Privacy Policy — mari2u

1. Introduction

This Privacy Policy (hereinafter "the Policy") issued by the operator of the online gaming platform accessible at https://mari2u.cam (hereinafter "mari2u", "the Company", "we", "us", or "our"). It applies to all individuals who access, register on, or interact with the Platform in any capacity, including registered players, prospective players, and general website visitors (collectively referred to as "you" or "the User").

This Policy explains what personal data we collect, the purposes for which we process it, the legal bases underpinning that processing, with whom we may share it, how long we retain it, and the rights available to you in relation to your personal data.

By accessing the Platform or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should cease using the Platform and contact us to request account closure.

This Policy should be read alongside our Terms and Conditions, which govern your use of the Platform as a whole.

2. Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, residential address, payment details, and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means the Company, which determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of the Company under a data processing agreement.
• "Consent" means freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC Data" means identity and address verification documentation collected as part of our Know Your Customer obligations under our international gaming licence.
• "Cookies" means small text files placed on your device by the Platform to store preferences, session information, and analytics data.
• "Third Parties" means entities other than the Company and the User, including payment processors, game providers, analytics services, and regulatory bodies.

3. Personal Data We Collect

We collect personal data across several categories, depending on the nature of your interaction with the Platform. The categories of data we may collect include:

3.1 Registration and Account Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (required to verify the21+ age requirement);
• Residential address, including postcode and city (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam);
• Email address and contact telephone number;
• Preferred username and hashed account password (passwords are never stored in plain text);
• Nationality and country of residence.

3.2 KYC Verification Data

• Copy of government-issued photo identification (Malaysian MyKad, passport, or driving licence);
• Proof of residential address (e.g., utility bill, bank statement);
• Proof of payment method ownership (e.g., screenshot of e-wallet or bank account in your name);
• Source of funds documentation where required by compliance obligations;
• Selfie or video verification where required for enhanced due diligence.

3.3 Financial and Transaction Data

• Deposit and withdrawal amounts, dates, and payment method used (e.g., Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, BTC, ETH, USDT TRC20);
• Transaction reference numbers and payment status;
• Account balance history and bonus transaction records;
• Cryptocurrency wallet addresses used for deposits or withdrawals (where applicable).

3.4 Gaming Activity Data

• Games played, bet amounts, wins, losses, and session durations;
• Sports betting selections, markets, and odds accepted;
• Bonus usage, rollover progress, and promotional participation history.

3.5 Technical and Device Data

• IP address and approximate geographical location derived therefrom;
• Device type, operating system, and browser information;
• Session timestamps, page navigation patterns, and feature usage data;
• Cookie identifiers and similar tracking technologies.

3.6 Communications Data

• Records of live chat, email, and support ticket communications with our team;
• Responses to surveys or feedback requests (where voluntarily provided);
• Marketing preference settings and consent records.

4. How We Collect Your Data

We collect personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey;
• Automatically via the Platform: Technical and usage data is collected automatically when you access the Platform through cookies, server logs, and similar technologies;
• From third-party payment processors: When you initiate a deposit or withdrawal, our payment partners share transaction confirmation data with us;
• From identity verification services: Where we use third-party KYC or fraud-screening services, they may provide verification results, risk scores, and data derived from publicly available sources;
• From licensing authorities or law enforcement: We may receive data from regulatory bodies or law enforcement agencies in connection with our compliance obligations.

5. Purposes of Data Processing

The table below sets out the primary purposes for which we process your personal data:

6. Legal Bases for Processing

We process your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you, including account management, game provision, and payment processing;
• Legal obligation: Processing required to comply with our licensing obligations, AML regulations, and any applicable legal requirements;
• Legitimate interests: Processing necessary for fraud prevention, security monitoring, platform improvement, and responsible gambling enforcement, where these interests are not overridden by your rights;
• Consent: Where we send marketing communications or use non-essential cookies, we do so only where you have provided explicit consent, which may be withdrawn at any time.

7. Data Sharing & Disclosure

7.1 We do not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with the following categories of recipients only where necessary and subject to appropriate safeguards:

• Payment processors: Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency processing services, solely for the purpose of executing deposits and withdrawals;
• Identity verification and KYC service providers: Third-party services used to assist with document verification, fraud screening, and age verification;
• Game content providers: Licensed game studios and live dealer providers whose software powers the games available on the Platform, who may receive anonymised session data;
• IT and infrastructure providers: Cloud hosting, database management, and cybersecurity service providers who process data on our behalf under data processing agreements;
• Regulatory and licensing authorities: Our licensing jurisdiction's regulatory body may require access to player records as part of ongoing compliance oversight;
• Law enforcement and legal proceedings: We may disclose personal data where required to do so by court order, warrant, or legally binding government request.

