Privacy Policy pad2 – Our Commitment to Protecting Your Personal Data

Pad2 is an online entertainment platform built exclusively to serve Malaysian players. We understand that our members' trust is our most valuable asset, and that trust begins with how we handle your personal information. This pad2 Privacy Policy is designed to provide full transparency about our data practices, so you can make informed decisions about the information you share with us.

As a platform operating in Malaysia, pad2 is bound by the Personal Data Protection Act 2010 (PDPA) and all applicable related legislation. We take this responsibility seriously and have implemented a range of technical and organisational measures to ensure our members' personal data is always handled in a responsible, secure, and legally compliant manner.

Pad2 acts as the data controller for all personal information collected from members through the pad2 platform. This means pad2 determines the purposes and means of processing your personal data. If you have any questions about how we handle your data, pad2's privacy team is always on hand to assist you through the communication channels listed in Section 12 of this document.

Pad2 collects members' personal information across several key categories. We only gather data that is genuinely necessary to provide you with a safe, seamless and responsible pad2 platform experience.

Information You Provide Directly

• Registration Information: Full name, date of birth, email address, mobile number, username, and password chosen when registering a pad2 account.
• Identity Verification (KYC) Information: A copy of your MyKad or passport, a verification selfie, bank statement, or other supporting documents requested during the identity verification process.
• Financial Information: Details of payment methods used for deposits and withdrawals — including e-wallet account numbers (Touch 'n Go, GrabPay, Boost, ShopeePay), DuitNow information, and bank details for FPX (Maybank2u, CIMB Clicks, and others). pad2 does not directly store credit or debit card numbers.
• Communications: The content of messages, complaints or enquiries you submit to pad2's support team via live chat, email or other channels.

Automatically Collected Information

• Usage Data: Login records, game history, wagering amounts, wins and losses, bonus activity, and financial transactions on the pad2 platform.
• Device & Technical Data: IP address, web browser type, operating system, device model, screen resolution, and other technical data related to your access to the pad2 platform.
• Location Data: General location information based on IP address for the purposes of geographic eligibility verification and fraud prevention.
• Cookies & Tracking Data: Information collected through cookies, web beacons, and similar tracking technologies, as described in further detail in Section 6.

Pad2 uses our members' personal data for legitimate and specific purposes only. Every use of data is grounded in a lawful basis under Malaysia's PDPA — whether based on your consent, contractual necessity, legal obligation or pad2's legitimate interests, provided these do not override your fundamental rights.

The primary purposes for which pad2 uses your personal data are as follows:

• Service Provision: Managing your pad2 account, processing deposits and withdrawals, providing access to games, and ensuring all platform functions operate correctly.
• Identity Verification & KYC: Ensuring you meet the minimum age requirement (18 and above), verifying your identity and fulfilling Know Your Customer (KYC) legal obligations as required by the relevant authorities.
• Security & Fraud Prevention: Detecting, investigating and preventing fraudulent activity, money laundering, collusion or any misuse of the pad2 platform that could harm other members' interests or the overall integrity of the platform.
• Customer Support: Responding to enquiries, resolving complaints and providing technical support through pad2's support channels, which operate 24/7 in Bahasa Malaysia.
• Marketing & Promotions: Sending you information about pad2's latest promotions, bonuses, and offers — only if you have given consent to receive marketing communications. You may withdraw this consent at any time.
• Platform Improvements: To analyse usage patterns on an aggregate basis (without identifying individuals) in order to understand how members use pad2 and make informed decisions to continually improve the user experience.
• Legal Compliance: To fulfil reporting, audit, and compliance obligations required under Malaysian law or by directive of a lawful authority.

Pad2 will not use your personal data for any purpose other than those stated in this Privacy Policy without first obtaining your consent, unless required to do so by law.

Pad2 does not sell, rent or trade our members' personal data to any third party for their own marketing or commercial purposes. This is an unconditional commitment on pad2's part. However, in the course of operating the pad2 platform, there are limited situations where we may need to share your personal data with certain parties, as described below.

