Privacy Policy

1. Introduction

12joker ("12joker," "we," "us," or "our") is committed to protecting the privacy and security of all personal data entrusted to us by our members and platform visitors. This Privacy Policy ("Policy") explains what personal data we collect, why we collect it, how we use and safeguard it, and what rights you have in relation to your data.

This Policy applies to all users of the 12joker website at 12joker.one, mobile platform, games, sportsbook, and related services (collectively, the "Platform"). By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy should be read alongside the 12joker Terms & Conditions, which govern your overall use of the Platform.

2. Personal Data We Collect

2.1 Registration & Account Data

When you register a 12joker account, we collect the following categories of personal data:

• Full legal name as it appears on official identification documents.
• Date of birth (to verify the 21+ age requirement).
• Email address and mobile phone number.
• Residential address, including city, state, and postcode.
• Username and encrypted password credentials.
• Preferred currency (default: Malaysian Ringgit / MYR).

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer obligations, we may request and retain:

• Copies of government-issued photo identification (e.g., Malaysian IC, passport).
• Proof of address documentation (e.g., utility bill, bank statement dated within 90 days).
• Selfie or liveness verification images for identity matching purposes.
• Source of funds documentation where required by anti-money laundering obligations.

2.3 Financial Transaction Data

We collect records of all deposits and withdrawals, including payment method identifiers (e.g., partial Touch 'n Go eWallet account numbers, bank account holder names, Maybank or CIMB account references), transaction timestamps, amounts in MYR, and transaction status. We do not store full card numbers or full bank account numbers on our servers — these are handled by our PCI-compliant payment processors.

2.4 Gaming & Betting Activity Data

We record all wagering activity on the Platform, including game sessions, bet amounts, outcomes, session durations, sportsbook selections, and bonus usage. This data is used for account management, responsible gaming monitoring, dispute resolution, and regulatory compliance.

2.5 Technical & Device Data

When you access the Platform, we automatically collect:

• IP address and approximate geographic location.
• Device type, operating system, and browser version.
• Session timestamps and duration.
• Referring URL and navigation patterns within the Platform.
• Cookie and similar tracking technology identifiers (see Section 9).

2.6 Communications Data

Records of your communications with the 12joker support team — including live chat transcripts, email correspondence, and support ticket history — are retained for quality assurance, training, and dispute resolution purposes.

3. How We Collect Your Data

12joker collects personal data through the following channels:

• Directly from you: Through registration forms, account settings updates, KYC submission portals, payment forms, and communications with support.
• Automatically: Through cookies, web beacons, server logs, and similar technologies when you access or interact with the Platform.
• From third-party verification providers: Identity verification and fraud screening partners may supply us with verification outcomes and risk scores derived from the documents you submit.
• From payment processors: Our payment partners provide us with transaction confirmation data, partial payment method identifiers, and failure or chargeback notifications.

4. How We Use Your Personal Data

12joker uses your personal data for the following purposes:

• Account creation and management: To establish, maintain, and administer your 12joker membership account.
• Identity verification and fraud prevention: To verify your identity, confirm age eligibility (21+), and detect and prevent fraudulent, money laundering, or otherwise illegal activity.
• Transaction processing: To process deposits, withdrawals, bonus credits, and all other financial transactions on the Platform in MYR.
• Game and platform delivery: To provide access to the live casino, slots, roulette, Plinko, sportsbook, and all other Platform features.
• Customer support: To respond to enquiries, resolve disputes, and provide technical assistance.
• Regulatory compliance: To comply with applicable anti-money laundering, Know Your Customer, and gaming regulatory obligations.
• Responsible gaming: To monitor gaming behaviour, identify at-risk members, apply account limits, and process self-exclusion requests.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to members who have opted in to marketing communications. You may opt out at any time through your account settings or by contacting support.
• Platform improvement: To analyse usage patterns, troubleshoot technical issues, and improve the Platform's features and performance.
• Legal proceedings: To establish, exercise, or defend legal claims where necessary.

5. Legal Basis for Processing

12joker processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and 12joker — including account management, game delivery, and payment processing.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, KYC requirements, and gaming licensing conditions.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming monitoring, where such interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, where you have provided explicit opt-in consent. You may withdraw this consent at any time.

6. Sharing of Personal Data

12joker does not sell your personal data to any third party. We may share your personal data with the following categories of recipients in the circumstances described:

6.1 Payment Processors

We share necessary transaction and identity data with our payment partners — including Touch 'n Go eWallet, Boost, GrabPay, and banking partners such as Maybank, CIMB, and Public Bank — solely for the purpose of processing your deposits and withdrawals.

6.2 Identity Verification & KYC Providers

We work with third-party identity verification and AML screening providers who process your KYC documents and return verification outcomes. These providers operate under contractual data processing agreements and may not use your data for any purpose beyond verification.

6.3 Game Content Providers

Our live casino and slot game providers may receive anonymised or pseudonymised gameplay identifiers (e.g., session tokens) to deliver game content and resolve technical disputes. Individual member identity is not disclosed to game providers except where required for licence compliance.

6.4 Regulatory & Law Enforcement Authorities

12joker may be required to disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required by applicable law or regulatory instruction. Such disclosures will be limited to the minimum data necessary.

6.5 Professional Advisors

We may share data with legal counsel, auditors, and other professional advisors under strict confidentiality obligations where necessary for the conduct of their professional services.

7. Data Retention

12joker retains personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. Specific retention periods include:

• Active account data: Retained for the duration of your membership plus a minimum of 5 years following account closure, in line with anti-money laundering record-keeping obligations.
• KYC documents: Retained for a minimum of 5 years following account closure or the date of the last transaction, whichever is later.
• Transaction records: Retained for a minimum of 5 years in compliance with financial record-keeping requirements.
• Communications data: Support communications are retained for 2 years following the last interaction for quality assurance and dispute resolution purposes.
• Technical logs: Server and access logs are retained for up to 12 months for security and fraud investigation purposes.

Where retention beyond these periods is required by law or regulatory direction, 12joker will retain the relevant data accordingly.

8. Data Security

12joker implements technical and organisational security measures appropriate to the sensitivity of the personal data we hold. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption at rest for sensitive personal data and financial records stored on our servers.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Multi-factor authentication requirements for internal administrative systems.
• Third-party vendor due diligence to ensure data processors maintain equivalent security standards.

While 12joker takes all reasonable precautions to protect your data, no internet transmission or electronic storage system is entirely secure. You are responsible for maintaining the security of your own account credentials.

9. Cookies & Tracking Technologies

12joker uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function — including session management, login authentication, and security features. These cannot be disabled without impacting Platform functionality.
• Functional cookies: Remember your preferences — such as language settings and preferred game categories — to personalise your experience.
• Analytics cookies: Collect anonymised data on how members interact with the Platform, enabling us to identify technical issues and improve user experience.
• Marketing cookies: Used to deliver relevant promotional content based on your Platform activity. Marketing cookies are only placed with your consent.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality. We do not use third-party advertising networks to serve ads on behalf of external businesses.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights in relation to your personal data held by 12joker:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction: You may request that processing of your personal data be restricted in certain circumstances.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a machine-readable copy of your data.
• Right to object: You may object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact 12joker's data protection team at the email address listed in Section 14. We will respond to all valid requests within 30 days. We may need to verify your identity before processing your request.

11. Minors

The 12joker Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will immediately suspend the associated account, delete the data, and report the matter to the relevant authorities where required. Parents or guardians who believe a minor may have registered on the Platform are requested to contact us immediately via the details in Section 14.

12. International Data Transfers

12joker's servers and data processors may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, 12joker ensures that appropriate safeguards are in place — including contractual clauses requiring recipient organisations to apply equivalent data protection standards — before any transfer is made. By using the Platform, you consent to the international transfer of your personal data where such transfer is necessary to deliver the services you have requested.

13. Changes to This Policy

12joker may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. Where changes are material, we will notify registered members via the email address associated with their account and/or by displaying a prominent notice on the Platform. The "Last updated" date at the top of this Policy will be revised accordingly. Continued use of the Platform following notification of changes constitutes acceptance of the revised Policy.

14. Contact & Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or 12joker's handling of your personal data, please contact our data protection team:

Email: [email protected]

We aim to respond to all privacy-related enquiries within 5 business days. For formal data subject rights requests, please clearly state the nature of your request and provide sufficient identity information for us to verify your identity before processing.

Please do not include sensitive account credentials — such as passwords or full payment card numbers — in any email communication with 12joker.