Privacy Policy
Ongcuci takes your privacy seriously. This Policy explains exactly what personal data we collect, why we collect it, how it is used and protected, and what rights you hold over your own information.
Data Categories Covered in This Policy
Introduction
This Privacy Policy ("Policy") is issued by the entity operating the ongcuci Platform ("the Company", "we", "us", "our") and applies to all personal data collected and processed in connection with your use of the ongcuci website at https://ongcuci.cam and all associated services (collectively, the "Platform").
Ongcuci is committed to protecting the privacy and personal data of all users, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. We process personal data only where we have a lawful basis to do so and in accordance with the principles of transparency, purpose limitation, data minimisation, and security.
By registering an Account or using the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read in conjunction with our Terms and Conditions, which govern the broader relationship between you and ongcuci.
Our Commitment: Ongcuci does not sell your personal data to third parties for marketing purposes. We collect only what is necessary to operate the Platform safely and in compliance with our international licensing obligations.
Definitions
The following definitions apply throughout this Privacy Policy:
- "Personal Data" — any information that identifies or can reasonably identify a living individual, directly or in combination with other data.
- "Data Controller" — the Company, as the entity that determines the purposes and means by which Personal Data is processed.
- "Data Processor" — any third party that processes Personal Data on behalf of the Company under a written data processing agreement.
- "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
- "Player" / "User" / "you" — any individual who registers an Account or accesses the Platform.
- "KYC Data" — identity and address verification documents submitted as part of the Know Your Customer verification process.
- "Cookie" — a small text file placed on your device by a website to store session or preference information.
- "Special Category Data" — sensitive personal data requiring heightened protection, including (where relevant) data related to self-exclusion or problem gambling indicators.
Personal Data We Collect
The categories of personal data we may collect in connection with your use of the ongcuci Platform are set out below:
3.1 Identity Data
Full legal name, date of birth, nationality, and government-issued identification details (Malaysian NRIC / MyKad number, passport number, or driver's licence number) collected as part of account registration and KYC verification.
3.2 Contact Data
Email address, mobile telephone number, and — where provided — residential address. For Malaysian players, this may include your address in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location within Malaysia or internationally.
3.3 Financial Data
Payment method identifiers (e-wallet account references for Touch 'n Go eWallet, Boost, GrabPay; bank account numbers for Maybank, CIMB, Public Bank, Hong Leong; DuitNow ID; cryptocurrency wallet addresses for BTC, ETH, USDT, LTC), transaction history, deposit amounts, withdrawal amounts, and wagering records. We do not store complete card numbers or full banking credentials on our servers.
3.4 Technical & Device Data
IP address, device type, operating system, browser type and version, screen resolution, mobile network information, and unique device identifiers.
3.5 Usage Data
Pages visited, games played, betting history, session duration, clickstream data, search queries within the Platform, and feature interaction patterns.
3.6 Communications Data
Records of correspondence submitted via live chat, support tickets, email communications, and any feedback or complaint submissions.
3.7 Verification Data
Documents submitted for KYC verification, including scanned copies of identification documents and selfie photographs. These are processed under heightened security controls and retained only for as long as required by our licensing obligations.
Sensitive Data Note: Where a player activates self-exclusion or discloses problem gambling concerns, we may record this information as part of our responsible gambling programme. Such data is treated as Special Category Data and is subject to additional access controls.
How We Collect Personal Data
We collect personal data through the following means:
4.1 Direct Collection
Data provided by you directly, including information entered during account registration, KYC document submissions, deposit and withdrawal requests, support enquiries, and voluntary profile updates.
4.2 Automated Collection
Technical and usage data collected automatically as you interact with the Platform, including via cookies, web beacons, log files, and similar tracking technologies. See Section 8 (Cookies & Tracking) for full details.
4.3 Third-Party Sources
We may receive personal data from third-party identity verification providers, fraud detection services, payment processors, and — where applicable — publicly available sources or credit reference agencies used for AML (Anti-Money Laundering) screening purposes. All third-party data processors are subject to written data processing agreements.
Legal Basis for Processing
We process your personal data on one or more of the following legal grounds:
| Legal Basis | Examples of Processing |
|---|---|
| Contractual Necessity | Processing required to register your Account, process deposits and withdrawals, settle bets, and fulfil our obligations under the Terms and Conditions. |
| Legal Obligation | KYC/AML identity verification, age verification (21+), fraud prevention, regulatory reporting obligations under our international gaming licence. |
| Legitimate Interests | Platform security monitoring, fraud detection, improving Platform performance, analytics and service optimisation, responsible gambling programme operation. |
| Consent | Marketing communications (where you have opted in), placement of non-essential cookies, personalised content recommendations. |
How We Use Your Personal Data
The Company uses your personal data for the following purposes:
6.1 Account Management
To register and maintain your player account, authenticate logins, process profile updates, and manage Account security — including detecting and preventing unauthorised access.
