Privacy Policy xcom2 – Malaysia Personal Data Protection

1 Introduction – xcom2's Privacy Commitment

Xcom2 is an online entertainment platform that operates with the trust and wellbeing of every member at its core. As part of xcom2's fundamental commitment to transparency and accountability, we have prepared this Privacy Policy as a clear and straightforward guide to how we manage your personal data from the moment you register until your xcom2 account remains active in our systems.

This Privacy Policy is designed to fully comply with the provisions of Malaysia's Personal Data Protection Act 2010 (PDPA) – the principal legislation governing the collection and processing of personal data in our country. xcom2 regards compliance with the PDPA not merely as a legal obligation, but as a genuine expression of our commitment to respecting the privacy rights of every Malaysian who chooses to play with us.

By registering and using the xcom2 platform, you acknowledge that you have read and understood this Privacy Policy and agree to the manner in which xcom2 collects and uses your personal data as described in this document. If you have any doubts or questions, the xcom2 support team is always on hand to help you better understand this Privacy Policy.

2 Types of Personal Data We Collect

Xcom2 collects two main categories of data from members and users of our platform – data you provide directly when registering or using our platform, and data collected automatically as you browse or interact with the xcom2 platform.

Data you provide directly to xcom2 includes:

• Identity Information – Your full name, Malaysian identity card number (MyKad), date of birth, and gender are required for identity verification and to confirm that you meet xcom2's minimum age requirement.
• Contact Information – An active Malaysian mobile number, email address and current residential address in Malaysia, required for account-related communications and services.
• Financial Information – Details of the payment methods you use for deposits and withdrawals, including your DuitNow account number, the phone number linked to your Touch 'n Go eWallet, GrabPay, Boost or ShopeePay, or your FPX Maybank2u and CIMB Clicks information. Note: xcom2 does not store credit or debit card numbers directly.
• Account Information – Your username, encrypted password and account preferences configured within the xcom2 platform.
• Communications – Records of any communications you send to the xcom2 support team via live chat, email or WhatsApp, including enquiries, complaints and feedback.

Data collected automatically by xcom2 includes:

• Your device's IP address and associated network information.
• Device type, operating system and web browser version you are using.
• Gaming session data including games played, bet amounts, game outcomes and session duration.
• Cookie data and tracking technologies as described in the Cookies section of this Privacy Policy.
• Platform activity logs including login times, in-account actions and transaction records.

3 How xcom2 Collects Your Personal Data

Xcom2 collects your personal data through several distinct channels over the course of your interactions with our platform. Understanding how this data is collected is key to giving you full visibility and control over your own personal information.

Direct Collection occurs when you actively provide information to xcom2 – for example, when completing a new account registration form, submitting requested identity verification documents, making your first deposit via DuitNow or Touch 'n Go eWallet, submitting a winnings withdrawal request, contacting the xcom2 support team with any enquiry or complaint, or filling in feedback forms and surveys we conduct from time to time.

Automatic Collection occurs while you use the xcom2 platform without any specific action on your part — this includes technical data collected by xcom2 servers when you access our website or app, session data recorded for the purpose of winnings settlement and game fairness verification, and cookie data collected to enhance your browsing experience and account security.

• New xcom2 account registration via the online form on our official website.
• The KYC (Know Your Customer) identity verification process required for certain accounts.
• Financial transactions including deposits made via approved Malaysian local payment methods.
• Two-way communication with the xcom2 support team through our various official channels.
• Cookie and web analytics technology as you browse the xcom2 platform.
• Xcom2 referral or promotional programmes that require additional information from participants.

4 How We Use Your Personal Data

Xcom2 uses collected personal data solely for purposes that are lawful, necessary and directly related to delivering our platform services to you. We do not use your data for purposes you would not expect or that could be detrimental to your interests.

