Privacy Policy
super22 Data Commitment

Introduction

This Privacy Policy ("Policy") is issued by super22, the operator of the online casino and sports betting platform accessible at https://super22.cam (the "Platform"). super22 is an English-language gaming platform serving players in Malaysia and other eligible jurisdictions.

This Policy governs how super22 collects, uses, stores, discloses, and otherwise processes personal data relating to individuals who access or use the Platform, register an account, or interact with super22 in any capacity ("you", "User", "Player"). It is to be read alongside the super22 Terms & Conditions and Responsible Gambling Policy, each of which is incorporated by reference.

super22 is committed to processing personal data in a lawful, fair, and transparent manner. We collect only the data that is necessary for the purposes described in this Policy, and we take reasonable technical and organisational measures to protect that data against unauthorised access, loss, or disclosure.

Definitions

In this Privacy Policy, the following terms carry the meanings set out below:

Personal Data We Collect

super22 collects personal data from you directly, automatically through your use of the Platform, and from authorised third-party sources. The categories of personal data we collect include:

3.1 Registration & Identity Data

• Full legal name, date of birth, and gender;
• Malaysian MyKad number, passport number, or other government-issued identification number;
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam) and postcode;
• Email address and mobile phone number;
• Username and encrypted account password.

3.2 KYC Verification Data

• Copies of government-issued photo identification (Malaysian MyKad, passport, or driver's licence);
• Proof of residential address documents (e.g., utility bills, bank statements);
• Source of funds documentation where requested for compliance purposes;
• Selfie or liveness verification images submitted during KYC review.

3.3 Financial & Transaction Data

• Details of deposits and withdrawals, including amounts (denominated in MYR), timestamps, and payment method references;
• E-wallet account identifiers for Touch 'n Go eWallet, Boost, and GrabPay transactions;
• Malaysian bank account details for DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and RHB transfers;
• Cryptocurrency wallet addresses for BTC, ETH, USDT, and BNB transactions;
• Wagering history, bet amounts, game activity, and win/loss records.

3.4 Technical & Usage Data

• IP address, device type, operating system, and browser information;
• Session duration, pages visited, and features accessed on the Platform;
• Geolocation data derived from IP address (country and region level only);
• Error logs and platform performance data for diagnostic purposes.

3.5 Communications Data

• Records of live chat, email, and support ticket correspondence with super22's customer service team;
• Feedback, complaints, and survey responses submitted by you;
• Marketing preference settings and opt-in/opt-out records.

Purposes of Data Processing

super22 processes your personal data for the following specified, explicit, and legitimate purposes:

Legal Bases for Processing

super22 processes your personal data on the following legal bases:

• Contractual Necessity: Processing that is necessary for the performance of the agreement between you and super22, including account management, payment processing, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC verification, anti-money laundering obligations, and gaming licence conditions.
• Legitimate Interests: Processing necessary for super22's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and business analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and optional personalisation features, where you have given freely informed and specific consent. You may withdraw this consent at any time by contacting us or updating your account preferences.

Data Sharing & Third-Party Disclosure

super22 does not sell, rent, or trade your personal data to third parties for commercial gain. We share personal data with third parties only where necessary and only as described below:

• Payment Service Providers: Licensed Malaysian e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), FPX banking partners (Maybank, CIMB, Public Bank, Hong Leong, RHB), DuitNow infrastructure providers, and cryptocurrency processing services. These providers act as Data Processors under binding data processing agreements.
• KYC & Identity Verification Providers: Authorised third-party identity verification services engaged by super22 for the purpose of conducting KYC checks in compliance with regulatory requirements.
• Cloud Infrastructure & Hosting Providers: Technology service providers who host the Platform infrastructure. All providers are subject to contractual data protection obligations.
• Regulatory & Law Enforcement Authorities: Where required by law, court order, or applicable regulation, super22 may disclose personal data to competent government authorities, regulatory bodies, or law enforcement agencies.
• Fraud Prevention Services: Third-party providers used to identify and prevent fraudulent activity, money laundering, and other prohibited conduct on the Platform.
• Professional Advisers: Legal counsel, auditors, and compliance consultants, under obligations of professional confidentiality.

