Introduction: This Policy ("Policy") describes the privacy practices of cm2my ("we", "Platform") regarding the collection, use, disclosure and protection of your personal information when you use the cm2my.onl online entertainment platform and the cm2my mobile app. By using our platform, you acknowledge that you have read and understood this Policy.
01
Information We Collect
Cm2my collects various types of information to provide a safe, fair, and quality service to all users. The information we collect can be divided into two main categories:
Information You Provide Directly:
- Registration Information: Full name, date of birth, Malaysian identity card number (for KYC verification), email address, mobile number, and password
- KYC (Know Your Customer) Information: Copy of identity card or passport, selfie with identity card, proof of current address (utility bill or recent bank statement)
- Financial Information: Bank account number for withdrawal processing, payment methods used, and transaction history
- Communications: Records of conversations with the cm2my customer support team, including live chat and email
Automatically Collected Information:
- Technical Data: IP address, browser type and version, device operating system, screen resolution and related technical information
- Usage Data: Pages visited, games played, session duration, visit frequency and general usage patterns
- Location Data: General location information based on IP address for region verification and regulatory compliance purposes
- Cookie Data: Information stored by cookies and similar tracking technologies — explained in further detail in section 5
Data Minimisation Principle: cm2my only collects information that is strictly necessary to provide our services and meet legal compliance requirements. We do not collect excessive or irrelevant data.
| Data Type |
Example |
Primary Purpose |
| Identity |
Name, IC, date of birth |
KYC verification, age restriction |
| Contact |
Email, phone number |
Communications, OTP verification |
| Finance |
Bank account, deposit records |
Transaction processing |
| Technical |
IP, device, browser |
Security, fraud detection |
| Usage |
Games, sessions, clicks |
Platform enhancement, analytics |
02
How We Use Your Data
Personal information you provide to cm2my is used for clear and lawful purposes. We do not use your data for any purpose other than those stated here without your prior consent.
- Account Management: Creating and managing your account, verifying your identity, and processing account-related requests
- Transaction Processing: Processing deposits, withdrawals, and all other financial transactions securely and accurately
- Service Provision: Allowing you to access all games and features on the cm2my platform with a seamless experience
- Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and platform abuse
- Legal Compliance: Meeting KYC, AML (Anti-Money Laundering) compliance obligations and other applicable legal requirements
- Customer Support: Handling your enquiries, complaints, and support requests effectively
- Service Communications: Sending important notifications related to your account, security, and policy changes
- Platform Enhancement: Analysing aggregated usage data to improve the functionality, performance, and user experience of the cm2my platform
- Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling and provide appropriate support
03
Legal Basis for Data Processing
Under Malaysia's Personal Data Protection Act 2010 (PDPA), cm2my processes your personal data on the following legal bases:
- Contract Performance: Processing required to fulfil the service agreement between you and cm2my — including account registration, financial transactions, and access to the platform
- Legal Obligation: Processing required to comply with applicable Malaysian laws including KYC and AML requirements
- Legitimate Interest: Processing for platform security, fraud prevention, and service improvement purposes — where our interests do not override your privacy rights
- Consent: For certain processing activities such as marketing communications, we require your explicit consent, which you may withdraw at any time
Right to Withdraw Consent: Where processing of your data is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of processing that took place prior to withdrawal.
04
Sharing Information with Third Parties
Cm2my takes a highly cautious approach to sharing users' personal data. We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.
Your information may only be shared in the following limited situations:
- Trusted Service Providers: Partners who help us operate the platform — including payment service providers, gaming software providers, and cloud service providers. All third parties are bound by strict confidentiality agreements and are prohibited from using your data for any other purpose.
- Legal Requirement: When required by Malaysian law, court order, or a request from a competent regulatory authority.
- Rights Protection: When disclosure is necessary to protect the rights, property or safety of cm2my, other users or the public — including in fraud and money laundering investigations.
- Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred as part of that transaction, with advance notice provided to users.
International Data Transfers: Some of our service providers may operate outside Malaysia. In such cases, cm2my ensures that data protection equivalent to Malaysia's PDPA standards is maintained through appropriate contractual agreements.
05
Cookies and Tracking Technologies
The cm2my platform uses cookies and similar tracking technologies to enhance user experience and ensure platform security. The following are the types of cookies we use:
- Essential Cookies: Required for core platform functionality — secure login, session management and security features. These cookies cannot be disabled as the platform cannot function without them.