6.2 Payment Processing
To process deposits made via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency methods, and to execute withdrawal requests to your verified payment account.
6.3 Regulatory Compliance
To fulfil Know Your Customer (KYC), Anti-Money Laundering (AML), and age verification obligations required under our international gaming licence. This includes verifying that all players are aged 21 or above before permitting gambling activity.
6.4 Platform Operation & Improvement
To operate, maintain, and improve the Platform; to diagnose technical faults; to analyse usage patterns and improve game selection, interface design, and mobile performance for Malaysian users.
6.5 Customer Support
To respond to enquiries, resolve disputes, process complaints, and communicate with you regarding your account or any Platform-related matter.
6.6 Fraud Prevention & Security
To detect, investigate, and prevent fraudulent activity, bonus abuse, money laundering, and other prohibited conduct as defined in the Terms and Conditions.
6.7 Responsible Gambling
To operate self-exclusion tools, deposit limit systems, reality checks, and other responsible gambling features. To monitor for indicators of problem gambling behaviour and provide appropriate support where concerns arise.
6.8 Marketing Communications
Where you have provided explicit consent, to send you promotional communications about ongcuci bonuses, new game launches, seasonal offers, and VIP programme updates. You may withdraw this consent at any time via your Account settings or by contacting support.
Data Sharing & Disclosure
Ongcuci does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We may share your personal data in the following limited circumstances:
7.1 Service Providers & Data Processors
We engage trusted third-party service providers to perform functions on our behalf, including payment processing, identity verification, fraud detection, data hosting, email delivery, and customer support tooling. All such providers are bound by written data processing agreements and are permitted to use your data only for the specified purpose.
7.2 Regulatory Authorities & Law Enforcement
We may disclose personal data to our licensing regulator, financial intelligence units, law enforcement agencies, or other public authorities where required by law, legal process, or regulatory obligation — including obligations arising under our international gaming licence.
7.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
7.4 With Your Consent
We may share your data with specific third parties where you have provided explicit, informed consent to such sharing.
Reminder: Ongcuci does not share your personal data with third-party marketers, affiliate networks for direct-marketing targeting, or any party that intends to use your data for purposes beyond what is described in this Policy without your explicit consent.
Cookies & Tracking Technologies
The ongcuci Platform uses cookies and similar technologies to operate core functionality, improve user experience, and analyse Platform performance.
8.1 Types of Cookies We Use
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Session authentication, security tokens, shopping cart / balance management | No — essential for Platform operation |
| Functional | Language preferences, display settings, last visited game category | No — supports basic personalisation |
| Analytics | Aggregate usage statistics, page performance, error logging | Yes — consent requested on first visit |
| Marketing | Personalised promotional content, re-engagement campaigns | Yes — opt-in required |
8.2 Managing Cookies
You may manage cookie preferences through the cookie consent banner displayed on your first visit to the Platform, or by adjusting your browser settings. Disabling strictly necessary cookies will impair core Platform functionality. Withdrawal of analytics or marketing cookie consent does not affect the lawfulness of processing prior to withdrawal.
Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by our legal, regulatory, or licensing obligations. The following indicative retention periods apply:
- Account and transaction data: Retained for a minimum of five (5) years following Account closure, in accordance with AML regulatory requirements under our international gaming licence.
- KYC verification documents: Retained for the duration of the Account relationship and for five (5) years following Account closure.
- Customer support communications: Retained for two (2) years from the date of last interaction, or longer where a dispute remains unresolved.
- Marketing consent records: Retained until consent is withdrawn, plus one (1) year to evidence the consent lifecycle.
- Technical / log data: Typically retained for twelve (12) months from collection, unless required for ongoing security investigations.
When data is no longer required, it is securely deleted or anonymised in accordance with our data destruction procedures.
Data Security
Ongcuci employs a multi-layered approach to protecting your personal data from unauthorised access, disclosure, alteration, or destruction:
- TLS 1.3 Encryption: All data transmitted between your device and our servers is protected using 256-bit SSL/TLS encryption.
- Access Controls: Personal data is accessible only to authorised personnel on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
- Data Pseudonymisation: Where technically feasible, personal identifiers are pseudonymised in analytics and reporting systems.
- Third-Party Security Standards: All data processors are required to maintain security standards consistent with our own, evidenced by appropriate certifications or contractual commitments.
- Incident Response: We maintain a documented data breach response procedure. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay.
