Privacy Policy

scrplay2 ("we", "us", "our", "Platform") operates the online gaming and sports betting services accessible at https://scrplay2.cam (the "Website"). We are committed to protecting the privacy and security of the personal data of all users who access or use our Platform.

This Privacy Policy ("Policy") sets out the basis on which we collect, use, disclose, and store personal data relating to our users ("you", "your", "Data Subject") in connection with your use of the scrplay2 Platform. This Policy applies to all personal data processed by scrplay2, whether collected through our Website, mobile-optimised interface, live chat, email, or any other communication channel.

scrplay2 processes personal data in accordance with the principles of applicable data protection legislation. Our processing is guided by the core principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, email address, IP address, or any factor specific to the physical, economic, cultural, or social identity of that person.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. scrplay2 is the Data Controller for data collected through this Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of scrplay2 under a data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data.
• "KYC Data" — documentation submitted during identity verification, including government-issued identification, proof of address, and proof of payment method.
• "Cookies" — small text files stored on your device by a website to remember preferences and session information.
• "Platform" — the scrplay2 website, mobile interface, and all associated services accessible at https://scrplay2.cam.

scrplay2 collects the following categories of personal data, depending on how you interact with our Platform:

We collect only the minimum data necessary for the purposes described in this Policy. We do not collect special categories of sensitive personal data (such as health or biometric data) except where strictly required for responsible gambling compliance.

4.1 Directly from You

The majority of personal data we hold is collected directly from you through your interactions with scrplay2. This includes data provided during account registration, the KYC verification process, completion of deposit or withdrawal requests, communication with our support team, and participation in promotions or surveys.

4.2 Automatically

When you access the scrplay2 Platform, we automatically collect certain technical and usage data via cookies, server logs, and similar tracking technologies. This includes your IP address, device identifiers, browser characteristics, pages accessed, game sessions initiated, and timestamps. This data is used to maintain Platform security, detect fraudulent activity, and improve service performance.

4.3 From Third Parties

We may receive data about you from third-party sources in limited circumstances, including: identity verification service providers engaged for KYC purposes; payment processors such as those facilitating GrabPay, DuitNow, FPX, and cryptocurrency transactions; fraud detection and anti-money laundering screening services; and public databases required for sanctions and politically exposed persons (PEP) screening in compliance with applicable AML regulations.

scrplay2 processes your personal data for the following specific purposes:

• Account Management: To create, maintain, and administer your scrplay2 account, verify your identity and age, and process your requests;
• Service Delivery: To provide access to games, betting markets, live dealer services, and all associated Platform features;
• Payment Processing: To process deposits and withdrawals via Malaysian payment methods (including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank2u, CIMB Clicks) and cryptocurrencies;
• KYC & AML Compliance: To verify identity, comply with anti-money laundering obligations, counter-terrorism financing screening, and applicable regulatory requirements;
• Responsible Gambling: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, apply deposit limits, and comply with our responsible gambling obligations;
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account takeover attempts, bonus abuse, and other prohibited activities;
• Customer Support: To respond to your queries, resolve disputes, and maintain records of communications for quality and compliance purposes;
• Marketing & Promotions: Where you have provided consent, to send you information about relevant promotions, bonuses, and platform updates. You may withdraw consent at any time;
• Platform Improvement: To analyse usage patterns and technical performance data to improve the Platform's functionality, stability, and user experience;
• Legal Obligations: To comply with applicable laws, regulations, court orders, and lawful requests from regulatory or law enforcement authorities.

scrplay2 processes your personal data on the following legal bases, as applicable:

• Contractual Necessity: Processing necessary to perform our contractual obligations to you under the scrplay2 Terms and Conditions — including account creation, payment processing, game access, and withdrawal handling;
• Legal Obligation: Processing required to comply with applicable laws, including KYC, AML, and responsible gambling regulatory requirements;
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, dispute resolution, and service improvement, provided such interests do not override your data protection rights;
• Consent: Processing based on your freely given consent, primarily for marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

scrplay2 does not sell or rent your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment Service Providers: Third-party processors facilitating your chosen Malaysian payment methods (GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and cryptocurrency networks) receive transactional data necessary to process payments;
• Identity Verification Providers: KYC and AML screening service providers receive identity documents and personal data necessary to complete regulatory verification;
• Fraud & Security Services: Third-party fraud detection, risk management, and cybersecurity providers process technical and behavioural data to identify and prevent fraudulent activity;
• IT Infrastructure Providers: Cloud hosting, content delivery, and database service providers who store and process Platform data under strict data processing agreements and confidentiality obligations;
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other government authorities where required by applicable law, a valid court order, or our regulatory licence obligations;
• Professional Advisors: Legal counsel, auditors, and accountants may access personal data on a confidential basis in the course of providing professional services to scrplay2.

As an online platform operating across jurisdictions, your personal data may be transferred to, stored in, or processed by servers or service providers located outside of Malaysia. Where such transfers occur, scrplay2 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protection afforded under applicable Malaysian data protection principles.

Safeguards for international transfers may include: standard contractual clauses incorporated into agreements with third-party processors; transfers to jurisdictions recognised as providing adequate levels of data protection; and binding corporate rules where applicable.

If you would like further information about the international transfer safeguards applicable to your personal data, please contact us at [email protected].

scrplay2 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account with scrplay2 plus a minimum post-closure retention period as required by applicable AML and gaming regulatory obligations (typically 5–7 years);
• KYC Documentation: Retained for a minimum of 5 years following account closure or the conclusion of any regulatory investigation, whichever is later;
• Transaction Records: Financial transaction data is retained for a minimum of 5 years for AML compliance and tax purposes;
• Support Communications: Live chat and email records retained for a minimum of 2 years for dispute resolution and quality assurance purposes;
• Marketing Data: Retained until consent is withdrawn or account closure, whichever is earlier. Withdrawal of consent does not affect previously sent communications;
• Technical Log Data: Server logs and IP data retained for a maximum of 12 months unless required for an ongoing security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual.

10.1 What We Use

scrplay2 uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. These technologies help us maintain session continuity, remember your preferences, analyse traffic patterns, and detect security threats.

10.2 Types of Cookies

• Strictly Necessary Cookies: Essential for the Platform to function. Cannot be disabled. These include session authentication cookies and security tokens;
• Functional Cookies: Remember your preferences and settings (e.g., language, display options) to personalise your experience;
• Analytics Cookies: Collect aggregated, anonymised data about how users interact with the Platform. Used to identify performance issues and improve user flows;
• Security Cookies: Detect and prevent fraudulent activity, brute-force login attempts, and session hijacking.

10.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect Platform functionality. Strictly necessary cookies cannot be disabled as they are essential to service operation. Instructions for managing cookies are available through your browser's help documentation.

Subject to applicable data protection law and certain legal exceptions, you have the following rights in relation to your personal data held by scrplay2:

To exercise any of the above rights, please contact our support team via live chat or at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and aim to fulfil it within 30 days, or such extended period as may be permitted by applicable law.

Please note that certain rights are subject to exceptions. For example, we may be unable to delete data that we are legally required to retain under AML or gaming regulatory obligations. We will always explain the reason where a request cannot be fully fulfilled.

The scrplay2 Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Our registration process includes age verification steps, and accounts identified as belonging to under-age individuals are closed immediately with all associated data deleted.

If you have reason to believe that a person under the age of 21 has registered an account on scrplay2 or provided personal data to us, please contact our support team immediately at [email protected]. We will investigate and take appropriate action, including data deletion, promptly upon receiving a verified report.

scrplay2 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption of sensitive data fields at rest in our databases;
• Strict access controls ensuring personal data is accessible only to authorised personnel with a documented business need;
• Multi-factor authentication requirements for administrative access to systems holding personal data;
• Regular penetration testing and security audits conducted by qualified third-party security professionals;
• Automated monitoring and alerting for anomalous access patterns or potential data breach indicators;
• Documented data breach response procedures including notification protocols.

While we take all reasonable and industry-standard steps to protect your personal data, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the security of your own account credentials. Please refer to our Terms & Conditions for your responsibilities regarding account security.

scrplay2 reserves the right to amend this Privacy Policy at any time. Where material changes are made to how we collect, use, or share your personal data, we will provide notice of the update via a prominent on-Platform notification or by email to your registered address prior to the changes taking effect.

The effective date of the most recent revision is stated at the top of this Policy. Your continued use of the scrplay2 Platform after the publication of changes constitutes acceptance of the revised Privacy Policy. We recommend reviewing this Policy periodically to remain informed of how we protect your data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us through the following channels. We aim to acknowledge all privacy-related communications within 3 business days:

• Email: [email protected] — please use subject line "Privacy Enquiry" or "Data Rights Request" for priority routing
• Live Chat: Available 24 hours a day, 7 days a week via the scrplay2 Platform — including Malaysian public holidays

For data rights requests, please include your full name, registered email address, account username (if applicable), and a clear description of your request. We may require identity verification before processing certain data rights requests to ensure we disclose information only to the correct individual.