D21 Privacy Policy – Data Protection Malaysian Member Privacy

D21 is an online entertainment platform operating under the name d21, accessible via d21.in. We are the data controller for all personal information collected through our platform relating to our registered Malaysian members and users.

This Privacy Policy is drawn up in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) — the primary legislation governing the processing of personal data for commercial purposes in Malaysia. We comply with all data protection principles set out in the PDPA, including the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, the Access Principle, and the Limited Use Principle.

We believe transparency is the foundation of a healthy relationship between a platform and its users. That's why d21's Privacy Policy is written in plain, easy-to-understand language — not cluttered with confusing legal jargon. Our goal is for every d21 member to genuinely understand what happens with their data.

D21 collects various types of personal data depending on how you interact with our platform. Below are the categories of data we collect, along with explanations for each:

Identity Data:

• Full name as stated on your Malaysian identity card (MyKad)
• Malaysian identity card number (MyKad) — for the KYC (Know Your Customer) process
• Date of birth — to verify that you are 18 years of age or older
• Gender

Contact Data:

• An active Malaysian mobile number — used for OTP verification and account communications
• Email address — for official communications, transaction receipts, and account notifications

Financial Data:

• Malaysian bank account details used for withdrawals
• The name and account number of any e-wallet (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) registered in your name
• Deposit and withdrawal transaction history on the d21 platform

Platform Usage Data:

• Gaming and betting history on d21 (game type, bet amount, outcome)
• Login time and session duration
• Device type and web browser used
• IP address and general location information
• Cookies and session data (detailed further in Section 7)

We do not collect data unrelated to the operation of our platform. We also do not collect sensitive information such as medical data, religious beliefs, or political views unless specifically required by applicable law.

D21 collects your personal data through several distinct channels. It is important that you understand each of these channels so you can make informed decisions about your use of our platform:

• During Account Registration: You provide your identity and contact details directly through the d21 registration form. This is our primary source of data.
• During the KYC Process: When you submit identity verification documents (such as a copy of your MyKad) for the account verification process or your first withdrawal.
• During Financial Transactions: Payment information is collected automatically when you make a deposit or withdrawal via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, or CIMB Clicks.
• While Using the Platform: Usage data is collected automatically as you browse, play, or interact with the d21 platform — including cookies, server logs, and session records.
• Through Communications with Us: When you contact d21 customer support via live chat, email, or Telegram, the content of those communications may be retained for service improvement and compliance purposes.
• From Third-Party Sources: In certain situations, we may receive data about you from our payment service providers for the purposes of transaction verification and fraud prevention.

D21 uses collected personal data solely for legitimate and relevant purposes. We do not use your data for anything unrelated to the operation of the platform. Below is a full list of the purposes for which your data is used:

Account Operations & Services:

• Creating and managing your d21 account
• Verifying your identity and processing KYC documents
• Enables you to log in, play, and access all d21 services
• Processing deposits and withdrawals to and from your account
• Sending important notifications relating to your account

Security & Compliance:

• Detecting and preventing fraud, money laundering, and other illegal activities
• Compliant with Malaysian legal requirements, including PDPA 2010 and Anti-Money Laundering (AML) obligations
• Verifying that users meet the minimum age requirement of 18 years
• Investigating and resolving disputes or complaints submitted to d21

Platform Enhancements:

• Analysing usage patterns to improve d21's interface and overall user experience
• Developing new features that are more relevant to Malaysian players
• Resolving technical issues and ensuring platform stability

Marketing Communications (With Consent):

• Sending information about d21 promotions, bonuses, and exclusive offers to members who have consented to receive such communications
• Keeps you informed about new games, the latest platform features, and special events

You may opt out of marketing communications at any time by updating your notification preferences in your d21 account settings or by contacting our customer support team.

D21 does not sell, rent, or disclose members' personal data to third parties for marketing or commercial purposes without your explicit consent. This is an unconditional commitment.

