Spiv2 Privacy Policy — Malaysia Player Personal Data Protection

1Information We Collect From You

To provide a secure, personalised, and high-quality service, spiv2 collects various types of information from members and platform visitors. Below are the categories of information we collect and the purposes for which they are collected:

We also collect information you voluntarily provide when contacting our support team, participating in customer satisfaction surveys, or taking part in spiv2 promotional programmes. All voluntarily provided information will be used solely for the purposes stated at the time of collection.

2How We Use Your Personal Data

Spiv2 uses collected personal data solely for lawful and transparent purposes. Below are the primary purposes for which your data is used:

• Account Management: Creating, verifying, and maintaining your member account including a secure login process using two-factor authentication.
• Financial Transaction Processing: Processing deposits and withdrawals securely and accurately through your preferred payment methods such as FPX, Touch 'n Go eWallet, and bank transfer.
• KYC Verification: Meeting legal compliance obligations including age verification, identity verification, and source of funds checks in line with Malaysia's legal requirements.
• Service Communications: Sending important notifications related to your account, transactions, policy changes, and relevant security information.
• Marketing & Promotions: With your consent, sending information about spiv2 promotions, bonuses, and special offers that may interest you.
• Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, and any other illicit activity on the platform.
• Platform Improvement: Analysing aggregated usage patterns to improve the design, functionality, and overall experience of the spiv2 platform.
• Responsible Gaming: Monitoring gaming patterns to identify members who may need help or support related to problem gambling.

Spiv2 will not use your personal data for any other purpose not stated above without first obtaining your explicit consent. All data processing is carried out on a valid legal basis — whether your consent, contract fulfilment, legal obligation, or the legitimate interests of spiv2 that do not override your fundamental rights.

3Sharing Personal Data with Third Parties

Spiv2 takes a highly cautious approach to sharing member personal data. We only share your information in the following limited circumstances:

• Trusted Service Providers: Technical partners that help spiv2 deliver its services — such as payment processing providers, certified cloud service providers, and gaming software vendors that have signed strict confidentiality agreements with spiv2.
• Legal Requirements: When required by applicable Malaysian law, a valid court order, or an official request from law enforcement authorities.
• Integrated Fraud Prevention: Sharing the minimum necessary information with recognised fraud prevention bodies or identity verification platforms for industry protection purposes.
• Business Transfer: In the event of a merger, acquisition, or sale of spiv2 assets, member data will be transferred to the new entity subject to this Privacy Policy or an equivalent policy.

All third parties granted access to spiv2 member data are bound by strict data processing agreements and are required to implement security measures equivalent to or exceeding the standards set by spiv2.

4Data Storage & Security

The security of your personal data is spiv2's highest priority. We implement multiple layers of technical and organisational protection to ensure your data remains safe at all times:

• Data Encryption: All personal data is encrypted using AES-256 standards at rest and TLS 1.3 in transit across the network.
• Strict Access Controls: Only spiv2 staff with a legitimate operational need may access member data, and such access is logged and continuously monitored.
• Secure Server: Member data is stored in ISO 27001-certified data centres with multi-layered physical and cyber protection.
• Regular Backups: Data is automatically and regularly backed up to ensure service continuity and data recovery in the event of technical disruptions.
• Vulnerability Testing: The spiv2 system undergoes regular penetration testing to identify and address any security vulnerabilities before they can be exploited.

Data Retention Period: spiv2 retains member personal data for the duration of the active account and up to 7 years after account closure to fulfil applicable legal and regulatory obligations. Data that is no longer required will be securely deleted using methods that meet industry standards.

5Cookies & Tracking Technologies

The spiv2 platform uses cookies and similar tracking technologies to enhance the user experience and ensure platform security. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled as the platform will not function properly without them.
• Preference Cookies: Saving your preferences such as display language, display settings, and other options to make future use of the platform more convenient.
• Analytics Cookies: Collecting anonymous information about how visitors use our platform to help us understand usage patterns and improve our services.
• Security Cookies: Detecting suspicious activity, such as unusual login attempts or sudden changes in usage patterns that may indicate account compromise.

You can manage cookie settings through your web browser at any time. However, disabling certain cookies may affect the functionality or security of your experience on the spiv2 platform. For more information on managing cookies, please refer to the guide for your web browser.

6Your Rights as a Data Owner

In accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the following rights regarding the personal data held by spiv2:

To exercise any of the above rights, please contact the spiv2 data protection team via our official email. We will process your request within 30 days working days from the date of receipt. In complex cases, this period may be extended by up to 60 days with notice to you.

7Children's Data & Protection of Minors

The spiv2 platform is intended exclusively for adults aged 18 years and above. spiv2 does not intentionally collect or process personal data of children or individuals under the age of 18.

Should we discover that personal data of an individual under the age of 18 has been collected without valid consent, we will take immediate steps to delete that data and close the relevant account. Parents or guardians who have reason to believe their child or ward has registered on spiv2 are required to contact us immediately.

8Changes to This Privacy Policy

Spiv2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or service improvements. Each new version will display the latest "Updated" date at the top of this document.

For changes considered material — meaning changes that significantly affect how we use or disclose your personal data — spiv2 will provide advance notice via your registered email or an in-platform notification at least 14 days before the changes take effect.

Your continued use of the spiv2 platform after the effective date of any changes will be considered your acceptance of the updated Privacy Policy. It is recommended that you review this page periodically to stay informed about how we protect your information.

9Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding how spiv2 manages your personal data, or if you wish to exercise any of your data protection rights, please contact the spiv2 Data Protection Officer (DPO) through the following channels:

Spiv2 is committed to addressing all privacy-related inquiries seriously and professionally. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Department of Malaysia (JPDP), the relevant regulatory authority in Malaysia.