Privacy Policy — ujudi Platform

This Privacy Policy ("Policy") is published by ujudi and governs the collection, use, storage, sharing, and protection of personal data in connection with the ujudi platform at ujudi.cam and all related services, features, and communications (collectively, "the Platform").

ujudi is committed to handling your personal data with integrity and transparency. This Policy explains what personal data we collect from you, the lawful basis on which we process it, how long we retain it, and what rights you have in relation to your own data. We encourage you to read this Policy in full before registering an Account or using the Platform.

By registering an Account on ujudi, accessing the Platform, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy and agree to the data practices described herein. If you do not agree, you should not use the Platform.

This Policy is to be read in conjunction with our Terms and Conditions, which govern the overall contractual relationship between ujudi and registered Users. In the event of any conflict between this Policy and the Terms and Conditions specifically relating to data privacy, this Policy shall take precedence.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, directly or indirectly, including name, identification number, contact details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — ujudi, in its capacity as the entity that determines the purposes and means by which Personal Data is processed.
• "Data Subject" — the individual to whom the Personal Data relates; in most cases, this is the registered User of the Platform.
• "Third Party" — any entity other than ujudi and the Data Subject, including payment processors, identity verification providers, and analytics partners.
• "KYC" — Know Your Customer; the identity verification process required under applicable financial crime prevention regulations.
• "AML" — Anti-Money Laundering; the set of legal and procedural requirements designed to prevent the use of financial platforms for money laundering and related activities.
• "Cookies" — small text files placed on a User's device by the Platform to enable functionality, authentication, and analytics.
• "Sensitive Data" — a sub-category of Personal Data warranting heightened protection, including government-issued identification numbers, financial account details, and health-related information.

ujudi collects Personal Data from Users across several categories, depending on the nature of the interaction. The following table summarises the primary data categories we process:

We collect Personal Data through the following channels and methods:

4.1 Directly from You

• During account registration, when you provide your name, date of birth, email address, phone number, and residential address;
• During the KYC verification process, when you upload identification and supporting documents;
• When you complete deposit or withdrawal transactions using Malaysian payment methods including FPX, DuitNow, Maybank2u, CIMB Clicks, Public Bank, Touch 'n Go eWallet, Boost, or GrabPay;
• When you contact our customer support team via live chat or email;
• When you participate in promotions, complete surveys, or engage with Platform features that require data input.

4.2 Automatically via Technology

• Through browser cookies and similar session-tracking technologies as described in Section 10;
• Through server logs that record IP addresses, device identifiers, timestamps, and access patterns;
• Through in-Platform analytics tools that track feature usage and session behaviour to improve user experience;
• Through fraud detection and security monitoring systems that analyse access patterns for anomalous activity.

4.3 From Third-Party Sources

• From identity verification partners that corroborate the accuracy of documents provided during KYC;
• From payment processors and financial institutions in connection with transaction validation and fraud screening;
• From publicly available sources or regulatory databases where relevant to AML and financial crime prevention obligations.

ujudi processes Personal Data only for specific, defined purposes. We do not process data beyond what is necessary to fulfil the purpose for which it was collected. The primary purposes for which we process your data include:

• Account creation and management — to register, verify, maintain, and administer your ujudi Account;
• Contract performance — to provide the betting, gaming, and payment services that constitute the Platform's core service offering;
• Identity verification and KYC compliance — to fulfil legal obligations under applicable AML, financial crime prevention, and know-your-customer regulatory requirements;
• Payment processing — to facilitate deposits and withdrawals via FPX, DuitNow, and other Malaysian payment channels, and to reconcile financial transactions;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, account misuse, collusion, and other prohibited conduct;
• Responsible gambling — to identify behavioural patterns associated with problem gambling, to enforce deposit and loss limits, and to manage self-exclusion requests;
• Customer support — to respond to your enquiries, resolve complaints, and provide assistance with account and transaction issues;
• Platform improvement — to analyse usage patterns and feedback in order to develop, test, and optimise Platform features and user experience;
• Marketing communications — to send you relevant promotional offers, bonus notifications, and platform news, where you have consented to receive such communications;
• Legal compliance — to meet reporting obligations, respond to lawful requests from regulatory bodies or law enforcement authorities, and preserve records as required by applicable law.

All processing of Personal Data by ujudi is carried out on one or more of the following lawful bases:

• Contractual necessity — processing is required to fulfil or enter into a contract with you, including providing the gaming and payment services you have requested;
• Legal obligation — processing is required to comply with applicable law, including AML legislation, KYC requirements, and financial reporting obligations;
• Legitimate interests — processing is necessary for ujudi's legitimate business interests, including fraud prevention, platform security, and service improvement, provided such interests are not overridden by your rights;
• Consent — where you have provided freely given, specific, and informed consent to particular processing activities, such as receiving marketing communications. You may withdraw such consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

ujudi does not sell, rent, or trade your Personal Data to third parties for commercial or marketing purposes. We may, however, share your data in the following circumstances:

7.1 Service Providers and Processors

We engage trusted third-party service providers who process data on our behalf under binding data processing agreements. These include payment processors (including those facilitating FPX, DuitNow, and e-wallet transactions), identity verification and KYC providers, cloud hosting and infrastructure providers, fraud detection and security vendors, and customer support platform operators. All third-party processors are contractually required to handle your data in accordance with applicable privacy standards and solely for the purposes instructed by ujudi.

7.2 Legal and Regulatory Disclosure

ujudi may disclose Personal Data to government authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or in connection with the investigation of suspected financial crime, fraud, or other unlawful activity. Such disclosures are made only to the extent strictly necessary.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of ujudi's business assets, Personal Data held by the Platform may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained.

ujudi retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Account and identity data — retained for the duration of the active Account relationship and for a defined period following Account closure, in line with AML record-keeping requirements;
• Financial transaction records — retained for a minimum period consistent with applicable financial services record-keeping obligations;
• KYC documents — retained for the period required by applicable AML and identity verification regulations, typically calculated from the date of the last transaction or Account closure;
• Support communications — retained for a reasonable period after the resolution of the relevant support matter, to facilitate follow-up and dispute resolution;
• Technical and behavioural data — retained in aggregated or anonymised form for analytics purposes beyond the individual User's active Account period, where such data no longer constitutes Personal Data.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

ujudi implements and maintains a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the Platform;
• Encryption at rest for sensitive data held in our databases, including KYC documents and financial records;
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access Personal Data;
• Two-factor authentication (2FA) available for all User Accounts, and mandatory for administrative system access;
• Real-time intrusion detection and security monitoring systems that flag and respond to anomalous access patterns;
• Regular security assessments and vulnerability testing of Platform infrastructure and code.

While ujudi takes all reasonable steps to protect your data, no digital platform can guarantee absolute security. You also have a role to play in protecting your own Account — please maintain a strong password and enable two-factor authentication. If you suspect any unauthorised access to your Account, contact our support team immediately.

ujudi uses cookies and similar technologies on the Platform. Cookies are small data files stored on your device by your browser. They serve several functions essential to the safe and effective operation of the Platform.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies — required for the Platform to function at a basic level. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without rendering the Platform non-functional.
• Functional Cookies — used to remember your preferences and settings, such as language preference, notification settings, and recently viewed game categories.
• Analytics Cookies — used to collect anonymised information about how Users interact with the Platform — which pages are visited most, where Users encounter errors, and how navigation flows are used. This data helps us improve Platform performance and usability.
• Security Cookies — used by fraud detection and bot prevention systems to identify and block malicious access patterns without impeding legitimate Users.

10.2 Managing Cookies

You may configure your browser to block, delete, or alert you to the presence of cookies. Please note that disabling strictly necessary cookies will prevent you from accessing the Platform. For analytics and functional cookies, your browser settings or any cookie preference banner displayed on the Platform can be used to manage your choices.

You have the following rights in relation to your Personal Data held by ujudi. To exercise any of these rights, please contact our support team with a clear description of your request. We will acknowledge receipt and provide a substantive response within a reasonable timeframe. Note that certain rights may be subject to limitations where legal obligations override individual data rights.

To submit a data rights request, contact our support team as described in Section 15. Please note that we may need to verify your identity before processing any request relating to your Personal Data.

ujudi is strictly an adults-only platform. Registration and use of the Platform is prohibited for any individual under the age of 21 years. We do not knowingly collect, use, or retain Personal Data relating to any person under the age of 21.

If we become aware, through our KYC process or any other means, that a registered Account belongs to an individual who is under the minimum age requirement, that Account will be immediately suspended. Any funds held in the Account will be reviewed and handled in accordance with our Terms and Conditions and applicable regulations. Relevant notifications will be issued as required.

If you have reason to believe that a minor has registered an Account on ujudi, please contact our support team immediately so that we can investigate and take appropriate action.

In the course of operating the Platform and working with third-party service providers, it may be necessary to transfer certain Personal Data to servers or processors located outside Malaysia. Where such transfers occur, ujudi takes steps to ensure that appropriate safeguards are in place to maintain a level of data protection equivalent to the standards described in this Policy.

Safeguards for international transfers may include the use of standard contractual clauses, data processing agreements that bind the recipient to equivalent data protection obligations, and transfer only to jurisdictions that maintain recognised data protection frameworks.

Malaysian payment infrastructure — including FPX transactions processed through PayNet and DuitNow transfers — is handled through domestic financial network systems operating under Bank Negara Malaysia oversight. Such transactions do not involve international data transfer of financial credentials.

ujudi reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. When material changes are made to this Policy, we will notify registered Users via on-platform notification or email communication, and will update the version number and effective date displayed at the top of this document.

We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of an updated Policy constitutes your acknowledgement of the revised terms. If the changes are material and you do not agree with them, you may request Account closure in accordance with our Terms and Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the ujudi data support team through any of the channels listed below. All contact details are provided as plain text — none of the addresses listed are clickable links.