NTC22 Privacy Policy – Malaysian Member Data Protection

NTC22 collects members' personal information through several channels — during account registration, during platform use, and through interactions with our support team. We only collect data that is genuinely necessary for the stated purposes, and nothing beyond that.

NTC22 uses members' personal data only for specific, legitimate purposes. We do not use your data beyond what is stated here without first obtaining your additional consent.

• Identity verification & fraud prevention: To ensure every account is held by a real individual who meets NTC22's eligibility requirements, including the minimum age of 21 and Malaysian citizenship or residency.
• Financial transaction processing: Enables deposits and withdrawals via Malaysian local payment methods — including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks) — all processed securely and accurately.
• Platform service delivery: Managing member accounts, processing bets, calculating winnings, and ensuring a smooth gaming experience across all NTC22 game categories.
• Customer support: Enables the NTC22 support team to locate your account, understand the context of your enquiry, and provide accurate, effective assistance.
• Legal compliance: To meet anti-money laundering (AML) requirements, financial reporting obligations, and other legal requirements applicable to platform operations.
• Platform improvements: Analysing usage patterns in aggregate (not individually) to improve the performance, interface, and overall user experience of the NTC22 platform.
• Marketing communications: Sending relevant NTC22 promotional information, bonuses, and offers — only to members who have consented to receive such communications.

NTC22 does not sell, rent, or trade member personal data to any third party for their own marketing purposes. Data sharing only occurs in the following limited circumstances, and only to the extent necessary for those purposes:

• Payment service providers: The payment gateways handling transactions for Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and other e-wallets require your transaction details in order to process your deposits and withdrawals.
• Game software provider: NTC22's gaming partners — such as slots providers and live casino platforms — receive only the minimum session data required to technically operate the games.
• Identity verification services: Approved third-party KYC providers may receive identity verification documents for age verification and anti-fraud purposes only.
• Legal requirements: ntc22 may disclose data to the relevant authorities where required by law, court order, or a legitimate investigation.
• Business transfers: In the event of a merger, acquisition, or sale of NTC22 assets, member data may be transferred as part of the business assets, subject to member notification and equivalent privacy protections.

All third parties that receive NTC22 member data are bound by strict data protection agreements and are only permitted to use that data for the specific authorised purposes. NTC22 conducts regular reviews of third-party compliance with these data protection obligations.

NTC22 implements multiple layers of technical and organisational security measures to protect member personal data from unauthorised access, loss, or misuse:

• 256-bit SSL Encryption: All data transmitted between your device and NTC22 servers is encrypted using 256-bit TLS/SSL — the same standard used by Malaysia's leading banking institutions.
• Encryption of stored data: Sensitive data stored on NTC22 servers — including identity information and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Strict access controls: Only NTC22 staff who require access to specific data in order to carry out their duties are permitted to do so. A role-based access control (RBAC) system is enforced at all levels.
• 24/7 Monitoring: An automated security monitoring system operates around the clock to detect and respond to any suspicious activity or unauthorised access attempts.
• Regular security audits: NTC22 conducts regular security audits and independent penetration testing to identify and address any system vulnerabilities.
• Secure data backup: Member data is regularly backed up to secure, separate server locations to ensure data recovery in the event of an unexpected system failure.

The NTC22 platform uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. The following types of cookies are used:

• Session cookies (mandatory): Required to maintain your login session, retain your game balance and settings, and ensure account security. Cannot be disabled without affecting the platform's core functionality.
• Preference cookies: Saving your preferences such as display language, odds display limits, and other interface configurations you have set. Allowing NTC22 to recognise you as a returning visitor.
• Analytics cookies: Collecting aggregated usage data (not personal identities) to help NTC22 understand how members interact with the platform — including the most frequently visited pages, time spent, and navigation flows.
• Security cookies: Helps detect fraudulent activity, suspicious login attempts, and platform abuse. These cookies form part of NTC22's account protection system.

You can manage or delete cookies through your web browser settings. Please note that disabling essential cookies will affect the functionality of the NTC22 platform, including your ability to log in to your account.

As an NTC22 member, you have clear and enforceable rights over your personal data. NTC22 is committed to facilitating the exercise of these rights without any undue restrictions:

• Right to Access: You have the right to request a copy of the personal data NTC22 holds about you. Such requests will be processed within 30 business days.
• Right to Rectification: If any of your personal data is inaccurate or out of date, you have the right to request a correction. Much of your basic information can be updated directly through your NTC22 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request that your personal data be deleted. Please note that NTC22 may need to retain certain data for a period required by legal obligations even after your account is closed.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. Once an objection is received, NTC22 will cease such processing immediately.
• Right to Data Portability: You may request that your personal data be provided in a machine-readable format for the purpose of transferring it to another service, to the extent that this is technically feasible.
• Right to Restrict Processing: In certain circumstances, you may request that the processing of your data be restricted — for example, while you are disputing the accuracy of data we hold.

To exercise any of the rights listed above, submit a written request to NTC22 by email at support@ntc22.xyz with the subject line "Data Privacy Rights Request", along with your account number and the type of request. We will verify your identity before processing the request to ensure the security of your data.

NTC22 retains members' personal data only for as long as necessary to fulfil the original purpose of collection and any related legal requirements. Retention periods are as follows:

• Active account data: Retained for the duration of your active membership on the NTC22 platform and used to provide a continuous service.
• Data after account closure: Financial and identity records are retained for a minimum of 5 years after account closure to meet legal requirements for anti-money laundering and financial reporting.
• Support communication records: Live chat and email support conversation records are retained for 2 years from the date of interaction for quality control and dispute resolution purposes.
• Aggregated analytics data: Non-personally identifiable usage data may be retained for longer periods for trend analysis and platform improvement purposes.
• Security logs: System and security logs are retained for a minimum of 12 months to enable investigation of security incidents should they occur.

Once the relevant retention period has elapsed, your personal data will be securely deleted or anonymised using methods that ensure it cannot be recovered.

The ntc22 platform is exclusively for individuals aged 21 and above and is not intended for minors or individuals under the legal age. NTC22 does not knowingly collect or process personal data of individuals under the age of 21.

If NTC22 discovers that personal data of an underage individual has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered on the NTC22 platform without permission are urged to contact us immediately at support@ntc22.xyz.

The NTC22 platform may contain links to third-party payment services such as the Touch 'n Go eWallet website, GrabPay, and internet banking gateways (Maybank2u, CIMB Clicks via FPX) that you will be redirected to when making transactions. Please be aware that:

• The NTC22 Privacy Policy applies solely to the ntc22.xyz platform and does not cover any third-party sites or services.
• Each third-party payment platform has its own privacy policy and terms of service, which you should review separately.
• Ntc22 is not responsible for the privacy practices of these third parties, even where they are our approved payment partners.
• Ntc22 selects payment partners based on their security and compliance standards; however, our control is limited to the contractual agreements in place.

We encourage you to read the privacy policy of each third-party service you use alongside the NTC22 platform to understand how they handle your data.