Cm8ply Privacy Policy – Malaysian Member Personal Data Protection

Cm8ply Full Privacy Policy

This Privacy Policy describes how cm8ply collect, use, disclose, store, and protect the personal information you provide to us when registering and using our platform. We understand that privacy is a serious matter — especially when financial transactions are involved — and we want you to feel confident that your data is in responsible hands.

This policy applies to all registered cm8ply members, visitors to our website, and any individual who interacts with our platform in any capacity. The effective date of this document is 1 January 2026 and it supersedes all previous versions. We encourage you to read the entire document — it is written in plain language, not legal jargon that requires a lawyer to interpret.

1. Information We Collect

Cm8ply collects various types of personal information depending on how you interact with our platform. In general, there are three main categories of information we collect:

Information You Provide Directly:

• Full name as stated on your Malaysian identity card (MyKad).
• Identity card (IC) number or passport number for non-Malaysian members.
• Date of birth for age verification purposes — you must be at least 18 years old to use the cm8ply platform.
• An active email address used for account communications, important notices, and promotional offers (if you have opted in to receive them).
• Malaysian mobile number for two-factor authentication and important communications.
• Current residential address for identity verification and regulatory compliance purposes.
• Payment method details — the name of the digital wallet holder or bank account number used for deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, or CIMB Clicks.

Automatically Collected Information:

• The IP address of the device used to access the cm8ply platform.
• The type and version of the internet browser used.
• Your device's operating system (Android, iOS, Windows, and so on).
• Session data — including pages visited, time spent, and navigation sequences within the platform.
• Cookie data used to ensure a better user experience and secure session authentication.
• Geolocation information at the country or region level for regulatory compliance purposes.

Identity Verification (KYC) Information:

• A copy of your identity card or passport.
• A selfie or facial photo for basic biometric identity verification.
• Bank statement or proof of current address when required for withdrawals exceeding certain limits or in situations requiring additional verification.

2. Purpose of Data Use

Cm8ply uses collected personal data only for legitimate purposes directly related to delivering our platform services. The table below outlines the primary purposes for which your data is used:

3. Sharing Data with Third Parties

Cm8ply does not sell or rent members' personal data to any third party for commercial purposes. However, in the course of operating our platform lawfully, there are limited situations where we need to share data with certain parties:

• Payment Service Providers — When you make a deposit or withdrawal using Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, the necessary transaction information is shared with the respective payment processor to complete the transaction. All payment processors we work with are licensed and regulated in Malaysia.
• Game Software Providers — Third-party game providers that supply slots, table games, and live casino on the cm8ply platform may receive the minimum account information required to enable games to function properly. They do not receive your full financial information.
• Legal Authorities — cm8ply will disclose the required information to relevant authorities if mandated by law, court order, or in the course of a legitimate criminal investigation. This includes cases involving money laundering, fraud, or security threats.
• Independent Audit Services — Third-party audit firms we engage to conduct security and game fairness reviews may access anonymized transaction data for audit purposes only.

4. Cookies and Tracking Technologies

Platform cm8ply uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better user experience. The following are the types of cookies we use:

• Essential Cookies (Required) — These cookies are required for core platform functions such as login session authentication, account security, and basic navigation. Without them, the platform cannot function properly. This type of cookie cannot be disabled.
• Performance Cookies — Used to collect information about how visitors use our platform — such as the most frequently visited pages and error messages received. This information is used to improve platform performance. This data cannot identify you personally.
• Functional Cookies — Allows the platform to remember your preferences such as language, region, and display settings to provide a more personalised experience during your gaming session.
• Analytics Cookies — Helps cm8ply understand overall usage patterns for product improvement purposes. Analytics data is aggregated and cannot identify individual members.

You can manage your cookie preferences through your web browser settings. Disabling certain cookies may affect the functionality of some parts of the cm8ply platform.

5. Data Security

Cm8ply consistently invests in security infrastructure to protect members' personal data. Key security measures we have implemented include:

• SSL/TLS 256-bit encryption for all data communications between your device and our servers — the same security standard used by major banking institutions in Malaysia.
• An intrusion detection system (IDS) that monitors platform traffic in real time to identify and block suspicious activity before it can cause harm.
• Data segregation — personal information, financial information, and gaming data are stored in separate systems with strict access controls. This means no single cm8ply staff member has access to all categories of data at once.
• Two-factor authentication (2FA) is available and encouraged for all cm8ply member accounts.
• Independent security audits conducted twice a year by a third-party audit firm unaffiliated with cm8ply — to ensure our systems meet the latest security standards.
• Regular data security training for all cm8ply staff with access to systems containing member data.

6. Data Retention Period

Cm8ply retains members' personal data for as long as necessary to fulfil the purpose for which it was collected, or for the duration required by applicable laws and regulatory obligations. In general:

• Active account data is retained for the duration the account remains active and for five (5) years following account closure, for audit and legal compliance purposes.
• Financial transaction records are retained for seven (7) years in accordance with anti-money laundering compliance requirements that are standard in Malaysia's financial industry.
• Customer support records are retained for two (2) years from the date of the last interaction.
• Data collected for marketing purposes (with your consent) is retained until you withdraw your consent or close your account.

Once the retention period has lapsed, data will be securely deleted or anonymised using procedures that ensure it cannot be recovered.

7. How to Exercise Your Privacy Rights

To exercise any of the privacy rights outlined in this document, you may:

• Log in to your cm8ply account and go to the "Privacy Settings" section in your account profile to access or amend certain information directly.
• Contact the cm8ply customer support team via in-platform live chat (operating 24/7 in Bahasa Melayu) for requests that require staff assistance.
• Send an email to support@cm8ply.xyz with the subject line "Privacy Request" and specify the type of right you wish to exercise along with your account details.

Cm8ply is committed to responding to all privacy rights requests within 30 working days from the date the request is received. For more complex cases, we may require additional information from you to verify your identity before processing the request — this is a standard safeguard to ensure that no third party can exercise your rights without your authorisation.

8. Amendments to the Privacy Policy

Cm8ply reserves the right to amend this Privacy Policy from time to time to reflect changes in our data handling practices, new legal requirements, or improvements to how we protect your information. For material amendments, we will notify you through:

• An email notification to your registered email address, sent at least 14 days before the amendment takes effect.
• A notice displayed prominently on the cm8ply platform homepage when you log in.
• Update the "Updated" date at the top of this document.

Continued use of the platform cm8ply after the effective date of such amendments will be considered your acceptance of the revised Privacy Policy. If you do not agree with any amendments, you have the right to close your account before the effective date.

9. Marketing and Promotional Communications

Cm8ply may send you marketing communications about the latest promotions, new bonuses, and platform updates — but only if you have explicitly given your consent to receive such communications during registration or through the communication preference settings in your account.

You may withdraw your consent to receive marketing communications at any time in the following ways:

• Click the "Unsubscribe" link found at the bottom of every marketing email you receive from cm8ply.
• Update your communication preferences in your cm8ply account settings.
• Contact cm8ply customer support and request to be removed from the marketing communications list.

Withdrawing consent for marketing communications will not affect your receipt of important non-marketing account communications — such as security notices, transaction confirmations, or significant policy updates.

10. Children's Privacy

Platform cm8ply is intended for individuals aged 18 and above only. We do not knowingly collect or process personal data from individuals under the age of 18. Should we discover that personal information from a minor has been collected without our knowledge, we will promptly delete that information and close the relevant account. If you have reason to believe that someone under the age of 18 has registered an account at cm8ply, please contact us immediately at support@cm8ply.xyz.