Privacy Policy

This Privacy Policy (hereinafter "this Policy" or "the Privacy Policy") is issued by cuci8, the operator of the online gaming platform accessible at cuci8.cam (the "Platform"). This Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by cuci8.

cuci8 is committed to handling your personal data with integrity, transparency, and care. We process personal data in accordance with applicable international data protection standards, including principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

This Policy applies to all individuals who access or use the cuci8 Platform — whether as registered account holders, visitors to the website, or any other person whose data we process in connection with our services. It applies to all personal data collected via the Platform, our customer support channels, and any electronic communications between you and cuci8.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which also form part of your agreement with cuci8. In the event of any conflict between this Policy and the Terms & Conditions on the subject of data processing, this Policy shall prevail.

In this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, cuci8 is the Data Controller in respect of all Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of the Data Controller, under documented instructions and contractual obligations.
• "Data Subject" — the natural person whose Personal Data is being processed; in this context, you as a user of the cuci8 Platform.
• "Consent" — freely given, specific, informed, and unambiguous indication of agreement by a Data Subject to the processing of their Personal Data.
• "Cookies" — small text files placed on your device by the Platform for the purposes of recognising your browser, storing session information, and enabling certain Platform functionality.
• "KYC" — Know Your Customer verification procedures, including identity and address verification, required for regulatory compliance and anti-money laundering purposes.

cuci8 collects only the personal data that is necessary for the purposes described in this Policy. The categories of data we collect are set out in the table below:

cuci8 collects personal data through a variety of means, which are set out below:

4.1 Directly From You

The majority of the personal data we hold about you is provided directly by you in the course of your use of the Platform:

• During account registration, when you provide your name, date of birth, email address, phone number, and residential address.
• During KYC verification, when you submit identity documents and proof of address.
• When you make a deposit or withdrawal and provide payment method information.
• When you contact our customer support team via live chat or email.
• When you participate in promotions, surveys, or other voluntary interactions on the Platform.
• When you update your account settings or communication preferences.

4.2 Automatically Through Platform Use

When you use the Platform, certain technical and usage data is collected automatically:

• Your IP address and approximate geolocation (country and city level).
• Device and browser information, including operating system and screen resolution.
• Session data, including login timestamps, page views, and feature interactions.
• Gaming activity data, including games played, wagers placed, and outcomes.
• Cookie and tracking technology data, as further described in Section 10.

4.3 From Third Parties

In certain circumstances, cuci8 may receive personal data about you from third parties, including:

• Payment processors and e-wallet providers (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, and CIMB), who may share transaction confirmation data and fraud risk indicators.
• Identity verification service providers used to assist in KYC compliance processes.
• Fraud prevention databases and shared industry risk registers operated under applicable regulatory frameworks.
• Advertising and analytics partners, to the extent permitted by applicable law and your marketing preferences.

cuci8 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes for which we process your data are:

Account Management

To create, maintain, and administer your cuci8 account, including verifying your identity at registration and upon request, managing your account preferences, and ensuring only you have access to your account.

Payment Processing

To process deposits and withdrawal requests via Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and USDT TRC20. We retain payment transaction records as required by financial regulatory obligations.

Regulatory Compliance & KYC

To fulfil our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) regulatory requirements. This includes verifying the source of funds for certain account activities and maintaining records as required by our operating licence.

Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, money laundering, collusion, account takeover, and other prohibited activities as defined in our Terms & Conditions. Technical data is used to identify unusual patterns of access or usage that may indicate security incidents.

Responsible Gambling

To monitor gaming behaviour patterns for indicators of problem gambling, to enforce self-exclusion and deposit limit requests, and to identify accounts that may require responsible gambling interventions. This processing is conducted in the genuine interest of player welfare.

Customer Support

To respond to your enquiries, resolve complaints, process account requests, and maintain records of support interactions for quality assurance and dispute resolution purposes.

Marketing Communications

Where you have provided explicit consent to receive marketing communications, we may use your Contact Data and Marketing Data to send you information about promotions, bonuses, new games, and other offers on cuci8. You may withdraw your marketing consent at any time by contacting our support team.

