Privacy Policy — cm2slot

This Privacy Policy ("Policy") is issued by cm2slot ("we", "us", "our") and applies to all personal data collected from individuals ("you", "User", "Player") who access or use the cm2slot platform, accessible at https://cm2slot.cam, including its associated mobile interfaces, services, and communications.

cm2slot is an online gaming and sports betting platform serving users in Malaysia and internationally. In the course of providing our services — which include online slots, live casino games, sports betting, live football markets, and related products — we collect and process personal data as described in this Policy.

We are committed to protecting the privacy and security of your personal information. We process personal data only for the purposes described in this Policy, in a manner consistent with applicable data protection laws and the requirements of our international online gaming licence.

This Policy should be read alongside our Terms & Conditions, which govern your use of the cm2slot platform. By creating an account or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" means any operation performed on personal data, whether by automated or manual means, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means cm2slot, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of cm2slot pursuant to a data processing agreement.
• "KYC Data" means identity verification documents submitted by Users, including government-issued identification such as a Malaysian MyKad, passport, or utility bill.
• "Cookies" means small data files stored on your device by the Platform for the purposes of session management, analytics, and personalisation.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinion, religious belief, health condition, or financial details that require heightened protection under applicable law.
• "Third Party" means any entity other than cm2slot and the User, including payment processors, game software providers, analytics services, and fraud prevention services.

3.1 Registration & Account Data

When you register a cm2slot account, we collect:

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Email address
• Mobile telephone number
• Chosen username and encrypted password hash
• Preferred language and currency (MYR/RM for Malaysian users)

3.2 KYC Verification Data

To comply with our licensing obligations and prevent fraud and money laundering, we collect:

• Government-issued photo identification (e.g., Malaysian MyKad front and back, passport data page)
• Proof of residential address (e.g., utility bill, bank statement dated within 90 days)
• Proof of payment method (e.g., screenshot or photograph of the registered e-wallet or bank account)
• Selfie or live photograph for facial verification, where required

3.3 Financial & Transaction Data

We collect and record all financial transactions on your account, including:

• Deposit amounts, dates, and payment methods (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, BTC, ETH, USDT, LTC)
• Withdrawal requests, amounts, dates, and destination payment details
• Account balance history and bonus crediting records
• Transaction reference numbers and payment processor response codes

3.4 Gaming & Betting Activity Data

We log all gaming and wagering activity on your account for integrity, dispute resolution, and regulatory compliance purposes:

• Games played, wager amounts, outcomes, and session durations
• Sports bets placed, markets selected, odds accepted, and settlement outcomes
• Bonus usage, wagering progress, and promotion eligibility status
• Responsible gambling tool usage (deposit limits set, self-exclusion requests, session alerts)

3.5 Technical & Device Data

When you access the Platform, we automatically collect:

• IP address and approximate geographic location (country/city level)
• Device type, operating system, and browser version
• Session start/end times and page navigation data
• Cookie identifiers and similar tracking technologies (see Section 10)
• Referral URL (the page or link that brought you to cm2slot)

3.6 Communication Data

When you contact our support team or send us communications, we retain:

• Live chat transcripts
• Email correspondence content and metadata
• Complaint records and their resolution status

cm2slot collects personal data through the following channels:

• Directly from you — through account registration forms, KYC submission portals, support interactions, and promotional opt-in forms.
• Automatically — through cookies, web beacons, server logs, and similar technologies as you navigate and interact with the Platform.
• From third parties — including payment processors (who share transaction confirmation and fraud signals), identity verification service providers, and fraud detection partners.
• From publicly available sources — where relevant to verifying your identity, assessing fraud risk, or complying with our anti-money laundering obligations.

We process your personal data for the following purposes:

We process personal data under the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and cm2slot — including account creation, transaction processing, and customer support.
• Legal obligation: Processing required to comply with applicable law — including KYC/AML requirements, licensing obligations, and regulatory reporting.
• Legitimate interests: Processing for purposes that are in the legitimate interests of cm2slot or third parties, where those interests are not overridden by your rights — including fraud prevention, platform security, and service improvement.
• Consent: Processing where you have provided clear, specific, informed consent — primarily for optional marketing communications. You may withdraw consent at any time by contacting support or managing your communication preferences in your account dashboard.

7.1 We Do Not Sell Your Data

cm2slot does not sell, rent, or commercially transfer your personal data to third parties for their own marketing or commercial purposes. Any sharing of data is limited to what is strictly necessary for the purposes described in this Policy.

7.2 Service Providers and Data Processors

We share personal data with the following categories of trusted third-party service providers who process data on our behalf under written data processing agreements:

• Payment processors: To facilitate deposit and withdrawal transactions via Malaysian payment channels (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect) and cryptocurrency networks.
• Identity verification providers: To complete KYC checks, facial verification, and document authentication.
• Fraud detection and AML screening services: To identify suspicious transactions and comply with anti-money laundering obligations.
• Game software providers: Whose game engines process game session data to deliver and record game outcomes.
• Cloud infrastructure providers: Who host the Platform and data on secure servers under contractual data protection obligations.
• Customer support platform providers: Who power our 24/7 live chat service.
• Analytics services: Who help us understand Platform usage patterns to improve user experience, using aggregated or pseudonymised data where possible.

