Cm2 Privacy Policy – Data Protection Malaysian Users

01 Introduction & Scope of Privacy Policy

Cm2 ("we", "our platform") takes our responsibility for the privacy and protection of all users' personal data seriously. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of personal information you provide to us or that we collect when you use the cm2 platform.

This policy applies to all users who register an account, browse our website, use the cm2 mobile app, or interact with our services through any channel. By using the cm2 platform, you agree to the data protection practices described in this document.

02 Types of Personal Data We Collect

Cm2 only collects data that is strictly necessary to provide a safe, functional, and compliant service. We do not collect excessive or irrelevant data beyond the scope of our service.

In addition to data you provide directly, we also collect data automatically when you use our platform, including cookie data, server log data, and device information. This data helps us maintain platform security and deliver a better experience for you.

03 How We Use Your Data

Every piece of data we collect is used on the basis of a legitimate and defined purpose. cm2 does not use your data for purposes unrelated to the services we offer.

• Account Management: Creating, verifying, and managing your user account, including secure login processes and two-factor authentication.
• Transaction Processing: Securely processing deposits and withdrawals via your preferred payment methods such as FPX, Touch 'n Go, DuitNow, Boost, and GrabPay.
• Legal Compliance: Meeting compliance requirements such as Anti-Money Laundering (AML), identity verification (KYC), and reporting to relevant authorities when required.
• Platform Security: Detecting and preventing fraud, unauthorised access, system manipulation, and other suspicious behaviour that could harm the platform or other users.
• Service Communications: Sending you transaction notifications, account updates, security alerts, and important service information.
• Product Improvement: Analysing usage patterns in aggregate to develop new features, improve the interface, and enhance the overall platform experience.
• Marketing Communications: Sending promotional information, bonus offers, and platform updates — only if you have consented to receive such communications.
• Responsible Gaming: Monitoring gameplay patterns to identify users who may need support related to excessive gaming and activating appropriate protection measures.

04 Data Sharing & Disclosure to Third Parties

Cm2 does not sell, rent, or trade your personal data to third parties for their marketing purposes. Data disclosure only occurs under the following defined and controlled circumstances:

• Payment Processors: Required payment data is shared with trusted payment processors to handle your deposit and withdrawal transactions. These processors are bound by strict confidentiality agreements.
• Technical Service Providers: Cloud infrastructure providers, hosting services, and cybersecurity partners that help us operate the platform securely. All such providers adhere to high data protection standards.
• Legal Authorities: When required by law, court order, or official investigation, we will disclose the necessary information to the relevant authorities.
• AML Compliance: In the context of anti-money laundering compliance, certain transaction information may be reported to the relevant regulatory bodies.
• Business Transfer: In the event of a company merger, acquisition, or asset sale, user data may be transferred as part of the business assets, with appropriate notice provided to users.

05 Data Storage & Security Measures

Your data security is our technical priority. cm2 continuously invests in security infrastructure to ensure your information is always protected against internal and external threats.

• Data Encryption: All sensitive data is encrypted using AES-256 encryption standards during storage and 256-bit SSL/TLS during transmission over the network.
• Access Control: Access to users' personal data is strictly limited to staff who require it to perform their duties. All access is logged and monitored.
• Security Audits: The cm2 platform undergoes regular security audits by independent third parties to identify and address any system vulnerabilities.
• Threat Detection: Our real-time monitoring system is always active to detect suspicious activity, intrusion attempts, and other security threats around the clock.
• Retention Period: Personal data is retained for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Financial transaction records are typically retained for a minimum of 7 years for compliance purposes.
• Data Deletion: When data is no longer needed and there is no legal obligation to retain it, we will securely delete or anonymise it.

06 Cookies, Tracking Technologies & Your Choices

The cm2 platform uses cookies and similar tracking technologies to enhance user experience, maintain session security, and understand how users interact with our platform. The following are the types of cookies we use:

• Essential Cookies: Cookies required for core platform functions such as login sessions, security, and basic preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information on how users use our platform — such as the most frequently visited pages and error messages — to help us improve the platform.
• Functional Cookies: Storing your preferences such as language, display settings, and other preferences to provide a more personalised experience.
• Analytics Cookies: Helping us understand user behaviour in aggregate and anonymised form for product development and marketing purposes.

You can manage or delete cookies through your browser settings at any time. However, disabling certain cookies may affect the functionality of the cm2 platform. For more information on managing cookies, refer to your browser's documentation.

07 Your Rights as a User

Cm2 respects and upholds users' rights regarding their personal data. The following are the rights you hold and how to exercise them:

To exercise any of the above rights, please contact our support team via live chat within the platform or by email at [email protected]. We will process your request within 30 business days. In complex cases, this period may be extended with appropriate notice to you.

08 Identity Verification (KYC) & Compliance

As a responsible platform, cm2 carries out an identity verification process (Know Your Customer, or KYC) as required by anti-money laundering regulations and online gambling industry standards. This process is in place to protect you and the integrity of the platform.

• Required Documents: Identity verification typically requires documents such as a Malaysian identity card (MyKad), a valid passport, or other official identification documents.
• Payment Method Verification: You may be asked to provide proof of ownership of the payment method used, such as a bank statement or e-wallet account screenshot.
• KYC Document Retention: Documents submitted for KYC purposes are stored securely using encryption and are accessible only to authorised compliance staff.
• Processing Time: The KYC verification process is typically completed within 24 to 48 hours after all required documents have been submitted.
• Document Confidentiality: All KYC documents are handled with the highest level of confidentiality and are never shared with third parties except as stated in this policy.

09 Children's Data Protection

The cm2 platform is a service exclusively for adults aged 18 and above. We do not knowingly collect, store, or process personal data from individuals under the age of 18.

10 Amendments to the Privacy Policy

Cm2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. We are committed to keeping you informed of any significant changes.

• Amendment Notice: For significant amendments, we will display a clear notice on the platform and send a notification email to all registered users at least 7 days before the changes take effect.
• Effective Date: The "Updated" date at the top of this document indicates when this Privacy Policy was last reviewed.
• Continuity of Use: Continued use of the cm2 platform after amendments take effect constitutes acceptance of the revised terms. If you do not agree with the amendments, you have the right to close your account.

11 How to Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, our Data Protection team is ready to assist.

We take every privacy enquiry seriously and will provide a thorough response within the stipulated timeframe. Your privacy rights matter to us, and we always strive to address any concerns carefully and respectfully.