Agar2 Privacy Policy – Data Protection for Malaysian Players

agar2 collects personal data from you in several ways — directly when you complete the registration form, automatically as you use the platform, and occasionally from legitimate third parties. The following are the categories of data we collect:

agar2 does not collect unnecessary data, and we practise the principle of "data minimisation" — we only ask for information that is genuinely required to provide you with platform services safely and efficiently.

Personal data collected by agar2 solely for the following legitimate and stated purposes. We do not use your data for any other purpose without informing you in advance:

• Account Management: Registering and verifying your agar2 account, processing secure logins, and managing your player profile.
• Financial Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, FPX Maybank2u and CIMB Clicks, and securely and accurately processing winning withdrawals in MYR (Malaysian Ringgit).
• Identity Verification (KYC): Meeting the legal requirements of the Personal Data Protection Act 2010 and the anti-money laundering (AML) regulations in force in Malaysia.
• Service Provision: Granting you access to all games on agar2, managing your bonuses and promotions, and delivering effective customer support.
• Platform Security: Detecting and preventing fraud, hacking, account abuse and suspicious activity that could compromise your safety or that of other members on agar2.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and reaching out to the relevant players with appropriate support resources.
• Important Communications: Sending account-related notices, terms updates, security information, and responses to your support inquiries to agar2.
• Platform Improvements: Analysing usage data in an aggregated and anonymised manner to understand how players interact with agar2 for the purpose of continuous improvement.

agar2 processes your personal data on one or more valid legal grounds under Malaysia's Personal Data Protection Act 2010 (PDPA). Every data processing activity we carry out has a clear legal justification:

• Contract Performance: Data processing required to deliver agar2's platform services to you — such as processing deposits and withdrawals — is based on the service contract between you and agar2.
• Legitimate Interest: agar2 has a legitimate business interest in processing certain data for platform security, fraud prevention and service improvement purposes, provided that such interests do not override your fundamental rights.
• Legal Obligation: Certain data processing activities are required by Malaysian law — for example, KYC requirements under anti-money laundering regulations oblige us to retain member identity records.
• Consent: For processing activities not covered by other legal bases — such as marketing communications — agar2 will obtain your explicit consent beforehand. You are free to withdraw that consent at any time.

agar2 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, there are limited circumstances in which agar2 may need to share your data with trusted third parties for service delivery purposes:

• Payment Providers: agar2 shares necessary transaction information with Malaysian payment service providers such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay and FPX providers solely for the purpose of processing your financial transactions.
• Game Providers: Game session information that must be shared with game providers such as Habanero, Red Tiger, and Spadegaming for technical purposes and the resolution of game-related disputes.
• Technology Service Providers: Companies that help agar2 operate its platform — such as cloud service providers and support system vendors — may process your data as third-party data processors acting on agar2's instructions. All such providers are bound by strict confidentiality agreements.
• Legal Authorities: agar2 will disclose your personal data to Malaysian authorities if required to do so by law, court order, or for the purposes of a legitimate criminal investigation.

Protecting your personal data from unauthorised access, loss, misuse or disclosure is our absolute priority agar2. We implement multiple layers of technical and organisational security measures for this purpose:

• 256-Bit SSL Encryption: All communications between your device and agar2's servers are protected by 256-bit SSL encryption, ensuring that your data cannot be intercepted in transit.
• Encryption of Stored Data: Sensitive data such as payment information and passwords are stored in encrypted form on agar2's servers using the latest industry-standard encryption algorithms.
• Multi-Layered Access Controls: Access to systems storing agar2 members' personal data is restricted to authorised personnel only, with two-factor authentication and comprehensive audit logs in place.
• Regular Security Imaging: agar2 conducts regular penetration testing and security audits carried out by independent cybersecurity experts to identify and address vulnerabilities before they can be exploited.
• Incident Response Procedure: agar2 has a tested incident response procedure in place to address any data security breaches swiftly. Should a breach occur that affects your data, agar2 will notify you and the relevant authorities within the timeframe required by Malaysian law.