Your Responsibility: While we implement strong technical safeguards, you are responsible for maintaining the confidentiality of your Account password and for ensuring your device is protected with appropriate security software. Contact support immediately if you suspect unauthorised access to your Account.
International Data Transfers
As an internationally licensed platform, ongcuci may process or store your personal data on servers or through service providers located outside Malaysia. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to maintain a level of protection equivalent to the standards described in this Policy.
Such safeguards may include standard contractual clauses, data processing agreements incorporating appropriate protective terms, or reliance on jurisdiction-specific adequacy assessments. Details of applicable transfer mechanisms are available upon request by contacting us at the details set out in Section 16.
Your Data Rights
Subject to applicable law and regulatory restrictions, you have the following rights in relation to your personal data held by ongcuci:
Right of Access
Request a copy of the personal data we hold about you and information about how it is being processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your Account or our records.
Right to Erasure
Request deletion of your personal data where it is no longer necessary, subject to overriding legal or regulatory retention obligations.
Right to Restrict Processing
Request that we limit processing of your data in certain circumstances — for example, while the accuracy of data is contested.
Right to Data Portability
Request your personal data in a structured, commonly used, machine-readable format for transfer to another controller where technically feasible.
Right to Object
Object to processing based on legitimate interests, including profiling, and to the use of your data for direct marketing communications.
To exercise any of these rights, please contact us using the details in Section 16. We will respond to verified requests within thirty (30) days. Identity verification may be required before processing your request. Note that some rights may be limited or unavailable where we are required to retain or process data under legal or regulatory obligations.
Children's Privacy & Age Restrictions
The ongcuci Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an individual under 21, we will take immediate steps to close the associated Account and securely delete the relevant data.
Parents and guardians who believe that a minor has registered an Account or provided personal data to ongcuci are encouraged to contact us immediately using the contact details in Section 16. We operate a zero-tolerance policy towards underage gambling and treat age verification as a mandatory compliance obligation, not an optional step.
Third-Party Services & Links
The ongcuci Platform operates as a self-contained service. However, third-party payment processors — including e-wallet operators such as Touch 'n Go eWallet, Boost, and GrabPay, and banking institutions such as Maybank, CIMB, Public Bank, and Hong Leong — may have their own separate privacy policies governing how they handle your financial data during payment processing.
Ongcuci is not responsible for the privacy practices of third-party payment providers. When you initiate a payment, you are interacting with their systems under their applicable terms. We recommend reviewing the privacy policy of any third-party payment provider you use in connection with your ongcuci transactions.
Similarly, game content delivered via our studio partnerships is subject to the technical data handling practices of the respective studios. These studios are bound by data processing agreements with the Company and are not permitted to use player data for any purpose other than game delivery and fraud prevention.
Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform functionality. Where changes are material, we will notify registered players via Account notification or email, and the updated Policy will be published on this page with a revised effective date.
The current effective date of this Policy is displayed at the top of this page. We encourage you to review this Policy periodically to remain informed of how we protect your data. Continued use of the Platform following the publication of an updated Policy constitutes your acknowledgement of the revised terms.
Contact Us & Data Protection Enquiries
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the ongcuci data protection team using the following details:
Data Privacy Enquiries
Ongcuci Privacy Team
Email: [email protected]
Subject line: "Privacy Request – [Your Name]"
Response Timeframe
We will acknowledge your request within 5 business days and aim to fully respond within 30 days.
Live chat support is available 24/7 for general privacy questions.
For related information, see our Terms & Conditions and our Responsible Gambling page.
How We Protect Your Data
Beyond the legal text, here is a plain-language summary of the six most important ways ongcuci protects your privacy in practice.
We Never Sell Your Data
Your personal information is never sold, rented, or traded to third-party marketers. Period. We collect data to run the Platform — not to monetise your profile.
Bank-Grade Encryption
All data in transit uses TLS 1.3 encryption — the same standard used by leading global financial institutions. Your session data, payment details, and personal information are always encrypted.
Strict Access Controls
Only authorised personnel with a verified need can access player data. Access is logged, audited, and reviewed on a regular schedule to prevent internal misuse.
Your Rights, Respected
Access, correct, export, or delete your data — your rights are clearly defined and honoured. Submit a request via email and receive a response within 30 days.
Transparent Cookie Use
Non-essential cookies require your explicit consent. You can manage preferences at any time. We use analytics and marketing cookies only with your permission.
Defined Retention Limits
We don't hold your data indefinitely. Clear retention schedules are defined for each data category, and data is securely deleted when it is no longer required.
Privacy Questions? We're Here to Help.
Contact our support team at any time for privacy-related enquiries, data access requests, or to exercise any of your rights under this Policy.
For players aged 21 and above only. Play responsibly.