Privacy Policy ubet — Data Protection & Privacy for Malaysian Players

This Privacy Policy applies to all information collected through the ubet platform, including the ubet.express website, any mobile applications we release, and all communications you have with the ubet team via email, live chat or other channels.

Within the context of this Policy, the following terms carry the meanings defined below:

• "Personal Data" refers to any information that can be used to identify you directly or indirectly as an individual, including your name, phone number, email address, IP address and financial information.
• "Processing" refers to any operation performed on personal data, including collection, storage, use, disclosure and deletion.
• "Data Controller" refers to ubet as the party that determines the purposes and means of processing your personal data.
• "Data Processor" refers to third parties that process data on ubet's behalf, such as payment service providers and technology infrastructure providers.
• "PDPA" refers to Malaysia's Personal Data Protection Act 2010, which governs the processing of personal data in commercial transactions in Malaysia.

Ubet collects various types of personal data depending on how you interact with our platform. Below is a comprehensive overview of the data we collect:

We do not collect sensitive personal data such as medical information, religious beliefs, or sexual orientation. All data collected serves a legitimate and necessary purpose for the operation of the ubet platform.

Ubet uses the personal data collected solely for the following purposes. We will not use your data for any other purpose without first informing you and obtaining your consent where required:

• Account management: To create, maintain and manage your ubet account, including login, identity verification and profile updates.
• Transaction processing: To process deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, Boost and ShopeePay, and to process withdrawal of winnings to the account you registered in MYR.
• Service delivery: To provide access to slots, Live Casino, baccarat, Sports Betting on Malaysia Super League and EPL football, badminton, virtual sports, and live matches on the ubet platform.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account abuse, and other security threats to the platform.
• Legal compliance: To comply with the legal and regulatory obligations applicable to ubet's operations, including Malaysia's PDPA and AML laws.
• Service communications: To send important notices regarding your account, changes to our terms, security updates, and transaction information.
• Marketing (with your consent): To send you information about promotions, bonuses, special offers and new games on ubet — only where you have given consent to receive marketing communications.
• Responsible gambling: To monitor betting patterns and provide support and responsible gaming tools to members who need assistance.
• Platform improvements: To analyse how players use the platform for the purpose of improving design, performance and user experience — on an aggregated and anonymised basis.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), ubet processes your personal data on valid legal grounds. These grounds are:

• Consent: You provide explicit consent when registering a ubet account and accepting these Terms & Conditions and Privacy Policy. This consent applies to most routine data processing, including account management and platform services.
• Contract performance: Processing is necessary to fulfil the agreement between you and ubet — including processing deposits, withdrawals and managing your betting account.
• Legitimate interests: ubet has a legitimate interest in processing certain data for platform security, fraud prevention and service improvement purposes, provided this does not override your fundamental rights.
• Legal obligations: Some data processing is necessary to comply with laws applicable to ubet, including AML legislation and financial reporting requirements.

If you wish to withdraw consent previously given for a specific purpose (such as marketing communications), you may do so at any time through your account settings or by contacting support@ubet.express. Withdrawal of consent does not affect the lawfulness of any processing that took place prior to the withdrawal.

Ubet does not sell your personal data. We only share your personal data with third parties in the limited circumstances set out below, and only to the extent necessary for those purposes:

• Payment service providers: ubet shares the necessary transaction information with e-wallet providers (Touch 'n Go, GrabPay, Boost, ShopeePay), DuitNow, and FPX-supporting banks (Maybank, CIMB, and others) to process deposits and withdrawals in RM.
• Game providers: Slot and casino providers such as Pragmatic Play, PG Soft, NetEnt and others receive only the minimum technical data required to run your game session. These providers are bound by strict confidentiality agreements.
• Technology infrastructure providers: Cloud computing, cybersecurity and analytics service providers that assist ubet in running the platform on a technical level may access data on a limited basis, strictly as required for their respective functions.
• Malaysian authorities: ubet will disclose personal data to the police, the Malaysian Anti-Corruption Commission (MACC), Bank Negara Malaysia or other regulatory bodies if ordered by a court or lawfully requested as part of a criminal investigation.
• Identity verification service providers: For the KYC process, ubet uses certified third-party identity verification services that are bound by strict confidentiality obligations.

All third parties with whom ubet shares data are bound by contractual agreements requiring them to protect your data in accordance with ubet's security standards and applicable laws. They are not permitted to use your data for any purpose beyond what ubet has authorised.

Ubet implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and ubet's servers is protected by TLS protocol with 256-bit SSL encryption. The platform URL begins with HTTPS, confirming a secure connection.
• Encryption at rest: Sensitive data such as passwords and financial information is stored in encrypted form within our databases using the latest industry-standard encryption.
• Access controls: Access to members' personal data is restricted to authorised ubet staff who require it to carry out their duties. The principle of least privilege is applied to all internal data access.
• Two-factor authentication: ubet offers and encourages the use of two-factor authentication (2FA) for all member accounts as an additional layer of protection.
• 24-hour security monitoring: An automated security monitoring system operates around the clock to detect suspicious activity, intrusion attempts, and anomalies in account usage patterns.
• Regular security audits: ubet's security infrastructure is regularly audited by independent cybersecurity experts to identify and address any potential vulnerabilities.
• Staff training: All ubet staff who handle personal data receive ongoing data protection training and are bound by strict confidentiality agreements.

While ubet takes all reasonable steps to protect your data, no security system can be guaranteed to be 100% foolproof. If you suspect your account has been accessed without authorisation, please contact our security team at support@ubet.express immediately.

Ubet retains your personal data only for as long as necessary for the purposes stated in this Policy or as required by law. General data retention guidelines are as follows:

• Active account data: Personal data and activity records are retained for as long as your account remains active on the ubet platform.
• Data following account closure: Following account closure, ubet retains the necessary records for a minimum period of 7 years to meet legal compliance obligations, dispute resolution requirements, and financial reporting obligations under Malaysia's AML laws.
• Financial transaction records: Records of all deposit and withdrawal transactions in RM are retained in accordance with Malaysia's applicable financial and tax laws.
• Support communication data: Records of all live chat sessions and emails with the support team are retained for 3 years from the date of communication for reference and dispute resolution purposes.
• Technical logs: System logs and technical data such as IP addresses and session records are retained for 12 months for security and technical troubleshooting purposes.

Once the relevant retention period has ended, your personal data will be securely and irreversibly deleted or anonymised (converted into a format that can no longer identify you).

The ubet platform uses cookies and similar tracking technologies to enhance your experience, maintain session security and analyse platform usage. The following are the types of cookies we use:

• Essential cookies: These cookies are essential for the core functions of the ubet platform — including secure login, session management and account security. The platform cannot operate properly without them and they cannot be disabled.
• Performance cookies: These cookies collect information about how you use the ubet platform — pages visited, time spent and errors encountered. All such information is aggregated and anonymised, used solely to improve the platform.
• Functional cookies: These cookies remember your preferences such as selected language, display settings and login information for your convenience. They allow ubet to provide a more personalised experience.
• Analytics cookies: ubet uses analytics tools to understand overall usage patterns for product improvement purposes. This data is not used to identify you as an individual.

You can manage cookies through your web browser settings. However, disabling certain cookies may affect the functionality of the ubet platform. For more information on managing cookies, refer to the help documentation of your browser.

Under Malaysia's PDPA and ubet's Privacy Policy, you have the following rights in relation to your personal data held by us. All requests regarding these rights may be submitted to support@ubet.express:

The ubet platform is strictly for individuals aged 18 and above. ubet does not intentionally collect or process personal data of anyone under 18. The ubet registration process includes age verification and identity verification to ensure only adults can open an account.

If ubet discovers that personal data belonging to an individual under the age of 18 has been inadvertently collected, we will take immediate steps to delete that data and close the account in question. Parents or guardians who have reason to believe their minor child has registered a ubet account should contact us immediately at support@ubet.express.

Ubet reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements or new platform features. When we make material changes to this Policy, we will notify you via:

• By email to the address registered to your ubet account, at least 14 days before the changes take effect.
• A prominent notice within the ubet platform when you log in.
• Update the "Last updated" date at the top of this Privacy Policy page.

Your continued use of the ubet platform after the effective date of any changes will be deemed acceptance of the updated Privacy Policy. If you do not agree with the changes, please discontinue use of the platform and contact us to close your account.

If you have any questions, concerns or complaints regarding this Privacy Policy or how ubet handles your personal data, please reach out to us through the following channels:

• Email: support@ubet.express — for all privacy-related enquiries and data rights requests.
• Live Chat: Via the ubet platform — for general privacy enquiries that require a prompt response.

The ubet privacy team is Malaysian-speaking and will respond within 72 business hours to all privacy-related enquiries. More complex requests, such as data access or deletion applications, may require up to 14 business days to be fully resolved.

If you are dissatisfied with ubet's response to your privacy concerns, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia, who is responsible for enforcing the PDPA 2010.