UDM19 Privacy Policy – Personal Data Protection for Malaysian Members

UDM19 is an online betting platform operating under the domain udm19.site, serving members across Malaysia. We understand that privacy is more than a line in a document — it is the foundation of trust that underpins our relationship with every member who has entrusted us with their personal information.

This Privacy Policy is written in Bahasa Malaysia and constitutes the official binding version for all UDM19 members in Malaysia. It clearly and transparently sets out the types of personal data we collect, why we need it, how we use it, who may access it, how long we retain it and what rights you have in relation to that data.

All data handling practices at UDM19 comply with Malaysia Personal Data Protection Act (PDPA) 2010 and the Personal Data Protection (Class of Data Personal Data Sensitive) Regulations 2013. We conduct regular internal compliance reviews and continuously update our practices in line with legislative amendments or new guidelines from the Department of Personal Data Protection Malaysia.

If you have any questions about the content of this policy or how we handle your data, our team is available 24/7 via in-account live chat or email at support@udm19.site.

UDM19 collects members' personal data through several sources and across different categories, depending on the nature of your interaction with our platform:

Data you provide directly:

• Full name as per MyKad or Malaysian passport
• An active Malaysian mobile phone number
• A valid email address
• Date of birth (for age verification)
• Bank account or digital wallet information used for deposits and withdrawals (Touch 'n Go eWallet, GrabPay, DuitNow, Maybank2u or CIMB Clicks account, ShopeePay, Boost)
• A copy of your identity document (MyKad or passport) when KYC verification is required
• Information you provide when contacting customer support

Data collected automatically when you use the platform:

• IP address and general location information (state and city within Malaysia)
• Device type, operating system and web browser used
• Login records, session times and in-platform activity
• Betting history, game types played, and transaction values
• Cookie data and other tracking technologies (as described in Section 7)

UDM19 collects and processes members' personal data solely for legitimate, clearly stated purposes. Below is a complete list of our data processing purposes along with the relevant legal bases:

We will not use your personal data for any purposes not stated above without first obtaining your consent. If you do not wish to receive marketing communications from UDM19, you may unsubscribe at any time via the unsubscribe link in our emails or by contacting our support team.

UDM19 does not sell, rent or trade members' personal data to any third party. However, in the course of operating the platform, there are limited situations where data may need to be shared with certain parties:

Authorised service providers: We work with a select group of third-party service providers who help operate the platform — including payment processors handling transactions via Touch 'n Go eWallet, GrabPay, DuitNow, and FPX, server and infrastructure service providers, and analytics tools that help us understand how the platform is used. All these providers are bound by strict data protection agreements and are only permitted to use shared data for the specified purposes.

Legal requirements and authorities: UDM19 may be required to disclose members' personal data to Malaysian authorities when compelled by law — for example, at the request of the police, courts or financial crime prevention agencies. We will notify the relevant member of such disclosure unless we are prohibited from doing so by a court order or applicable law.

Business transfer: In the event of a merger, acquisition, or sale of any part of UDM19's assets, members' personal data may form part of the transferred assets. Members will be notified in advance via email or an in-platform notification before any such transfer takes place, and you will have the option to withdraw your consent if you do not wish for your data to be transferred.

UDM19 implements comprehensive technical and organisational security measures to protect members' personal data from unauthorised access, unauthorised disclosure, alteration, damage, or loss:

• 256-bit SSL Encryption: All data transmitted between your device and UDM19's servers is encrypted using TLS 1.3 — the highest encryption standard commercially available today.
• Encryption of stored data: Sensitive data such as payment information and identity documents are stored in encrypted form in our database, not as plain text.
• Strict access controls: Only UDM19 staff who genuinely require access to specific data in order to perform their duties are permitted to do so — in line with the principle of least privilege.
• 24/7 Monitoring: Our security systems are continuously monitored to detect any unauthorised access attempts or suspicious activity.
• Regular security audits: UDM19 conducts regular penetration testing and third-party security audits to identify and remediate vulnerabilities before they can be exploited.
• Incident management: We have a clear incident response procedure in place. In the event of a data breach affecting members' personal data, we will notify the affected members within the timeframe stipulated by the PDPA and report to the Department of Personal Data Protection Malaysia where required.

While we take all reasonable steps to protect your data, it is important to remember that no security system is entirely foolproof. You also play a key role in keeping your data safe — by using a strong password, not sharing your login credentials with anyone and notifying us immediately if you suspect any unauthorised access to your UDM19 account.

