Privacy Policy
menang29 Data & Privacy Commitment

1 Information We Collect

1.1 Registration Data. When you create a menang29 account, we collect information you provide directly, including your full name, date of birth, Malaysian mobile number (in +60 format), email address, and a username of your choosing. This information is required to create and administer your account.

1.2 Identity Verification (KYC) Data. To comply with our international gaming licence obligations and applicable anti-money laundering requirements, menang29 may request copies of your government-issued identity document (such as your MyKad or passport), proof of address, and, in certain circumstances, evidence of source of funds. This data is stored securely and accessed only by authorised compliance personnel.

1.3 Financial Data. menang29 collects information about your deposit and withdrawal transactions, including payment method type (e.g., Touch 'n Go eWallet, DuitNow, FPX), transaction amounts in MYR, and reference identifiers. We do not store full card numbers or bank account credentials — these are handled directly by our licensed payment processing partners.

1.4 Platform Usage Data. menang29 automatically collects data about how you interact with the platform, including login timestamps, pages visited, games played, bet history, session duration, device type, operating system, browser version, IP address, and geographic location (city level). This data is used for security monitoring, fraud prevention, and platform improvement.

1.5 Communications Data. When you contact menang29 support via live chat or email, we retain a record of the conversation, including the content of your messages, timestamps, and support agent responses. This enables us to track issues and maintain service quality.

1.6 Responsible Gaming Data. If you set deposit limits, cooling-off periods, or self-exclusion restrictions on your menang29 account, we record and store those preferences as part of our responsible gaming obligations. This data is treated with the highest level of confidentiality.

2 How We Use Your Information

menang29 uses the personal data we collect for the following purposes:

menang29 does not use personal data for automated decision-making that produces significant legal effects without human review, except where required for fraud prevention or regulatory compliance.

3 Legal Basis for Processing

3.1 Contract Performance. The majority of personal data processing by menang29 is necessary for the performance of the contract between you and the Company — specifically, to operate your account, process transactions, and deliver gaming services.

3.2 Legal Obligation. Certain processing activities are required by law, including identity verification, anti-money laundering record-keeping, and reporting obligations imposed by our international gaming licence. menang29 is required to retain KYC and financial transaction records for a minimum period specified by our licensor.

3.3 Legitimate Interest. menang29 processes some data — such as usage analytics, device fingerprinting for fraud prevention, and responsible gaming monitoring — on the basis of our legitimate interest in maintaining a secure, fair, and sustainable gaming platform. We conduct legitimate interest assessments to ensure this processing does not override your fundamental rights.

3.4 Consent. Where menang29 sends you direct marketing communications — such as promotional emails or SMS notifications about offers — this is done only with your explicit consent, which you may withdraw at any time by updating your communication preferences in your menang29 account settings or by contacting support.

4 Sharing of Personal Data

menang29 shares personal data with third parties only to the extent necessary to deliver our services and meet our legal obligations. We do not sell your data. Categories of recipients include:

• Payment Processing Partners: Licensed payment service providers facilitating your MYR deposits and withdrawals, including e-wallet operators and FPX bank transfer processors. These parties receive only the minimum data required to authorise and complete transactions.
• Game Content Providers: Licensed game studios and live casino operators whose content is hosted on the menang29 platform may receive session identifiers and stake/win data for the purpose of game delivery and RNG auditing. They do not receive your full personal profile.
• Identity Verification Services: Third-party KYC service providers who assist menang29 in verifying the authenticity of identity documents submitted during account registration. These providers operate under strict data processing agreements.
• Fraud Prevention and Security: Specialist fraud detection services that analyse transaction patterns and device data to identify suspicious activity. Data shared with these services is pseudonymised where possible.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or the instructions of our licensing authority, menang29 may disclose personal data to government agencies, regulators, or law enforcement bodies.
• Professional Advisers: Legal, audit, and compliance advisers operating under strict confidentiality obligations who assist menang29 in managing regulatory and legal affairs.

5 Data Retention

5.1 Active Accounts. Personal data associated with active menang29 accounts is retained for as long as the account remains open and for a period of five (5) years following account closure, unless a longer retention period is required by our licensing authority or applicable law.

5.2 KYC and Financial Records. Identity verification documents and financial transaction records are retained for a minimum of five (5) years following the end of the customer relationship, in accordance with international anti-money laundering standards. This retention period may be extended where records are subject to ongoing investigation or legal proceedings.

5.3 Communication Records. Support chat transcripts and email communications are retained for three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.

5.4 Marketing Data. Where you have consented to receive marketing communications from menang29, your contact details will be retained for marketing purposes until you withdraw your consent or request deletion, whichever is earlier.

5.5 Deletion. Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be attributed to an identified individual. Aggregated, anonymised data (from which individuals cannot be identified) may be retained indefinitely for analytical purposes.

6 Cookies & Tracking Technologies

The menang29 website and mobile applications use cookies and similar tracking technologies to improve platform functionality, remember your preferences, and analyse usage patterns. The categories of cookies used by menang29 are as follows:

• Strictly Necessary Cookies: Essential for the operation of the menang29 platform, including session management, login authentication, and security features. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Enable enhanced features such as remembering your preferred language, odds format (Asian handicap, decimal, fractional), and display preferences.
• Analytics Cookies: Used to collect aggregated data about how users interact with the menang29 platform, including pages visited, session duration, and navigation paths. This data is used to improve the platform experience.
• Security and Fraud Prevention Cookies: Used to identify and prevent suspicious activity on the platform, including bot detection and device fingerprinting for fraud prevention purposes.

You may manage cookie preferences through your browser settings at any time. Blocking strictly necessary cookies will impair your ability to access menang29 services. Blocking analytics or functional cookies will not prevent access but may reduce platform functionality.

7 Security Measures

menang29 implements a comprehensive information security programme designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key measures include:

• TLS 1.3 encryption for all data in transit between user devices and menang29 servers;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and payment identifiers;
• Multi-factor authentication required for all menang29 administrative system access;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Strict role-based access controls limiting employee access to personal data on a need-to-know basis;
• Continuous real-time monitoring for suspicious access patterns and anomalous transactions;
• Documented incident response procedures with defined notification timelines in the event of a data breach.

8 Your Rights

Subject to applicable law and our licensing obligations, menang29 users have the following rights with respect to their personal data:

• Right of Access: You may request a copy of the personal data that menang29 holds about you. We will respond within thirty (30) days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update basic account details directly from your menang29 account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal and regulatory retention obligations. Data subject to mandatory retention periods cannot be deleted until those periods expire.
• Right to Restriction: You may request that menang29 restrict processing of your data while a request for correction or objection is being considered.
• Right to Data Portability: Where processing is based on your consent or contract performance, you may request that menang29 provide your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing of your personal data where it is based on our legitimate interest, including for direct marketing purposes. We will cease processing upon receiving your objection unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact the menang29 support team via 24/7 live chat or by email at [email protected]. Please note that we may need to verify your identity before processing your request.

9 Children's Privacy

The menang29 platform is intended exclusively for individuals who are 21 years of age or older. menang29 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account.

Parents and guardians who believe that a person under 21 may have registered an account on menang29 are encouraged to contact our support team immediately via live chat. menang29 will investigate and take appropriate action without delay.

We encourage parents and guardians to use parental control software to restrict minors' access to online gambling platforms. A number of free parental control tools are available from device manufacturers and internet service providers.

10 International Data Transfers

10.1 Cross-Border Processing. menang29 operates as an international gaming platform. As such, your personal data may be processed by menang29's servers, affiliates, or service providers located outside of Malaysia. This includes data processed in connection with our gaming licence jurisdiction and by service providers operating globally.

10.2 Transfer Safeguards. Where personal data is transferred to countries that do not provide a level of data protection equivalent to that applicable in your jurisdiction, menang29 implements appropriate safeguards including contractual data protection clauses that impose equivalent obligations on the recipient. Details of applicable transfer mechanisms are available on request from our support team.

10.3 Payment Data. Payment transaction data processed in connection with Touch 'n Go eWallet, DuitNow, Boost, GrabPay, and FPX is processed by licensed payment service providers and is subject to the privacy policies of those providers. menang29 selects payment partners that demonstrate compliance with applicable data protection standards.

11 Changes to This Policy

11.1 Right to Update. menang29 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. The "Last updated" date at the top of this Policy will be revised accordingly.

11.2 Material Changes. Where changes to this Policy are material — for example, where we introduce a new category of data collection or a new purpose for processing — menang29 will provide advance notice by email to your registered address or via a prominent notice on the menang29 platform, at least fourteen (14) days before the changes take effect.

11.3 Continued Use. Your continued use of the menang29 platform following the effective date of an updated Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not accept the updated Policy, please close your account before the effective date of the change.

12 Contact & Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or menang29's handling of your personal data, please contact us using the following channels:

• Live Chat: 24/7 live chat available from your menang29 account dashboard at menang29.co — the fastest way to reach us.
• Email: [email protected] — for data subject access requests, deletion requests, or privacy-related complaints. Please include "Privacy Request" in the subject line and provide your registered account username for faster processing.

menang29 aims to acknowledge all privacy-related enquiries within 5 business days and to resolve or formally respond to data subject requests within 30 days. Where a request is complex or involves a large volume of data, we may extend this period by up to a further 30 days, in which case we will notify you of the extension and the reason for it.

This Privacy Policy was last updated on 1 January 2026 and supersedes all prior versions. The current version of this Policy is always available at menang29.co/privacy-policy.