7u7 Privacy Policy — Personal Data Protection Our Platform Users

7u7 ("we", "Platform" or "7u7") takes our responsibility to protect the privacy of every user seriously. This Privacy Policy explains in detail how we manage your personal data — from the moment you register an account through every login and use of the platform.

This document applies to all users who access the 7u7 platform via our official website, mobile app for Android and iOS, and any official 7u7 communication channels including email, live chat, and customer support WhatsApp.

This Privacy Policy is provided in clear, straightforward language to ensure all Malaysian users can understand their rights and how we handle personal data transparently. We hide nothing in fine print or confusing terminology.

7u7 collects personal data through several means — information you provide directly during registration, data generated automatically as you use the platform, and in some cases, information we receive from trusted third parties for verification purposes.

We do not collect sensitive data such as medical information, political views, religious beliefs, or biometric data beyond what is required for standard KYC verification.

Every piece of data we collect has a clear and legitimate purpose. 7u7 does not process your personal data for undisclosed purposes without obtaining your consent beforehand. Below are the primary purposes of our data processing:

• Account Management: Create and maintain your account, process secure logins, and verify your identity during each session.
• Transaction Processing: Facilitate deposit, withdrawal, and all financial transactions on the platform securely and efficiently.
• KYC and AML Compliance: Fulfil legal obligations related to Know Your Customer (KYC) and anti-money laundering (AML) as required by the authorities.
• Platform Security: Detect and prevent fraud, unauthorised access, account abuse, and any other security threats.
• Service Improvement: Analyse aggregated usage patterns to improve the interface, performance, and overall user experience.
• Service Communications: Send important notifications relating to your account, transactions, security updates, and changes to terms of service.
• Marketing (with consent): Send promotional offers, bonuses, and new product information — only to users who have given consent to receive marketing communications.
• Legal Compliance: Comply with instructions, court orders, or reporting requirements mandated by relevant regulatory authorities.

7u7 does not sell or trade your personal data to any party for commercial purposes. However, in the course of operating a secure and legally compliant platform, there are certain situations where your data may need to be shared with selected third parties:

• Payment Providers: FPX, Touch 'n Go eWallet, GrabPay, Boost, and other approved payment service providers receive only the data strictly necessary to securely process your transactions.
• KYC Service Providers: A third-party identity verification platform integrated with the 7u7 system to process identification documents for regulatory compliance.
• Game Providers: Casino and sports game software providers that require a unique user identifier to accurately display game history and credit balance.
• Analytics Services: Analytics tools that process usage data in aggregated and anonymised form for platform improvement purposes.
• Authorities: Law enforcement agencies, courts, or regulatory bodies when we are legally required to do so.

All third parties we work with are bound by strict data confidentiality agreements and may only process your data in accordance with 7u7's instructions and for specified purposes only.

Should 7u7 be involved in a merger, acquisition, or asset sale, user data may be transferred as part of that business transaction. You will be notified in advance via email or an in-platform notification before any such transfer takes place.

Protecting your personal data from unauthorised access, loss, or disclosure is an absolute priority for 7u7. We implement multiple layers of security to ensure comprehensive protection:

• 256-bit SSL/TLS Encryption: All communications between your browser and the 7u7 server are encrypted using bank-grade security protocols.
• Two-Factor Authentication (2FA): 2FA is available and encouraged for all accounts to add an extra layer of security during login.
• Continuous Monitoring: An automated threat detection system monitors account activity 24 hours a day, 7 days a week to identify any suspicious access.
• Internal Access Control: Only 7u7 staff who require access to specific data to perform their duties are permitted to do so, with a full audit log maintained for every access.
• Secure Password Storage: User passwords are never stored in plain text — they are processed using strong cryptographic hashing algorithms.
• Regular Security Testing: Penetration testing and security audits are conducted regularly by independent security experts to identify and address any system vulnerabilities.

While we take all reasonable precautions, no system can guarantee 100% security at all times. In the event of any security incident involving your data, we will notify you within the timeframe required by law and take immediate action to mitigate any potential impact.

The 7u7 platform uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better experience for you. Below are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as maintaining your login session and ensuring security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collect data on how users interact with the platform — most frequently visited pages, time spent, and any errors encountered. All data is collected anonymously.
• Functional Cookies: Store your preferences such as language, display settings, and saved login information to facilitate repeat use.
• Analytics Cookies: Used to understand overall usage patterns for the purpose of improving 7u7's products and services.

You may manage or delete cookies through your web browser settings at any time. Please note that disabling essential cookies may affect the functionality and user experience of the 7u7 platform. Refer to your browser's guide for detailed instructions on managing cookies.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by 7u7:

To exercise any of the above rights, contact our privacy team via email or the in-platform live chat. We will process your request within 14 working days. For more complex cases, we may require up to 30 days and will notify you in advance if additional time is needed.

7u7 retains your personal data only for as long as necessary for the stated purposes or as required by law. Our general data retention guidelines are as follows:

• Active Account Data: Retained for as long as your account is active and for a reasonable period following account closure to allow resolution of any outstanding claims or disputes.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the transaction date in accordance with Malaysia's tax and financial legislation.
• KYC Records: Retained for a minimum of five (5) years following account closure or the date of the last transaction, in accordance with AML legal requirements.
• Support Communication Logs: Retained for three (3) years for reference and service improvement purposes.
• Technical Data & Logs: Retained for 12 months for security and cyber threat detection purposes.

When data is no longer required, it will be deleted or converted to an anonymised format in a secure and irreversible manner. This data disposal process is carried out in accordance with strict internal procedures that are thoroughly documented.

The 7u7 platform is strictly limited to users aged 18 and above. We do not knowingly collect or process any personal data from minors.

If we determine that a child's personal data has been collected without valid parental or guardian consent, we will take immediate steps to delete that data and close the associated account. Parents or guardians who believe their child has registered an account on our platform are encouraged to contact our support team promptly.

7u7 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or newly introduced service features.

When significant amendments are made, we will notify you via:

• Email to the address registered to your account
• In-platform notifications while you are logged in
• Banner or pop-up display on the platform's home page

Notice will be given at least 14 days before the amendments take effect, unless changes are required immediately for security or legal reasons. Continued use of the platform after the amendment's effective date constitutes your acceptance of the updated Privacy Policy.

We recommend that you review this Privacy Policy periodically. The "Updated" date at the top of this document will always reflect the date of the most recent amendment made.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact the 7u7 privacy and data protection team through the following channels:

• Privacy Email: [email protected]
• Live Chat: Available 24/7 via the chat icon at the bottom corner of the platform
• FAQ Section: Visit our FAQ page for answers to frequently asked questions about privacy

Our team will endeavour to respond to all enquiries within 3 working days. For official data subject rights requests, please submit a written request to our privacy email along with a copy of your identification document for verification purposes.

If you are not satisfied with our response, you have the right to lodge a complaint with the Malaysia Personal Data Protection Department or the relevant regulatory authority in your country.

Effective Date: 1 January 2026
Document Version: 2.5
Data Controller: 7u7 Online Platform