Privacy Policy — my36 Malaysia

my36 ("we", "us", "the Company") operates the online gaming platform accessible at my36.asia and is committed to protecting the privacy and personal data of all users ("Player", "you") who register for and use our services.

This Privacy Policy ("Policy") describes how my36 collects, uses, stores, shares, and protects your personal data in connection with your use of the my36 platform, including the website at my36.asia, any associated services, and all communications between you and my36. This Policy forms part of and should be read alongside our Terms & Conditions and Responsible Gaming Policy.

By registering an account with my36 or continuing to use our platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this Policy, please discontinue use of the my36 platform and contact us to close your account.

my36 is committed to compliance with applicable data protection legislation and the standards set by our international gaming authority licence, which includes obligations relating to the protection of player data, secure data handling, and KYC (Know Your Customer) record-keeping.

my36 collects personal data through your registration, account activity, transactions, communications with support, and technical interactions with the platform. The categories of personal data we collect include:

2.1 Registration & Identity Data

• Full legal name;
• Date of birth (for age verification — 21+ requirement);
• Residential address (including postcode and state in Malaysia);
• Nationality;
• Government-issued identity document number (e.g. MyKad number, passport number), where required for KYC verification.

2.2 Contact Data

• Email address;
• Malaysian mobile phone number (used for OTP verification and account communications).

2.3 Financial Data

• Payment method identifiers (e.g. last four digits of bank card, e-wallet account identifier);
• Transaction history (deposits and withdrawals) including amounts, timestamps, and payment methods used;
• Account balance information.

2.4 Gaming Activity Data

• Game session logs, including games played, bet amounts, outcomes, and session duration;
• Bonus and promotion participation history;
• Responsible gaming settings and any self-exclusion history.

2.5 Technical & Usage Data

• IP address and approximate geographic location;
• Device type, operating system, and browser information;
• Session timestamps and page interaction logs;
• Cookie identifiers and related tracking data (see Section 6).

2.6 Communications Data

• Content of your communications with my36 customer support (live chat transcripts, email correspondence);
• Marketing preferences and communication opt-in/opt-out history.

my36 uses your personal data only for the purposes described below. We do not use your data for purposes incompatible with those for which it was originally collected without first obtaining your consent or establishing another lawful basis.

• Account creation and management: To register your account, verify your identity, authenticate your logins (including OTP verification), and administer your account throughout its lifecycle;
• Payment processing: To process deposits and withdrawals in Malaysian Ringgit (MYR) via your chosen payment methods (Touch n Go eWallet, Boost, Maybank FPX, CIMB, Public Bank, Visa, Mastercard);
• Game provision: To deliver gaming services, record game outcomes, calculate and credit winnings, apply bonuses, and resolve disputes;
• Legal and regulatory compliance: To fulfil KYC obligations under our gaming licence, comply with anti-money laundering (AML) requirements, and respond to requests from law enforcement or regulatory bodies;
• Responsible gaming: To monitor gaming patterns, apply player-set limits, detect signs of problem gambling, and administer self-exclusion requests;
• Customer support: To receive, investigate, and respond to your support queries and complaints;
• Security and fraud prevention: To detect and prevent unauthorised account access, fraud, collusion, and other prohibited conduct;
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — only where you have opted in or where we have a legitimate interest and you have not opted out;
• Platform improvement: To analyse usage patterns, diagnose technical issues, and improve the my36 user experience.

my36 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with our gaming licence conditions, AML regulations, tax obligations, and responses to lawful authority requests;
• Legitimate interests: Processing for fraud prevention, security monitoring, and improving platform performance — where our interests do not override your rights and freedoms;
• Consent: Processing for direct marketing communications, where we have obtained your explicit opt-in consent. You may withdraw this consent at any time by updating your communication preferences in account settings or contacting support.

my36 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the following limited circumstances:

• Game providers: We share necessary session data with our licensed game software providers (e.g. Pragmatic Play, PG Soft, Evolution Gaming) to enable game delivery. These providers are bound by data processing agreements and may not use your data for their own purposes;
• Payment processors: We share transaction data with payment service providers (including e-wallet operators and bank payment gateways) strictly for the purpose of processing your deposits and withdrawals;
• Identity verification services: We may share identity and document data with regulated third-party KYC verification providers to fulfil our age verification and AML obligations;
• Regulatory and law enforcement bodies: We will disclose personal data to competent authorities, gaming regulators, or law enforcement agencies where required to do so by law, legal process, or our licensing conditions;
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the Company's assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third parties with whom we share personal data are required to maintain appropriate technical and organisational security measures and to use your data only for the purpose for which it was shared.

my36 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The types of cookies we use include:

• Strictly necessary cookies: Required for the platform to function, including session management and authentication tokens. These cannot be disabled;
• Functional cookies: Remember your preferences (e.g. language, game lobby filters, "Remember Me" login setting);
• Analytics cookies: Collect anonymised data on how players navigate the platform to help us identify areas for improvement. Data is aggregated and not linked to individual identity;
• Security cookies: Help detect and prevent fraudulent login attempts and unusual account activity.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the my36 platform. my36 does not use advertising network cookies or third-party behavioural profiling cookies.

my36 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. Specific retention periods include:

• Active account data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements;
• Transaction records: Retained for a minimum of five (5) years following the date of each transaction;
• KYC/identity documents: Retained for a minimum of five (5) years following account closure or the conclusion of a dispute, whichever is later;
• Support communications: Retained for up to three (3) years from the date of the communication, unless the matter is subject to ongoing proceedings;
• Marketing opt-in records: Retained for the duration of the consent period plus three (3) years as evidence of consent.

When data is no longer required, my36 will securely delete or anonymise it in accordance with our data destruction procedures.

my36 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the my36 platform;
• Encrypted storage of passwords using industry-standard hashing algorithms;
• Two-factor authentication (OTP via SMS) available for all accounts;
• Access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing;
• Automated fraud detection and suspicious login monitoring systems.

Despite these measures, no data transmission over the internet can be guaranteed to be 100% secure. You are responsible for keeping your login credentials confidential. my36 staff will never ask for your password.

Subject to applicable law and our regulatory obligations, you have the following rights in relation to your personal data held by my36:

• Right of access: You may request a copy of the personal data my36 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where it is no longer required for the purpose for which it was collected, subject to our retention obligations under applicable law;
• Right to restrict processing: You may request that we limit our use of your data in certain circumstances;
• Right to data portability: You may request that we provide your data in a structured, commonly used, machine-readable format;
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact my36 support via Live Chat or email. We will respond to all verifiable requests within 30 days. In some cases, we may need to verify your identity before processing the request. Note that certain rights are subject to limitations where data must be retained for legal or regulatory compliance purposes — for example, KYC and transaction records required under our gaming licence cannot be deleted on request.

The my36 platform contains links to our licensed game providers' interfaces, which are operated by independent third parties. This Privacy Policy applies only to data processed directly by my36. When you interact with third-party game software embedded in the my36 platform, the applicable game provider may also process certain session data in accordance with their own privacy policies.

my36 is not responsible for the privacy practices of third-party game providers, payment processors, or any other third parties whose services are integrated into or accessible via the platform. We encourage you to review the applicable privacy documentation of any third party whose services you use.

If you believe that a person under the age of 21 has registered on the my36 platform or provided personal data to us, please contact us immediately via Live Chat so that we can investigate and take appropriate action.

my36 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. Material changes will be notified to registered players via the email address on file, or via a prominent notice on the my36 platform, no less than 7 days before the updated Policy takes effect.

The "Last updated" date at the top of this page indicates when the Policy was most recently revised. Continued use of the my36 platform after the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with a change, you should cease using the platform and may request account closure.

If you have any questions, concerns, or requests regarding this Privacy Policy or how my36 processes your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 via the chat widget on my36.asia
• Email: [email protected]

For queries specifically about data subject rights (access, deletion, portability), please mark your enquiry clearly as a "Data Rights Request" when contacting support, to ensure it is routed to the appropriate team.

For responsible gaming support, visit our Responsible Gaming page. For general platform questions, see our FAQ.

This Privacy Policy was last updated on 11 June 2026. © 2026 my36.asia. All rights reserved.