Privacy Policy Cuci — How We Protect Your Personal Data

Cuci ("we", "Platform") takes the privacy and security of every member's personal data seriously. This Privacy Policy explains in detail how we collect, use, store, and protect your personal information when you register and use the services offered through the Cuci platform, including the website, mobile app, and all other related digital channels.

The cuci platform operates in accordance with internationally recognised data protection standards. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and the data protection requirements set by relevant regulatory bodies.

If you have any questions about how we handle your data that are not addressed in this document, our support team is available via 24-hour live chat or through the support email listed at the end of this document.

Cuci collects your personal data from several different sources. Below is an overview of the data we collect and how it is obtained:

Cuci uses your personal data solely for legitimate, disclosed purposes. We do not use your data for any other purpose without obtaining fresh consent from you. The primary purposes for data use are as follows:

• Account Management: Create, verify, and manage your account, including the KYC process required to comply with anti-money laundering (AML) requirements.
• Transaction Processing: Process deposits, withdrawals, and all financial transactions in your account securely and accurately.
• Platform Security: Detect and prevent fraud, account breaches, multiple account usage, and activities that violate the terms of service.
• Service Improvement: Analyse usage patterns to improve platform design, speed, and overall user experience.
• Service Communications: Send important account-related notifications such as transaction confirmations, security updates, and policy changes.
• Legal Compliance: Meet reporting and record-keeping requirements mandated by applicable laws and regulatory bodies.
• Marketing Communications (with consent): Send promotional information, bonuses, and special offers — only if you have given your consent, which can be withdrawn at any time.

Cuci does not sell your personal data. We share data only in limited, necessary situations:

• Payment Provider: Required financial information is shared with payment service providers (DuitNow, FPX, TNG eWallet, Boost, GrabPay) solely for the purpose of processing your transactions.
• Game Provider: Minimum technical data is shared with third-party game providers to enable access to games available on the platform.
• KYC Service Provider: Identity verification documents are shared with appointed KYC service providers to verify the authenticity of your documents.
• Authority: Cuci will disclose data to law enforcement or regulatory bodies when required by law or a valid court order.

All cuci third-party partners are required to comply with privacy and data security policies that meet or exceed our own standards. They are only permitted to use your data for specific and limited purposes.

Cuci continually invests in security infrastructure to ensure your personal data is protected to the highest standard. The key security measures we implement are as follows:

• Data in Transit Encryption: All communications between your device and cuci servers are secured by TLS 1.3 protocol with 128-bit encryption.
• Stored Data Encryption: Sensitive data such as IC numbers and banking information is stored in encrypted form in our database.
• Integrated Access Control: Access to member personal data within Cuci's internal systems is restricted to staff who require it to perform their duties, based on the principle of least privilege.
• Regular Security Audits: Cuci conducts penetration testing and independent security audits at least twice a year.
• 24/7 Monitoring: An automated monitoring system operates around the clock to detect any suspicious activity or unauthorised access attempts.

Cuci does not retain your personal data for longer than necessary. Below are our general data retention guidelines:

• Active Account Data: Retained for as long as your account is active and for the period required to meet legal obligations following account closure (typically 7 years based on financial record-keeping requirements).
• Transaction Records: Retained for a minimum of 7 years after each transaction in accordance with anti-money laundering and tax law requirements.
• KYC Documents: Retained for the duration of the active account period plus 5 years after account closure.
• Technical Logs: Retained for 90 days and then automatically deleted unless required for an ongoing investigation.
• Support Communications: Conversation records with the support team are retained for 2 years.

Once the retention period expires, data is securely deleted using non-recoverable deletion methods, or anonymised if the data is still needed for internal statistical purposes.

As a cuci member, you have the following rights regarding your personal data, which can be exercised at any time by contacting our support team:

Cuci will process data rights requests within 14 working days. In complex cases, this period may be extended to up to 30 working days with prior notice.

Cuci uses cookies and similar tracking technologies to enhance your experience on the platform. Below are the types of cookies we use:

• Essential Cookies: Required for basic platform operations such as maintaining your login session. These cookies cannot be disabled.
• Performance Cookies: Collect information about how you use the platform to help us improve performance and the interface.
• Functional Cookies: Remember your preferences such as language and display settings to provide a more personalised experience.
• Security Cookies: Helps detect and prevent fraudulent activity by recognising your account's normal usage patterns.

You can manage cookie settings through your browser preferences. Please note that disabling essential cookies may affect platform functionality. Cuci does not use third-party cookies for targeted advertising.

Cuci services are strictly for individuals aged 18 and above. cuci does not intentionally collect or process personal data of anyone under the age of 18.

If you as a parent or guardian become aware that your child has provided personal data to cuci, please contact us immediately. We will take prompt action to delete the relevant data and close the account.

Cuci reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. Each time an amendment is made:

• The "Updated" date at the top of the document will be revised.
• For material amendments, we will send a notification via email or in-app notification.
• The document version will be incremented and all previous versions are available upon request from our support team.

Continued use of the cuci platform after any amendments take effect constitutes your acceptance of the updated terms. If you do not agree, please discontinue use and contact us to close your account.

If you have any questions, concerns, or wish to exercise your data rights, please contact the cuci Data Privacy team through the following channels: