kfc2u Privacy Policy

01 About This Privacy Policy

kfc2u ("we," "us," "our") operates the online gaming and sports betting platform accessible at kfc2u.one (the "Platform"). This Privacy Policy governs the collection, processing, storage, and disclosure of personal data relating to individuals ("you," "your," "Player") who register an Account with kfc2u or otherwise interact with the Platform.

kfc2u recognises the importance of data privacy to Malaysian players and to users across all jurisdictions where the Platform is accessible. We are committed to processing personal data fairly, transparently, and in accordance with applicable data protection legislation, including principles consistent with Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection standards.

This Privacy Policy applies to all personal data collected through the kfc2u Platform, including data collected during account registration, login sessions, deposits and withdrawals, customer support interactions, and general use of the Platform's gaming and betting services. It does not apply to third-party websites or services that may be linked from the Platform.

02 Categories of Personal Data We Collect

kfc2u collects the following categories of personal data, depending on how you interact with the Platform:

kfc2u does not collect sensitive personal data categories (such as racial or ethnic origin, religious beliefs, or health data) except where required by applicable law or where you have provided such data voluntarily in a support context.

03 How We Collect Personal Data

kfc2u collects personal data through the following channels:

• Direct interactions: Data you provide when registering an Account, completing identity verification, using the cashier, contacting support, or updating account settings.
• Automated technologies: Technical and usage data collected automatically when you access the Platform, including through cookies, session tokens, server logs, and similar tracking technologies. See Section 7 for further details on cookies.
• Third-party payment providers: Transaction confirmation data received from payment processors including Maybank, CIMB, Public Bank, Touch n Go eWallet, and Boost when you make deposits or request withdrawals.
• Identity verification services: Data received from third-party KYC and identity verification providers engaged by kfc2u to fulfil its regulatory obligations.
• Fraud prevention and AML services: Risk signals and screening results from third-party compliance service providers used to meet anti-money laundering and fraud prevention obligations.

04 Legal Basis for Processing Personal Data

kfc2u processes personal data on one or more of the following legal bases:

• Performance of a contract: Processing necessary to provide the Platform services to you, including account management, gaming services, and payment processing.
• Legal obligation: Processing required to comply with applicable law, including KYC obligations, AML requirements, age verification mandates, and responses to regulatory or law enforcement requests.
• Legitimate interests: Processing in pursuit of kfc2u's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, service improvement, and internal analytics — provided such interests are not overridden by your rights and interests.
• Consent: Where kfc2u relies on your consent for a specific processing activity (such as marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

05 How kfc2u Uses Your Personal Data

kfc2u uses the personal data it holds for the following purposes:

• Creating and managing your kfc2u Account, including identity verification and eligibility assessment
• Facilitating deposits, withdrawals, and all financial transactions in MYR via supported payment methods
• Delivering and operating all gaming and sportsbook services available through the Platform
• Enforcing responsible gaming obligations, including monitoring for indicators of problem gambling and administering self-imposed limits and exclusions
• Complying with KYC, AML, and other regulatory requirements applicable to kfc2u's operating licence
• Detecting and preventing fraud, account sharing, bonus abuse, and other prohibited conduct under the kfc2u Terms & Conditions
• Responding to customer support queries and resolving complaints or disputes
• Improving the Platform through internal analytics, A/B testing, and performance monitoring
• Sending transactional communications, including account notifications, security alerts, and withdrawal confirmations
• Sending marketing communications, where you have opted in and to the extent permitted by applicable law

kfc2u does not use personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by applicable law or where you have expressly consented to such processing.

06 Data Sharing & Third-Party Disclosure

kfc2u does not sell personal data to third parties. kfc2u may share personal data with the following categories of recipients for the purposes described in this Privacy Policy:

• Payment service providers: Maybank, CIMB, Public Bank, Touch n Go eWallet, Boost, and other payment processors — to process transactions and confirm payment statuses.
• Identity verification and KYC providers: Third-party services engaged to verify player identity documents and age in compliance with kfc2u's regulatory obligations.
• AML and fraud prevention services: Compliance technology providers used to screen transactions and player activity against regulatory watchlists and fraud indicators.
• Game studios and platform technology providers: Software partners who provide game content, live casino streaming infrastructure, and sportsbook data feeds — limited to data necessary for service operation.
• Regulatory and law enforcement authorities: Where kfc2u is required by law, court order, or regulatory direction to disclose personal data.
• Professional advisers: Legal, audit, and accounting professionals, subject to confidentiality obligations, where required for kfc2u's business operations.

All third parties with whom kfc2u shares personal data are required to maintain appropriate data security standards. kfc2u does not authorise third parties to use personal data for their own marketing or commercial purposes.

