Privacy Policy

This Privacy Policy ("Policy") describes how 12play ("Platform", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://12play.casa, collects, processes, stores, and protects the personal data of individuals ("Members", "Users", "you") who access or use our services.

This Policy applies to all personal data collected through the 12play website, mobile interface, customer support channels, and any other touchpoints through which you interact with 12play. It should be read in conjunction with our Terms and Conditions, which are available at https://12play.casa/terms-conditions.

12play is committed to handling personal data responsibly and in accordance with applicable data protection principles. We serve a significant player base across Malaysia — including members in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — and we take the privacy expectations of Malaysian users seriously.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and behavioural data generated by Platform use.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" means 12play, as the entity that determines the purposes and means of Processing personal data collected through the Platform.
• "Third Party" means any natural or legal person other than the Member and 12play.
• "Cookies" means small data files stored on your device by the Platform to facilitate session management, preferences, and analytics.
• "KYC" means Know Your Customer — the identity verification process required for Account activation and withdrawal processing.
• "Payment Processor" means authorised third-party service providers that facilitate financial transactions on the Platform, including FPX operators, DuitNow, e-wallet providers, and cryptocurrency processors.

12play collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity and Account Data

• Full legal name as it appears on government-issued identification.
• Date of birth (for age verification — minimum age 21).
• Malaysian MyKad number, passport number, or equivalent government-issued ID number.
• Username and encrypted account password.
• Profile photograph (where submitted for enhanced KYC).

3.2 Contact Data

• Email address registered to the Account.
• Malaysian mobile phone number.
• Residential address, including postcode and state (for verification and regulatory compliance).

3.3 Financial and Transaction Data

• Bank account details associated with FPX, Maybank, CIMB, Public Bank, Hong Leong, or other linked banking providers.
• E-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, and DuitNow.
• Cryptocurrency wallet addresses where BTC or USDT deposits or withdrawals are conducted.
• Complete deposit and withdrawal transaction history, including amounts in MYR and timestamps.
• Wagering history, game session records, and betting patterns.

3.4 Technical and Usage Data

• IP address and approximate geographic location derived from IP.
• Device type, operating system, browser type and version.
• Session duration, pages visited, and navigation patterns within the Platform.
• Login timestamps and access logs.
• Error logs and technical diagnostic data generated during Platform use.

3.5 Communications Data

• Records of Live Chat, email, and WhatsApp interactions with the 12play support team.
• Complaint and dispute records.
• Responses to voluntary surveys or feedback requests.

12play collects personal data through the following means:

12play processes personal data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing is necessary to fulfil our obligations under the Terms and Conditions, including Account management, transaction processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, KYC requirements, and responsible gambling mandates.
• Legitimate Interests: Processing is necessary for the legitimate interests of 12play, including fraud prevention, platform security, abuse detection, and service improvement — provided these interests are not overridden by your fundamental rights.
• Consent: Where processing is based on consent (for example, optional marketing communications), you may withdraw that consent at any time by contacting our support team or updating your Account preferences.

12play uses the personal data we collect for the following specific purposes:

• To create and administer your 12play Account and verify your identity and age.
• To process deposits via Malaysian payment channels (including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC, and USDT) and to execute withdrawal requests.
• To verify compliance with our minimum age requirement of 21 years.
• To provide access to casino games, live dealer tables, sports betting markets, and e-sports wagering.
• To deliver customer support across our 24/7 multilingual channels (English, Bahasa Melayu, Chinese).
• To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other forms of prohibited conduct.
• To comply with anti-money laundering, responsible gambling, and other applicable regulatory obligations.
• To send essential service communications, including account notifications, security alerts, and Terms updates.
• To send promotional communications where you have consented to receive them, and to administer loyalty programmes and bonuses.
• To analyse platform usage in aggregate form to improve the quality, performance, and features of the Platform.
• To enforce our Terms and Conditions and protect the rights, property, and safety of 12play, our Members, and third parties.

12play does not sell your personal data to any third party. We may share personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

7.1 Payment Processors

To process deposits and withdrawals, we share relevant financial and identity data with licensed payment processors, including Malaysian FPX banking gateways, e-wallet providers (Touch 'n Go, Boost, GrabPay, DuitNow), and cryptocurrency transaction processors. These processors are contractually bound to handle your data in accordance with applicable security and confidentiality obligations.

7.2 Identity Verification Providers

For KYC purposes, we may share identity documents and related data with regulated third-party identity verification service providers. All such providers operate under strict data processing agreements.

