ATM2U Privacy Policy – Personal Data Protection for Malaysian Members

1. Introduction & Scope of This Policy

ATM2U ("we", "the platform") operates the online betting website and services under the domain atm2u.best. This Privacy Policy outlines our commitment to protecting the personal data of all registered members and users of the ATM2U platform in Malaysia.

This policy is drawn up in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and sets out the types of personal data we collect, the purposes of collection, how we use it, who we share it with, and your rights as a data subject. We take this responsibility very seriously, as we believe every ATM2U member has the right to know how their information is handled.

By registering an ATM2U account or continuing to use our platform after this Policy has been updated, you consent to ATM2U processing your personal data in the manner described in this document. If you do not agree with any part of this Policy, please discontinue use of the platform and contact us to close your account.

2. Personal Data We Collect

ATM2U collects your personal data through three main channels: information you provide directly during registration or platform use, data generated automatically as you use the platform, and in limited cases, information received from authorised payment providers.

2.1 Data You Provide Directly

2.2 Automatically Generated Data

While you use the ATM2U platform, our systems automatically record certain technical information needed to ensure the platform operates securely and smoothly. This includes your device's IP address, the type and version of your web browser or app, login and logout session data, in-platform navigation history, a record of all transactions and bets placed, and gameplay data such as games played, session duration, and bet amounts.

This data is used for security purposes (detecting suspicious logins or fraudulent activity), technical maintenance, and improving the user experience on the ATM2U platform. It is not used to build marketing profiles or sold to third parties.

3. How We Use Your Personal Data

ATM2U uses your personal data only for legitimate purposes that have been made known to you. Below is a complete list of the purposes for which ATM2U member data is used:

• Account Management: Creating and managing your ATM2U account, processing registrations, and maintaining accurate account records.
• Transaction Processing: Deposits are processed via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, with withdrawals sent directly to your Malaysian bank account or e-wallet.
• Identity Verification (KYC): Verifying members' identity and age in accordance with anti-money laundering (AML) compliance requirements and licence obligations.
• Platform Security: Detecting and preventing fraud, bot usage, collusion, money laundering, and any activity that violates ATM2U's Terms & Conditions.
• Customer Support: Responding to your enquiries, complaints, and requests via Live Chat or email in Bahasa Melayu.
• Legal Compliance: Meeting legal obligations under Malaysia's PDPA, licensing requirements, and lawful requests from relevant authorities.
• Service Communications: Sending important account notifications such as deposit confirmations, security alerts, or updates to our Terms or Privacy Policy.
• Platform Improvements: Aggregated usage patterns are analysed (without identifying individuals) to improve features, performance, and the overall ATM2U platform experience.
• Responsible Gaming: Monitoring betting patterns to identify members who may need responsible gambling support, and enforcing limits set by members themselves.

ATM2U does not use your personal data for automated decision-making that could significantly affect your rights without human intervention, except in cases of automated fraud detection where temporary measures may be taken to protect your account pending manual review.

4. Data Sharing & Disclosure

ATM2U does not sell, rent, or transfer members' personal data to third parties for marketing purposes under any circumstances. However, there are limited situations in which ATM2U may share personal data with trusted parties:

• Payment Providers: Required transaction information is shared with authorised Malaysian payment providers such as Touch 'n Go, GrabPay, DuitNow, and FPX banks to process your deposits and withdrawals. These providers maintain their own privacy policies and are bound by strict confidentiality obligations.
• Gaming Software Providers: Only the minimum technical details required for gameplay are shared with authorised casino gaming and betting software providers. This data does not include any personally identifiable information.
• Audit & Security Firms: Third parties authorised to audit game fairness (RNG), platform security, and licence compliance may access certain technical data under strict confidentiality agreements.
• Legal Authorities: ATM2U will disclose personal data to Malaysian legal authorities where required by a valid court order, AML investigation requirements, or legitimate licence compliance obligations. ATM2U will notify the relevant member of such disclosure unless prohibited by law or court order.

5. Data Security at atm2u

ATM2U continually invests in information security technologies and procedures to protect members' personal data from unauthorised access, disclosure, alteration, or accidental deletion. Key security measures we employ include:

• 256-bit SSL/TLS encryption for all communications between clients and ATM2U servers.
• Passwords are stored using a strong hashing algorithm (bcrypt with salt) — ATM2U never stores your password in plain text.
• Two-factor authentication (2FA) available on all member accounts as an additional layer of protection.
• Round-the-clock security monitoring by ATM2U's information security team, detecting suspicious activity in real time.
• Data segregation — member funds are held in accounts that are completely separate from ATM2U's operational accounts.
• Strict access controls — only ATM2U staff who require data access to carry out their duties are granted permission, and all access is recorded in audit logs.
• Regular penetration testing by independent security firms to identify and address system vulnerabilities.
• Encrypted data backups are performed regularly to a secure, separate location to ensure continuity of service.