Cookies & Tracking Technologies

super22 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication tokens, security identifiers, and load-balancing cookies. They cannot be disabled without affecting Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including page views, session duration, and error events. This data is used solely to improve Platform performance.
• Functionality Cookies: Used to remember your preferences, such as language settings and responsible gambling tool configurations.

super22 does not use third-party advertising cookies, behavioural targeting cookies, or social media tracking pixels on the Platform. You may control cookie settings through your browser preferences. Please note that disabling essential cookies may impair your ability to access certain Platform features.

Data Retention

super22 retains your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the duration of your active account on the Platform.
• Post-Closure Account Data: Following account closure, personal data is retained for a minimum of five (5) years to satisfy anti-money laundering obligations, gaming regulatory record-keeping requirements, and to resolve any post-closure disputes.
• KYC Documents: Retained for a minimum of five years from the date of submission, in accordance with applicable regulatory requirements.
• Transaction Records: Retained for a minimum of seven (7) years for financial audit and regulatory compliance purposes.
• Support Communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required for ongoing dispute resolution.
• Marketing Consent Records: Retained for the duration of your account, plus three years following account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

Data Security

super22 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the super22 Platform is encrypted using industry-standard TLS 1.3 protocols.
• Encrypted Data Storage: Personal data and financial records stored on super22's servers are encrypted at rest.
• Access Controls: Access to personal data is restricted to authorised super22 personnel and Data Processors on a strict need-to-know basis, with all access activity logged and audited.
• Security Monitoring: super22 employs continuous security monitoring, intrusion detection systems, and regular penetration testing to identify and remediate vulnerabilities.
• Employee Training: All super22 personnel who handle personal data receive regular data protection and security training.

While super22 takes all reasonable precautions, no data transmission over the internet or electronic storage method is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying super22 promptly if you suspect any unauthorised access to your account.

International Data Transfers

super22's Platform is operated in connection with cloud infrastructure and service providers that may be located in jurisdictions outside Malaysia. Where personal data is transferred to a third country, super22 ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses;
• Transfer only to service providers operating in jurisdictions with adequate data protection frameworks;
• Minimisation of the data transferred to that which is strictly necessary for the specific processing purpose.

super22 does not transfer personal data to countries or territories that do not provide an adequate level of data protection without first implementing appropriate safeguards as described above.

Your Rights as a Data Subject

Subject to applicable law and certain conditions or limitations, you have the following rights in relation to your personal data held by super22:

• Right of Access: You have the right to request a copy of the personal data that super22 holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. Note that erasure requests may be declined where processing is necessary for legal compliance, dispute resolution, or regulatory record-keeping.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Restrict Processing: You may request that super22 restrict the processing of your personal data in certain circumstances, for example while a data accuracy dispute is being resolved.
• Right to Object: You may object to processing based on legitimate interests, including profiling for marketing purposes. You may withdraw marketing consent at any time without penalty.

To exercise any of these rights, please contact super22's support team using the contact details in Section 15. super22 will respond to all valid data subject requests within 30 calendar days of receipt. Identity verification may be required before requests are processed.

Minors & Age Restriction

The super22 Platform is strictly accessible to individuals who are 21 years of age or older. super22 does not knowingly collect personal data from individuals under the age of 21.

If super22 becomes aware that it has collected personal data from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that your child has registered on the Platform, please contact us immediately using the details in Section 15.

Third-Party Links & Services

The super22 Platform does not contain links to external third-party websites. All game content, payment processing, and support services are delivered through super22's own Platform or through Data Processors operating under contractual data protection obligations.

super22 is not responsible for the privacy practices of any third-party service provider beyond the contractual safeguards described in Section 6. Players are encouraged to review the privacy policies of any payment service providers or financial institutions they use in connection with their super22 account.

Amendments to This Policy

super22 reserves the right to amend, update, or replace this Privacy Policy at any time. The "Last Updated" date at the top of this document will reflect the date of the most recent revision. Where changes are material, super22 will notify registered users via Platform notification or email prior to the effective date of the change.

Your continued use of the Platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you must cease using the Platform and submit a request to close your account.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by super22, please contact us using the following details:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week, via the super22 Platform
• Response Time: Data subject requests and privacy enquiries are responded to within 30 calendar days. General support queries via live chat are typically acknowledged within 90 seconds.

When submitting a data subject request by email, please include your registered account username and a description of the specific request. Identity verification will be required before any personal data is disclosed or deleted in response to your request.