Privacy Policy — 12spin

This Privacy Policy ("Policy") is issued by 12spin ("the Company", "we", "us", or "our") and applies to all personal data collected, processed, and stored in connection with the operation of the 12spin online gambling platform, accessible at https://12spin.cam (the "Platform").

12spin is committed to protecting the privacy and personal data of all individuals who interact with the Platform, including registered Account Holders, prospective players, and visitors who browse the Platform without creating an account. This Policy sets out in clear and transparent terms what personal data we collect, the purposes for which we use it, the legal bases upon which we rely, the circumstances under which we may disclose it, and the rights you hold in respect of your own data.

This Policy should be read in conjunction with our Terms & Conditions, which govern the contractual relationship between you and 12spin. By creating a 12spin account or using the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), including but not limited to name, email address, identification number, financial details, location data, and online identifiers.
• "Data Controller" means 12spin, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third-party service provider that processes personal data on behalf of 12spin pursuant to a written data processing agreement.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Consent" means a freely given, specific, informed, and unambiguous indication by a Data Subject that they agree to the processing of their personal data for a specified purpose.
• "KYC Data" means identity verification documents and associated information submitted by an Account Holder in compliance with Know Your Customer requirements.
• "Cookies" means small text files placed on your device by the Platform that collect and store certain information about your browsing activity and preferences.

The categories of personal data that 12spin collects and processes include the following:

3.1 Registration & Account Data

• Full legal name;
• Date of birth (to verify 21+ age eligibility);
• Residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam);
• Email address;
• Mobile phone number;
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

• Government-issued identification documents (Malaysian MyKad, Passport, or Driver's License);
• Proof of residential address (utility bill or bank statement dated within 3 months);
• Selfie photograph used to verify identity against the submitted document.

3.3 Financial & Transaction Data

• Payment method details (e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; bank account numbers for Maybank, CIMB, Public Bank, Hong Leong; cryptocurrency wallet addresses for BTC, ETH, USDT, LTC);
• Deposit and withdrawal transaction records (amounts, dates, methods, statuses);
• Account balance history.

3.4 Gameplay & Wagering Data

• Game play history (games accessed, bets placed, results, session duration);
• Sports betting records (events wagered on, markets selected, odds, outcomes);
• Bonus and promotional activity records.

3.5 Technical & Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser type;
• Session timestamps and activity logs;
• Cookie identifiers and similar tracking data (see Section 9).

3.6 Communications Data

• Live chat transcripts and email correspondence with the 12spin support team;
• Complaint and dispute records;
• Responses to surveys or promotional communications (where applicable).

12spin collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or interact with promotional features;
• Automatically — through cookies, web beacons, log files, and similar technologies when you access or use the Platform (see Section 9);
• From third-party service providers — including payment processors (e.g., FPX, DuitNow, e-wallet operators), identity verification providers, fraud detection services, and analytics providers, each acting within their own applicable privacy frameworks;
• From publicly available sources — where relevant for fraud prevention or compliance purposes (e.g., sanctions lists, politically exposed persons databases).

We do not collect or process sensitive categories of personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) except where strictly required by our regulatory obligations and with appropriate safeguards in place.

12spin processes your personal data for the following purposes:

12spin processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — i.e., to operate your account, process payments, and provide gaming services as described in our Terms & Conditions;
• Legal Obligation: Processing required to comply with applicable laws and regulatory obligations, including anti-money laundering (AML) requirements, KYC obligations, and mandatory record-keeping;
• Legitimate Interests: Processing carried out in pursuit of legitimate interests of 12spin or a third party, where such interests are not overridden by your rights — including fraud prevention, security monitoring, product analytics, and responsible gambling monitoring;
• Consent: Processing based on your voluntary, freely given, and specific consent — including optional marketing communications and the use of non-essential cookies. Where processing is consent-based, you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

12spin does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual protections:

7.1 Service Providers and Data Processors

Third-party providers that assist in the operation of the Platform, including payment processors (including Malaysian e-wallet and banking partners such as FPX, DuitNow, Maybank, CIMB, Public Bank, and Hong Leong), identity verification providers, cloud hosting providers, cybersecurity services, fraud detection platforms, and customer support software providers. All such providers are bound by data processing agreements that prohibit them from using your data for any purpose beyond the service provided to 12spin.