- Functional Cookies: Saving your preferences such as language, display theme, and other personal settings for a smoother return experience.
- Analytics Cookies: Helping us understand how users interact with the platform — most visited pages, popular games, and technical issues that need improvement. Analytics data is collected in aggregate and does not identify users individually.
- Security Cookies: Used to detect and prevent suspicious activity, cyberattacks and fraud attempts.
You can manage cookie settings through your browser settings at any time. However, disabling certain cookies may affect the functionality of some parts of the cm2my platform.
06
Data Retention Period
Cm2my retains your personal data for as long as it is needed for the purposes stated in this Policy, or as required by applicable Malaysian law. General principles of our retention periods:
- Active Account Data: Retained for as long as your account remains active on the cm2my platform
- KYC & Transaction Data: Retained for a minimum of 7 years after account closure in accordance with Malaysian anti-money laundering legal requirements
- Communication Records: Customer support records are retained for 3 years for reference and dispute resolution purposes
- Analytics Data: Anonymised usage data is retained for as long as necessary for business analytics purposes
Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with cm2my's established data disposal procedures.
07
Your Rights Regarding Personal Data
Under Malaysia's PDPA, you have the following rights regarding your personal data held by cm2my. We fully respect and facilitate the exercise of these rights:
Right of Access
You have the right to request a copy of the personal data we hold about you at any time.
Right to Rectification
You may request that we correct any inaccurate or incomplete personal data.
Right to Erasure
Under certain circumstances, you may request the deletion of your personal data from our systems.
Right to Object
You have the right to object to the processing of your data for direct marketing purposes at any time.
Right to Data Portability
You may request your data in a structured, machine-readable format for transfer to another provider.
Right to Restriction of Processing
In certain situations, you may request cm2my to restrict the processing of your personal data.
How to Submit a Request: To exercise any of the rights above, please contact our privacy team by email at
[email protected] or via live chat within the platform. We will process your request within 21 business days. In complex cases, this period may be extended to 60 days, with notice provided to you.
08
Data Security Measures
Cm2my invests seriously in security infrastructure to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures we employ:
- SSL/TLS Encryption: All communications between the platform and your device are protected with unbreakable 256-bit encryption
- Data-at-Rest Encryption: Sensitive data stored on our servers is also encrypted using the latest industry standards
- Two-Factor Authentication (2FA): An additional security layer for user accounts via OTP or authenticator app
- 24/7 Monitoring: The cm2my IT security team continuously monitors systems to detect and respond to security threats
- Regular Penetration Testing: Independent security testing is conducted regularly to identify and patch system vulnerabilities
- Tiered Access Control: Access to user data is strictly limited on a need-to-know basis — only staff who require access to perform their duties are granted permission
While cm2my takes all reasonable steps to protect your data, no system is completely impenetrable. You also play an important role in keeping your account secure by using a strong password and not sharing your login credentials.
09
Children's Privacy
The cm2my platform is strictly for individuals aged 18 and above. We do not knowingly collect, use, or disclose personal information of children under the age of 18.
If we determine that personal information of a minor has been collected without proper age verification, we will take immediate steps to delete that information and close the associated account. Parents or guardians who believe their child may have registered on our platform are encouraged to contact our support team immediately.
10
Changes to This Privacy Policy
Cm2my reserves the right to update or amend this Privacy Policy from time to time in response to changes in legislation, industry practices, or our business operations. Any material changes will be communicated to you through:
- In-platform notifications on cm2my upon your next login
- Notification email to your registered email address
- Update the "Last Updated" date at the top of this page
Continued use of the cm2my platform after any Privacy Policy changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically to stay informed about how we protect your information.
11
Contact Our Privacy Officer
If you have any questions, concerns, or complaints regarding how cm2my handles your personal data, or if you wish to exercise any of your privacy rights, please contact us through the following channels:
- Privacy Email: [email protected] (state "Privacy Inquiry" in the email subject line)
- Live Chat: Available 24/7 through the cm2my platform — select the "Privacy & Data" category
- Help Centre: Visit page FAQ us for answers to common privacy questions
Response Time: We aim to respond to all privacy-related enquiries within 5 business days. For formal data access requests, please allow up to 21 business days for processing. If you are unsatisfied with our response, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP).