Candy916 Privacy Policy — Data Protection & Security Information

1 Introduction

Candy916 ("we", "Platform" or "candy916") is fully committed to protecting the privacy and security of all users' personal information. This Privacy Policy transparently explains how we collect, use, store, share, and protect your personal data when you use the candy916 platform, including the website, mobile app, and all related services.

This document is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices. By using the candy916 platform, you agree to the collection and use of information as described in this Privacy Policy.

We encourage you to read this document carefully and contact us if you have any questions or concerns. This Privacy Policy should be read together with Terms and Conditions candy916.

2 Information We Collect

Candy916 only collects data that is strictly necessary to operate the platform safely and efficiently. The following are the categories of data we collect:

Candy916 does not collect sensitive information such as biometric data, medical records, or religious information unless specifically required by applicable law.

3 How We Use Your Data

The personal data we collect is used solely for lawful and transparent purposes. The following outlines the legal basis and purposes of data use at candy916:

• Service Delivery: Managing your account, processing deposits and withdrawals, and ensuring seamless access to all games and features on the candy916 platform.
• Legal Compliance: Fulfilling our obligations under Malaysia's PDPA, Anti-Money Laundering (AML) regulations, Counter Financing of Terrorism (CFT) requirements, and relevant regulatory reporting obligations.
• Platform Security: Detecting and preventing fraud, unauthorised access, hacking attempts, and suspicious activity that could compromise your account security or the platform as a whole.
• Customer Support: Providing accurate and effective assistance whenever you contact our support team via live chat, email, or other available channels.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing appropriate intervention when needed, for the well-being of our members.
• Service Improvement: Analysing usage data in aggregate and anonymised form to improve platform design, speed, and overall user experience.
• Marketing Communications: Sending you relevant offers, promotions, and updates — only with your consent and in accordance with your communication preferences.

Candy916 will not use your personal data for any purpose other than those stated above without first obtaining your consent.

4 Data Sharing With Third Parties

Candy916 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. However, in operating the platform, we may share your data with selected parties in the following circumstances:

• Payment Service Providers: Payment gateways and transaction processors required to carry out your deposits and withdrawals securely. All such providers are bound by strict data protection agreements.
• Game Providers: Game studios and software providers that require basic session information to deliver the gaming experience to you.
• Identity Verification Services: Registered and trusted third-party KYC providers for document verification and AML screening purposes.
• Regulatory Authority: When required by law, court order, or official directive from the relevant Malaysian authorities.
• Analytics Services: Analytics tools are used in aggregate and anonymised form to understand overall platform usage patterns.

5 Data Security

Candy916 continuously invests in state-of-the-art security infrastructure to ensure your personal data is protected at all times. The security measures we implement include:

• End-to-End Encryption: All data communications use TLS 1.3 protocol with AES-256 bit encryption, ensuring your data cannot be intercepted during transmission.
• Multi-Layer Access Control: Access to user data within our internal systems is strictly limited based on the principle of least privilege — only staff who require access for their specific duties are permitted.
• 24/7 Security Monitoring: Intrusion detection systems (IDS) and real-time threat monitoring operate around the clock to identify and neutralise threats before they can affect your data.
• Two-Factor Authentication (2FA): candy916 provides 2FA options for all member accounts as an additional layer of protection against unauthorised access.
• Regular Security Audits: candy916 undergoes regular penetration testing and independent security audits to identify and patch any vulnerabilities.
• Secure Data Backup: Your data is regularly backed up to a separate, secure location to ensure service continuity under any emergency.

While no security system can guarantee absolute protection, candy916 applies industry best practices and continuously updates our defences against evolving cyber threats. Should any data security breach occur that may affect you, we will notify you as promptly as possible in accordance with PDPA requirements.

6 Cookies & Tracking Technologies

Candy916 uses cookies and similar tracking technologies to enhance your experience on the platform. Understanding how we use these technologies is important for your privacy.

Types of cookies used by candy916:

• Essential Cookies: Required for core platform functions such as login session authentication, security, and language preferences. These cookies cannot be disabled as they are essential to platform operation.
• Performance Cookies: Collecting information on how visitors use our platform, such as the most frequently visited pages. This data is used in aggregate and anonymised form for platform improvement.
• Functional Cookies: Saving your preferences such as display settings, game preferences, and marketing choices to deliver a more personalised experience.
• Analytics Cookies: Helping us understand overall usage patterns. This analytics data does not contain any personally identifiable information.

You can manage or disable cookies through your browser settings at any time. Please note, however, that disabling certain cookies may affect the functionality of some areas of the candy916 platform.

7 Your Rights Under PDPA

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and the candy916 privacy policy, you have the following rights regarding your personal data:

To exercise any of the above rights, contact the candy916 Privacy team by email at [email protected] or via live chat on the platform. We will process your request within the timeframe stipulated by the PDPA.

8 Data Retention & Deletion Period

Candy916 retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy or as required by applicable Malaysian law.

• Active Account Data: Retained for the duration your account is active and for five (5) years following account closure for AML legal compliance purposes.
• Financial Transaction Records: Retained for seven (7) years in accordance with Malaysian accounting and tax legal requirements.
• Security Logs: Retained for twelve (12) months for security incident investigation and fraud detection purposes.
• Support Communication Data: Retained for three (3) years to allow reference in the event of any related disputes.
• Marketing Data: Deleted within thirty (30) days after you withdraw consent for marketing communications.

Once the retention period expires, your data will be securely deleted or converted into an anonymised form that cannot be used to personally identify you.

9 Cross-Border Data Transfers

In operating a global platform, candy916 may need to transfer your personal data to servers or service providers located outside Malaysia. Any cross-border data transfer carried out by candy916 is subject to the following safeguards:

• Transfers are only made to countries with adequate data protection standards recognised as equivalent to Malaysia's requirements.
• Standard contractual clauses are used to ensure consistent protection across all jurisdictions.
• All third-party providers outside Malaysia that receive candy916 user data are required to comply with privacy and security policies equivalent to or stricter than Malaysia's PDPA requirements.

By using the candy916 platform, you agree to such data transfers subject to the safeguards stated above.

10 Children's Privacy

The candy916 platform is exclusively for individuals aged 18 years and above. We do not knowingly collect or process personal data from individuals who are underage.

If we discover that personal data of an individual under 18 has been collected without our knowledge, we will immediately take steps to delete that data and close the relevant account. If you believe your child or a minor has registered on our platform, please contact us immediately at [email protected].

11 Changes to the Privacy Policy

Candy916 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or service improvements.

When we make significant changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page.
• Displaying a clear notice on the candy916 platform homepage.
• Sending email notifications to all registered members for material changes.
• In cases of highly significant changes, we may request your renewed consent before you continue using the platform.

We encourage you to review this page periodically. Your continued use of the candy916 platform after any Privacy Policy updates are published will be considered your acceptance of the revised version.

12 Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by candy916, please contact us through the following channels:

• Privacy Email: [email protected] — please indicate "Privacy Enquiry" in the email subject line for faster handling.
• 24/7 Live Chat: Reach us directly via the chat icon on the candy916 platform for instant enquiries.
• FAQ: Visit the page FAQ us for answers to frequently asked privacy questions.

We aim to respond to all privacy-related enquiries within three (3) business days. For official requests such as data access or data deletion, the processing period is up to twenty-one (21) business days in accordance with PDPA provisions.