7.2 Regulatory and Law Enforcement Authorities

Where required by applicable law, court order, regulatory direction, or at the request of competent authorities in connection with a lawful investigation, 12spin may disclose personal data without prior notice to you.

7.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets involving 12spin, personal data held by the Company may be transferred to the relevant successor entity, subject to equivalent privacy protections being maintained. Affected Account Holders will be notified of any material changes to this Policy arising from such a transaction.

7.4 No Marketing Data Sales

12spin retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, tax, or accounting obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures. Where data has been anonymised, it may be retained in aggregate form for statistical or analytical purposes without time limit, as it no longer constitutes personal data.

The 12spin Platform uses cookies and similar tracking technologies to support the operation, security, and improvement of the Platform. The following categories of cookies are used:

• Essential Cookies: Strictly necessary for the Platform to function. These enable secure login sessions, maintain your Account Balance display, and ensure secure payment processing. These cookies cannot be disabled without impairing Platform functionality;
• Functional Cookies: Used to remember your preferences (such as language settings) and provide a more personalised experience. These cookies are not strictly essential but enhance usability;
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including pages visited, session duration, and navigation paths — to help us improve the user experience;
• Security Cookies: Used to detect suspicious activity, prevent automated attacks, and support our fraud detection and responsible gambling monitoring systems.

Non-essential cookies (functional and analytics) are deployed only with your consent, which you may provide or withdraw at any time through your browser settings or by contacting our support team. Withdrawing cookie consent may affect certain Platform features.

12spin implements a comprehensive suite of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the 12spin Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols;
• Encrypted Data Storage: Sensitive data fields — including passwords (stored as salted hashes), payment method details, and KYC documents — are encrypted at rest using strong encryption standards;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis using role-based access controls. Administrative access is protected by multi-factor authentication;
• Intrusion Detection: Automated systems monitor Platform infrastructure for anomalous behaviour, intrusion attempts, and other security incidents in real time;
• Regular Security Audits: The Platform undergoes regular third-party security assessments and penetration testing;
• Staff Training: All staff with access to personal data receive mandatory data protection and security training.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be completely secure. In the event of a data breach that is likely to result in a high risk to your rights, 12spin will notify affected individuals without undue delay in accordance with applicable notification obligations.

As an internationally operating Platform serving players primarily in Malaysia, some of the personal data we process may be transferred to or stored in countries outside of Malaysia. This may include transfers to countries where our cloud hosting infrastructure or third-party service providers are located.

Where such transfers occur, 12spin ensures that appropriate safeguards are in place to provide a level of data protection equivalent to that available under the laws of the transferring jurisdiction. Safeguards may include:

• Standard contractual clauses approved by applicable data protection authorities;
• Data processing agreements with recipients that impose equivalent data protection obligations;
• Transfers to recipients in jurisdictions that have received an adequacy determination from relevant regulatory authorities.

You may request details of the specific safeguards applicable to any international data transfer involving your personal data by contacting our support team.

Subject to applicable law and certain conditions, you hold the following rights in respect of your personal data held by 12spin. To exercise any of these rights, please contact our support team with your Account details and a description of your request.

If 12spin becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. All account registrations are subject to age verification through our KYC process.

If you have reason to believe that an individual under 21 has registered or is using a 12spin account, please contact our support team at [email protected] immediately.

12spin reserves the right to update or amend this Privacy Policy at any time. The "Last updated" date at the top of this page reflects the most recent revision. Where we make material changes that significantly affect how we process your personal data, we will notify registered Account Holders via email or a prominent in-platform notification prior to those changes taking effect.

We encourage you to review this Policy periodically to stay informed about how we are protecting your data. Your continued use of the Platform following the publication of any amendment signifies your acceptance of the updated Policy. If you do not accept the amended Policy, you should cease using the Platform and contact us to close your account.

For all privacy-related enquiries, data rights requests, or concerns about how 12spin handles your personal data, please contact our support team using the information below. All privacy correspondence must be submitted in English.

You also have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction if you believe that our processing of your personal data does not comply with applicable data protection law. We would, however, appreciate the opportunity to address your concerns directly before any regulatory escalation.