Privacy Policy —
vcuci Data Commitment

This Privacy Policy ("Policy") is published by vcuci ("Company", "We", "Us", "Our") and applies to all personal data collected through the vcuci platform, accessible at https://vcuci.cam, including any associated mobile interfaces, applications, and digital services ("Platform").

vcuci operates as an online casino and sports betting platform serving registered members in Malaysia and other permitted jurisdictions. In delivering our services — which include live casino games, slot titles, sports betting markets, payment processing, and customer support — we necessarily collect and process certain personal data about you ("Player", "User", "You").

This Policy is intended to give you a clear and transparent account of what data we hold, why we hold it, how it is used, with whom it may be shared, and what rights you have in respect of it. It should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

For the purposes of this Policy, the following terms carry the meanings assigned below:

• "Personal Data" — any information that identifies or could reasonably identify you as an individual, including your name, email address, identification number, IP address, and payment details.
• "Processing" — any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.
• "Data Controller" — vcuci, which determines the purposes and means of processing your personal data.
• "Data Processor" — any third party engaged by vcuci to process personal data on our behalf, under documented instructions and appropriate contractual safeguards.
• "KYC Data" — identity and address verification documents submitted by Players for the Know Your Customer compliance process.
• "Cookies" — small text files placed on your device by the Platform to store session information, preferences, and usage analytics.
• "Sensitive Data" — a subset of personal data requiring heightened protection, including but not limited to government-issued identification numbers and financial account details.

vcuci collects personal data through several channels: information you provide directly during registration and account management, data generated automatically through your use of the Platform, and data received from third parties such as payment processors in the normal course of transaction processing.

We do not intentionally collect any special category data (such as health information, political opinions, or biometric data) unless it is incidentally included in documentation submitted for KYC purposes, in which case it is processed solely for verification and immediately isolated from general data systems.

vcuci processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to deliver the services you have contracted with us to receive — including account management, payment processing, game delivery, and KYC verification;
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, tax reporting requirements, and regulatory directives from licensing authorities;
• Legitimate Interests: Processing carried out for the Company's legitimate business interests, including fraud prevention, platform security, service improvement, and responsible gambling monitoring, provided these interests are not overridden by your rights;
• Consent: Processing for which we have obtained your specific, informed, and freely given consent — primarily in relation to direct marketing communications. You may withdraw this consent at any time.

The personal data we hold about you is used for the following specific purposes:

• To create and manage your vcuci player account, including maintaining accurate account records and processing your login credentials;
• To process deposits and withdrawals via your chosen Malaysian payment methods — including Touch 'n Go eWallet, DuitNow, Maybank, CIMB, Public Bank, FPX, and cryptocurrency wallets;
• To verify your identity and age (minimum 21 years) through the KYC process in compliance with our regulatory obligations;
• To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other prohibited conduct;
• To provide customer support across our live chat, email, and multilingual (English, Bahasa Melayu, Mandarin) support channels;
• To administer bonuses, promotions, VIP tier rewards, and the referral programme;
• To monitor your gambling behaviour for responsible gambling purposes, including identifying patterns that may indicate problem gambling and triggering appropriate interventions;
• To send transactional notifications (deposit confirmations, withdrawal updates, security alerts) and, where you have consented, promotional communications about offers and events;
• To improve the Platform through anonymised usage analytics, A/B testing, and service performance monitoring;
• To comply with legal obligations, respond to regulatory enquiries, and cooperate with law enforcement authorities where lawfully required.

vcuci does not sell, rent, or commercially distribute your personal data to third parties. We may share personal data with the following categories of recipient strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• Payment Processors: Licensed Malaysian payment service providers (including FPX operators, e-wallet providers such as Touch 'n Go, Boost, and GrabPay, and banking partners including Maybank, CIMB, Public Bank, and Hong Leong) for the purpose of processing transactions;
• KYC and Identity Verification Partners: Third-party compliance service providers engaged to assist with identity verification and AML screening, operating under strict data processing agreements;
• Cloud Infrastructure Providers: Hosting and database service providers who store Platform data on our behalf in secure, access-controlled environments;
• Regulatory and Law Enforcement Authorities: Where we are legally obligated or compelled by a valid court order, regulatory directive, or law enforcement request to disclose personal data;
• Professional Advisers: Legal counsel, auditors, and compliance consultants, where disclosure is necessary for legitimate business or legal purposes and is subject to professional confidentiality obligations;
• Business Successors: In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring entity, subject to your continued privacy rights.

