Privacy Policy jalan2 – Personal Data Protection for Malaysian Players

1Introduction

Jalan2 (operating under jalan2.my) is an online gaming platform committed to protecting the privacy of all its users. This Privacy Policy explains how we handle your personal information when you visit our website, register an account, make deposits or withdraw winnings, and interact with any of the services we offer.

By registering an account or using the platform jalan2, you are deemed to have read, understood, and agreed to this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform and contact our support team to close your account.

This Privacy Policy is drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data protection. jalan2 assumes the role of "data controller", responsible for how your personal data is collected and used.

2Personal Data We Collect

Jalan2 collects various types of personal data depending on how you interact with our platform. Below is a detailed explanation of the types of data we collect and the purposes for which they are collected:

A. Data You Provide Directly

• Registration information: Full name, date of birth, Malaysian identity card number (MyKad), email address, mobile phone number.
• Account information: Your chosen username, password (stored in encrypted form — we never see your password in plain text), language preference, and communication settings.
• Financial information: E-wallet or bank account name, and account number required to process deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks).
• Verification documents: A copy of your MyKad or passport and any other supporting documents required for the identity verification (KYC) process.

B. Automatically Collected Data

• Device and technical data: IP address, browser type, operating system, screen resolution, and device type (mobile or desktop).
• Activity data: Pages visited, time spent on the platform, games played, bet amounts, win/loss history, and the timing and frequency of gaming sessions.
• Transaction data: Complete deposit and withdrawal history, payment methods used, transaction amounts and timestamps.
• Cookie data: Information collected through cookies and similar tracking technologies as described in Section 7 of this document.

3How We Use Your Personal Data

Jalan2 uses the personal data we collect solely for legitimate purposes that have been disclosed to you at the point of collection. Below is a detailed breakdown of how we use your data:

• Account management: Creating and maintaining your jalan2 account, verifying your identity at login, and managing your account password and security settings.
• Transaction processing: Processing deposits made via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or FPX, as well as processing withdrawals of your winnings to the same account.
• Provision of gaming services: Enabling your access to all games on jalan2 — including slots, live casino, crash games and table games — and recording all your gaming activity.
• Security and fraud prevention: Detecting and preventing unauthorised access, fraud, money laundering, and platform abuse. This includes analysis of transaction patterns and suspicious activity.
• Legal compliance: To fulfil jalan2's obligations under Malaysia's PDPA, anti-money laundering laws, gaming licensing requirements, and valid court orders.
• Responsible gaming: Monitoring your gaming patterns to identify signs of problem gambling and activating the protections you have set, such as deposit limits and cooling-off mode.
• Service improvement: Analysing how users interact with the jalan2 platform to identify areas for improvement and develop new features that benefit Malaysian players.
• Service communications: Sending important notifications about your account, security updates, changes to terms, and other essential service information via email or SMS.

4Data Sharing with Third Parties

Jalan2 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We only share data in the following limited circumstances:

• Payment providers: Minimum transaction data required is shared with approved Malaysian payment service providers — such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and banks supporting FPX — solely for the purpose of processing your deposits and withdrawals. All such providers are bound by strict data protection agreements.
• Gaming software providers: Minimum game session information is shared with the software providers powering games on the jalan2 platform to ensure games function correctly and RNG outcomes can be verified.
• Regulatory bodies and law enforcement authorities: jalan2 will disclose your personal data to the relevant authorities if we receive a valid court order, a proper law enforcement request, or where disclosure is required to fulfil our legal obligations under Malaysia's PDPA or anti-money laundering laws.
• Professional advisors: Lawyers, accountants or auditors bound by professional confidentiality obligations, where required for legitimate legal or financial advisory purposes.
• Business merger or acquisition: In the event of a change of ownership or restructuring of jalan2, your personal data may be transferred to the successor entity. In such circumstances, jalan2 will notify you in advance and ensure that equivalent privacy protections are maintained.

5Personal Data Security

Jalan2 continually invests in comprehensive security infrastructure to protect the personal data of all our users. The security measures we implement include:

• Encryption in transit: All data transmitted between your web browser and jalan2's servers is encrypted using TLS 1.3 with a 256-bit SSL certificate. This ensures your data cannot be read by any party attempting to intercept the communication.
• Stored data encryption: Sensitive data stored in jalan2's databases — including financial information and passwords (stored as irreversible hashes) — is encrypted using robust encryption algorithms.
• Strict access controls: Access to personal data within jalan2 is strictly limited to employees with a legitimate business need. All access is logged and regularly audited.
• Two-factor authentication (2FA): jalan2 offers and encourages the use of 2FA on all user accounts to add an extra layer of security beyond passwords alone.
• Continuous monitoring: Automated monitoring systems operate 24 hours a day to detect any suspicious activity or unauthorised access attempts to jalan2's systems and data.
• Regular security audits: jalan2 conducts regular independent penetration testing and security audits to identify and address vulnerabilities before they can be exploited.

While jalan2 implements all reasonable security measures, no security system is completely infallible. In the event of a data breach affecting your personal information, jalan2 is committed to notifying you promptly in accordance with Malaysia's PDPA requirements and taking appropriate remedial action.

6Data Retention Period

Jalan2 retains your personal data only for as long as necessary for the purposes stated in this policy, or as required by Malaysian law. Retention periods vary depending on the type of data:

• Active account data: For the duration that your jalan2 account remains active. Once the account is closed, basic account data is retained for 7 years to comply with Malaysia's financial and anti-money laundering legal requirements.
• Transaction history: Records of all deposits, withdrawals, and financial activity are retained for a minimum of 7 years from the date of the transaction — a mandatory requirement under Malaysian financial law.
• Gaming data: Detailed game history is retained for 3 years for the purposes of fair play verification and customer support. Aggregated and anonymised gaming data may be kept for longer for analytical purposes.
• Identity verification documents (KYC): Copies of identity documents are retained for 7 years after the business relationship with jalan2 ends, in line with anti-money laundering legal requirements.
• Customer support communication logs: Records of interactions with jalan2's support team are retained for 2 years for quality control and reference purposes.
• Marketing data: Data used for marketing and promotional communications is retained until you withdraw your consent or close your account, whichever comes first.

Once the relevant retention period has expired, your personal data will be securely deleted or permanently anonymised so that it can no longer be linked to you as an individual.

7Cookies & Tracking Technologies

Jalan2 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. The following are the types of cookies we use:

You can manage or disable cookies through your web browser settings. Please note, however, that disabling essential cookies may affect the functionality of the platform. jalan2 and may prevent you from logging in or using certain platform features.

8Your Personal Data Rights

As a jalan2 user who is a Malaysian citizen or resident, you have certain rights under Malaysia's PDPA with respect to your personal data. jalan2 is committed to respecting and facilitating the exercise of these rights:

10Amendments to This Privacy Policy

Jalan2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new technologies, evolving legal requirements or other reasonable grounds. Each new version will carry a refreshed "Updated" date at the top of this page.

For material amendments — that is, changes that significantly affect your privacy rights — jalan2 will provide reasonable notice to users via:

• Email notifications sent to the email address registered to your account
• A prominent notice displayed upon logging in to your jalan2 account
• Updates to the "Last Updated" date on this Privacy Policy page

Your continued use of the jalan2 platform following any amendments that take effect will be deemed acceptance of the latest version of this Privacy Policy. If you disagree with the changes made, please stop using the platform and contact us to close your account.

Current version This Privacy Policy is effective from 1 January 2026.

11Contact Us About Privacy

Jalan2 takes all privacy concerns and inquiries seriously. If you have questions about this Privacy Policy, how we handle your personal data, or wish to exercise any of your privacy rights, please contact us through the following channels:

• Email: [email protected] (please include "Privacy Enquiry" in the email subject line)
• Response time: We are committed to responding to all privacy-related inquiries within 48 business hours.
• Operating hours: 24 hours a day, 7 days a week

If you are not satisfied with jalan2's response to your privacy inquiry or complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection, Ministry of Communications and Digital Malaysia).