Vclub Privacy Policy — Malaysia User Data Protection

Vclub collects your personal information through several channels when you register, log in, make a deposit or withdrawal, contact customer support, or use any feature of our platform. The following are the categories of information we collect:

Registration Information:

• Full name as stated in your official identification document.
• Date of birth for age verification (18 years and above).
• Active email address for communication and account verification.
• Mobile number for two-factor authentication (2FA) and notifications.
• Passwords stored in an irreversible hashed format.

KYC (Know Your Customer) Information:

• A copy of your MyKad, passport, or other valid identity document.
• Current residential address.
• Proof of address such as a utility bill or bank statement (no older than 3 months).
• A selfie with your identity document for additional identity verification.

Financial Information:

• Bank account or e-wallet details (DuitNow, Touch 'n Go eWallet, Boost, GrabPay, FPX).
• Deposit and withdrawal transaction history within the platform.
• Betting and game activity records for internal audit purposes.

Technical Information (collected automatically):

• IP address, device type, operating system, and browser type.
• Access log data including login times, pages visited, and session duration.
• Cookie information and similar technologies as described in Section 7.
• General geolocation data (state/city) for geographic eligibility verification.

The personal information we collect is used solely for legitimate purposes necessary to operate the vclub platform. We do not use your data for purposes unrelated to the services you use.

Vclub does not use your personal data for automated decision-making that has a serious impact on you without human review. Any critical decisions such as account closure or withdrawal rejection involve review by our team.

Under Malaysia's PDPA and globally recognised data protection principles, vclub processes your personal data on the following legal bases:

• Consent: You provide explicit consent when registering an account and may withdraw consent for specific purposes such as marketing communications at any time.
• Contract Performance: Processing is necessary to fulfil the contractual obligations between you and vclub, including transaction processing and account management.
• Legal Obligations: Some data is processed to fulfil legal obligations including KYC/AML requirements under Malaysian law.
• Legitimate Interest: vclub processes certain data based on legitimate business interests such as fraud prevention and platform security, provided these do not override your fundamental rights.

Vclub does not sell, rent, or disclose your personal data to third parties for marketing purposes. However, there are specific situations where data sharing with selected parties is necessary to operate the platform:

• Payment Service Providers: Payment gateways such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay processors receive the transaction information required to process your deposits and withdrawals. All these providers comply with PCI DSS standards.
• KYC Service Providers: A third-party identity verification platform that helps us verify your documents and personal information during the KYC process.
• Game Service Providers: Game software providers may receive the minimum information required to operate live casino or slot games, subject to strict confidentiality agreements.
• Regulatory Authority: vclub will disclose information to government authorities or law enforcement when lawfully required to do so under Malaysian law.
• Analytics Services: Anonymous and aggregated usage data may be shared with analytics tools for platform improvement. This data does not contain information that can directly identify individuals.

Vclub implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All communications between your device and vclub's servers are protected by industry-standard encryption protocols.
• Data-at-Rest Encryption: Sensitive data stored in our databases, including KYC and financial information, is encrypted using AES-256 encryption.
• Two-Factor Authentication (2FA): vclub provides 2FA for all user accounts, adding an extra layer of protection to your account login.
• Internal Access Controls: Access to user data within vclub is restricted according to the principle of least privilege. Only staff who genuinely require access to specific data to perform their duties are permitted to do so.
• Regular Security Audits: Our platform undergoes regular penetration testing and security audits by independent third parties to identify and address any vulnerabilities.
• 24/7 Monitoring: An active monitoring system ensures any suspicious activity or intrusion attempts are detected and addressed promptly.

Vclub retains your personal data for as long as necessary to fulfil the purpose for which it was collected and to comply with relevant legal obligations. The following are our data retention guidelines:

• Active Account Data: For the duration of your active account plus any additional period required by law.
• Financial Transaction Records: Minimum 7 years after a transaction occurs, in line with Malaysia's tax and AML legal requirements.
• KYC Documents: For the lifetime of your account plus 5 years after account closure, in line with anti-money laundering legal requirements.
• Support Communication Logs: 3 years from the date of last interaction.
• Technical Data (Access Logs): 90 days for standard technical logs; longer if related to an ongoing security investigation.
• Marketing Data (with consent): Until you withdraw your consent to receive marketing communications.

Upon expiry of the retention period, your data will be securely deleted or anonymised so that it can no longer be linked back to your identity.

Vclub uses cookies and similar technologies to enhance the user experience, maintain session security, and understand how our platform is used. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session verification, security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information on how pages are used to help us improve platform performance and speed. Data is collected anonymously.
• Functional Cookies: Stores your preferences such as language selection and display settings for a more personalised experience.
• Analytics Cookies: Helps us understand overall platform usage patterns for continuous improvement. Data is collected in aggregated and anonymised form.

You can manage cookie settings through your browser settings. However, disabling essential cookies may affect your ability to fully use certain features of the vclub platform.

Under Malaysia's PDPA and the data protection principles we adhere to, you have the following rights regarding your personal data that we hold. All requests will be processed within 14 business days:

As vclub uses international-grade infrastructure and service providers, some of your personal data may be processed or stored on servers located outside Malaysia. In all such cases, vclub ensures that:

• Data transfers only occur to countries or entities that provide a level of data protection equivalent to or higher than Malaysia.
• Contractually binding data transfer agreements are established with all international data recipients.
• Additional protection measures such as data encryption are applied during cross-border transfers.
• Data transfers comply with Malaysia's PDPA requirements and applicable laws.

If you have any questions, concerns, or wish to exercise any of your personal data rights as described in this privacy policy, please contact vclub's Data Protection Officer (DPO) through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 via the chat icon within the vclub platform.

All privacy-related requests will be acknowledged within 2 business days and resolved within 14 business days. If your issue cannot be resolved to your satisfaction, you have the right to file a complaint with Malaysia's Department of Personal Data Protection.

Vclub reserves the right to update this privacy policy from time to time to reflect changes in operational practices or legal requirements. Users will be notified of any material changes via email or in-platform notification at least 14 days before the changes take effect.