Candy916 Privacy Policy – Malaysia User Personal Data Protection

01 Information We Collect

Candy916 collects two main categories of information from users: information you provide directly while using our platform, and information collected automatically through standard tracking technologies.

Information You Provide Directly:

• Registration Information: Full name, date of birth, email address, mobile number, and password when registering a candy916 account.
• Identity Verification (KYC) Information: Copies of your identity card, passport, or other official documents required to verify your identity in compliance with legal requirements.
• Financial Information: Your Malaysian bank account or eWallet details used for deposits and withdrawals. candy916 does not store credit or debit card information directly.
• Communication: The content of messages, emails, or live chat sessions you conduct with the candy916 customer support team.
• Profile Information: Game preferences, account settings, and other information you voluntarily enter in your candy916 profile.

Information Collected Automatically:

• Your IP address, web browser type, and device operating system.
• Pages you visit, session duration, and actions taken within the candy916 platform.
• General location data based on IP address for security and regional verification purposes.
• Device information such as model, unique identifiers, and operating system when you use the candy916 mobile app.

02 How We Use Your Data

Candy916 uses your personal data for limited, lawful, and transparent purposes. We do not process your data for any purpose other than those stated below without obtaining fresh consent from you:

• Service Provision: Managing your account, processing deposits and withdrawals, providing access to games, and ensuring the candy916 platform runs smoothly for you.
• Identity Verification: Carrying out legally mandated KYC processes to verify the age and identity of new members and prevent fraud.
• Platform Security: Detecting and preventing fraud, money laundering, account abuse, and other security threats that could affect the candy916 platform and its members.
• Service Communication: Sending important notices about your account, changes to terms, security updates, and transaction information via email or in-app notifications.
• Customer Support: Processing inquiries, complaints, and support requests you submit to the candy916 support team.
• Platform Improvement: Analyzing usage patterns in aggregate and anonymized form to improve the design, performance, and content of the candy916 platform.
• Legal Compliance: Meeting the reporting, auditing, and record-keeping obligations required under applicable Malaysian law.

03 Sharing Information with Third Parties

Candy916 does not sell, rent, or disclose your personal data to third parties for marketing or commercial purposes. However, in the course of operating the platform, candy916 may share your personal data with a limited number of third parties in the following circumstances:

• Payment Service Providers: Information required to process deposits and withdrawals is shared with payment gateway providers such as FPX, DuitNow, and registered eWallet providers in Malaysia. These providers are bound by strict confidentiality agreements.
• Game Software Providers: Usernames and required game information are shared with licensed game providers to enable you to access their game content through the candy916 platform.
• KYC Service Providers: Identity verification documents are shared with licensed KYC service providers to process identity verification securely and in accordance with legal requirements.
• Legal Authorities: candy916 will disclose the necessary information to authorities, regulatory bodies, or law enforcement agencies when required to do so by law or a valid court order.
• Analytics Services: Anonymised and aggregated usage data may be shared with analytics providers to help us understand and improve the candy916 platform user experience.

04 Data Security and Protection Measures

Candy916 continuously invests in the latest security infrastructure to ensure your personal data is always protected. Key security measures we implement include:

• Encryption in Transit: All data transmitted between your browser or app and the candy916 servers is encrypted using TLS 1.3 protocol and 256-bit SSL encryption.
• Storage Encryption: Sensitive data stored in the candy916 database is encrypted using industry-standard encryption algorithms at rest.
• Access Control: Access to members' personal data is restricted to candy916 staff who require it to perform their duties, with the principle of least privilege enforced.
• Continuous Monitoring: The candy916 system is continuously monitored 24/7 to detect suspicious activity, intrusion attempts, or other security threats.
• Security Audit: candy916 conducts regular security audits and penetration testing by independent third parties to identify and address security vulnerabilities.
• Data Backup: Member data is backed up regularly to a secure, separate location to ensure data recovery in the event of an unexpected incident.

While candy916 takes all reasonable steps to protect your data, no security system can be guaranteed 100% secure. You also play an important role in protecting your account by using a strong password, not sharing your login credentials, and notifying us immediately if you suspect any unauthorized access.

05 Cookies, Tracking Technologies, and Your Choices

Candy916 uses cookies and similar tracking technologies to enhance user experience, ensure platform security, and analyze usage patterns. The following are the types of cookies we use:

• Essential Cookies: Required for core candy916 platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Storing your preferences such as preferred language, display settings, and saved login details for your convenience.
• Analytics Cookies: Collecting aggregated and anonymized information about how you use the candy916 platform to help us understand usage patterns and improve our services.
• Security Cookies: Helping detect and prevent fraudulent activity, cyberattacks, and platform abuse by identifying abnormal behavioral patterns.

06 Your Rights as a candy916 User

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and the candy916 privacy policy, you have the following rights regarding your personal data:

To exercise any of the rights above, please contact the candy916 customer support team via live chat or our official email. We will process your request within 30 days working days from the date of receipt of a complete request.

07 Data Retention Period

Candy916 retains your personal data for as long as necessary to fulfill the purpose for which it was collected, subject to applicable legal requirements in Malaysia.

• Active Account Data: Retained for as long as your candy916 account remains active or as long as necessary to provide services to you.
• Financial Transaction Data: Retained for a minimum of 7 years after a transaction is made, in line with Malaysia's accounting and anti-money laundering legal requirements.
• KYC Records: Retained for a minimum of 5 years after the business relationship ends, in line with applicable legal requirements.
• Security Logs: Retained for 2 years for the purpose of security incident investigation and fraud detection.
• Support Communication Data: Retained for 2 years after case resolution, for reference and service quality improvement purposes.

Upon expiry of the retention period, candy916 will securely delete or anonymize your personal data in accordance with established data deletion procedures. If you close your candy916 account, the data deletion process will be initiated after the minimum retention period required by law.

08 Child Privacy & Young User Protection

Candy916 strictly prohibits use of the platform by individuals under the age of 18. We do not knowingly collect or process personal data of minors.

As an added safeguard, candy916 enforces a strict age verification process during account registration. All new members are required to confirm they are 18 years of age or older, and candy916 reserves the right to request age verification documents at any time.

09 Changes to This Privacy Policy

Candy916 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our operational practices, new legal requirements, or new technologies we adopt. The "Last Updated" date at the top of this document indicates when the current version took effect.

For significant changes, candy916 will notify members via one or more of the following methods:

• A clear notice on the home page or within your candy916 account.
• Notification emails are sent to your registered email address.
• Push notifications via the candy916 mobile app (if you have enabled notifications).

Your continued use of the candy916 platform after an updated Privacy Policy takes effect will be considered your acceptance of those changes. If you disagree with any changes, you have the right to close your account and request deletion of your personal data in accordance with the procedures set out.