Trusted Third-Party Service Providers

Pad2 works with carefully vetted service providers to support the operation of our platform. These providers may process your personal data on pad2's behalf solely for the stated purposes and are not permitted to use your data for any other reason. The categories of service providers involved include:

• Payment processing providers that handle transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
• Identity verification (KYC) service providers who assist in verifying documents submitted by members.
• Server infrastructure and cloud service providers that store pad2 platform data in a secure, encrypted environment.
• Analytics software providers that help pad2 understand platform usage patterns on an aggregate, non-identifiable basis.
• Customer support service providers who help manage live chat and email communications on behalf of pad2.

Legally Required Disclosures

Pad2 may be required to disclose members' personal data to the following parties when mandated by law or a valid court order:

• Malaysian government authorities or relevant regulatory bodies when required by law.
• Law enforcement agencies in the course of legitimate criminal investigations.
• Parties to legal proceedings in which pad2 is involved, where such disclosure is required and permitted by law.

The personal data security of our members is pad2's highest technical and operational priority. We have implemented multiple comprehensive layers of protection to keep your data safe from unauthorised access, alteration, disclosure or destruction.

The technical security measures we employ at pad2 include:

• 256-bit SSL/TLS Encryption: All communications between your web browser or application and pad2's servers are encrypted using 256-bit SSL/TLS protocol, the highest protection standard in the industry.
• Encryption of Stored Data: Sensitive data — including financial information and identity verification documents — is stored in encrypted form on pad2 servers, ensuring it remains unreadable even in the event of a breach.
• Two-Factor Authentication (2FA): pad2 provides and actively encourages all members to use 2FA, adding an extra layer of protection to their accounts beyond just a password.
• 24/7 Monitoring: pad2's security monitoring system operates around the clock to detect and respond to any suspicious activity or intrusion attempts in real time.
• Strict Access Controls: Only authorised pad2 staff with a legitimate business need are permitted to access members' personal data, and every access is logged for audit purposes.
• Regular Security Testing: pad2 conducts regular penetration testing and security audits by independent third parties to identify and address any system vulnerabilities.

While pad2 has taken all reasonable steps to protect your data, no system can guarantee absolute security. We encourage all members to take precautions on their end — such as using a strong password, enabling 2FA, and never sharing your account details with anyone.

The pad2 platform uses cookies and similar tracking technologies to enhance the user experience, maintain secure login sessions and collect analytics that help us understand how our members use the pad2 platform.

Types of Cookies Used

• Essential Cookies: Required for the core functionality of the pad2 platform — including maintaining your logged-in session, remembering your language preference and keeping your session secure. These cookies cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies: Used to gather information on how members interact with the pad2 platform — such as the most frequently visited pages, most popular games, and time spent on the platform. This information is collected in aggregate form and does not personally identify any individual.
• Functional Cookies: Enables the pad2 platform to remember the preferences and settings you have configured — such as your preferred currency, your usual betting limits and game preferences — to deliver a more personalised and comfortable experience.
• Security Cookies: Used to detect suspicious activity, prevent unauthorised access and help identify illegitimate login attempts to your pad2 account.

You may manage or delete cookies through your web browser settings at any time. Please note, however, that disabling certain cookies may affect the functionality or performance of the pad2 platform, particularly those essential for login session authentication.

The pad2 platform is strictly for individuals aged 18 and above. pad2 does not knowingly collect or process any personal data from anyone under the age of 18. Should pad2 discover that personal data of a minor has been collected without valid parental or guardian consent, we will take immediate steps to delete that information and close the relevant account.

If you are a parent or guardian and believe that your minor child has registered an account with pad2 or has provided us with personal information, please contact the pad2 support team immediately via email at [email protected] or through live chat. We will treat such situations as a highest-priority matter and take prompt action to ensure the relevant information is securely deleted.

Pad2 employs age verification procedures during registration and may request more detailed proof of age at any time deemed necessary to ensure all members meet the minimum age requirement.

In the course of operating the pad2 platform, your personal data may be stored or processed on servers located outside Malaysia. This occurs in the context of using world-class cloud infrastructure providers, enabling pad2 to deliver fast, stable, and reliable services to all our members across Malaysia.

