Th13 Privacy Policy – Our Full Commitment to Protecting the Personal Data of Malaysian Members

1 Introduction & Scope of This Privacy Policy

Th13 ("we", "the platform", or "th13") is an online entertainment platform operating in Malaysia and serving registered members nationwide. We understand that your trust in us depends not only on the quality of our games and the speed of our transactions, but also on how we handle the personal information you entrust to us.

This Privacy Policy sets out clearly and transparently: what personal information we collect from you, how it is collected, the purposes for which it is used, how it is protected against unauthorised access, and your rights as the owner of that data. This document forms part of our commitment to transparency and integrity across all aspects of th13's operations.

This Privacy Policy applies to all users of the th13 platform, including unregistered visitors, registered members, and anyone who interacts with us through any communication channel. By continuing to use the th13 platform after reading this Privacy Policy, you confirm your consent to the practices described herein.

2 Personal Information We Collect

Th13 collects several categories of information from members and users of our platform. Below is a comprehensive list of the types of information we may collect:

We do not collect sensitive data categories such as medical information, religious beliefs, political views, or biometric data. Credit or debit card details are not stored directly on th13's servers — payment processing is handled by accredited payment service providers that maintain their own security standards.

3 How We Collect Information

Th13 collects members' personal information through a number of different methods:

• Account Registration: When you register a th13 account, you provide your username, phone number, and password directly to us. OTP verification via phone number is part of the registration process to confirm the validity of your account.
• Platform Usage: When you log in and play on th13, our systems automatically record gaming data, transaction history, and technical data such as your IP address and device type.
• Financial Transactions: When you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u or CIMB Clicks), transaction-related information is recorded for security and accounting purposes.
• Customer Support Interactions: All communications between you and the th13 support team via live chat, email, or WhatsApp are recorded for quality control and issue resolution purposes.
• Cookies and Tracking Technologies: The th13 platform uses cookies and similar tracking technologies to enhance the user experience, enable the "remember me" function, and analyse platform usage patterns in aggregate.
• KYC Process: Where required for legal compliance or during identity verification for withdrawals of certain amounts, we may request a copy of your official identification document.

Th13 does not purchase or acquire data lists from external sources to populate our member database. Every piece of information in our system is collected directly from your interactions with the th13 platform.

4 How We Use Your Personal Information

Th13 uses the information collected for the following legitimate and necessary purposes:

• Account Management: To create, verify, and manage your th13 account, including password recovery and identity verification.
• Transaction Processing: All your deposits and withdrawals are processed securely and efficiently through legitimate Malaysian payment methods.
• Gaming Service Provision: Enables access to all games on th13, including slots, Live Casino, and more, while maintaining a record of your gaming activity.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, unauthorised access, and any other activities that violate th13's Terms & Conditions.
• Customer Support: Enables the th13 support team to provide you with relevant, personalised assistance in Bahasa Melayu.
• Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling and proactively reaching out to members who may need assistance.
• Legal Compliance: To fulfil legal obligations under Malaysia's PDPA and applicable financial regulations.
• Platform Enhancements: Analyses aggregated usage data (which cannot be used to identify any individual) to improve the performance, interface, and overall experience of the th13 platform.
• Service Communications: To send you important notifications regarding your account, transactions, policy updates, and security information you need to be aware of.
• Marketing (with Consent): Sending bonus offers, promotions, and new game information to members who have consented to receive marketing communications from th13. You may withdraw this consent at any time.

Th13 will not use your personal information for any purpose beyond those stated above without obtaining your prior consent.

5 Information Sharing & Disclosure

Th13 does not sell, rent, or transfer members' personal information to third parties for their own commercial or marketing purposes. However, in the following limited circumstances, your information may be shared with relevant parties:

• Payment Service Providers: Transaction information that must be shared with payment service providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and banks via FPX in order to process your deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Game Developers: Anonymised game statistics that cannot be linked to any individual may be shared with game providers such as Pragmatic Play for technical maintenance and game improvement purposes.
• Regulatory & Governing Authorities: Where required by Malaysian law, a court order, or an official request from a legitimate regulatory authority, th13 will disclose only the information necessary and within the scope specified.
• Third-Party Security Audits: Independent audit bodies that verify the RNG systems and security of the th13 platform may require limited access to certain technical data. All audit bodies are bound by strict confidentiality agreements.
• Business Merger or Acquisition: In the event that th13 is involved in any merger, acquisition, or asset transfer, member information may be transferred as part of that transaction — however, the new recipient will be bound by a Privacy Policy of equivalent or greater stringency.

In all instances of data sharing described above, th13 ensures that the receiving party has adequate data protection obligations in place and receives only the information strictly necessary for the stated purpose — a "minimum necessity" principle we adhere to rigorously.