However, there are limited situations where d21 may need to share your personal data with carefully selected third parties:

• Payment Service Providers: Required transaction data is shared with the Malaysian payment service providers we work with (such as FPX, Touch 'n Go, and GrabPay) solely for the purpose of processing your financial transactions. These providers are bound by strict data security policies.
• Gaming Platform Providers: Live casino game providers and Sports Betting operators on the d21 platform may receive limited game session data for technical operational purposes. This data does not include full identity information.
• Legal Authorities: d21 will disclose personal data if required by Malaysian law, a court order, or a directive from a lawful authority. In all such cases, we will endeavour to notify you in advance unless prohibited by law from doing so.
• Professional Advisors: Lawyers, accountants, or auditors bound by professional confidentiality obligations may access certain data in the context of their professional services to d21.
• Business Transfers: If d21 is involved in a merger, acquisition, or sale of assets, user data may be transferred to the new entity, subject to appropriate notice to members and continued compliance with PDPA.

D21 stores your personal data on secure servers with robust technical and organisational safeguards in place. The following are the key security measures we employ:

• 256-bit SSL Encryption: All data transmitted between your device and d21's servers is protected by 256-bit Secure Socket Layer (SSL) encryption — the same industry standard used by Malaysia's leading banking institutions such as Maybank and CIMB.
• Secure Password Storage: Your password is never stored in plain text. We use a strong hashing algorithm (bcrypt) to store passwords securely.
• Access Controls: Access to user data within d21's systems is restricted to staff who require it to perform their duties. All access is logged and monitored.
• Two-Factor Authentication (2FA): d21's internal systems containing user data are protected by multi-factor authentication to prevent unauthorised access.
• Continuous Monitoring: d21's security systems are monitored around the clock to detect any suspicious access attempts or unusual activity.
• Regular Security Audits: d21's systems and infrastructure undergo regular security audits by independent third parties to identify and address any potential vulnerabilities.

Data Retention Period:

D21 retains your personal data for as long as your account is active, or as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by Malaysian law. Financial and transaction records are kept for a minimum of seven years in line with applicable Malaysian legal requirements. Once the retention period expires, data is deleted or anonymised securely.

If you close your d21 account, your personal data will be deleted or anonymised within 30 days, except for data that must be retained for legal compliance purposes or the resolution of any outstanding disputes.

D21 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small data files stored in your web browser when you visit d21.in.

You can manage cookie settings through your web browser. However, disabling essential or security cookies may affect the functionality of the d21 platform and could prevent you from logging in or using certain services. d21 is not responsible for any disruption in functionality resulting from cookie setting changes made by the user.

As a d21 member and as a Malaysian citizen or resident, you have specific rights under the Personal Data Protection Act 2010 (PDPA) regarding the personal data we hold about you. d21 respects and facilitates the exercise of all these rights:

D21 is an entertainment platform strictly limited to individuals aged 18 and above. We do not knowingly collect, process, or store the personal data of anyone under 18.

At registration, you are required to confirm that you are 18 years of age or older. d21 reserves the right to request age verification at any time and to suspend or close accounts found to belong to individuals below the minimum age requirement.

If you are a parent or guardian who has discovered that a minor in your care has registered a d21 account without authorisation, please contact us immediately at support@d21.in. We will take immediate action to close the account and refund any related funds.

D21 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements in how we protect your information. All amendments will be published on this page with a clear effective date.

For material amendments — those that significantly change how we use or protect your personal data — d21 will provide advance notice to registered members via:

• Email sent to the address registered with your d21 account
• In-platform notifications when you log in to your d21 account
• Prominent notice on the d21.in homepage

Where practicable, at least 14 days' notice will be given before any material amendments take effect. Your continued use of the d21 platform after an updated Privacy Policy comes into force will be deemed acceptance of those changes. If you do not agree with the amendments, you have the right to close your account before they take effect.

If you have any questions, concerns, or complaints regarding d21's Privacy Policy or how we handle your personal data, we encourage you to reach out to us directly. We are committed to addressing all privacy enquiries seriously and within a reasonable timeframe.

Communication channels for privacy enquiries:

• Privacy Email: privacy@d21.in (dedicated to personal data and PDPA-related enquiries)
• General Support Email: support@d21.in
• Live Chat: Available 24 hours a day, 7 days a week within the d21 platform
• Telegram: Through d21 Malaysia's official support channels

The d21 privacy team will acknowledge receipt of your enquiry within 3 business days and provide a full response within 21 business days for data access or deletion requests. For simpler enquiries, we aim to respond within 5 business days.

If you are not satisfied with how d21 has handled your privacy complaint after contacting us, you have the right to lodge a formal complaint with the Department of Personal Data Protection (JPDP) Malaysia, the regulatory body responsible for enforcing the PDPA in this country.