Cucu100 Privacy Policy — Personal Data Protection for Malaysian Members

This Privacy Policy ("Policy") is published by cucu100, which operates the online entertainment platform accessible at cucu100.best. This policy explains in detail how we collect, process, store, protect, and disclose your personal data when you use our platform.

This policy applies to all registered members cucu100, website visitors, and any individual who interacts with our platform in any capacity. By registering an account or using the cucu100 platform, you confirm that you have read and understood this Privacy Policy and that you consent to the processing of your personal data in the manner described herein.

Cucu100 is a "data controller" as defined under Malaysia's Personal Data Protection Act 2010 (PDPA), meaning we bear full responsibility for how your personal data is collected and processed on our platform. We take this responsibility seriously.

Cucu100 collects personal data through several channels — directly from you during registration and platform use, automatically via tracking technologies, and in some cases, from legitimate third parties. The categories of data we collect are as follows:

Data you provide directly:

• Full name as stated in your official Malaysian identification document
• An active Malaysian phone number (used for OTP verification and communications)
• Date of birth (for age verification)
• Payment account details — e-wallet account numbers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) or FPX bank account numbers (Maybank2u, CIMB Clicks, and others)
• Your chosen username and password (passwords are stored in encrypted hash format — we are unable to read your actual password)
• Any information you provide when contacting our support team

Automatically collected data:

• IP address and approximate location data derived from IP
• Device type, operating system, and web browser used
• Gaming session history — games played, session duration, bet amounts, and outcomes
• Financial transaction history — all deposits and withdrawals with timestamps
• Cookie data and session identifiers (further details in Section 9)
• Platform access logs, including pages visited and actions taken

Cucu100 collects and processes your personal data only for legitimate and necessary purposes. The following are the primary purposes of data processing on our platform:

• Account management — creating and maintaining your member account, verifying your identity, and ensuring account security.
• Service provision — enabling you to access and enjoy all games and features available on the cucu100 platform.
• Payment processing — processing deposits and withdrawals via your chosen Malaysian payment method, including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
• Fraud verification and prevention — detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Legal compliance — to fulfil the legal and regulatory obligations applicable to our platform under Malaysian law.
• Customer Support — providing assistance and resolving issues you report to our support team.
• Responsible gaming — monitoring gameplay patterns to identify and assist members who may be experiencing gambling-related issues.
• Platform improvements — analysing platform usage in aggregate and anonymised form to improve the user experience.
• Promotional communications — sending you information about cucu100 promotions and offers, provided you have given consent or have not withdrawn it.

Cucu100 will not process your personal data for any other purpose without first informing you and, where required by law, obtaining your consent.

Under Malaysia's Personal Data Protection Act 2010, cucu100 processes your personal data on the following legal bases:

• Consent — for marketing communications and the storage of preference cookies. You may withdraw this consent at any time without affecting the core services we provide.
• Contractual performance — to process account registration, deposits, withdrawals, and provide access to games. This processing is necessary to fulfil the agreement between you and cucu100.
• Legal obligation — to comply with Malaysian legal requirements relating to anti-money laundering, identity verification, and financial record-keeping.
• Legitimate Interests — to detect and prevent fraud, maintain platform security, and improve the quality of our services. We ensure these legitimate interests do not override your privacy rights and interests.

Cucu100 does not sell, does not rent, and does not transfer your personal data to third parties for their marketing purposes. Your data is only shared in strictly limited situations and for legitimate reasons, namely:

• Payment service providers — information required to process deposit and withdrawal transactions is shared with the relevant e-wallet providers and banks (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank, CIMB, and others). These providers are bound by strict confidentiality agreements.
• Gaming software providers — in some cases, gaming data required to deliver a seamless playing experience is shared with licensed game providers. This data is typically in the form of session IDs that do not directly identify you.
• Authorities and law enforcement agencies — when required by Malaysian law, court order, or a legitimate request from a relevant authority. cucu100 will disclose only the data required and nothing beyond that.
• Technology service providers — cloud services, cybersecurity, and technical infrastructure providers that assist us in operating the platform. All such providers are bound by data processing agreements that ensure a level of protection equivalent to cucu100's standards.

Protecting your personal data from unauthorised access, loss, or misuse is our top technical and organisational priority. The security measures we have implemented include:

• Data transmission encryption — all communications between your device and cucu100's servers are encrypted using TLS 1.3 protocol with a 256-bit SSL certificate.
• Secure password storage — member passwords are never stored in plain text. We use strong cryptographic hashing algorithms with a unique random salt for each password.
• Data access controls — only cucu100 staff who require data access to carry out their assigned duties are granted that access, in accordance with the "least privilege" principle.
• Continuous security monitoring — an automated 24-hour monitoring system that detects and alerts our security team to any suspicious activity or unauthorised access attempts.
• Firewall and attack protection — our servers are protected by multi-layered firewalls and DDoS mitigation systems to defend against cyber attacks.
• Regular security audits — cucu100 conducts regular security assessments, including penetration testing, to identify and address any vulnerabilities before they can be exploited.
• Staff training — all cucu100 staff who handle personal data undergo regular data protection training and security awareness programs.

