Privacy Policy scrplay2 — We Take Care of Your Data

This Privacy Policy is issued by scrplay2 ("we", "platform") and applies to all individuals who use the scrplay2 platform at scrplay2.ws, including all registered members, website visitors, and anyone who interacts with scrplay2 services through any digital channel.

Scrplay2 acts as the data controller for all personal information collected through the platform. This means we determine the purposes and means by which your personal data is processed, and we are fully responsible for ensuring that such processing is carried out in accordance with applicable law, in particular Personal Data Protection Act (PDPA) 2010 Malaysia.

By using the scrplay2 platform, registering an account, or making a deposit via Touch 'n Go eWallet, DuitNow, GrabPay, or any other local payment method we support, you agree to the practices described in this Privacy Policy. If you do not agree with any part of this policy, we respect your decision not to use the scrplay2 platform.

2.1 Data You Provide Directly

When you register an account or use scrplay2's services, we collect information you provide directly, including:

• Registration information: Full name, Malaysian phone number, and password (stored in encrypted form)
• Identity verification information (KYC): A copy of your MyKad or valid Malaysian identity document
• Financial information: Payment account details (Touch 'n Go, DuitNow, FPX bank account number) for deposits and withdrawals
• Support communications: Correspondence content, live chat logs, and emails you send to the scrplay2 team

2.2 Automatically Collected Data

While you use the scrplay2 platform, our systems automatically collect certain technical information:

• Log data: IP address, browser type, operating system, login and logout timestamps
• Usage data: Pages visited, markets viewed, time spent on each section of the platform
• Device data: Device type (smartphone, tablet, computer), screen resolution, operating system
• Cookie data: Session cookies, preference cookies, and analytics cookies (see Section 6 for full details)

2.3 Betting Activity Data

As a sports betting platform, scrplay2 naturally records all betting activity associated with your account:

• A record of all bets placed, including markets, odds, amounts, and results
• Complete deposit and withdrawal history in MYR
• Bonus and promotion usage records
• In-play activity records under the Live Matches section

3.1 Service Provision

The primary purpose of data collection is to operate the scrplay2 platform and deliver the services you signed up for. This includes processing account registrations, verifying your identity, handling deposits and withdrawals in MYR, and processing bets on Malaysia Super League and EPL football, BWF badminton, T20 cricket, and all other available sports.

3.2 Security & Fraud Detection

Scrplay2 uses technical data and betting activity data to detect and prevent suspicious activity, including identity fraud, multi-account abuse, money laundering, and bonus abuse. This represents scrplay2's legitimate interests and constitutes our obligation under Malaysian financial regulations.

3.3 Legal Compliance

Certain data processing is mandatory under Malaysian law — we have no choice but to comply. This includes retaining financial transaction records for periods specified under Malaysian tax and financial legislation, and disclosing information to competent authorities when required by court order or lawful regulatory request.

3.4 Communication & Support

We use your contact information (Malaysian phone number) to send important account notifications, keep you informed of material platform or policy changes, and for customer support purposes when you reach out to us.

3.5 Marketing (With Your Consent)

With your consent, scrplay2 may use your information to send you details about promotions, bonuses, and special offers relevant to your preferences. You may withdraw this consent at any time through your account settings or by contacting scrplay2 support.

Scrplay2 takes a strict approach to data sharing. In short: we do not sell or rent your personal data to any third party for their own marketing or commercial purposes, under any circumstances.

4.1 Third-Party Service Providers

In operating the platform, scrplay2 works with selected service providers who assist us in delivering our services to you. These providers include:

• Payment processors: Entities that facilitate transactions via Touch 'n Go eWallet, DuitNow, FPX, GrabPay, ShopeePay, and Boost. They receive only the data necessary to process your transaction.
• Technical infrastructure providers: Server hosting and cloud service providers that store your data in a secure, encrypted environment.
• Identity verification service providers: Companies that assist us in carrying out KYC processes in accordance with compliance requirements.

All third-party service providers are bound by data processing agreements that require them to handle your data to a standard at least equivalent to scrplay2's Privacy Policy.

4.2 Legal Requirements & Authorities

Scrplay2 may be required to disclose your data to Malaysian government authorities or law enforcement if obligated to do so by law, court order, or valid official request. In such circumstances, scrplay2 will endeavour to notify you in advance unless prohibited from doing so by law.