All third-party data processors engaged by vcuci are required to process personal data only on our documented instructions, implement appropriate technical and organisational security measures, and comply with applicable data protection requirements.

vcuci uses cookies and similar technologies to operate and improve the Platform. The following categories of cookies are in use:

vcuci does not use advertising cookies, cross-site tracking pixels, or third-party behavioural profiling technologies. You may manage or disable cookies through your browser settings; however, disabling essential cookies will affect your ability to log in and use the Platform.

vcuci retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, in compliance with AML and financial record-keeping requirements;
• KYC Documents: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later, in accordance with AML legislation;
• Transaction Records: Retained for a minimum of seven (7) years for financial reporting and regulatory compliance purposes;
• Support Communications: Retained for up to three (3) years to assist with dispute resolution and service quality assurance;
• Marketing Consent Records: Retained for the duration of the marketing relationship, plus one (1) year following opt-out, as evidence of consent management.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

vcuci employs a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• At-rest encryption for all personal data and financial records stored on our servers;
• Role-based access controls ensuring that only authorised personnel can access personal data relevant to their specific job function;
• Two-factor authentication options for player accounts and mandatory MFA for all internal administrative access;
• Continuous monitoring and automated threat detection for anomalous access patterns and potential breaches;
• Regular penetration testing and third-party security audits of the Platform infrastructure.

Notwithstanding these measures, no digital system can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, vcuci will notify affected individuals and relevant authorities in accordance with applicable notification obligations.

As an international platform, vcuci may transfer certain personal data to service providers or infrastructure partners located outside Malaysia. Where such transfers occur, we ensure appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by recognised data protection authorities;
• Transfers to jurisdictions that provide an adequate level of data protection as determined by applicable regulatory frameworks;
• Binding corporate rules or equivalent arrangements with group entities.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia. We take reasonable steps to ensure that any international transfer meets the standards described in this Policy.

Subject to applicable law, you hold the following rights in respect of your personal data held by vcuci. Requests to exercise any of these rights should be directed to our support team and will be processed within thirty (30) calendar days:

The vcuci Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is conducted during the account registration and KYC processes to enforce this requirement.

If we become aware that personal data has been collected from an individual under 21 years of age, we will take immediate steps to delete all such data and close the associated account. Any funds deposited by an underage account will be handled in accordance with our Terms & Conditions.

If you have reason to believe that a minor has accessed or registered on the Platform, please contact our support team immediately so that the matter can be investigated and resolved promptly.

The vcuci Platform does not contain links to external third-party websites as a general practice. Where any reference to an external resource is made in an informational context, we are not responsible for the privacy practices or data handling of any third-party website, application, or service. This Privacy Policy applies solely to data collected and processed by vcuci through its own Platform.

We encourage you to review the privacy policies of any third-party service you interact with independently of the vcuci Platform, including your chosen payment providers (such as Touch 'n Go eWallet, Maybank, or CIMB).

vcuci reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or regulatory guidance. Material changes will be communicated to registered Players via in-platform notification or email with reasonable advance notice.

The "Last Reviewed" date displayed at the top of this page will be updated with each revision. We recommend reviewing this Policy periodically. Your continued use of the Platform following the publication of amendments constitutes acceptance of the updated Policy.

Where an amendment materially affects your rights or the way in which we process your personal data, we will seek fresh consent where required by applicable law.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact vcuci through the following channels:

• Live Chat: Available 24/7 via your account dashboard. Average response time: 3–5 minutes. Agents available in English, Bahasa Melayu, and Mandarin.
• Email: [email protected] (plain text — not a clickable link). Responses within 2 hours for privacy-related requests.

When submitting a privacy-related enquiry, please include your registered email address, account username, and a clear description of your request so that our team can respond accurately and within the required timeframe.

If you are not satisfied with our response to a privacy concern, you may be entitled to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.