UDM19 retains members' personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required under applicable Malaysian law. The following is a general guide to data retention periods by category:

• Active account data: Retained for as long as your account remains active on the UDM19 platform.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, in accordance with Malaysian financial and tax legislation.
• KYC and identity verification records: Retained for a minimum of 5 years after account closure, in accordance with anti-money laundering legal requirements.
• Service logs and technical data: Typically retained for between 12 and 24 months for security and technical troubleshooting purposes.
• Customer support correspondence: Retained for 2 years after the case is resolved for reference and quality assurance purposes.
• Marketing data (if you have given consent): Retained until you withdraw your consent or request deletion.

When personal data is no longer needed and there is no legal requirement to retain it, UDM19 will securely destroy or anonymise the data in accordance with established procedures. Once anonymised, the data can no longer be linked to any specific individual.

The UDM19 platform uses cookies and similar tracking technologies to enhance the user experience, maintain the security of login sessions, and understand how members interact with our platform.

Types of cookies we use:

• Essential cookies (mandatory): Required for core platform functions such as login authentication, session management and security. Without these cookies, the platform cannot operate properly. These cookies cannot be disabled.
• Performance cookies: Collects information on how platform pages are used — which pages are visited most frequently, page load times, and any error messages. All data is collected in aggregate form and does not personally identify you.
• Functional cookies: Allows the platform to remember your preferences — such as language, display settings and login details (if you select "Remember Me") — to provide a more personalised experience.
• Analytical cookies: Used to understand overall platform usage patterns, helping us make informed decisions about feature and content improvements.

You can manage your cookie preferences through your web browser settings at any time. However, disabling certain cookies may affect the functionality of the UDM19 platform. For guidance on managing cookies in your browser, please refer to the relevant browser's help documentation.

In accordance with the Malaysian Personal Data Protection Act 2010 (PDPA), every UDM19 member has the following rights regarding their personal data. These rights may be exercised by contacting us through the channels stated in Section 12:

To exercise any of the rights above, contact our privacy team by email at support@udm19.site with the subject line "Data Rights Request" and clearly state the right you wish to exercise, along with your full name and UDM19 account number for identity verification. We will respond within 21 business days of receiving your request.

In the course of operating the platform, there may be instances where UDM19 members' personal data needs to be transferred to or processed on servers located outside Malaysia — for example, for data backup purposes, cloud infrastructure or third-party technical support services that operate globally.

Where cross-border data transfers are required, UDM19 will ensure that:

• The destination country or territory maintains an adequate level of data protection recognised by the relevant Malaysian authorities.
• Appropriate data transfer agreements have been put in place with data recipients to ensure a standard of data protection equivalent to that required under Malaysia's PDPA.
• Transfers are carried out only for necessary purposes and via secure methods with encryption in transit.

UDM19 prioritises the use of service providers with data centres in the Asia-Pacific region to minimise cross-border data transfers while maintaining optimal platform performance for Malaysian users.

The UDM19 platform is strictly for individuals aged 18 years of age and above only. We do not knowingly collect or process personal data from individuals under the age of 18.

If we discover that personal data belonging to an individual under the age of 18 has been collected without proper age verification, we will take immediate steps to delete that data and close the account in question. If you believe that your child or underage dependent has registered for or used the UDM19 platform, please contact us immediately by email at support@udm19.site so that we can take the appropriate action.

UDM19 employs multiple layers of verification to prevent registration by underage individuals, including date-of-birth verification during registration and a KYC process requiring official Malaysian identity documents that confirm the member's age.

UDM19 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or changes in how our platform operates.

For any material amendments — meaning changes that significantly affect how we use your personal data or your rights — UDM19 will:

• Sending a notification via email to the address registered in your account at least 14 calendar days before the amendment takes effect.
• Displaying a prominent notice on the platform's main page and at the top of this Privacy Policy for the same duration.
• Updating the "Last Updated" date at the top of this document.

For minor, non-material amendments such as spelling corrections, language clarifications or the addition of clarifying information, we may not provide advance notice but will always update the date at the top of this document.

Your continued use of the UDM19 platform after any amendments take effect will be considered acceptance of the revised Privacy Policy. We encourage members to review this page periodically.

If you have any questions, concerns or requests relating to this Privacy Policy or the way UDM19 handles your personal data, please contact us through the following channels:

• Privacy Email: support@udm19.site (Please state "Privacy Enquiry" or "Data Rights Request" in the email subject line)
• Live Chat: Available in your UDM19 account, 24 hours a day, 7 days a week
• Response time: Live chat is typically answered within 2 minutes; email responses are within 1–2 hours for general enquiries and 21 business days for formal data rights requests

We encourage you to contact us first regarding any privacy concerns. However, if you feel that we have not handled your complaint to your satisfaction, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia through their official channels.