While agar2 takes all reasonable precautions, no security system can guarantee absolute 100% protection in an ever-changing online environment. You also play an important role in keeping your agar2 account secure by using a strong password and not sharing it with anyone.

agar2 follows a "purpose limitation" principle in data retention — we retain your personal data only for as long as necessary for the purpose for which it was collected, or as required by Malaysian law. The following are our general data retention guidelines:

• Active Account Data: For as long as your agar2 account remains active, we retain all data necessary to provide our services to you.
• Data After Account Closure: After an account is closed, agar2 retains identity and transaction records for seven (7) years as required under Malaysia's anti-money laundering laws.
• Communication Data: Live chat records and support tickets are retained for three (3) years for the purposes of dispute resolution and service improvement.
• Marketing Data: If you have withdrawn consent for marketing communications, data associated with that purpose will be deleted within 30 days from the date of consent withdrawal.
• Technical Data (Logs): Technical logs such as IP addresses and session data are retained for 90 days for security purposes and technical troubleshooting.

Once the relevant retention period has expired, agar2 will securely delete or destroy such data using procedures that ensure it cannot be recovered by any party. Data that is no longer needed will not be retained for any reason.

Platform agar2 uses cookies and similar tracking technologies to enhance your user experience. Cookies are small text files stored on your device when you visit the agar2 website. The following are the types of cookies we use:

• Essential Cookies: These cookies are essential for the core functions of the agar2 platform — including login authentication, session management and security. The platform cannot operate properly without them and they cannot be disabled.
• Functional Cookies: These cookies allow agar2 to remember your preferences — such as your preferred language and display settings — to provide a more personalised experience on your next visit.
• Analytics Cookies: agar2 uses analytics cookies to understand how players interact with our platform in aggregate, anonymised form. This information helps us continuously improve the agar2 platform over time.
• Security Cookies: These cookies help agar2 detect suspicious activity, prevent fraud, and protect player accounts from unauthorised access.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a member agar2 have important rights regarding your personal data. agar2 respect and facilitate the exercise of all these rights:

• Right of Access: You have the right to request and receive a copy of the personal data that agar2 holds about you. Such requests will be processed within 14 business days.
• Right to Rectification: If any personal data held by agar2 is inaccurate or incomplete, you have the right to request a correction or update. You may also update certain information directly through your agar2 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request that agar2 erase your personal data. However, this right may not apply where agar2 is under a legal obligation to retain the data in question.
• Right to Object: You have the right to object to the processing of your personal data for specific purposes — in particular, for direct marketing. You may do so through your account settings or by contacting agar2.
• Right to Restrict Processing: In certain circumstances, you may request that agar2 restrict how we process your data — for example, while we are investigating a data-related dispute.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing that took place prior to the withdrawal.

To exercise any of the rights above, please contact agar2 via email at [email protected], stating the right you wish to exercise along with your account details. We will process your request within 14 working days and notify you of the action taken.

Platform agar2 is an adult entertainment service restricted to individuals aged 18 and above. agar2 does not knowingly collect personal data from children or individuals below the stipulated age limit.

If agar2 discovers that personal data has been collected from individuals under the age of 18 without our knowledge — possibly due to inaccurate information provided during registration — we will take the following immediate action:

• Immediately suspending the account in question.
• Deleting all personal data associated with the account.
• Forfeiting all funds, bonuses and winnings in the account in question.
• Reporting the matter to the relevant authorities where necessary.

If you, as a parent or guardian, believe that your minor child has registered an account at agar2, please contact us immediately at [email protected] so that prompt action can be taken to protect your child's best interests.

agar2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, current legal requirements or platform improvements. You will be notified of any material amendments via a prominent notice on the agar2 platform or by email to the address registered to your account.

It is your responsibility to review this Privacy Policy from time to time. The "Updated" date at the top of this document indicates when the last amendment was made. Your continued use of the platform agar2 after the amendments are published shall be deemed as your acceptance of the revised policy.

If you have any questions, concerns or complaints regarding this Privacy Policy or how agar2 handle your personal data, please contact us through the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 on the agar2 platform
• Response Time: We aim to respond to all privacy-related enquiries within 2 business days.