Privacy Policy

This Privacy Policy ("Policy") is issued by 12play15 ("Company", "we", "us", "our") and applies to all personal data processed in connection with your use of the 12play15 online gaming platform at https://12play15.cam, including any associated mobile applications and related services (collectively, the "Platform").

12play15 is committed to handling your personal data with transparency, integrity, and in accordance with applicable data protection laws and internationally recognised privacy standards. We process personal data only for clearly defined, legitimate purposes and retain it only for as long as necessary.

By registering an account on the Platform or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy forms part of and should be read together with our Terms and Conditions.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

12play15 acts as the Data Controller for all personal data collected through the Platform. As Data Controller, we are responsible for determining the purposes for which and the means by which your personal data is processed.

Where we engage third-party service providers to process personal data on our behalf (for example, payment processors such as those facilitating DuitNow, FPX, Touch 'n Go eWallet, or Boost transactions), such providers act as Data Processors. We enter into written data processing agreements with all such providers requiring them to process data only in accordance with our instructions and to maintain appropriate security standards.

For any questions or requests relating to the exercise of your data rights, please contact our Data Protection team using the contact details provided in Section 15 of this Policy.

12play15 collects personal data through several channels. The categories of data we collect and the circumstances in which we collect them are set out below:

4.1 Data Provided Directly by You

4.2 Data Collected Automatically

12play15 uses personal data for the following purposes:

• Account Registration and Management: To create and maintain your player account, verify your identity and age (21+ requirement), and administer your account settings and preferences.
• Payment Processing: To process deposits and withdrawals via your chosen payment method (FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC, ETH, USDT), verify payment method ownership, and maintain transaction records.
• KYC and Identity Verification: To verify your identity, age, and residential address in compliance with applicable anti-money laundering (AML) regulations and responsible gambling requirements.
• Gaming Services: To provide access to slots, live casino, sports betting, live football, lottery, and arcade games, and to record game activity for dispute resolution and audit purposes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and other prohibited conduct on the Platform.
• Responsible Gambling: To monitor gaming behaviour for signs of problem gambling, enforce deposit limits and self-exclusion requests, and deliver responsible gambling interventions where appropriate.
• Customer Support: To respond to your queries, complaints, and requests through live chat and email support channels.
• Marketing Communications: To send you relevant promotional offers, bonus notifications, and platform updates where you have given consent to receive such communications. You may opt out at any time.
• Legal Compliance: To meet our obligations under applicable law, including AML regulations, tax reporting requirements, and responses to lawful requests from regulatory or law enforcement authorities.
• Platform Improvement: To analyse usage patterns, troubleshoot technical issues, and improve the performance and user experience of the Platform.

For each processing activity, 12play15 relies on one or more of the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms and Conditions — including account management, gaming services, and payment processing.
• Legal Obligation: Processing required to comply with applicable law — including KYC/AML verification, age verification (21+ compliance), tax reporting, and responses to lawful regulatory requests.
• Legitimate Interests: Processing conducted for our legitimate business interests, provided those interests are not overridden by your privacy rights — including fraud prevention, security monitoring, and internal analytics for platform improvement.
• Consent: Processing activities for which we rely on your freely given consent — in particular, direct marketing communications. You may withdraw consent for marketing at any time without affecting other processing activities.

Where we rely on legitimate interests, we have conducted a balancing assessment to confirm that our interests do not override your fundamental rights and freedoms.

12play15 does not sell your personal data. We may share personal data with the following categories of third party only where necessary and subject to appropriate contractual safeguards:

• Payment Service Providers: Banks (Maybank, CIMB, Public Bank, Hong Leong), e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), DuitNow network operators, FPX network operators, and cryptocurrency exchange or custodian services — solely for the purpose of processing your transactions.
• Identity Verification (KYC) Providers: Specialist third-party providers engaged to verify the authenticity of identity documents and perform liveness checks as part of our age and identity verification process.
• Game Studios: Licensed third-party game software providers that supply the games on our Platform may receive your account identifier (not your full personal profile) for the purpose of facilitating game sessions and maintaining game integrity records.
• Fraud Prevention Services: Third-party providers of fraud detection, device fingerprinting, and IP analysis services used to protect the Platform from fraudulent activity.
• Legal and Regulatory Authorities: We may disclose personal data to regulatory bodies, law enforcement agencies, financial intelligence units, or courts where we are required to do so by law or valid legal order.
• Professional Advisers: Legal, financial, or audit advisers engaged by 12play15 may access personal data on a strictly confidential, need-to-know basis.

