Rm20 Privacy Policy – Personal Data Protection for Malaysian Players

rm20 collects your personal data through two primary methods: information you provide directly and data collected automatically through your use of our platform.

Data you provide directly:

• Upon account registration: full name, email address, mobile phone number and date of birth.
• During identity verification (KYC): a copy of your MyKad or passport, a selfie for facial verification, and proof of current address such as a utility bill or bank statement.
• During deposit or withdrawal transactions: details of the payment method used (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX Maybank2u, or CIMB Clicks) — however, we do not store your card number or wallet password.
• When communicating with the support team rm20: the content of any enquiries, complaints or feedback you submit.

Automatically collected data:

• Technical information: IP address, device type, operating system, browser version and screen resolution.
• Activity data: pages visited, games played, session duration, and actions taken within the platform.
• Cookie data and similar tracking technologies as further described in Section 6.
• Approximate location information based on IP address to confirm you are accessing the platform from a permitted region.

rm20 does not collect any data beyond what is necessary for the purposes outlined in this policy. We do not request sensitive information such as medical details, religious beliefs, or political views.

rm20 uses your personal data solely for legitimate purposes directly related to our platform services. Those purposes are as follows:

• Account Management: Creating, verifying and managing your player account on rm20, including processing your registration, login, and account settings.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX Maybank2u and CIMB Clicks, as well as securely and accurately processing withdrawals of winnings.
• Identity Verification (KYC): Verifying your identity to comply with legal requirements relating to anti-money laundering and age verification.
• Platform Security: Detecting and preventing fraud, unauthorised access, multiple account usage and any activity that violates our Terms & Conditions rm20.
• Responsible Gaming: Monitoring gameplay patterns to identify players who may need responsible gaming support, and enforcing the limits you have set for yourself.
• Service Improvements: Analysing usage data in aggregate (not at an individual level) to improve the user experience, refine the interface and introduce useful new features.
• Service Communications: Sending important notices about your account, changes to our terms, security messages and transaction information.
• Legal Compliance: Maintaining records required by Malaysian law, including the PDPA 2010, the Anti-Money Laundering Act 2001 and other applicable regulations.

rm20 will not use your data for purposes beyond those listed above without first obtaining your fresh consent. Should we ever wish to use your data for a new purpose not specified here, you will be notified and your explicit consent will be sought.

rm20 does not sell, rent or share your personal data with any third party for marketing or commercial purposes. However, there are limited situations where sharing data with certain parties is necessary for operations:

• Payment Providers: Transaction information that must be shared with payment processors such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow and FPX to process your deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Game Providers: Minimum technical data required by licensed game providers to operate games within the platform rm20. These providers do not receive your personally identifiable information.
• KYC Verification Services: To verify your identity, we use accredited third-party services. They receive only the data necessary for verification and are bound by strict confidentiality agreements.
• Legal Authorities: rm20 will disclose your personal data to Malaysian authorities where required by court order, warrant or applicable law. We will endeavour to notify you of any such disclosure unless prohibited from doing so by law.
• Auditors & Legal Advisors: In the event of a compliance audit or legal dispute, auditors or legal counsel appointed by rm20 may need to access certain data. Such access is limited, controlled and subject to professional confidentiality.

In all data-sharing scenarios described above, rm20 ensures that only the minimum necessary data is shared, and all recipients are bound by confidentiality and security obligations equivalent to our own standards.

rm20 invests seriously in security infrastructure to ensure your personal data is always protected to the highest standard. The security measures we have in place include:

• 256-bit SSL Encryption: All communications between your device and the rm20 encrypted using the latest SSL/TLS protocols.
• Data-at-Rest Encryption: Sensitive data stored in our databases is also encrypted using the industry-standard AES-256 protocol.
• Strict Access Controls: Only authorised staff of rm20 who require access to perform their specific duties are permitted to access personal data. All access is logged and audited on a regular basis.
• Continuous Monitoring: Our security monitoring system operates around the clock to detect any intrusion attempts or unauthorised access.
• Regular Backups: Data is regularly backed up to separate, secure servers to ensure continuity of service.

Data Retention Period: rm20 retains your personal data for as long as your account remains active and for the period prescribed by Malaysian law following account closure — typically 7 years for financial records in accordance with the Companies Act and relevant financial regulations. Once the mandatory retention period has elapsed, data will be securely deleted using industry-standard data disposal methods.

While we take every reasonable precaution, no digital security system can be guaranteed 100% infallible. You also play an important role by keeping your account password confidential and not sharing it with anyone — including staff of rm20 which will never ask for your password.

As a data subject under Malaysia's PDPA 2010, you have the following rights regarding your personal data at rm20:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Such requests will be processed within 21 business days.
• Right to Rectification: If your personal data is inaccurate or outdated, you have the right to request a correction. Corrections will be made within 14 business days.
• Right to Withdraw Consent: You may withdraw your consent for us to use your data for specific purposes, such as marketing communications. Withdrawing consent does not affect the use of your data for necessary operational purposes.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data. However, this right is subject to our legal obligations to retain specific records.
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain circumstances, such as when you are disputing the accuracy of your data.
• Right to Data Portability: You have the right to request your personal data in a machine-readable format for transfer to another party.
• Right to Lodge a Complaint: If you are not satisfied with the way rm20 handling your data, you have the right to lodge a complaint with the Department of Personal Data Protection, Ministry of Digital Malaysia.

To exercise any of the rights listed above, please send a written request to [email protected], clearly stating the right you wish to exercise and any relevant information. rm20 will respond within 14 business days to acknowledge receipt of your request and inform you of the next steps.

rm20 uses cookies and similar technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. The types of cookies we use are as follows:

You can manage and delete cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of some platform features. rm20. Essential cookies cannot be disabled as they are required for the security and core functionality of the platform.

rm20 does not use any third-party tracking technologies for advertising or marketing analytics purposes involving your personal data.

rm20 may send you marketing communications from time to time, including information about new promotions, special bonuses, the latest games and exclusive member offers. The types of marketing communications we send include:

• Promotional emails about deposit bonuses, weekly cashback and exclusive member offers rm20.
• SMS or WhatsApp notifications about limited-time promotions and personalised offers.
• In-platform notifications about new games and the latest features.

You agreed to receive these marketing communications at the time of registration. However, you have the full right to opt out of marketing communications at any time by:

• Click the "Unsubscribe" link found at the bottom of any marketing email.
• Update your communication preferences in your account settings rm20 under the "Notification Preferences" section.
• Contacting our support team at [email protected] to request that all marketing communications be stopped.

Please note that opting out of marketing communications does not mean you will stop receiving essential service communications, such as transaction notices, account confirmations, security alerts and terms updates — these are necessary for the operation of your account and cannot be stopped while your account remains active.

If you have any questions, concerns, or requests regarding this Privacy Policy or how rm20 handling your personal data, please contact us through the following channels:

• Email: [email protected] — for written requests requiring an official record, particularly when exercising your rights under the PDPA.
• Live Chat: Via the live chat icon within the platform rm20 — for general privacy enquiries that require a prompt response.
• Response Time: We are committed to responding to all privacy enquiries within 14 business days. For urgent security matters, we aim to respond within 24 hours.

For complaints that cannot be resolved through rm20 directly, you have the right to file a complaint with the Department of Personal Data Protection, Ministry of Digital Malaysia, which is the regulatory body responsible for enforcing the PDPA 2010 in Malaysia.

rm20 will update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or new technologies. Any material changes will be communicated to you via the email address registered to your account at least 14 days before the changes take effect. The date of the most recent update is always stated at the top of this document.