Privacy Policy

Introduction

crickex ("we", "us", "our") operates the online platform accessible at https://crickex.cam and takes the privacy of its users seriously. This Privacy Policy sets out in detail how crickex collects, uses, stores, discloses and protects the personal data of individuals who use the Platform, including registered account holders, visitors and anyone who submits information through the Platform.

This Policy applies alongside the crickex Terms & Conditions. In the event of a conflict between this Policy and any other document, this Policy shall take precedence in respect of personal data handling matters. For responsible-gambling data matters, please also read our Responsible Gambling page.

crickex is committed to handling personal data in accordance with applicable data protection laws and regulations. Malaysian users are also protected by the Personal Data Protection Act 2010 (PDPA), and this Policy is drafted with those obligations in mind.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably identify a natural person, directly or indirectly, including name, identification number, contact details, financial information and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure or destruction, whether or not by automated means.
• "Data Subject" means any natural person whose Personal Data is processed by crickex.
• "Data Controller" means crickex, which determines the purposes and means of processing Personal Data.
• "Third Party" means any natural or legal person, public authority or body other than the Data Subject and crickex.
• "KYC" means Know Your Customer identity verification, which may require submission of government-issued identification, proof of address or other documents.
• "Consent" means a freely given, specific, informed and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a stated purpose.

Data We Collect

crickex collects Personal Data through several channels, depending on how you interact with the Platform. The categories of data we may collect include:

We do not intentionally collect special categories of sensitive data (such as health, racial or biometric data) unless specifically required for mandatory compliance purposes, in which case you will be notified and separate consent obtained where required.

Data Processing

crickex processes your Personal Data for the following purposes:

• Account Management: To create, maintain and administer your crickex account, including authentication and account security.
• Identity Verification: To carry out KYC checks and confirm that you meet the minimum age requirement of 21 years and are eligible to use the Platform.
• Payment Processing: To facilitate deposits and withdrawals through Malaysian payment channels such as DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost and GrabPay, and to maintain accurate transaction records.
• Service Delivery: To provide betting information, game content, promotions and all other features available on the Platform.
• Legal and Regulatory Compliance: To comply with applicable law, including anti-money-laundering obligations, responsible-gambling requirements and regulatory reporting.
• Responsible Gambling Monitoring: To detect patterns that may indicate problem gambling and to enable or enforce deposit limits, session limits, cooling-off periods and self-exclusion arrangements.
• Fraud Prevention and Security: To detect, investigate and prevent fraudulent activity, unauthorised account access and misuse of the Platform.
• Platform Improvement: To analyse usage patterns, identify technical issues and improve the user experience, including optimising the Platform for users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya and other Malaysian cities.
• Communications: To respond to your enquiries, send transactional messages and, where you have provided consent, send promotional information.

Legal Basis for Processing

crickex processes Personal Data only where a valid legal basis exists. The bases we rely upon include:

• Contractual necessity: Processing required to perform our contract with you, including account operation, bet placement and payment processing.
• Legal obligation: Processing required to comply with applicable law, including KYC obligations, anti-money-laundering rules and responsible-gambling regulations.
• Legitimate interests: Processing necessary for our legitimate business interests, including fraud prevention, security, Platform improvement and responsible-gambling monitoring, provided those interests do not override your fundamental rights.
• Consent: Processing for purposes such as direct marketing communications, where you have provided explicit and revocable consent. You may withdraw consent at any time by contacting us at [email protected].

Data Disclosure

crickex does not sell, rent or trade your Personal Data. We may share your data with the following categories of recipients only as necessary and only on a need-to-know basis:

• Payment Service Providers: Financial institutions and payment processors that facilitate MYR transactions, including banks and eWallet operators, subject to applicable financial-sector obligations.
• Identity Verification Providers: Third-party KYC services that assist with document verification and age confirmation.
• Technology Partners: Hosting providers, cloud infrastructure services and cybersecurity partners who process data only on our documented instructions and under appropriate contractual protections.
• Regulatory and Law Enforcement Authorities: Where required by law, court order, regulatory direction or to prevent fraud or serious harm.
• Responsible Gambling Authorities: Where required by applicable responsible-gambling obligations or where a User has initiated a self-exclusion request that must be reported to a relevant scheme.
• Business Successors: In the event of a merger, acquisition or transfer of business assets, Personal Data may be transferred to the successor entity under equivalent data protection standards.