Platform Improvement & Analytics

To analyse usage patterns, identify technical issues, optimise Platform performance, and develop new features and services. Analytical processing is conducted on aggregated or pseudonymised data where possible.

cuci8 processes your personal data on the following legal bases, depending on the purpose of processing:

• Contractual Necessity: Processing that is necessary for the performance of the contract between you and cuci8 — including account management, payment processing, and customer support.
• Legal Obligation: Processing that is required to comply with applicable laws and regulatory requirements, including KYC, AML, CTF, and financial record-keeping obligations.
• Legitimate Interests: Processing that serves the legitimate interests of cuci8 or a third party, where those interests are not overridden by your fundamental rights — including fraud prevention, platform security, and responsible gambling monitoring.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily applicable to marketing communications. You have the right to withdraw consent at any time, and withdrawal will not affect the lawfulness of processing conducted prior to withdrawal.

cuci8 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. We share your data only where necessary for the purposes described in this Policy, and only with parties who are subject to appropriate contractual obligations regarding data protection.

We may share your personal data with the following categories of recipients:

• Payment Service Providers: Malaysian payment processors, e-wallet operators (Touch 'n Go, Boost, GrabPay), and banking partners (Maybank, CIMB, Public Bank, Hong Leong, RHB) necessary to process your transactions. These parties act as Data Processors under documented data processing agreements.
• Identity Verification Providers: Third-party KYC and identity verification service providers engaged to assist in confirming the identity and eligibility of account holders.
• Fraud Prevention Services: Industry-shared fraud prevention databases and risk assessment providers used to protect the Platform and its users from financial crime.
• Technology and Infrastructure Providers: Cloud computing, data hosting, cybersecurity, and software infrastructure providers who process data on our behalf under strict data processing agreements.
• Customer Communications Platforms: Live chat and email support infrastructure providers who facilitate our customer service operations.
• Regulatory Authorities and Law Enforcement: Where we are required by applicable law, court order, regulatory direction, or lawful request from a competent authority to disclose personal data. cuci8 will notify you of any such disclosure to the extent permitted by law.
• Professional Advisers: Legal advisers, auditors, and compliance consultants, subject to confidentiality obligations, where necessary for the operation of our business.

cuci8 operates under an international gaming licence, and some of our technical infrastructure, data processors, and service providers may be located outside Malaysia. Accordingly, your personal data may be transferred to and processed in countries other than your country of residence.

Where we transfer your personal data internationally, we take reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with applicable data protection principles. These safeguards may include:

• Contractual clauses between cuci8 and the receiving party that impose data protection obligations equivalent to those applicable under our operating jurisdiction.
• Transfers to countries or jurisdictions that are recognised as providing an adequate level of data protection.
• Technical and organisational security measures applied to data in transit and at rest.

If you would like further information about the safeguards applicable to any specific international transfer of your data, please contact us using the details in Section 16.

cuci8 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Account Data: Retained for the duration of your active account relationship with cuci8, and for a minimum period of five (5) years following account closure, in accordance with anti-money laundering regulatory retention requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable regulatory obligations.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Records: Live chat transcripts and email correspondence are retained for up to three (3) years from the date of the interaction.
• Technical and Usage Data: Retained for up to twenty-four (24) months from collection, unless a longer retention period is required for security or legal reasons.
• Marketing Data: Retained until you withdraw your consent to marketing communications or until the data is no longer relevant for the purposes for which it was collected.