The primary purposes for which xcom2 uses your personal data are as follows:

• Account Management – Creating, verifying and managing your xcom2 account, including the login process, two-factor authentication and account settings changes made at your request.
• Financial Transaction Processing – Processing deposits and withdrawals in MYR (RM) via your chosen local payment method – DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX Maybank2u and CIMB Clicks.
• Identity Verification & KYC – To confirm that you meet the minimum eligibility age of 21 and to verify your identity in compliance with our legal obligations on fraud prevention and anti-money laundering.
• Gaming Service Delivery – To ensure a seamless gaming experience, maintain game records for accurate and fair winnings settlement, and allow you to access your gaming history.
• Service Communications – Sending account-related notifications, transaction confirmations, important policy updates and responses to any enquiries or complaints you submit to the xcom2 support team.
• Security & Fraud Prevention – Detecting, investigating and preventing fraudulent activity, unauthorised access, bonus abuse and violations of xcom2's Terms & Conditions using our security analytics systems.
• Legal Compliance – To fulfil xcom2's obligations under applicable Malaysian law, including PDPA 2010, reporting requirements to the relevant authorities and compliance with any lawful court orders.
• Platform Improvements – Using aggregated, anonymised analytics data to understand platform usage patterns, identify areas for improvement and develop new features better suited to the needs of Malaysian players.

5 Data Sharing – Who Can See Your Information?

Xcom2 firmly upholds a zero-sell principle – we have never sold, rented or exchanged our members' personal data to any third party for commercial or marketing purposes. This is an absolute promise we make to all 850,000+ registered xcom2 members across Malaysia.

However, in the normal course of operating our platform, there are a limited number of situations in which your personal data may be shared with specific parties:

• Licensed Payment Processors – Transaction information required is shared with licensed payment processors handling DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX banking institutions such as Maybank and CIMB. Such sharing is strictly limited to the data necessary to process your transaction securely.
• Technology Service Providers – Technology infrastructure companies that support xcom2's operations — such as cloud server providers and cybersecurity system vendors — may have limited access to data in the course of carrying out their duties. All such parties are bound by strict confidentiality agreements with xcom2.
• Legal Authority – xcom2 will disclose personal data to the relevant Malaysian authorities where required to do so by a valid court order, an official request from law enforcement, or as part of xcom2's statutory reporting obligations under applicable legislation.
• Professional Advisors – In certain cases involving legal proceedings or audits, the legal advisors, auditors or professional consultants engaged may require access to specific data. All such parties are bound by strict professional confidentiality obligations.

In all of the data-sharing situations described above, xcom2 ensures that only the minimum data genuinely necessary for the stated purpose is shared, and that all parties receiving such data are bound by data protection obligations equivalent to or higher than xcom2's own standards.

6 Data Security – How xcom2 Protects Your Information

Xcom2 continuously invests in the latest security infrastructure and practices to ensure your personal data is protected from every possible angle. Data security is not a one-time task — it is an ongoing process that we take seriously every single day.

The technical security measures xcom2 employs to protect your personal data include:

• 256-bit SSL Encryption – All data communications between your device and xcom2's servers are protected by 256-bit SSL encryption, ensuring that no unauthorised third party can intercept or read your data in transit.
• Data Encryption at Rest – Sensitive data stored in xcom2's databases — including passwords and financial information — is encrypted using strong cryptographic algorithms before being stored, ensuring the data remains unreadable even if physically accessed.
• Layered Access Control – Only specific xcom2 staff with a legitimate business need have access to members' personal data, and every instance of access is recorded in an audit log that is continuously monitored.
• 24/7 Threat Monitoring – xcom2's automated threat detection system monitors all platform activity around the clock to identify and respond to any suspicious behaviour before it can cause harm.
• Regular Security Audits – Qualified independent cybersecurity firms conduct comprehensive security audits of xcom2's infrastructure on a regular basis to identify and remediate any potential vulnerabilities.
• Two-Factor Authentication (2FA) – xcom2 supports and recommends the use of 2FA on all accounts to provide an additional layer of protection against unauthorised access, even in the event that your password is compromised.

7 Data Storage & Retention Period

Xcom2 retains your personal data for as long as your account remains active in our system, for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required under applicable Malaysian law.

