21huat Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how 21huat ("the Company", "we", "us", "our") collects, uses, discloses, stores, and protects the personal data of individuals ("you", "Player", "User") who access or use the 21huat platform, including the website at https://21huat.app and all associated services, games, and features (collectively, the "Platform").

By registering an account, accessing the Platform, or otherwise providing your personal data to 21huat, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the Platform.

This Policy should be read alongside our Terms & Conditions, which govern your use of the 21huat Platform. In the event of a conflict between this Policy and the Terms & Conditions on a data protection matter, this Policy shall prevail.

2. Data Controller

21huat acts as the data controller in respect of personal data collected through the Platform. As data controller, 21huat determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection law and the requirements of our gaming licence.

For all data protection enquiries or requests, you may contact us via live chat on the Platform or by email at: [email protected]

3. Personal Data We Collect

3.1 Registration and Account Data

When you register an account with 21huat, we collect the following information:

• Full legal name
• Date of birth
• Email address
• Mobile phone number
• Residential address (including city, state, postcode, and country)
• Preferred currency (MYR)
• Username and encrypted password

3.2 KYC and Identity Verification Data

To comply with our anti-money laundering (AML) obligations and the requirements of our international gaming licence, we collect:

• Government-issued photo identification (MyKad, passport, or equivalent document)
• Proof of residential address (utility bill, bank statement, or equivalent dated within three months)
• Payment method documentation (bank statement, eWallet account screenshot, or equivalent)
• Photographs or selfies where required for identity confirmation

3.3 Financial and Transaction Data

We collect records of all financial transactions conducted through your 21huat account, including:

• Deposit and withdrawal amounts, dates, and methods
• Payment account details (bank account numbers, eWallet identifiers) to the extent necessary for transaction processing
• Account balance history
• Bonus credit and wagering history

3.4 Gaming Activity Data

We collect detailed records of your gaming activity on the Platform, including:

• Games played, bets placed, and wagers settled
• Game session duration and timestamps
• Win and loss history
• Responsible gaming tool settings and usage (deposit limits, session reminders, cool-off periods)

3.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location
• Device type, operating system, and browser type
• Pages visited, features used, and session duration
• Referral source (where applicable)
• Cookie identifiers (see Section 8)

3.6 Communications Data

Where you contact 21huat's support team via live chat or email, we retain records of those communications for quality assurance, dispute resolution, and regulatory purposes.

4. How We Collect Your Data

21huat collects your personal data through the following means:

• Directly from you: When you register, complete KYC, make deposits or withdrawals, adjust account settings, or contact support.
• Automatically: Through cookies, web beacons, server logs, and similar tracking technologies when you access the Platform.
• From third parties: Identity verification service providers engaged for KYC processing, payment processors for transaction authentication, and fraud prevention services.

5. Legal Basis for Processing

21huat processes your personal data on the following legal bases:

• Contractual necessity: Processing required to provide the Platform services, manage your account, process transactions, and enforce the Terms & Conditions.
• Legal obligation: Processing required to comply with AML regulations, KYC requirements, gaming licence conditions, and applicable data protection law.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and internal analytics where such interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications, where you have provided explicit consent. You may withdraw consent at any time.

6. How We Use Your Data

21huat uses your personal data for the following purposes:

• Creating, maintaining, and administering your account
• Verifying your identity and age in compliance with KYC obligations
• Processing deposits, withdrawals, and bonus credits
• Detecting and preventing fraud, money laundering, and other prohibited activities
• Providing customer support and resolving disputes
• Administering responsible gaming tools and safeguards
• Sending transactional communications (account activity, security alerts, withdrawal confirmations)
• Sending marketing and promotional communications, subject to your preferences and consent
• Improving Platform performance, features, and user experience through analytics
• Complying with regulatory reporting obligations

7. Sharing Your Data with Third Parties

21huat does not sell, rent, or trade your personal data. We share your data only with the following categories of third parties, and only to the extent strictly necessary:

• Payment processors: Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, FPX, and related financial intermediaries, for the purpose of processing deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify identity documents and conduct age verification checks in compliance with our licence requirements.
• Fraud prevention and security services: Third-party providers used to detect, investigate, and prevent fraud, money laundering, and other prohibited activity.
• Game software providers: To the extent that game studios receive session data necessary for game provision and audit trail purposes under their own licensing obligations.
• Regulatory authorities: Where we are legally required to disclose data to our gaming regulatory authority, financial intelligence units, or law enforcement agencies pursuant to applicable law.
• Professional advisors: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

All third-party service providers engaged by 21huat are subject to contractual data protection obligations and are permitted to use your data only for the specified purpose of their engagement.