Where retention is no longer necessary or legally required, personal data is securely deleted or anonymised in a manner that prevents re-identification.

cuci8 uses cookies and similar tracking technologies on the Platform for purposes including session management, security, analytics, and — where you have consented — personalisation and targeted communications.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function correctly. These enable you to log in securely, navigate between pages, and use core Platform features. These cookies cannot be disabled without affecting Platform functionality.
• Security Cookies: Used to detect and prevent fraudulent activity, including session hijacking and account takeover attempts. These are essential to the security of the Platform.
• Analytics Cookies: Used to collect aggregated and anonymised data about how visitors use the Platform — including pages visited, session duration, and navigation paths. This data is used to improve Platform performance and user experience.
• Preference Cookies: Used to remember your Platform settings and preferences, such as display language and communication preferences, to improve your experience on return visits.
• Marketing Cookies: Used — where you have provided consent — to track your interaction with promotional materials and to serve relevant communications. You may opt out of marketing cookies at any time by adjusting your preferences or contacting our support team.

10.2 Managing Cookies

You may control or delete cookies through your browser settings at any time. Please be aware that disabling certain cookies — particularly strictly necessary and security cookies — may impair the functionality of the Platform or prevent you from accessing certain features. Most browsers allow you to refuse new cookies, delete existing cookies, and configure cookie-related settings. Consult your browser's help documentation for specific instructions.

Subject to applicable law and certain conditions and exceptions, you have the following rights with respect to your personal data held by cuci8:

To exercise any of the above rights, please contact us using the details set out in Section 16. We will respond to all legitimate requests within a reasonable timeframe and in accordance with applicable legal requirements. We may ask you to verify your identity before processing your request to ensure the security of your data.

The cuci8 Platform is intended solely for individuals aged 21 years and above. cuci8 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If we become aware that personal data has been submitted by or on behalf of a person under the age of 21, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to cuci8 without your consent, please contact us immediately at the details provided in Section 16. We will investigate and take appropriate action promptly.

Age verification is a core component of our KYC process. We require submission of a valid government-issued identification document confirming date of birth before processing any withdrawal or completing the KYC review of any account.

cuci8 implements a comprehensive range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security framework includes, but is not limited to:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and the cuci8 Platform is encrypted using industry-standard Transport Layer Security (TLS) protocol.
• Encrypted Data Storage: Sensitive personal data, including identity documents and payment information, is stored in encrypted form using strong cryptographic algorithms.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All personnel with access to personal data are subject to confidentiality obligations and receive appropriate data protection training.
• Multi-Factor Authentication: Administrative systems and high-privilege data access points are protected by multi-factor authentication requirements.
• Intrusion Detection & Monitoring: Our infrastructure is subject to continuous security monitoring, including automated intrusion detection systems and regular security audits.
• Secure Payment Infrastructure: Payment processing integrations with Malaysian providers including Touch 'n Go eWallet, DuitNow, FPX, and major banks are conducted through PCI-DSS compliant payment gateways.

Notwithstanding the above, no data transmission over the internet or electronic storage system can be guaranteed as absolutely secure. While we employ all reasonable and commercially practicable security measures, cuci8 cannot warrant the absolute security of any data transmitted to or from the Platform. You are responsible for maintaining the security of your account credentials and for notifying us immediately if you suspect any unauthorised access.

The cuci8 Platform may contain references to or integrations with third-party services, including payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect. The privacy practices of these third-party services are governed by their own privacy policies and are outside the scope of this Policy.

cuci8 is not responsible for the privacy practices, data handling, or content of third-party services. We encourage you to review the privacy policies of any third-party service provider through which you transact or interact when using the Platform. Your use of third-party payment services is subject to the terms and privacy policies of those respective providers.

cuci8 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or operational circumstances. When we make material changes to this Policy, we will update the "Last Updated" date displayed at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Where a material change significantly affects how we process your personal data, we may notify registered account holders directly via email or platform notification, to the extent practicable.

Your continued use of the cuci8 Platform following the publication of any updated Privacy Policy constitutes your acknowledgment of the revised terms. If you do not agree with any changes, you should cease using the Platform and contact us to close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by cuci8, please contact us through the following channels. We will respond to all legitimate data subject requests within a reasonable timeframe.

When submitting a data rights request, please clearly state the nature of your request (e.g., access, rectification, erasure, portability), your registered account username, and provide sufficient information to verify your identity. This ensures we are able to action your request securely and accurately.