7.3 Regulatory and Legal Disclosure

We may disclose your personal data to our licensing authority, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required by law, court order, or regulatory demand. We will, where legally permissible, attempt to notify you of such disclosure requests before complying.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of cm2slot's business or assets, your personal data may be transferred to the acquiring entity. We will notify affected users in advance of any such transfer and ensure the acquiring entity is bound by privacy obligations at least equivalent to those in this Policy.

As an internationally operating platform, cm2slot may transfer your personal data to countries outside Malaysia and outside the European Economic Area for processing by our service providers. Where such transfers occur, we ensure that appropriate safeguards are in place, including contractual data transfer clauses, to provide a level of protection for your data equivalent to that applicable in the jurisdiction in which you reside.

By using the cm2slot platform and submitting your personal data, you acknowledge that your data may be transferred, stored, and processed in countries other than Malaysia. We take all reasonable steps to ensure that such transfers are handled securely and in accordance with this Privacy Policy.

We retain your personal data for as long as your account is active and for a period thereafter as required by our licensing obligations, legal requirements, and legitimate business interests. Specific retention periods by category:

• Account registration data: For the duration of the account relationship plus a minimum of 5 years after account closure, in accordance with AML record-keeping requirements.
• KYC documents: For the duration of the account plus 5 years, or longer where required by applicable law or regulatory authority.
• Financial transaction records: Minimum 5 years from the date of the transaction, in line with standard financial record-keeping obligations.
• Gaming activity logs: Minimum 3 years for dispute resolution and licensing compliance purposes.
• Communication records: Minimum 2 years from the date of the communication, or longer where linked to an unresolved complaint or legal matter.
• Technical and device data (server logs): Typically 90 days for routine logs; longer where retained as part of a fraud or security investigation.
• Marketing consent records: For the duration of your consent or until you withdraw it, plus 1 year for audit purposes.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

10.1 What Are Cookies

Cookies are small text files placed on your device by the cm2slot Platform when you visit. They allow the Platform to recognise your device, remember your preferences, maintain your session, and gather analytical data about how you use the Platform.

10.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred display options, and last visited game categories.
• Analytics Cookies: Collect aggregated, anonymised data about how users navigate the Platform — which pages are visited, how long sessions last, and how users arrive at the Platform. This helps us improve the user experience.
• Security & Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, including bot detection and session integrity monitoring.

10.3 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Note that disabling certain cookies may affect your ability to use parts of the Platform, including maintaining a logged-in session. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate.

Subject to applicable data protection law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights with respect to your personal data held by cm2slot:

cm2slot implements industry-standard technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the cm2slot Platform is encrypted using TLS (Transport Layer Security) with a minimum of 128-bit encryption.
• Encryption at rest: Sensitive personal data, including financial records and KYC documents, is encrypted in our databases using AES-256 or equivalent standards.
• Access controls: Access to personal data within cm2slot is restricted on a strict need-to-know basis, with role-based access controls, multi-factor authentication for administrative access, and comprehensive audit logging.
• Infrastructure security: Our servers are hosted in ISO 27001-aligned data centre facilities with physical access controls, redundant power, and continuous monitoring.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable law.

While we take all reasonable steps to protect your data, no digital transmission or storage system can be guaranteed to be 100% secure. You are also responsible for maintaining the security of your account credentials and for notifying us promptly if you suspect any unauthorised account access.

Age verification is a mandatory step in our account registration and KYC processes. cm2slot employs automated and manual age-check measures to enforce the 21+ requirement. We cooperate fully with any regulatory inquiry or parental request relating to underage access.

The cm2slot Platform may reference third-party services — such as Malaysian payment providers (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX) — by name for informational purposes. When you initiate a transaction using one of these payment channels, you will interact with that third party's systems under their own privacy policy and terms.

cm2slot is not responsible for the privacy practices, data handling, or content of third-party services or platforms. We strongly encourage you to review the privacy policies of any third-party service you use in connection with your cm2slot account.

cm2slot reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where changes are material — such as changes to the categories of data we collect, the purposes for which we process it, or your rights — we will provide advance notice by displaying a prominent notice on the Platform and, where practicable, sending notification to your registered email address.

The "Last Updated" date at the top of this page indicates the date of the most recent revision. Your continued use of the cm2slot Platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not agree with any changes to this Policy, you should discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way cm2slot handles your personal data, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 from within your account dashboard — the quickest way to reach us for general enquiries.
• Email: [email protected] (plain text — not a clickable link). For privacy-specific requests, please use the subject line "Privacy Request — [Your Account Username]".
• Response Commitment: We will acknowledge all privacy-related requests within 5 business days and aim to resolve them within 30 calendar days. Complex requests may require additional time, in which case we will notify you.