07 Cookies & Tracking Technologies

kfc2u uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for Platform functionality, including maintaining login sessions, security tokens, and cashier operations. These cannot be disabled without impairing Platform use.
• Performance and analytics cookies: Used to understand how players navigate the Platform, which pages are most frequently accessed, and where technical issues occur, enabling kfc2u to improve Platform performance.
• Functional cookies: Used to remember your preferences such as language settings, lobby filters, and recently played games.
• Fraud prevention cookies: Used to detect unusual access patterns that may indicate unauthorised account access or automated bot activity.

kfc2u does not use third-party advertising or behavioural tracking cookies on the Platform. You may control non-essential cookies through your browser settings. Disabling cookies may affect certain Platform functions. kfc2u's cookie practices are reviewed periodically and updated as needed.

08 Data Retention

kfc2u retains personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, and accounting obligations. The following general retention standards apply:

• Account data: Retained for the duration of your active Account and for a minimum of five (5) years following Account closure, in compliance with AML and gaming licence record-keeping requirements.
• Transaction records: Retained for a minimum of seven (7) years to meet financial record-keeping obligations.
• KYC and identity documents: Retained for the period required by kfc2u's licensing authority, typically a minimum of five (5) years from the date of verification.
• Support communications: Retained for three (3) years following the resolution of the support interaction, unless subject to an ongoing dispute or legal hold.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter to evidence the prior consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

09 Security Measures

kfc2u implements a layered security framework to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and kfc2u servers
• Encryption of sensitive data at rest within kfc2u's database infrastructure
• Access controls limiting personal data access to authorised kfc2u personnel on a need-to-know basis
• Multi-factor authentication requirements for kfc2u staff accessing administrative systems
• Regular security assessments and penetration testing by qualified third parties
• Player-facing security options including two-factor authentication and configurable session timeouts
• Segregated storage of player funds from operational funds

Notwithstanding the security measures above, no data transmission over the internet or data storage system can be guaranteed to be completely secure. In the event of a data security incident affecting your personal data, kfc2u will notify affected players and relevant authorities in accordance with applicable legal requirements.

10 Your Data Rights

Subject to applicable law, you have the following rights in respect of personal data kfc2u holds about you:

• Right of access: You may request confirmation of whether kfc2u holds personal data about you and, if so, request a copy of that data.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some corrections can be made directly within your account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer required for the purposes for which it was collected, subject to kfc2u's legal retention obligations.
• Right to restriction: You may request that kfc2u restrict the processing of your data in certain circumstances, for example while an accuracy dispute is being resolved.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time via your account settings or by contacting support.
• Right to data portability: Where technically feasible and legally applicable, you may request your personal data in a structured, commonly used, machine-readable format.

To exercise any of the above rights, please contact kfc2u's support team via the live chat channel. kfc2u will respond to valid requests within 30 days. Identity verification may be required before kfc2u processes a data rights request. kfc2u will not charge a fee for exercising these rights unless a request is manifestly unfounded or excessive.

11 Children & Minors — Strict 21+ Policy

The kfc2u Platform is strictly for individuals aged 21 and above. kfc2u does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the account registration process and may be repeated at any point during the account lifecycle.

If kfc2u becomes aware that personal data has been collected from a person under the age of 21 without verified parental consent, that Account will be closed immediately, the personal data will be deleted, and any balance will be returned to the originating payment method. If you believe a minor has registered on the Platform, please contact kfc2u's support team immediately via live chat.

kfc2u recommends that parents and guardians install appropriate content filtering or parental control software on shared devices to prevent minors from accessing online gambling content.

12 Changes to This Privacy Policy

kfc2u may update this Privacy Policy from time to time to reflect changes in its data processing practices, applicable law, or regulatory requirements. The date of the most recent update is displayed at the top of this page. Where a material change is made to how kfc2u processes your personal data, kfc2u will endeavour to notify registered Players via the email address associated with their Account or via a prominent Platform notification prior to the change taking effect.

Your continued use of the kfc2u Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the revised policy. kfc2u encourages you to review this Privacy Policy periodically. The version of the Privacy Policy in effect at the time of any data processing activity governs that activity.

13 Contact Information

For privacy-related enquiries, data rights requests, or concerns about kfc2u's handling of your personal data, please contact the kfc2u support team:

• Live Chat: Available 24 hours a day, 7 days a week through the Platform
• Email: [email protected] (plain text — not a clickable link)

kfc2u aims to acknowledge all privacy enquiries within one (1) business day and to resolve them within thirty (30) days. Complex requests involving data access or erasure may require up to sixty (60) days, in which case kfc2u will inform you of the extended timeline and the reason for it.