6 Data Security Measures

Th13 implements comprehensive technical and organisational security measures to protect members' personal information against unauthorised access, loss, misuse, or accidental disclosure:

• 256-bit SSL Encryption: All data transmitted between your device and th13's servers is encrypted using SSL 256-bit standards — the same technology used by Maybank, CIMB, and other leading Malaysian financial institutions.
• Password Encryption: Your account password is never stored in plain text — it is processed using an irreversible cryptographic hash function.
• Two-Factor Authentication (2FA): 2FA is available and strongly encouraged for all th13 accounts to add an extra layer of protection against unauthorised access.
• 24/7 Security Monitoring: th13's automated monitoring system operates around the clock to detect any suspicious activity, intrusion attempts, or abnormal transaction patterns.
• Internal Access Controls: Only th13 employees with a legitimate business need have access to members' personal information, and all such access is logged and continuously monitored.
• Regular Security Audits: th13 conducts regular independent penetration testing and security audits to identify and address any technical vulnerabilities before they can be exploited.
• Secure Data Centres: th13 member data is stored in data centres with strict physical and environmental controls, supported by backup systems that ensure continuity of service.

While th13 takes all reasonable steps to protect your data, no security system can be guaranteed 100% impenetrable. We encourage you to play your part in securing your account by using a strong password, enabling 2FA, and never sharing your login details with anyone.

7 Data Retention Period

Th13 retains members' personal information for as long as your account is active or as long as necessary to provide services to you. After account closure, we may still need to retain certain information for a specified period for the following reasons:

• Legal Obligations: Financial and transaction records may need to be retained for the period required under Malaysian accounting and tax laws (typically 7 years).
• Fraud Prevention: Certain information may be retained for a shorter period to assist in detecting and preventing repeated fraud attempts.
• Dispute Resolution: Records relating to any unresolved disputes or complaints will be retained until the matter has been fully resolved.
• Self-Exclusion: If you have enrolled in a Self-Exclusion programme for responsible gaming, your information will be retained for the duration of the chosen exclusion period to prevent unintentional re-registration.

Once the relevant retention period has expired, th13 will securely delete or anonymise your personal information in accordance with standardised data disposal procedures. Anonymised data (i.e. data that can no longer be linked to you as an individual) may be retained for analytics and platform improvement purposes.

8 Your Rights as a Data Owner

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices, you have the following rights regarding your personal information held by th13:

To exercise any of the above rights, please contact the th13 support team by email at [email protected] or via the platform's live chat. State the right you wish to exercise and the relevant details. th13 will process your request within 30 business days and may request identity verification before doing so to ensure the security of your data.

9 Cookies & Tracking Technologies

The th13 platform uses cookies and similar tracking technologies to enhance your user experience. Cookies are small text files stored on your device when you visit our platform. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login sessions, account security, and transaction processing. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Saves your preferences such as language, display settings, and "remember me" status to make your experience smoother on future visits.
• Analytical Cookies: Aggregates data on how users interact with the th13 platform to help us improve design, performance, and content. This data cannot be used to identify any individual.
• Security Cookies: To support th13's security monitoring systems in detecting suspicious activity and protecting your account from unauthorised access.

You can manage your cookie settings through your web browser's settings. However, disabling essential cookies may affect the functionality of the th13 platform and your ability to log in and play. For more information on managing cookies, please refer to your web browser's documentation.

Th13 does not use third-party cookies for targeted advertising involving external advertising networks.

10 Links to Third-Party Websites

The th13 platform may from time to time contain links or references to third-party websites or services that are not operated by us. This Privacy Policy does not apply to those third-party websites or services.

Th13 is not responsible for the privacy practices or content of any third-party websites you may access via links on our platform. We encourage you to read the Privacy Policy of each third-party website you visit before providing them with any personal information.

Payment service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, and CIMB Clicks have their own Privacy Policies governing how they handle transaction data. By using these payment services, you are also subject to their respective privacy policies.

11 Amendments to This Privacy Policy

Th13 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or platform enhancements that require different data collection or usage.

Any material amendments to this Privacy Policy will be communicated to members via registered email and/or in-platform notifications at least 7 days before taking effect. The "Updated" date at the top of this page always reflects the date of the current version of the Privacy Policy in force.

Your continued use of the th13 platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to close your account before the effective date by contacting the th13 support team.

We encourage you to review this Privacy Policy page periodically to stay informed about how th13 protects your personal information.

12 Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how th13 handles your personal information, our Data Protection Officer team is ready to assist through the following channels:

• Email: [email protected] — please include "Privacy Enquiry" in your email subject line to help us respond more quickly.
• Live Chat: Available on the th13 platform — the fastest way to get an immediate response.
• WhatsApp: Check the latest number in the "Contact Us" section on the th13 platform.

Th13 is committed to responding to all privacy-related enquiries within 5 business days. Requests to exercise data rights — such as access, correction, or deletion — will be processed within 30 business days.

This Privacy Policy is governed by the laws of Malaysia, in particular the Personal Data Protection Act 2010 (PDPA). Any dispute arising in connection with this Privacy Policy shall first be resolved through voluntary negotiation, and if necessary, referred to the Personal Data Protection Commissioner of Malaysia or a competent court in Malaysia.