7.3 Regulatory and Law Enforcement Authorities

Where required by applicable law, court order, or regulatory directive, 12play may disclose personal data to government agencies, law enforcement authorities, or licensed regulators. Such disclosures are made strictly in accordance with legal requirements and not on a voluntary basis.

7.4 Service Providers and Technology Partners

We engage third-party service providers to support platform operations, including cloud hosting, fraud detection, customer support software, and analytics. These providers are granted access only to the minimum personal data necessary to perform their contracted services and are prohibited from using such data for any other purpose.

12play uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in during your visit. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Store your preferences such as language settings, display preferences, and previously selected payment methods to improve your experience on return visits.
• Analytics Cookies: Help us understand how Members interact with the Platform in aggregate — such as which pages are most visited and how navigation flows perform. Analytics data is anonymised and used solely for internal improvement purposes.
• Security Cookies: Support fraud detection and session integrity monitoring to protect your Account from unauthorised access.

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from accessing certain features of the 12play Platform.

12play retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention guidelines apply:

• Active Account Data: Retained for the duration of your active Account and for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping obligations.
• Transaction Records: Retained for a minimum of seven (7) years to comply with financial record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years following the completion of the KYC process or Account closure, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the interaction unless the matter relates to an ongoing dispute or regulatory inquiry.
• Technical and Usage Logs: Retained for up to twelve (12) months for security and diagnostic purposes, unless required to be held longer in connection with a specific investigation.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

12play implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between users and 12play servers.
• AES-256 encryption at rest for all stored sensitive personal and financial data.
• Multi-factor authentication for internal system access by 12play personnel.
• Role-based access controls ensuring employees can access only data necessary for their specific function.
• Regular third-party security audits and penetration testing of all platform infrastructure.
• Intrusion detection systems and 24/7 security monitoring of all server environments.
• Formal data breach response procedures, including notification protocols where required by applicable law.

Subject to applicable legal limitations, you hold the following rights in relation to your personal data held by 12play:

• Right of Access: You may request a copy of the personal data 12play holds about you, together with information about how it is being processed.
• Right of Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. You may also update many data fields directly within your Account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another data controller where technically feasible.
• Right to Object: You may object to processing of your personal data based on legitimate interests. Where processing is for direct marketing purposes, you may object at any time and we will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact 12play's support team via Live Chat or by email at [email protected]. We will respond to valid requests within 30 calendar days. In some cases, 12play may need to verify your identity before processing a data rights request.

The 12play Platform is strictly intended for adults aged 21 years and above. 12play does not knowingly collect personal data from persons under the age of 21. Registration by any person under the minimum age is prohibited.

Where 12play becomes aware that personal data has been collected from a person under the age of 21, that Account will be immediately suspended, all data associated with the Account will be deleted, and any deposits made will be refunded through the original payment method where technically possible.

Parents or guardians who believe that a minor has registered an Account or accessed the Platform should contact us immediately at [email protected]. We take such reports seriously and act promptly.

12play operates globally and may process or store personal data on servers located outside Malaysia. Where personal data is transferred to countries that do not provide an equivalent level of data protection, 12play implements appropriate safeguards to ensure that such transfers comply with applicable data protection principles, including:

• Execution of data processing agreements with all third-party processors containing standard contractual clauses or equivalent transfer mechanisms.
• Conducting transfer impact assessments where required to ensure that transferred data receives adequate protection in the destination jurisdiction.
• Restricting access to transferred data to the minimum necessary for the contracted processing purpose.

12play reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, data processing practices, or platform operations. Where changes are material, we will notify registered Members via email or a prominent notice on the Platform prior to the changes taking effect.

The version of this Policy bearing the most recent "Last Updated" date published at the top of this page is the governing version. We encourage Members to review this Policy periodically. Continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 12play, please reach our Data and Privacy team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the 12play Platform. Support is available in English, Bahasa Melayu, and Chinese. Average response time: under 5 minutes.
• Email: [email protected] — for written privacy requests, data subject access requests, or formal complaints. We aim to respond within 3 business days and to resolve data rights requests within 30 calendar days.

When submitting a data rights request, please include your registered Account username and email address to allow our team to locate your records efficiently. We may need to verify your identity before processing sensitive requests.

For concerns about responsible gambling or self-exclusion that may involve your personal data, please also visit our Responsible Gambling page for relevant tools and resources.