4.3 Business Transfers

In the event that scrplay2 is involved in any merger, acquisition, or sale of assets, member data may be transferred as part of those business assets. In such circumstances, we will ensure the continuity of your privacy protection and provide appropriate notice before your data becomes subject to different privacy terms.

5.1 Technical Security Measures

Scrplay2 implements multiple layers of technical security to protect your personal data:

• Data encryption in transit: All data transmitted between your device and scrplay2's servers is encrypted using TLS 1.3 (256-bit SSL) — the highest industry standard.
• Data encryption at rest: Sensitive data, including financial information and identity details, is encrypted in the database using the AES-256 algorithm.
• Encrypted passwords: Your account password is never stored in plain text — only a cryptographic hash that cannot be decrypted is saved.
• 24/7 Monitoring: The scrplay2 IT security team continuously monitors infrastructure to detect any unusual activity or intrusion attempts.
• Regular security audits: Independent security assessments are conducted periodically by certified third-party security specialists.

5.2 Data Retention Period

Scrplay2 does not retain your personal data longer than necessary for its processing purposes or to meet legal requirements. Refer to the table in Section 2.3 for the specific retention periods applicable to each data category.

5.3 Data Breach Response Procedure

While scrplay2 takes all reasonable steps to protect your data, no system is 100% secure. In the event of a data breach affecting your personal data, scrplay2 is committed to:

• Notifying affected members within the required timeframe 72 hours after we detect the breach
• Provide clear information about what data may have been affected and the steps we are taking
• Reporting to the Department of Personal Data Protection Malaysia as required by law

6.1 What Are Cookies?

Cookies are small text files stored on your device when you visit the scrplay2 website. They help the platform run more smoothly and provide you with a more personalised experience. scrplay2 uses three main categories of cookies:

6.2 Managing Your Cookies

You can manage or delete cookies through your browser settings. Please note, however, that disabling essential cookies may affect the functionality of the scrplay2 platform. Preference and analytics cookies can be disabled without impacting core platform functionality.

As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data held by scrplay2:

7.1 How to Exercise Your Rights

To exercise any of the above rights, you may contact the scrplay2 Data Protection Officer at privacy@scrplay2.ws or through scrplay2 customer support. We will process your request within 30 days from the date of receipt. In complex cases, this period may be extended up to 60 days with prior notice given to you.

Please note that some of these rights are not absolute and are subject to certain exemptions under PDPA 2010 — for example, we cannot delete data required to fulfil legal obligations or to defend legal claims.

The scrplay2 platform is restricted to individuals aged 18 and above. scrplay2 does not knowingly collect personal data from anyone under the age of 18. Should we discover that we have inadvertently collected data from an underage individual, we will take immediate steps to delete that data and close the associated account.

In certain operational situations, your personal data may be transferred to or stored on servers located outside Malaysia — for example, when we use international cloud infrastructure providers for platform security and reliability purposes.

In all cases of cross-border data transfers, scrplay2 ensures that:

• The recipient country or entity maintains a level of data protection equivalent to or higher than Malaysia's
• Legally binding data processing agreements are in place
• Appropriate technical and organisational measures are in place to protect data in transit and when stored overseas

Scrplay2's primary goal is to store Malaysian members' data — particularly sensitive information such as identity and financial details — within infrastructure maintained under the highest security controls, regardless of the physical server location.

Scrplay2 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements. The "Updated" date at the top of this page will always reflect the current version of the policy.

For material changes — that is, changes that significantly affect how we use your data or that reduce your rights — scrplay2 will provide at least 30 days' notice before the changes take effect. Notice will be sent via your registered email and through in-platform notifications.

Continued use of the scrplay2 platform after a policy change takes effect will be considered acceptance of the updated policy. We encourage you to review this page periodically.

Scrplay2 has appointed a Data Protection Officer responsible for ensuring compliance with this Privacy Policy and applicable data protection laws. If you have any questions, concerns, or wish to exercise your rights under PDPA 2010, please contact us:

You also have the right to lodge a complaint with the Department of Personal Data Protection Malaysia if you are dissatisfied with how scrplay2 handles your personal data, though we strongly encourage you to contact us first so we can resolve any concerns directly.

This Privacy Policy is to be read together with Terms & Conditions and Responsible Gaming Policy scrplay2, all of which together form a comprehensive data protection framework for every scrplay2 member in Malaysia.