Where cross-border data transfers occur, pad2 ensures that:

• The destination country or territory maintains a level of data protection equivalent to or higher than that of Malaysia.
• Data processing agreements compliant with international data protection standards have been signed with all relevant providers.
• All transferred data remains encrypted and protected throughout the transfer process.
• Data transfers occur only for the purposes stated in this Privacy Policy and do not exceed the scope required.

Pad2 does not transfer personal data to jurisdictions that do not provide adequate data protection guarantees. The privacy and security of our members' personal data remains a primary consideration in every operational decision involving data handling.

As a pad2 member and data subject under Malaysia's PDPA, you have certain rights regarding the personal data that pad2 holds and processes. We fully respect and facilitate the exercise of these rights. Your rights include:

• Right to Access: You have the right to obtain a copy of the personal data pad2 holds about you and to be informed of how it is being used.
• Right to Rectification: If any personal data we hold about you is inaccurate or outdated, you have the right to request that we correct or update it.
• Right to Erasure: Under certain circumstances, you have the right to request that we delete your personal data — known as the "right to be forgotten" — subject to any legal obligations that may require us to retain certain records.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing carried out prior to the withdrawal.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes, and pad2 will cease such processing immediately upon receiving your objection.
• Right to Restrict: Under certain circumstances, you may request that we restrict the processing of your personal data while a related dispute or issue is being resolved.

To exercise any of the rights above, please contact pad2's privacy team by email at [email protected], stating the right you wish to exercise along with sufficient information for us to identify your account. pad2 will endeavour to respond to and action your request within 30 business days.

Pad2 retains members' personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by applicable laws and regulations in Malaysia. Different retention periods apply to different categories of data:

• Active Account Data: As long as your pad2 account remains active, we retain all data necessary to manage your account and provide services to you.
• Financial Transaction Data: Records of all deposits, withdrawals and wagers are retained for at least seven (7) years from the date of the transaction, in line with applicable financial reporting and anti-money laundering requirements.
• Identity Verification (KYC) Documents: Retained for the duration of the active account and for at least five (5) years after account closure, or longer if required by law.
• Support Communication Logs: Live chat and email conversation records are retained for two (2) years for reference and dispute resolution purposes.
• Security Log Data: Access logs and security activity records are retained for one (1) year for the purpose of investigating security incidents if required.

Once the relevant retention period expires, pad2 will delete or anonymise the personal data in question in a secure and irreversible manner, unless a legal or regulatory requirement prevents such deletion.

Pad2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements in how we handle members' personal information. Any amendments made will be reflected in a new "Last Updated" date at the top of this document.

For amendments considered material or significant, pad2 will notify members via in-platform notifications, the email address registered to their account or a prominent announcement on the pad2 homepage. It is each member's responsibility to review this Privacy Policy periodically and stay informed of any changes made.

Your continued use of the pad2 platform after any Privacy Policy amendment takes effect will be considered your acceptance of the revised policy. If you do not agree with the changes made, you have the right to close your pad2 account in accordance with the procedure set out in Terms & Conditions us.

If you have any questions, concerns, or requests regarding this pad2 Privacy Policy, how we handle your personal data, or wish to exercise any of your rights as a data subject, please do not hesitate to reach out to us. pad2's experienced privacy team is ready to assist you in a friendly and professional manner.

• Privacy Email: [email protected] — Please include "Privacy Enquiry" in your email subject line. We aim to respond to all privacy-related enquiries within 3 business days.
• Live Chat: Available 24 hours a day, 7 days a week through the pad2 platform — the fastest option for urgent enquiries.
• FAQs: Visit the page Frequently Asked Questions our pad2 for answers to the most frequently asked questions about privacy and data security.

Pad2 takes every privacy complaint and enquiry seriously. We are committed to resolving any privacy-related issues fairly, transparently, and within a reasonable timeframe. If you are not satisfied with pad2's response to your privacy complaint, you have the right to refer the matter to Malaysia's Personal Data Protection Department (PDPD) in accordance with the procedures set by that authority.