Privacy Policy 21hut — Security
Your Personal Data Is Our Priority

21hut collects several categories of information from members and platform visitors. Each data category is collected for a specific and legitimate purpose. Below is a comprehensive overview of the types of data we collect:

Data may also be collected automatically when you use our platform, including through cookies, tracking pixels, and related technologies that help us understand how you interact with our website and app.

Every piece of information we collect has a clear and legitimate purpose. 21hut does not use your data for any purpose other than those stated here:

• Account Management: Creating and maintaining your member account, processing registration, and enabling secure login.
• Transaction Processing: Handling deposits, withdrawals, and all financial transactions accurately and securely.
• Identity Verification (KYC): Verifying your identity to comply with legal requirements and to prevent money laundering and fraud.
• Customer Support: Responding to inquiries, resolving disputes, and providing effective technical support.
• Important Communications: Sending account-related notifications, security updates, policy changes, and relevant promotional information (with your consent).
• Platform Security: Detecting and preventing fraudulent activity, money laundering, multiple account usage, and other security threats.
• Responsible Gaming: Monitoring usage patterns to identify members who may need assistance and support in managing their betting habits.
• Continuous Improvement: Analysing usage data in aggregate (without identifying individuals) to improve our products, interface, and user experience.

21hut does not sell, rent, or share your personal data with third parties for marketing purposes. However, there are limited situations where data sharing is necessary to operate the platform:

• Payment Service Providers: Required transaction information is shared with approved payment processors (such as FPX, DuitNow, and e-wallets) solely to process your transactions. All such providers are bound by strict confidentiality agreements.
• Game Software Providers: Minimum game session data required to run games is shared with licensed game software providers.
• Identity Verification Services: During the KYC process, your identity information may be shared with licensed third-party verification services integrated with our system.
• Legal Authorities: 21hut will disclose data when required by Malaysian law or a valid court order, or when we believe such disclosure is necessary to prevent financial crime.
• Business Transfers: In the event of a merger, acquisition, or asset sale, member data may be transferred to the new entity, which will be bound by this Privacy Policy.

In all data sharing cases, we ensure that only the minimum necessary information is shared, and that receiving parties are bound by confidentiality obligations equivalent to our own standards.

21hut uses cookies and related technologies to enhance your experience and ensure account security. Cookies are small text files stored on your device when you access our platform.

We use several types of cookies for different purposes:

• Essential Cookies: Required for core platform functions such as login, session security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting anonymous information about how you use the platform to help us improve website performance.
• Functional Cookies: Remembering your preferences such as language, currency, and display settings to provide a more personalised experience.
• Analytics Cookies: Helping us understand platform traffic and usage patterns in aggregate for continuous improvement purposes.

Protecting your data from unauthorised access, loss, or misuse is our highest priority. 21hut continuously invests in robust security infrastructure to ensure your data remains protected at all times.

The technical and organisational security measures we implement include:

• 256-bit SSL/TLS Encryption for all data communications between your device and our servers.
• Encryption at Rest for all sensitive data stored in our databases.
• Two-Factor Authentication (2FA) available for all member accounts as an additional security layer.
• 24/7 Security Monitoring by automated systems capable of detecting and responding to threats in real time.
• Strict Access Controls ensuring only authorised personnel can access member data, and only when required for a specific task.
• Regular Security Audits by independent parties to identify and address any system vulnerabilities.

While we take all reasonable precautions, no system can be guaranteed 100% secure. Should a data security incident occur that affects your information, we will notify you within the timeframe required by applicable law.

21hut retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Account Data: Retained for the duration your account is active and for an additional period after account closure for audit purposes.
• Financial Transaction Records: Retained for a minimum of 7 years after a transaction occurs to comply with Malaysia's financial and tax regulations.
• KYC Documents: Retained for a minimum of 5 years after account closure to comply with anti-money laundering legal requirements.
• Security Logs: Retained for 12 months for security incident investigation purposes.
• Support Communication Data: Retained for 2 years for reference and service improvement purposes.

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to your identity.

As a 21hut member, you have the following rights regarding your personal data. We are committed to respecting and facilitating the exercise of these rights:

In operating a platform that encompasses international services, your data may be processed on servers located outside Malaysia. This occurs primarily when using licensed game software providers or cloud infrastructure integrated with our platform.

In all cases of cross-border data transfers, 21hut ensures that:

• Transfers only occur to countries or entities that provide an equivalent or higher level of data protection.
• Data transfer agreements compliant with international standards are signed with all data recipients outside Malaysia.
• Encryption is applied throughout the data transfer process regardless of the destination.

The 21hut platform is strictly for individuals aged 18 years and above. We do not intentionally collect any personal data from individuals under the age of 18.

If we discover that we have collected personal data from a child without valid parental consent verification, we will take immediate steps to delete that information and close the account in question. If you believe a child has registered an account on our platform, please contact us immediately at [email protected] so we can take the appropriate action.

21hut reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements in how we handle data.

When material changes are made to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page.
• Sending notifications via your registered email for significant changes.
• Displaying a clear notice on the platform's home page at least 7 days before changes take effect.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, our team is ready to help. There are several ways to reach us:

• Privacy Email: [email protected] — dedicated to data protection enquiries.
• General Support: [email protected] — for general account-related enquiries.
• Live Chat: Available 24/7 via the in-platform chat icon for immediate responses.
• FAQ: Visit our FAQ page for answers to frequently asked privacy questions.

We are committed to responding to all privacy-related inquiries within 24 hours business days, and to resolve more complex requests within 30 calendar days.