Menang29 Privacy Policy – Protection of Your Personal Data

This Privacy Policy is issued by menang29 ("we", "our platform") and applies to all members, visitors, and users of the menang29 platform in Malaysia. This document outlines our privacy practices, including the types of data collected, the purposes for collection, how data is handled, and your rights as a data subject under Personal Data Protection Act (PDPA) 2010 Malaysia.

Your privacy is more than a legal obligation to menang29 — it is a core value we have upheld since day one of this platform's operation. We understand that your trust is our most valuable asset, and that trust can only be maintained when you are confident your personal data is handled responsibly, transparently, and securely.

This Privacy Policy should be read together with Terms & Conditions and Responsible Gaming Policy menang29. menang29 reserves the right to update this Privacy Policy from time to time and will notify members of any material changes via email or in-platform notification.

Menang29 collects various categories of personal data depending on how you interact with our platform. Below is a full breakdown of the data that may be collected:

Menang29 collects and processes your personal data for legitimate and necessary purposes only as outlined below. We will not process your data for any other purpose without your explicit consent.

• Account management & identity verification: To ensure every menang29 account is legitimate, unique, and held by a qualified individual (aged 18 and above). This includes the KYC (Know Your Customer) process as required by law.
• Financial transaction processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, and to handle your withdrawal requests in Malaysian Ringgit (MYR) quickly and securely.
• Provision of gaming services: To operate the menang29 platform, including Sports Betting on Malaysia Super League, EPL, badminton, e-sports, slots, and Live Casino. Gaming activity data is used to ensure game integrity and resolve any disputes.
• Fraud prevention & security: To detect and prevent fraudulent activity, money laundering (AML), and unlawful use of the platform. This is a legal obligation of menang29 under Malaysian regulations.
• Service communications: To send important notifications relating to your account, including deposit confirmations, withdrawal status updates, security alerts, and updates to our terms or policies.
• Platform improvements: To analyse aggregated (non-individual) usage patterns in order to improve the user experience, platform performance, and develop new menang29 features.
• Legal compliance: To meet the legal and regulatory requirements applicable to menang29, including PDPA 2010, AML regulations, and lawful requests from Malaysian authorities.

Menang29 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, in the course of operating the platform, we may share data with the following categories of third parties in limited and controlled circumstances:

• Licensed payment processors: To process deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX. These processors receive only the minimum information required to complete a transaction and are bound by strict confidentiality agreements with menang29.
• Game software providers: Providers such as Evolution Gaming and Pragmatic Play Live may receive limited technical data (such as anonymised session IDs) necessary to operate live casino games. No personally identifiable information is shared for this purpose.
• Malaysian legal authorities: menang29 will disclose personal data when required by law, court order, or legitimate request from Malaysian authorities (including PDRM, Bank Negara Malaysia, or relevant regulatory bodies).
• Professional advisors: Lawyers, accountants, or auditors appointed by menang29 are bound by strict professional confidentiality obligations.

In all data-sharing arrangements described above, menang29 ensures that recipients are bound by data protection agreements meeting the same standards we hold ourselves to. No data transfers outside Malaysia are made without adequate safeguards in place.

Menang29 continuously invests in the latest cybersecurity infrastructure to protect your personal data. The following are the key layers of protection we have implemented:

• 256-bit SSL Encryption: All communications between your browser or app and menang29 servers are protected by industry-standard Transport Layer Security (TLS) encryption. This ensures no data can be intercepted in transit.
• Two-Factor Authentication (2FA): menang29 members are encouraged to enable 2FA, which adds an extra layer of security to their account by requiring verification via SMS or an authenticator app in addition to their password.
• 24/7 suspicious activity monitoring: The menang29 system continuously monitors accounts for unusual activity — including logins from new locations or unrecognised devices — and will alert you promptly if anything is detected.
• Hashed password storage: Your password is never stored in plain text. We use a strong one-way password hashing algorithm (bcrypt) to ensure your password cannot be recovered — not even by menang29 staff.
• Regular security audits: The menang29 platform undergoes regular independent penetration testing and security audits to identify and address any vulnerabilities before they can be exploited.
• Internal access controls: Only authorised menang29 staff who require access for specific job functions are permitted to access member personal data, and all access is logged and monitored.

Menang29 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit the menang29 platform. The following are the types of cookies we use:

You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies may affect the functionality of the menang29 platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

As a data subject under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding your personal data held by menang29:

Menang29 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required under Malaysian law.

• Active account data: Retained for the duration your account is active, plus 7 years after account closure, as required under Malaysian financial law.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysian tax and AML legal requirements.
• Support communication logs: Retained for 2 years from the date of last interaction for quality control and dispute resolution purposes.
• Analytics data: Non-personally identifiable usage data is retained for 3 years for platform improvement purposes.

When your personal data is no longer needed and there is no legal obligation to retain it, menang29 will securely delete or anonymise that data using industry-recognised methods.

The menang29 platform is restricted to users aged 18 years and above only. We do not knowingly collect personal data from minors. If you become aware that someone under the age of 18 has registered on menang29, please notify us immediately at support@menang29.ws and we will take prompt action to close the account and delete all associated data.

If you have any questions, concerns, or wish to exercise your rights under PDPA 2010 regarding personal data held by menang29, please contact our Data Protection Officer through the following channels:

• Privacy Email: support@menang29.ws (please state "Privacy Enquiry / PDPA" in the email subject line)
• Live Chat: Via the menang29 platform – select the "Privacy & Personal Data" category (available 24/7)
• Telegram: @menang29official

Menang29 will respond to all privacy-related enquiries within 5 business days. For more complex requests such as data access or full data deletion, the process may take up to 21 business days in accordance with the time limits prescribed by PDPA 2010.