8. Cookies and Tracking Technologies

21huat uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that help us recognise returning users, maintain session state, and understand how the Platform is used.

8.1 Types of Cookies Used

• Essential cookies: Required for Platform operation, including session management and login state. These cannot be disabled without affecting core functionality.
• Analytics cookies: Used to collect anonymised data about Platform usage patterns, page performance, and feature adoption to guide product improvements.
• Marketing cookies: Used to deliver relevant promotional content and measure the effectiveness of marketing campaigns. These are only set with your consent.

You may control cookie preferences through your browser settings. Disabling essential cookies will impair your ability to use the Platform. Disabling analytics and marketing cookies will not affect core Platform functionality.

9. Data Retention

21huat retains your personal data for as long as is necessary to fulfil the purposes described in this Policy and to comply with our legal obligations. Specific retention periods include:

• Active account data: Retained for the duration of your account relationship with 21huat and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission or from the date of the last transaction, whichever is later.
• Transaction records: Retained for a minimum of five (5) years in accordance with AML regulatory requirements.
• Support communications: Retained for a period of two (2) years from the date of the interaction, unless the communication is related to an open dispute or regulatory investigation.
• Technical and device data: Retained for up to twelve (12) months, subject to anonymisation after that period.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

10. International Data Transfers

The 21huat Platform serves Malaysian players and our primary operations are oriented toward the Malaysian market. However, some of our third-party service providers — including KYC verification platforms, cloud infrastructure providers, and game software studios — may be located outside Malaysia. Where personal data is transferred internationally, 21huat ensures that appropriate safeguards are in place, including contractual data protection clauses, to provide a level of protection equivalent to that applicable in our primary operating jurisdiction.

11. Your Data Rights

Subject to applicable law and the limitations arising from our AML and KYC obligations, you have the following rights in respect of your personal data held by 21huat:

• Right of access: You may request a copy of the personal data 21huat holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction of processing: You may request that we restrict processing of your data in certain circumstances.
• Right to data portability: You may request a structured copy of data you have provided to us, in a machine-readable format where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to object: You may object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, please contact 21huat support via live chat or at: [email protected]. We will respond to all valid requests within thirty (30) days. We may require identity verification before processing a data subject request.

Please note that certain data cannot be deleted prior to the expiry of mandatory AML and KYC retention periods regardless of your erasure request. We will inform you of any such limitations when responding to your request.

12. Security Measures

21huat implements industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data in transit between your device and our servers
• Encryption of sensitive data at rest, including payment details and KYC documents
• Role-based access controls limiting data access to authorised personnel on a need-to-know basis
• Multi-factor authentication requirements for internal system access
• Regular penetration testing and vulnerability assessments conducted by independent security firms
• Incident response procedures for data breach detection, containment, and notification

No security measure is entirely foolproof. In the event of a data breach that poses a risk to your rights and freedoms, 21huat will notify affected players and, where required, relevant regulatory authorities, without undue delay.

13. Children's Privacy

The 21huat Platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you have reason to believe that a minor has registered an account on the Platform, please notify us immediately at: [email protected]. Upon confirmation, we will close the account, delete all associated personal data to the extent permitted by law, and return any deposited funds.

14. Changes to This Policy

21huat reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. Material changes will be communicated to registered players via email notification or a prominent notice on the Platform prior to the change taking effect. The "Last updated" date at the top of this Policy will reflect the date of the most recent revision. Continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. We recommend reviewing this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or 21huat's data practices, please contact us through any of the following channels:

• Live chat: Available 24/7 on the 21huat Platform
• Email: [email protected]

We are committed to resolving privacy concerns promptly and transparently. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority or gaming regulatory body in your jurisdiction.