V27 Privacy Policy — Malaysian Player Data Protection

V27 collects several categories of personal data when you register and use our platform. The following are the types of data we may retain:

Identity Data:

• Full name as stated on your Malaysian identity card (MyKad).
• Date of birth for age verification purposes (18 years and above).
• National identification number (for KYC processing when required).
• Photo or copy of an identity document when full identity verification is required.

Contact Details:

• An active mobile phone number registered in Malaysia.
• A valid and active email address.

Financial Data:

• Bank account or e-wallet numbers (Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay) used for deposits and withdrawals.
• A full history of deposit and withdrawal transactions on the v27 platform.
• Net winnings and losses per session and on a cumulative basis.

Technical & Usage Data:

• Your device's IP address at the time of login and platform use.
• Device type, operating system, and web browser used.
• Login history including date, time, and approximate location.
• Records of all gaming activity including games played, bet amounts, and outcomes.
• Session data including time spent in each section of the platform.

V27 collects personal data through several key channels:

• Account Registration: When you complete the registration form on v27.asia, the information you enter is collected directly and stored in our secure database.
• Platform Usage: Your activity on the platform — including games played, bets placed, and interactions with the interface — is automatically recorded for security and service operation purposes.
• Financial Transactions: Every deposit and withdrawal generates a transaction record, which is retained for financial compliance and anti-money laundering (AML) purposes.
• Support Communications: When you contact the v27 support team via Live Chat or email, the content of that communication is retained for reference and service improvement purposes.
• Cookies & Similar Technologies: The v27 platform uses cookies and similar tracking technologies to enhance the user experience. Further details are set out in Section 6.
• Third-Party Sources: In certain cases such as identity verification or anti-fraud checks, v27 may receive data from registered verification service providers.

V27 processes your personal data for the following purposes, each of which has a valid legal basis under Malaysia's PDPA:

• Account Management: Creating, managing, and securing your account at v27.
• Service Provision: Enabling you to access and enjoy all games and features on the v27 platform — from online slots, Live Casino (Baccarat, Blackjack, Roulette), poker, and jackpots to live matches.
• Payment Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX, as well as handling winnings withdrawals to your account.
• Identity Verification (KYC): Ensuring compliance with age and identity verification requirements before processing large withdrawals or when requested by our compliance team.
• Legal Compliance: To fulfil legal obligations including anti-money laundering (AML) requirements, financial reporting, and transaction record-keeping in accordance with Malaysian law.
• Platform Security: Detecting and preventing fraud, system abuse, hacking attempts, and activities that violate v27's Terms & Conditions.
• Service Communications: Sending important notifications regarding your account, transactions, changes to terms, and relevant security updates.
• Marketing (with consent): Sending promotional information, bonuses, and special offers from v27 — only to players who have given explicit consent to receive marketing communications.
• Platform Improvement: Analysing aggregated usage patterns (without identifying individuals) to understand player needs and improve v27's products and services.

V27 does not sell, rent, or disclose players' personal data to third parties for commercial purposes. However, in the following limited circumstances, v27 may share data with specific parties:

• Payment Service Providers: Payment gateways that process your deposit and withdrawal transactions — including Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX providers — receive only the minimum transaction data required to complete the payment.
• Game Service Provider: Game developers such as Evolution Gaming, Pragmatic Play, Ezugi, and other partners receive only the minimum session data required to operate online games. These developers are bound by their own data protection agreements.
• Identity Verification Service Provider: Third-party KYC providers that assist with identity and age verification receive data solely for that purpose.
• Legal Authorities: v27 will disclose personal data to Malaysian authorities — including the police, courts, or regulatory bodies — when required by law, court order, or in the course of a legitimate criminal investigation.
• Business Transfer: In the event of a merger, acquisition, or transfer of v27's business assets, user data may be transferred to the new entity subject to continued compliance with Malaysia's PDPA.

All third parties that receive data from v27 are bound by legally enforceable data protection agreements and are required to store that data securely, use it solely for the specified purpose, and not disclose it to any other party without v27's authorisation.