While ATM2U takes all reasonable steps to protect your data, no security system can be guaranteed 100% secure. You also play an important role in your account's security by using a strong password, enabling 2FA, and never sharing your login credentials with anyone.

6. Your Rights Under PDPA Malaysia

As an ATM2U member and data subject under PDPA Malaysia 2010, you have the following rights regarding the personal data we hold:

To exercise any of the rights above, please send a written request to support@atm2u.best with the subject line "PDPA Data Rights Request", along with a copy of your identification document for identity verification. ATM2U will process your request within 21 business days as required under Malaysia's PDPA. We do not charge any fee for reasonable requests; however, we reserve the right to impose a reasonable fee for requests that are repetitive or excessive.

7. Cookies, Trackers & Similar Technologies

ATM2U uses cookies and similar tracking technologies to enhance user experience and platform security. Cookies are small text files stored on your device when you visit the ATM2U platform. We use the following types of cookies:

• Essential Cookies: Required for the ATM2U platform to function. This includes login session cookies, CSRF security cookies, and cookies that store your language preference. Disabling these cookies will prevent the platform from functioning properly.
• Performance & Analytics Cookies: Used to understand how members use the ATM2U platform — which pages are visited most frequently, where members encounter difficulties, and how we can improve the platform. Analytics data is collected in aggregate and does not identify individuals.
• Functional Cookies: Saving your preferences and settings on the ATM2U platform so you do not need to reconfigure them each time you log in — including display preferences, betting limit settings, and language selection.
• Security Cookies: Used to detect suspicious access patterns, prevent fraud, and protect member accounts from unauthorised use.

You can manage or delete cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the ATM2U platform and your ability to log in or conduct transactions securely.

8. Data Retention Period

ATM2U retains your personal data only for as long as necessary to fulfil the original purpose of collection, or for the period required by Malaysian law. The following are general guidelines on data retention periods:

• Active Account Data: Retained for the duration your ATM2U account remains active and for 7 years after account closure, in compliance with financial and AML regulations.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysian financial regulatory requirements.
• KYC Verification Data: Retained for the lifetime of the account and 7 years after account closure in accordance with AML compliance requirements.
• Support Communication Logs: Retained for 3 years for reference and service improvement purposes.
• Technical Log Data: Retained for 12 months for security and technical debugging purposes.

Once the relevant retention period has elapsed, your personal data will be securely deleted using methods that ensure the data cannot be recovered. Should you request deletion of your data before the mandatory retention period expires, ATM2U will comply with your request to the extent permitted by Malaysian law.

9. Child Protection

ATM2U is strictly for users aged 21 and above. ATM2U does not knowingly collect or process personal data from individuals under the age of 21. Should we find that personal data of an underage individual has been collected through fraud or error, we will delete that data immediately and terminate the associated account.

If you believe that a person under the age of 21 has registered an account on ATM2U, please notify us immediately at support@atm2u.best so that appropriate action can be taken without delay.

10. Links to Third-Party Platforms

The ATM2U platform may contain links to third-party websites or applications in certain contexts. ATM2U is not responsible for the privacy practices or content of those third-party platforms. We recommend reading the privacy policy of every platform you visit. The presence of links to other platforms within ATM2U does not imply our endorsement of or responsibility for their content or privacy practices.

11. Amendments to This Privacy Policy

ATM2U reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or service improvements. Members will be notified of any significant amendments via their registered email or an in-platform notification on ATM2U at least 14 days before the changes take effect, except where immediate changes are required for security or legal reasons.

The "Last Updated" date at the top of this document will be revised whenever changes are made. Your continued use of the ATM2U platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Policy periodically to stay informed of how ATM2U protects your information.

12. Contact Us About Privacy

If you have any questions, concerns, or complaints regarding ATM2U's Privacy Policy or how we handle your personal data, please contact ATM2U's Privacy Officer through the following channels:

• Privacy Email: support@atm2u.best (please state "Privacy Enquiry" in the email subject line)
• Live Chat: Available 24 hours a day, 7 days a week in Bahasa Melayu — average response time under 3 minutes

ATM2U is committed to addressing all privacy enquiries and complaints seriously and within the timeframes stipulated by Malaysia's PDPA. If you are not satisfied with our response, you have the right to lodge a complaint with the Malaysian Personal Data Protection Commissioner.