Xcom2's data retention principles are based on genuine necessity, not convenience or commercial interest alone. The following outlines our data retention periods:

• Active Account Data – For as long as your xcom2 account is active and you are using our platform, the personal data associated with your account will be retained to ensure uninterrupted service continuity.
• Financial Transaction Records – All records of deposit and withdrawal transactions in MYR are retained for a minimum of seven (7) years in accordance with Malaysia's accounting and tax legislation, even after an account is closed.
• Data After Account Closure – After your xcom2 account is closed at your request, your core personal data will be minimised to the least amount required for legal purposes and permanently deleted once the mandatory retention period has elapsed.
• Communication Logs – Communication records with the xcom2 support team are retained for two (2) years for reference, dispute resolution and customer service improvement purposes.

Once your personal data is no longer required and the mandatory retention period has expired, xcom2 will delete or destroy that data securely and irreversibly in accordance with our documented data deletion procedures.

8 Cookies & Tracking Technologies

Like most online platforms, xcom2 uses cookies and similar tracking technologies to enhance your experience, maintain account security and understand how our platform is used. This section transparently explains the types of cookies we use and their purpose.

Types of cookies used by xcom2:

• Essential Cookies – Required for the core functions of the xcom2 platform to operate correctly, including login authentication, session management and security. These cookies cannot be disabled as they are critical to the platform's security and basic functionality.
• Performance Cookies – Collects information on how you use the xcom2 platform — pages visited, time spent and any error messages encountered. This data is used in aggregate and anonymised form to improve our platform's performance.
• Functional Cookies – Allows the xcom2 platform to remember your preferences – such as language, display settings and game selections – to deliver a more personalised and comfortable experience throughout your gaming sessions.
• Security Cookies – Used to detect fraudulent activity, protect your account from unauthorised access and maintain the integrity of your login session throughout your time on the xcom2 platform.

You can manage your cookie settings through your web browser's settings. Please note that disabling certain cookies may affect the functionality and user experience of the xcom2 platform, particularly cookies related to security and login authentication.

9 Your Rights Under Malaysia's PDPA

As an xcom2 platform user and a Malaysian citizen protected under the Personal Data Protection Act 2010 (PDPA), you have several clear and enforceable rights regarding your personal data held within xcom2's systems. xcom2 fully respects and facilitates the exercise of all these rights.

10 Children's Data Protection

Xcom2 does not provide services to individuals under the age of 21. We do not knowingly collect any personal data from minors. If you suspect that an underage individual has registered an xcom2 account, please contact our support team at [email protected] immediately so we can take appropriate action to close the account and delete all associated data.

Should xcom2 discover that we have inadvertently collected personal data from an individual under the age of 21, we will take immediate steps to permanently delete that data from our systems and close the account in question without unnecessary delay.

11 Changes to This Privacy Policy

Xcom2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements in Malaysia, or improvements in how we protect our members' personal data. Any changes made are intended to strengthen the protections you receive, not to diminish them.

When material changes are made to this Privacy Policy, xcom2 will notify all registered members via the email address linked to their xcom2 account and/or through a prominent in-platform notification at least seven (7) days before the changes take effect. This gives you sufficient time to review the updates and make an informed decision about your continued use of the xcom2 platform.

Continued use of the xcom2 platform after an updated Privacy Policy takes effect will be considered your acceptance of the new version. If you do not agree with the changes made, you have the right to discontinue use of xcom2 and close your account before the changes come into effect.

12 Contact the xcom2 Privacy Officer

If you have any questions, concerns or requests relating to this xcom2 Privacy Policy or how we handle your personal data, please do not hesitate to get in touch. Our privacy and support team is always on hand to assist you in Bahasa Melayu.

You can reach xcom2 through the following channels:

• Official Privacy Email – [email protected] (Please include "Privacy Enquiry" in your email subject line for faster processing)
• Live Chat – Accessible directly within the xcom2 platform, with responses typically within 5 minutes, available 24 hours a day, 7 days a week including Malaysian public holidays.
• Official WhatsApp – Via the official xcom2 WhatsApp number listed in the "Contact Us" section of our platform

For official PDPA-related requests such as data access, data correction or data deletion, please submit your request by email to [email protected] along with proof of identity for verification purposes. xcom2 will respond to all official privacy requests within 14 business days of receipt.

We are committed to resolving all privacy concerns in a fair, transparent and timely manner. If you are not satisfied with xcom2's response, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection.