UDM19 Privacy Policy – Personal Data Protection for Malaysian Members

UDM19 is a Sports Betting, Live Casino, e-sports and online gaming platform that understands just how sensitive the personal data of Malaysian users can be. We do not treat privacy as a box to tick — it is a genuine commitment that informs every product and operational decision we make.

This Privacy Policy applies to all personal data collected through: (i) account registration and use UDM19; (ii) financial transactions including deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, and ShopeePay; (iii) interactions with our customer support team; (iv) use of the UDM19 mobile app; and (v) visits to udm19.click.

This policy is written in English as we are committed to ensuring every Malaysian member can read and understand their rights clearly, without needing to rely on third-party translations or interpretations.

UDM19 collects your personal data through several different means, depending on how you interact with our platform. The following are the categories of data we collect:

We do not collect sensitive category data such as health information, political views, religious beliefs or biometric data, unless specifically required for compliance with anti-money laundering (AML) laws.

UDM19 uses your personal data for the following purposes, all of which are lawful and necessary for the operation of the platform:

• Account Management: Creating, verifying and maintaining your account on the UDM19 platform, including the identity verification process (KYC) required by law.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, DuitNow, FPX (Maybank2u, CIMB Clicks), GrabPay, Boost and ShopeePay, as well as managing withdrawals to your account.
• Service Delivery: Gives you access to all features on the UDM19 platform — from EPL and Malaysia Super League Sports Betting, Live Casino, e-sports such as Mobile Legends and VALORANT, to slots and table games.
• Customer Support: Handling enquiries, complaints and support requests submitted via live chat, email or WhatsApp.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, unauthorised access, and platform abuse.
• Legal Compliance: Fulfilling legal obligations under PDPA 2010, anti-money laundering laws (AMLA) and our operating licence regulations.
• Platform Improvements: Analysing aggregated usage data (without identifying individuals) to understand how members use the platform and to drive continuous improvements.
• Service Communications: Sending important notifications regarding your account, transactions, changes to our terms and security information directly relevant to your use of the platform.
• Marketing (With Consent): Sends information about promotions, new bonuses, and special offers UDM19 — but only where you have given your consent. You may withdraw this consent at any time.

Under Malaysia's Personal Data Protection Act (PDPA) 2010, UDM19 process your personal data on the following legal bases:

• Consent: For marketing and promotional communications, we require your explicit consent. You may withdraw this consent at any time without affecting the validity of services previously provided.
• Contract Performance: The majority of our data processing is necessary to fulfil the service contract between you and UDM19 — namely the Terms & Conditions you accepted upon registration.
• Legal Obligations: Certain data processing is required to fulfil our obligations under Malaysian law, including the PDPA 2010, the Anti-Money Laundering Act (AMLA), and licensing regulations.
• Legitimate Interests: For platform security, fraud prevention, and service improvement purposes, we process data on the basis of legitimate business interests that do not prejudice your fundamental rights.

UDM19 does not sell, rent or share your personal data with third parties for their own commercial purposes. There are, however, situations where we need to share your data with certain parties to enable the platform to function properly:

• Payment Processing Providers: To process your deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost and ShopeePay, we are required to share the necessary transaction information with the respective payment providers. These providers are bound by strict data confidentiality agreements.
• Game Providers: To deliver live casino games, slots and e-sports, minimal session information is shared with our licensed game providers. No full identity data is shared.
• Cloud Services & Infrastructure: UDM19's servers and infrastructure are managed by certified cloud service providers, bound by strict data processing agreements.
• Legal Authorities: If required by a court order, warrant, or lawful request from a Malaysian law enforcement agency, we will disclose the necessary data. We will endeavour to notify you of any such request unless prohibited from doing so by law.
• Auditors & Professional Advisors: Independent auditors, accountants and legal advisors who are bound by professional confidentiality obligations may access certain data in the course of their professional duties.

UDM19 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, misuse, alteration, or destruction. Our key measures include:

• 256-bit SSL Encryption: All communications between your browser or app and UDM19's servers are encrypted using the latest Transport Layer Security (TLS) technology with 256-bit key strength.
• Strict Access Controls: Only staff with a legitimate business need may access members' personal data. All access is logged, monitored, and reviewed on a regular basis. Access follows a "least privilege" principle — staff can only view the minimum data required for their specific tasks.
• Two-Factor Authentication (2FA): All internal access to systems containing user data requires two-factor authentication for UDM19 staff.
• 24/7 Security Monitoring: Our systems are continuously monitored by automated security tools that detect and alert on any suspicious activity in real time.
• Regular Security Audits: UDM19 conducts regular penetration testing and independent security audits to identify and patch vulnerabilities before they can be exploited.
• Encrypted Data Backup: All data backups are performed regularly and stored in encrypted form at a location separate from the primary servers.
• Staff Training: All UDM19 staff who handle personal data undergo regular data protection training and are bound by strict confidentiality agreements.

While we take all reasonable steps to protect your data, no system can be guaranteed 100% secure. We encourage you to do your part by using a strong password, enabling 2FA, and keeping your login credentials private.

Platform UDM19 use cookies and similar tracking technologies to enhance your experience, analyse platform usage and maintain account security. The following are the types of cookies we use:

You can manage and delete cookies through your browser settings. Please note that disabling essential cookies may affect platform functionality — you may be unable to log in or use certain features fully. Analytics and preference cookies can be disabled without affecting basic platform use.

Under Malaysia's PDPA 2010, you have several important rights regarding your personal data held by UDM19. We are committed to making the exercise of these rights straightforward:

• Right of Access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 21 days of receipt.
• Right to Rectification: If your data is inaccurate or incomplete, you may request a correction. Most profile information can be updated directly from your account settings.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data — particularly where the data is no longer needed for the purpose it was collected, or where you withdraw your consent. Please note that we may be required to retain certain data for legal compliance purposes.
• Right to Restrict Processing: You may request that we stop processing your data for marketing purposes at any time. This will not affect the delivery of core services.
• Right to Data Portability: You may request your personal data in a machine-readable format for transfer to another service provider.
• Right to Withdraw Consent: For consent-based processing (such as marketing emails), you may withdraw your consent at any time via your account settings or by contacting us.

To exercise any of the above rights, please contact our Privacy Officer at support@udm19.click with the email subject "Data Privacy Rights Request", along with your account number and the type of request. We will verify your identity before processing your request to ensure your data remains secure.

UDM19 retain your personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required by law. The following are our general retention guidelines:

• Active Account Data: Retained for the duration of your active account plus 5 years after account closure, for compliance with anti-money laundering laws (AMLA).
• Financial Transaction Records: Retained for 7 years from the transaction date, in line with Malaysian accounting and tax legal requirements.
• Support Communication Logs: Retained for 2 years from the date of interaction for reference and dispute resolution purposes.
• Security & Access Logs: Retained for 1 year for security incident investigation purposes.
• Marketing Data: Deleted within 30 days after you withdraw your marketing consent.

Once a retention period expires, data is securely deleted or anonymised using methods that ensure it cannot be recovered. You may also request early deletion — subject to any legal requirements that prevent the deletion of specific data.

In the course of our operations, UDM19 may need to transfer your personal data to servers or entities located outside Malaysia — for example, cloud service providers or licensed international game suppliers.

When this occurs, UDM19 ensuring that all such transfers are carried out with adequate safeguards in place, through: (i) data transfer agreements that impose protection obligations equivalent to those under PDPA 2010; (ii) selecting recipient countries or entities recognised as having adequate data protection laws; or (iii) other approved safeguard mechanisms permitted under applicable law.

UDM19 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, technology used, legal requirements, or other relevant factors. The "Last Updated" date at the top of this document will always indicate the date of the most recent revision.

When we make significant changes to how we handle your personal data, we will notify you by email to the address registered on your account, or via a prominent notification within the platform. We encourage you to review this Privacy Policy periodically.

Continued use of the platform UDM19 after the change notification is considered acceptance of the updated Privacy Policy. If you disagree with the changes, you have the right to close your account and request data deletion in accordance with the procedures set out in Section 8.

If you have any questions, concerns or complaints regarding this Privacy Policy or how UDM19 manage your personal data, please contact our Data Protection Officer:

• Email: support@udm19.click — use the subject line "Data Privacy: [Query Type]"
• Live Chat: Available 24/7 on the udm19 platform — average response time under 3 minutes
• WhatsApp: Number available within the platform after logging in

For formal complaints or enquiries relating to the PDPA, you also have the right to contact the Department of Personal Data Protection Malaysia (JPDP), the regulatory body under the Ministry of Communications. That said, we encourage you to reach out to us first — we are committed to resolving every data issue directly, fairly and promptly.