scr2u Privacy Policy —
Your Data, Your Rights

scr2u ("we", "us", "our", "Company") is the operator of the online gaming platform accessible at https://scr2u.cam and all associated subdomains, mobile-optimised sites, and applications (collectively, the "Platform"). scr2u is committed to protecting the privacy and personal data of all individuals who interact with the Platform, including registered players, prospective players, and visitors.

This Privacy Policy ("Policy") sets out in a clear and accessible manner how scr2u collects, uses, discloses, stores, and otherwise processes personal data in connection with your use of the Platform. It also describes your rights in relation to that data and how you may exercise them.

By accessing or using the Platform, or by registering an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree, please discontinue your use of the Platform.

This Policy should be read alongside our Terms and Conditions, which govern the overall relationship between you and scr2u.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or is capable of identifying a natural person, directly or indirectly, including but not limited to names, email addresses, identification documents, financial account details, and IP addresses.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means scr2u, being the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of scr2u under a documented data processing agreement.
• "KYC Data" means identity and age verification documentation collected as part of the Know Your Customer compliance process, including government-issued identification and proof of address.
• "Cookies" means small data files stored on your device by the Platform for functional, analytical, or preference-related purposes.
• "Account" means the personal registered player account created by you on the scr2u Platform.

scr2u collects Personal Data in the following categories, depending on how you interact with the Platform:

scr2u processes your Personal Data one or more of the following legal bases, depending on the processing activity:

• Contractual Necessity: Processing required to perform our obligations under the Terms and Conditions, including managing your Account, processing deposits and withdrawals, and providing access to Platform services.
• Legal Obligation: Processing necessary to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, age verification mandates, and financial record-keeping requirements.
• Legitimate Interests: Processing carried out for scr2u's legitimate business interests, including fraud prevention, Platform security, service improvement, and responsible gambling monitoring, where those interests are not overridden by your rights and interests.
• Consent: Where we rely on your consent as a legal basis (primarily for optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

scr2u uses the Personal Data we collect for the following purposes:

• Account Management: To create, maintain, and administer your scr2u Account, including authentication and Account security.
• Service Delivery: To provide access to games, process bets, calculate and award winings, and facilitate deposits and withdrawals in MYR via supported Malaysian payment methods (Touch 'n Go eWallet, DuitNow, Maybank2u, CIMB Clicks, Public Bank, Hong Leong, FPX, Boost, GrabPay, and cryptocurrency channels).
• KYC & Compliance: To verify your identity and age (21+ requirement), fulfil anti-money laundering obligations, and meet reporting requirements under applicable gaming and financial regulations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, and any activity that violates our Terms and Conditions or applicable law.
• Responsible Gambling: To monitor player behaviour for indicators of problem gambling, apply deposit limits and self-exclusion settings at your request, and fulfil our duty of care obligations toward at-risk players.
• Customer Support: To respond to your enquiries, resolve complaints, and provide assistance with Account-related issues.
• Platform Improvement: To analyse usage patterns, identify technical issues, test new features, and continuously improve the scr2u Platform experience.
• Marketing Communications: Where you have provided consent, to send you relevant promotional offers, bonus alerts, and platform updates. You may opt out at any time.
• Legal & Regulatory: To comply with applicable laws, respond to lawful requests from authorities, and defend or pursue legal claims where necessary.

scr2u does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. Your data may be shared in the following limited circumstances only:

• Payment Processors: Malaysian payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and partner banks receive transaction-specific data necessary to process your deposits and withdrawals. These providers are bound by their own regulatory obligations and data protection requirements.
• KYC & Identity Verification Partners: Accredited third-party identity verification service providers receive KYC documentation for the sole purpose of verifying your age and identity on scr2u's behalf. All such providers operate under strict data processing agreements.
• Platform Technology Providers: Software providers whose games or services are integrated into the scr2u Platform may receive limited session data (player ID, game session identifiers) necessary for game delivery and fairness certification. No personally identifying data is shared beyond what is operationally essential.
• Fraud Prevention Services: Specialist fraud detection and anti-money laundering service providers may receive flaged transaction data for analysis where fraud is reasonably suspected.
• Legal & Regulatory Authorities: scr2u will disclose Personal Data to law enforcement, gaming regulators, tax authorities, or other governmental bodies where required to do so by applicable law, court order, or regulatory mandate.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of scr2u's assets, Personal Data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

The scr2u Platform uses cookies and similar tracking technologies (collectively, "Cookies") to deliver a functional, personalised, and secure user experience. Cookies are small text files stored on your device when you visit the Platform.