Some of the third-party service providers engaged by 12play15 may process personal data in jurisdictions outside Malaysia. Where this occurs, 12play15 takes steps to ensure that appropriate safeguards are in place to protect your personal data to a standard that is at least equivalent to the protections available under applicable Malaysian data protection requirements.

Appropriate safeguards may include standard contractual clauses, data processing agreements incorporating binding data protection obligations, or the use of service providers that are certified under recognised international data protection frameworks.

If you would like further information about the specific safeguards applied to any particular international transfer, please contact our Data Protection team using the details in Section 15.

12play15 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account Data: Retained for the duration of your account plus five (5) years following permanent account closure, to meet anti-money laundering record-keeping requirements and to resolve any post-closure disputes.
• Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, as required for financial record-keeping and regulatory audit purposes.
• KYC Documents: Retained for five (5) years from the date of verification or from the date of account closure, whichever is later, in accordance with AML obligations.
• Communication Records: Support chat and email records are retained for three (3) years from the date of the communication.
• Marketing Preferences: Retained until you withdraw consent or for three (3) years following your last interaction with a marketing communication, whichever occurs first.
• Technical and Usage Data: Aggregated analytics data may be retained indefinitely. Individual session and usage logs are retained for up to two (2) years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

The 12play15 Platform uses cookies and similar tracking technologies to deliver functionality, maintain session state, and understand how players interact with the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences (e.g., language settings, display preferences) so that you do not need to re-enter them on subsequent visits.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the Platform, which pages are visited most frequently, and where technical errors occur. This data helps us improve Platform performance and user experience.
• Security Cookies: Used to support fraud detection and prevention functions, including identifying unusual login patterns or suspicious transaction behaviour.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Disabling functional or analytics cookies will not prevent you from using the Platform but may affect your experience.

12play15 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, disclosure, or destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. All payment transaction data is encrypted end-to-end.
• Encryption at Rest: Sensitive personal data, including identity documents and financial records, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within 12play15 is restricted on a strict need-to-know basis. All staff with data access are subject to background checks and confidentiality obligations.
• Two-Factor Authentication: Players are encouraged to enable 2FA on their accounts. All administrative access to our systems requires multi-factor authentication.
• Penetration Testing: Our infrastructure is subject to regular independent penetration testing and vulnerability assessments.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach posing a risk to players, we will notify affected parties promptly and take immediate remedial action.

While we implement robust security measures, no system is completely immune to risk. You are responsible for maintaining the security of your own account credentials. If you suspect your account has been compromised, contact our support team immediately via live chat.

As a data subject, you have the following rights in relation to the personal data that 12play15 holds about you. These rights are subject to applicable legal exceptions, in particular where processing is required for the fulfilment of legal obligations or the establishment, exercise, or defence of legal claims.

To exercise any of the above rights, please contact our Data Protection team via email at [email protected] or through live chat in your account dashboard. We will respond to all valid requests within 30 calendar days. In complex cases, we may extend this period by up to an additional 60 days, in which case we will notify you of the extension and the reason for it.

The 12play15 Platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from any person under the age of 21. Our registration process includes mandatory age declaration, and KYC verification is required to confirm that all players meet the minimum age requirement.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately suspend the relevant account, delete all associated personal data, and — where required by law — notify the relevant regulatory authority.

12play15 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the types of personal data collected, the legal basis for processing, or your data rights — we will provide advance notice to registered players via email or in-platform notification prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. We recommend that you review this Policy periodically to remain informed of how your data is being handled. Your continued use of the Platform following notification of changes constitutes acceptance of the updated Policy.

For significant changes, we may also request renewed consent where the updated processing activities require it, particularly where marketing preferences or the scope of data sharing are materially altered.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which 12play15 processes your personal data, please contact our Data Protection team:

• Live Chat: Available 24/7 through your account dashboard. The fastest channel for urgent privacy-related matters.
• Email: [email protected] — mark your subject line "Privacy Request" for priority handling. We aim to respond within 5 business days for privacy-related queries and within 30 calendar days for formal data rights requests.

If you are dissatisfied with our response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection authority or regulatory body in your jurisdiction. We encourage you to contact us first so that we have the opportunity to address your concerns directly.