data to competent authorities (including financial intelligence units and law enforcement agencies) where required to do so by applicable law, court order, or regulatory directive. We will endeavour to notify affected players where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets involving cucirm, your Personal Data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

7. Data Retention

cucirm retains your Personal Data for as long as your account remains active and for such additional periods as are required to fulfil the purposes described in this Policy or to comply with applicable legal and regulatory obligations.

Specific retention periods applied by cucirm include:

• Account and transaction data: Retained for a minimum of 5 years following account closure, in line with standard anti-money laundering record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years following the completion of the business relationship, or for such longer period as required by applicable law.
• Communication records (live chat, email): Retained for 2 years following the date of the communication.
• Session and device logs: Retained for 12 months for fraud prevention and technical diagnostic purposes.
• Marketing consent records: Retained for the duration of the consent and for 3 years following withdrawal of consent as evidence of the consent given.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where data is anonymised, the anonymised data set may be retained indefinitely for statistical and analytical purposes.

8. Security Measures

cucirm implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• Encryption in Transit: All data transmitted between your device and the cucirm Platform is protected using TLS 1.2 or higher with strong cipher suites.
• Encryption at Rest: Personal Data and financial records stored on cucirm's servers are encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data is restricted to authorised personnel who require it to perform their specific job functions. All access is logged and subject to regular audit.
• Two-Factor Authentication (2FA): 2FA is available and encouraged for all player accounts. Internal administrative access to production systems requires mandatory 2FA.
• Penetration Testing: cucirm conducts periodic security assessments and penetration tests to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident Response: cucirm maintains a documented security incident response procedure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, you will be notified in accordance with applicable data breach notification requirements.

While cucirm applies robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately at [email protected] if you suspect any unauthorised access to your account.

9. Cookies & Tracking Technologies

cucirm uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit the Platform. Cookies allow the Platform to recognise your device, maintain your login session, and collect anonymous usage statistics.

9.1 Types of Cookies Used

• Essential Cookies: Required for the Platform to function. These include session cookies that maintain your logged-in state and security cookies that prevent cross-site request forgery. You cannot opt out of essential cookies without ceasing to use the Platform.
• Analytics Cookies: Used to collect aggregated, anonymous data about how players navigate and use the Platform. This data is used solely to improve Platform performance and user experience. No individual player behaviour is tracked for commercial profiling purposes.
• Preference Cookies: Store your platform preferences (e.g., language settings, display options) so they are preserved between sessions.

9.2 Cookie Management

You may configure your browser to block or delete cookies at any time. Note that disabling essential cookies will prevent certain Platform features from functioning correctly, including the ability to remain logged in. Instructions for managing cookies in common browsers (Chrome, Firefox, Safari, Edge) are available in each browser's help documentation.

cucirm does not deploy any third-party advertising or behavioural targeting cookies. You will not be subject to cross-site tracking by advertising networks through your use of the cucirm Platform.

10. Your Data Protection Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your Personal Data held by cucirm:

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request" and your full name and registered email address. cucirm will acknowledge your request within 5 business days and respond substantively within 30 days. In complex cases, this period may be extended by a further 30 days with prior notice.

11. Minors & Age Verification

cucirm's services are strictly intended for adults aged 21 and above. cucirm does not knowingly collect Personal Data from individuals under the age of 21 and actively employs age verification measures as part of the KYC process to prevent underage access to the Platform.

If cucirm becomes aware that Personal Data has been collected from an individual who was under 21 years of age at the time of collection, the following actions will be taken immediately:

• The Account will be suspended and permanently closed;
• Any winnings associated with the Account will be voided;
• Deposit funds will be returned to the original payment source; and
• All Personal Data associated with the underage account will be securely deleted, except where retention is required for legal compliance purposes.

If you believe a minor has accessed or registered on the cucirm Platform, please contact our support team immediately at [email protected]. We take all such reports seriously and will investigate and act on them without delay.

12. International Data Transfers

cucirm's primary operations are directed at players in Malaysia. However, some of our Data Processors — particularly cloud infrastructure providers and identity verification services — may process data in server locations outside Malaysia.

Where Personal Data is transferred internationally, cucirm ensures that adequate safeguards are in place to protect the data, including:

• Transfers to countries or territories recognised as providing an adequate level of data protection;
• Use of contractual clauses approved for international data transfers, binding the recipient to equivalent data protection standards; and
• Transfer only to processors that have demonstrated compliance with internationally recognised information security standards (e.g., ISO 27001).

You may request further information about the safeguards applicable to a specific international transfer by contacting us at [email protected].

13. Amendments to This Policy

cucirm reserves the right to update, amend, or replace this Privacy Policy at any time. Material changes — such as changes to the categories of data collected, new third-party sharing arrangements, or changes to your rights — will be communicated to registered players via the email address on file or through a prominent notice on the Platform at least 7 days prior to the effective date of the change.

Non-material updates (for example, editorial corrections or clarifications that do not substantively affect your rights) may be made without advance notice, though the "Last Updated" date at the top of this page will be revised accordingly.

Your continued use of the Platform after any amended Policy comes into effect constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must discontinue use of the Platform and contact us to close your account.

We encourage you to review this page periodically to stay informed of how cucirm protects your Personal Data.

14. Contact Us

If you have any questions, concerns, or requests in relation to this Privacy Policy or cucirm's data processing practices, please contact our Data Protection team using the details below. All communications should be submitted in English.

For matters relating to our Terms & Conditions, bonus queries, or responsible gambling tools, please refer to the respective dedicated pages or contact our support team directly.