scr2u uses the following categories of Cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These enable core functions such as session authentication, Account security, and payment processing. These Cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences and settings (e.g. language, responsible gambling controls, display preferences) to provide a more personalised experience on return visits.
• Analytical / Performance Cookies: Collect anonymised data about how users interact with the Platform — pages visited, session duration, error occurrences — to help us improve Platform performance and user experience. No personally identifying information is collected by these Cookies.
• Marketing Cookies: Used only where you have consented, to track your response to promotional communications and tailor bonus offers to your preferences.

scr2u retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following indicative retention periods apply:

• Account and Registration Data: Retained for the duration of your active Account and for a period of five (5) years following Account closure, to satisfy anti-money laundering record-keeping obligations and to resolve any post-closure disputes.
• KYC Documentation: Retained for a minimum of five (5) years following Account closure or the conclusion of the relevant business relationship, as required by applicable financial crime prevention regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping obligations.
• Technical and Usage Data: Retained for up to twenty-four (24) months from collection for fraud detection, security monitoring, and Platform improvement purposes, after which it is anonymised or deleted.
• Marketing Communications Data: Retained until you withdraw consent or opt out of marketing communications, after which your preference data will be updated and promotional processing will cease.
• Support Correspondence: Retained for up to three (3) years following the resolution of the relevant support interaction.

Upon expiry of the applicable retention period, Personal Data will be securely and irreversibly deleted or anonymised in manner that prevents re-identification.

scr2u implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, without limitation:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of Personal Data and financial records at rest using industry-standard encryption protocols.
• Role-based access controls ensuring that only authorised personnel with a documented operational need may access Personal Data.
• Multi-factor authentication requirements for internal systems that store or process Personal Data.
• Regular penetration testing, vulnerability scanning, and third-party security audits of Platform infrastructure.
• Incident response procedures providing for the prompt identification, containment, and notification of any Personal Data breach.

In the event of a Personal Data breach that poses a risk to your rights and freedoms, scr2u will notify affected individuals and relevant authorities in accordance with applicable law.

Subject to applicable law, you have the following rights in relation to the Personal Data scr2u holds about you. These rights may be exercised at any time by contacting our support team at [email protected]:

• Right of Access: You have the right to obtain confirmation of whether scr2u processes your Personal Data, and to receive a copy of the data we hold about you, together with information about how it is being used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data we hold about you. You may also update certain Account details directly through your Account settings.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. This right is subject to exceptions where retention is required by law.
• Right to Restriction of Processing: You have the right to request that scr2u restrict the processing of your Personal Data in certain circumstances, including where you contest the accuracy of the data or object to processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object: You have the right to object to processing of your Personal Data where that processing is based on legitimate interests, including profiling. scr2u will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

scr2u may request proof of identity before processing a rights request to ensure that Personal Data is not disclosed to or acted upon at the request of an unauthorised party.

The scr2u Platform is strictly intended for individuals aged 21 years and above. scr2u does not knowingly collect, process, or retain Personal Data from persons under the age of 21. Access to the Platform by minors is expressly prohibited.

scr2u employs mandatory age verification (KYC) processes to confirm that all registered players meet the minimum age requirement before withdrawal facilities are enabled. In the event that scr2u becomes aware that Personal Data has been collected from a person under the age of 21, that Account will be immediately suspended, any funds associated with the Account will be dealt with in accordance with our Terms and Conditions, and the relevant Personal Data will be deleted from our systems as soon as is practicable.

scr2u's primary data processing infrastructure is located within secure data centres. As an internationally licensed operator serving Malaysian players, certain processing activities — including KYC verification, fraud detection, and game delivery — may involve the transfer of Personal Data to service providers operating outside Malaysia.

Where such international transfers occur, scr2u ensures that appropriate safeguards are in place to protect your Personal Data to a standard equivalent to that which applies within the relevant jurisdiction. Safeguards employed include, without limitation:

• Contractual clauses that require the recipient to process Personal Data to an equivalent standard of protection as applied by scr2u.
• Transfer only to jurisdictions that maintain data protection standards recognised as adequate under applicable international frameworks.
• Technical encryption and access controls applied to all data in transit between jurisdictions.

For further information about international transfer safeguards applicable to your Personal Data, please contact our support team.

scr2u reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where amendments are material in nature, we will provide reasonable advance notice to registered players via the email address associated with their Account or through a prominent notice on the Platform.

The "Last Updated" date at the top of this Policy reflects the effective date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

The current version of this Privacy Policy is always accessible at https://scr2u.cam/privacy-policy. We encourage you to review this Policy periodically to stay informed about how we protect your data.

For any questions, concerns, or requests relating to this Privacy Policy or the exercise of your data protection rights, please contact the scr2u privacy team using the details below:

For general platform questions and responsible gambling support, please visit our FAQ page or our Responsible Gambling page.