V27 implements a multi-layered data security framework to protect your personal information against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All data transmitted between your device and v27's servers is encrypted using the latest TLS/SSL protocols, ensuring it cannot be intercepted or read by unauthorised parties during transmission.
• Database Security: Stored data is protected with additional layers of encryption. Database access is restricted to technical personnel who have undergone background checks and data security training.
• Access Controls: A role-based access control (RBAC) system ensures that every v27 staff member can only access the data required for their specific role. No single staff member has access to the entire player database.
• Two-Factor Authentication: v27's internal systems require two-factor authentication for all administrative access — adding an extra layer of protection against unauthorised entry.
• Regular Security Audits: v27 conducts regular penetration testing and security audits by independent third parties to identify and address any system vulnerabilities.
• 24/7 Monitoring: Automated monitoring systems operate around the clock to detect suspicious activity, hacking attempts, or abnormal access patterns.

The v27 platform uses cookies and similar technologies to enhance the user experience and ensure the platform functions correctly. The following are the types of cookies used:

You can manage cookie settings through your web browser. Disabling certain cookies may affect the functionality or user experience of the v27 platform. For guidance on managing cookies in your browser, please refer to the relevant browser help documentation.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding personal data held by v27:

• Right of Access: You have the right to request and receive a copy of the personal data we hold about you. v27 will process access requests within 14 working days.
• Right to Rectification: If any data we hold about you is inaccurate, incomplete, or outdated, you have the right to request a correction. For basic details such as your name and phone number, you can update these directly in your v27 account settings.
• Right to Withdraw Consent: You have the right to withdraw consent previously given for specific data processing activities — particularly for marketing purposes — at any time, without affecting the validity of processing carried out prior to withdrawal.
• Right to Object to Processing: You have the right to object to the processing of your personal data for certain purposes, subject to the legal basis on which that processing relies.
• Right to Erasure (limited): Under certain circumstances, you may request the deletion of your personal data. However, v27 may need to retain certain data for a specified period to fulfil legal obligations — for example, financial transaction records that are required to be kept under Malaysian law.
• Right to Complain: If you believe your privacy rights have been violated by v27, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the above rights, contact the v27 privacy team by email at support@v27.asia with the subject line "Personal Data Rights Request". State the right you wish to exercise and provide sufficient information for us to identify your account. v27 will respond within 14 business days.

V27 retains personal data only for as long as necessary for the purpose it was collected, or as required by Malaysian law. The following are our general data retention guidelines:

• Active Account Data: Retained for as long as your account is active with v27 and for a minimum period of 7 years following account closure, in order to meet Malaysia's financial record-keeping legal requirements.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date, in line with Malaysian financial and anti-money laundering legal requirements.
• Security Logs: Retained for 12 to 24 months for security investigation and fraud detection purposes.
• Support Communication Records: Retained for 2 years from the date of last interaction for reference and service improvement purposes.
• Marketing Data: Retained until you withdraw consent to receive marketing communications, after which the data will be deleted within 30 days.

When data is no longer needed and there is no legal obligation to retain it, v27 will securely delete or anonymise that data using methods that ensure it cannot be recovered.

In operating a platform that makes use of global technology services — including cloud infrastructure, international gaming software providers, and payment gateways — your data may at times be processed or stored on servers located outside Malaysia.

V27 ensures that any cross-border data transfers comply with Malaysia's PDPA requirements in the following ways:

• Data is only transferred to countries or entities that provide a level of data protection equivalent to that of Malaysia.
• All overseas data recipients are bound by legally enforceable data processing agreements.
• Data transferred is limited to what is strictly necessary for the specific service purpose.
• Encryption is applied to all data transferred across international borders.

For any enquiries, requests, or complaints regarding this Privacy Policy or the way v27 handles your personal data, please contact us through the following channels:

• Privacy Email: support@v27.asia (please include "Privacy Enquiry" in the subject line)
• Live Chat: Available 24/7 on the v27 platform — the fastest way to get an immediate response
• Response Time: All privacy enquiries will be responded to within 24 business hours; personal data rights requests within 14 business days

This Privacy Policy may be updated from time to time to reflect changes in our practices, legal requirements, or platform improvements. The latest version will always be available on this page with a clear update date. Significant changes will be communicated to active players via in-platform notifications or email.