7.2 All third-party processors engaged by the Company are required to maintain appropriate technical and organisational security measures and may only process personal data in accordance with our documented instructions.

8. International Data Transfers

8.1 As an internationally licensed gaming platform, some of the third-party service providers we engage may be located outside Malaysia. Personal data may therefore be transferred to and processed in countries other than your country of residence.

8.2 Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, including contractual clauses requiring the recipient to apply data protection standards equivalent to those described in this Policy.

8.3 By registering and using the Platform, you acknowledge and consent to the international transfer of your personal data as described in this section.

9. Data Retention

9.1 We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, as described in Section 5, or as required by applicable law or our licensing obligations.

9.2 As a general principle: account data and KYC records are retained for the duration of your account and for a minimum of five years following account closure; financial transaction records are retained for a minimum of seven years in accordance with anti-money laundering record-keeping requirements; communications with customer support are retained for three years from the date of the last interaction.

9.3 Where retention is no longer required, personal data is securely deleted or anonymised so that it can no longer be attributed to you.

10. Cookies & Tracking Technologies

10.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function — including session management, login authentication, and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., preferred language, display settings) to provide a more personalised experience.
• Analytics cookies: Collect anonymised data about how users navigate the Platform to help us identify areas for improvement. These are only set with your consent.
• Marketing cookies: Used to deliver relevant promotions and offers. These are only set where you have explicitly consented to marketing communications.

10.2 Managing Cookie Preferences

You may configure your browser settings to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies may impair the functionality of the Platform, including your ability to log in or complete transactions. For analytics and marketing cookies, you may withdraw consent at any time by adjusting your account privacy settings or contacting our support team.

11. Your Rights as a Data Subject

Subject to applicable law and our legal obligations, you have the following rights in relation to your personal data held by mari2u:

To exercise any of the rights listed above, please contact our support team as described in Section 16. We will acknowledge your request within 48 hours and aim to fulfil all valid requests within 30 days. We may need to verify your identity before processing a data request.

12. Children & Minors

12.1 The Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete all such data and close the associated account.

12.2 If you have reason to believe that a minor has registered on the Platform using false age information, please contact our support team immediately at [email protected] (plain text — not a link).

13. Security Measures

13.1 We implement a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, or destruction:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Multi-factor authentication for staff accessing backend systems containing personal data;
• Regular security audits, penetration testing, and vulnerability assessments;
• Incident response procedures in place for breach detection, containment, and notification.

13.2 Notwithstanding these measures, no internet transmission or electronic storage system is 100% secure. We cannot guarantee absolute security, and you accept that any transmission of personal data is at your own risk. We encourage you to use a strong, unique password for your Account and to notify us immediately if you suspect any unauthorised access.

14. Third-Party Services & Links

14.1 The Platform may integrate third-party services such as payment gateways, game providers, and analytics tools. These third parties operate under their own privacy policies and data practices. The Company is not responsible for the privacy practices of third-party services accessed through the Platform.

14.2 All third-party processors engaged by the Company are veted for data security compliance and are bound by data processing agreements that require them to maintain adequate protection standards and process data solely on our instructions.

15. Amendments to This Policy

15.1 We reserve the right to update, amend, or replace this Privacy Policy at any time. When material changes are made, we will provide advance notice via email to your registered email address or through a prominent notice on the Platform, with a minimum of seven (7) days' notice wherever practicable.

15.2 The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any revised Policy constitutes acceptance of those changes.

15.3 The current version of this Privacy Policy is always available at https://mari2u.cam/privacy-policy.

16. Contact & Data Requests

For any privacy-related enquiry, to exercise your data rights, to request data deletion or correction, or to raise a concern about how your personal data is being handled, please contact us via the following channel:

When submitting a privacy or data request, please include: your registered username or email address, a clear description of your request (e.g., access, deletion, correction), and any relevant transaction or account references that may help us locate your data efficiently. We will acknowledge your request within 48 hours and complete valid requests within 30 calendar days. In complex cases, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reason.