International Data Transfers

Some of crickex's service providers and technical partners may be located or operate infrastructure outside of Malaysia. Where Personal Data is transferred internationally, crickex takes steps to ensure that an adequate level of protection is maintained, including through contractual clauses, data processing agreements and assessments of the recipient's data protection environment.

Users who are Malaysian residents should be aware that data processed in overseas jurisdictions may be subject to the laws of those jurisdictions. crickex will not transfer your data to a jurisdiction that does not provide adequate protections without implementing appropriate safeguards.

Data Retention

crickex retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected or to comply with applicable legal, regulatory or contractual obligations. The following general retention principles apply:

• Account and identity data is retained for the duration of your account's active status and for a period of up to seven years following account closure, in line with common anti-money-laundering and record-keeping requirements.
• Transaction and financial records are retained for a minimum period required by applicable law or as directed by regulatory authorities.
• Communications data, including support correspondence, is retained for a reasonable period to resolve disputes and respond to regulatory enquiries.
• KYC verification documents are retained for the period required by applicable regulations and then securely deleted or anonymised.
• Usage and technical data may be retained in anonymised or aggregated form for Platform improvement purposes after the associated account is closed.

Once the applicable retention period expires, Personal Data is securely deleted or rendered irreversibly anonymous in accordance with our internal data lifecycle procedures.

Security Measures

crickex implements technical and organisational measures designed to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• Encryption of data in transit using industry-standard protocols.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Monitoring and logging of access to systems holding Personal Data.
• Periodic security assessments and vulnerability management procedures.
• Secure storage of identity verification documents with restricted access.

No method of electronic transmission or storage is completely secure. While crickex takes all reasonable steps to protect your data, we cannot guarantee absolute security. Users are reminded to protect their own account credentials and to use strong, unique passwords. Do not share your password, one-time passcode or banking security details with any person, including crickex staff.

Cookies & Tracking Technologies

crickex uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files placed on your device when you access the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for Platform functionality, such as maintaining your session state and security tokens. These cannot be disabled without affecting Platform operation.
• Functional Cookies: Retain your preferences, such as language or region settings, to improve your experience on return visits.
• Analytics Cookies: Collect anonymised information about how users navigate the Platform to help us identify improvements. Where analytics tools are used, they are configured to minimise the use of personally identifiable data.
• Security Cookies: Help detect and prevent fraudulent account activity and unusual access patterns.

You may configure your browser to refuse or delete cookies. Please note that disabling certain cookies may limit Platform functionality. Where consent is required for non-essential cookies, we will request it separately before those cookies are placed.

User Rights

As a Data Subject, you hold the following rights in respect of your Personal Data held by crickex. These rights are exercisable subject to applicable legal obligations and conditions:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is used.
• Right to Correction: You may request correction of inaccurate or incomplete Personal Data.
• Right to Erasure: You may request deletion of your Personal Data where processing is no longer necessary, where consent has been withdrawn, or where processing is unlawful, subject to overriding legal obligations.
• Right to Restriction: You may request that processing of your Personal Data be restricted in certain circumstances, for example while a correction request is being assessed.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.
• Right to Data Portability: Where technically feasible and legally required, you may request that your Personal Data be provided in a structured, commonly used and machine-readable format.

To exercise any of these rights, please contact us using the details in Section 14. We will respond within the time period required by applicable law. Identity verification may be required before a request is processed. There is generally no charge for exercising these rights unless requests are manifestly unfounded or excessive.

Minors

The crickex Platform is strictly intended for adults aged 21 years and above. crickex does not knowingly collect or process the Personal Data of any person under the age of 21. If we become aware that Personal Data has been collected from a person under this age without appropriate verification, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor has registered on the Platform or submitted Personal Data, please contact us immediately at [email protected]. Further guidance on age-related protections is available on our Responsible Gambling page.

Amendments to This Policy

crickex may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law or regulatory guidance. The date of the most recent revision is shown at the top of this document.

Where changes are material, we will notify registered users via the email address on file or through a prominent notice on the Platform prior to the change taking effect. Continued use of the Platform after the effective date of any amendment constitutes acceptance of the updated Policy. If you do not agree to the revised Policy, you must stop using the Platform and contact us to close your account.

Contact Us

For any questions, concerns or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the crickex data team using the details below:

• Email: [email protected]
• Response time: We aim to acknowledge data-related requests within 3 business days and to respond in full within 30 calendar days, or the period required by applicable law.

If you are a Malaysian resident and believe that your rights under the Personal Data Protection Act 2010 have been breached, you may also refer a complaint to the relevant regulatory authority. crickex encourages users to contact us directly in the first instance so that we can address concerns promptly.