While cucu100 takes all reasonable steps to protect your data, no data transmission over the internet can be guaranteed to be 100% secure. You also play an important role by keeping your password and account login details confidential.

Cucu100 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to meet our legal obligations. The following is a general guide to retention periods by data category:

• Active account data — retained for the duration your account remains active and for 5 years after account closure, in accordance with Malaysian financial regulatory requirements.
• Financial transaction records — retained for a minimum of 5 years from the transaction date, in accordance with applicable Malaysian financial and regulatory requirements.
• Gaming Activity History — retained for 5 years from the date the activity occurred. This data may be required for dispute resolution, audits, or responsible gaming purposes.
• Customer support communication logs — retained for 2 years to facilitate reference in the event of recurring issues or future disputes.
• Session cookie data — session cookies are deleted when you close your web browser. Preference cookies that require your consent are stored for the duration stated at the time you gave consent.

Once the retention period expires, your personal data will be securely deleted or anonymised so that it can no longer be linked to you. The deletion process uses methods that ensure the data cannot be recovered.

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by cucu100:

• Right of Access — you have the right to request a copy of the personal data we hold about you. This request will be processed within 21 business days and may be subject to a nominal fee as stipulated under the PDPA.
• Right to Rectification — if you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. We will respond within 21 days.
• Right to Withdraw Consent — you may withdraw consent previously given for specific purposes (such as marketing communications) at any time, without affecting our core services to you.
• Right to Data Erasure — under certain circumstances, you may request the deletion of your personal data. This right is subject to our legal obligations to retain certain records — we will clearly inform you if a request cannot be fully fulfilled.
• Right to Restrict Processing — in certain circumstances defined by law, you may request that we limit how we process your data while a raised issue is being resolved.
• Right to Object — you have the right to object to the processing of your data for specific purposes, including direct marketing communications.

Platform cucu100 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions smoothly. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies — required for core platform functions, including login session management and security. These cookies cannot be disabled without affecting the platform's basic functionality.
• Performance Cookies — collecting information on how you use the platform (pages visited frequently, load times, etc.) to help us improve the user experience. This data is collected in aggregate and anonymised form.
• Preference Cookies — saves your preferences such as interface language and display settings so you don't have to reconfigure them every time you log in.
• Analytics Cookies — used to understand overall platform usage patterns. cucu100 uses this analytics data internally — we do not use third-party analytics platforms that share your data with other parties.

You can manage your cookie settings through your web browser preferences. Disabling certain cookies may affect the functionality of the cucu100 platform. Session cookies are automatically deleted when you close your browser session.

In the course of operating the platform, some of your personal data may be processed or stored outside Malaysia, primarily through cloud infrastructure service providers with data centres in various locations. When this occurs, cucu100 takes the following steps to ensure your data remains protected:

• Cucu100 only works with service providers that meet or exceed the data protection standards required under Malaysia's PDPA.
• Legally binding data transfer agreements are established with all parties that receive cucu100 members' personal data, ensuring continuous protection regardless of geographic location.
• Cucu100 does not transfer personal data to countries without adequate data protection without first putting appropriate safeguards in place.

Platform cucu100 is intended for individuals aged 18 and above only. We do not knowingly collect, process, or store personal data of individuals under the age of 18.

If cucu100 discovers that personal data belonging to a minor has been collected without our knowledge, we will take immediate steps to delete that data and close the associated account. Parents or guardians who become aware that a child under their care has registered an account with cucu100 should contact us immediately at support@cucu100.best so that appropriate action can be taken.

Cucu100 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, the technologies we use, legal requirements, or other operational reasons. When changes are made:

• The latest version of this Privacy Policy is always available on this page with an up-to-date revision date.
• For material changes — that is, changes that significantly affect how we handle your personal data — we will notify you via an in-platform notification or email at least 14 days before the changes take effect.
• Continued use of the cucu100 platform after notification of changes constitutes acceptance of the updated Privacy Policy.
• If you disagree with any changes made, you may close your account before the changes take effect.

We encourage you to review this page periodically to stay up to date with cucu100's privacy practices.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact our privacy team cucu100 via:

• Email — support@cucu100.best with the subject line "Privacy Enquiry" or "Privacy Rights Request". For formal privacy complaints or requests, email is the recommended channel as it creates a written record.
• Live Chat — available 24 hours a day through the cucu100 platform for general privacy enquiries. Response times are typically under 10 minutes.

All privacy-related enquiries or complaints will be acknowledged within 3 business days and resolved within 21 business days, in line with Malaysia's PDPA requirements. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.