scr2 | Privacy Policy and Personal Data Protection

1. Introduction
2. Data Collected
3. Purpose of Data Use
4. Disclosure to Third Parties
5. Data Security
6. Cookies & Tracking Technologies
7. Data Retention Period
8. Your Rights
9. Cross-Border Data Transfers
10. Children
11. Policy Amendments
12. Contact Us

1 Introduction & Scope of This Policy

SCR2 ("we", "our platform") is fully committed to protecting the privacy of every individual who uses our services. This Privacy Policy explains our practices for collecting, using, disclosing, and safeguarding your personal information when you register or use the SCR2 platform at scr2.app.

This document applies to all registered members, users browsing our website, and any individual interacting with the SCR2 platform in any capacity. By registering as a SCR2 member or continuing to use our services, you consent to the practices described in this Privacy Policy.

Important Note: This Privacy Policy should be read in conjunction with Terms and Conditions SCR2. Together, these documents form the entire agreement between you and SCR2 regarding your use of the platform and the handling of your data.

2 Types of Personal Data We Collect

SCR2 collects the information necessary to deliver a secure, efficient, and personalized service to you. The following are the categories of data we collect:

Data Category	Example Information	Source
Identity Data	Full name, date of birth, identification card number	Yourself (registration)
Contact Data	Email address, phone number	Yourself (registration)
Financial Data	Bank account number, bank name, transaction records	Yourself (transactions)
Technical Data	IP address, device type, web browser, OS	Automatic (system)
Usage Data	Game records, session duration, game preferences	Automatic (activity)
KYC Data	ID card image, verification selfie, utility bill	Yourself (during KYC)

SCR2 never stores credit or debit card numbers directly in our systems. All payment transactions are processed through payment gateways that comply with PCI-DSS standards.

3 How We Use Your Data

Every piece of data we collect has a specific purpose. We do not collect unnecessary data, nor do we use it for purposes unrelated to our services:

Account Management: To create, verify, and manage your member account at SCR2.
KYC Fulfilment: To verify your identity in order to comply with legal requirements and to prevent fraud and money laundering.
Transaction Processing: To process deposits, withdrawals, and all financial transactions securely and accurately.
Service Delivery: To allow you to access and enjoy all games and features within the SCR2 platform.
Platform Security: To detect and prevent fraud, unauthorized access, and suspicious activity that could harm you or our platform.
Service Communications: To send you important information about your account, including transaction confirmations, security notifications, and terms updates.
Platform Improvements: To analyze aggregated usage patterns (without identifying individuals) in order to improve the quality of our services.
Promotions & Offers: To inform you about relevant promotions and bonuses, subject to your communication preferences.

You can opt out of marketing communications at any time by updating your communication settings in your account or by contacting the SCR2 support team.

4 Disclosure of Data to Third Parties

SCR2 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. However, in certain situations, we may need to share your data with specific parties to enable our services to operate:

Technology Service Providers: Including cloud service providers, hosting companies, and security solution providers that help us operate the platform. All such providers are bound by strict confidentiality agreements.
Third-Party Game Providers: To allow you to play games offered by specific providers, minimal session information may be shared with the relevant provider.
Payment Gateway: To process deposits and withdrawals, the necessary transaction information is shared with licensed and trusted payment providers.
Relevant Authorities: When required by Malaysian law, court order, or direction from a legitimate regulatory body, we will disclose the necessary information.
Business Transfers: In the event of a merger, acquisition, or sale of SCR2 assets, user data may be transferred as part of those assets. You will be notified in advance.

SCR2 ensures that all third parties who receive your data are bound by data processing agreements that obligate them to protect your data to the same or higher standard that we uphold.

5 Data Security Measures

Protecting your data is our top technical priority at SCR2. We continually invest in security infrastructure to ensure your information is always safeguarded:

Data encrypted in transit using 256-bit TLS/SSL protocol — the same standard used by leading financial institutions.
Data stored in our databases is encrypted using the internationally recognised AES-256 algorithm.
An active 24/7 intrusion detection system (IDS) to identify any suspicious access attempts.
Regular security audits by independent third parties to identify and remediate any potential vulnerabilities.
Strict internal access controls — only staff who require access to specific data to carry out their duties are granted permission.
Two-factor authentication (2FA) is available for all SCR2 member accounts as an added layer of security.

While we take all reasonable steps to protect your data, no system can guarantee 100% security in a digital environment. You are therefore encouraged to use a strong password and enable 2FA on your SCR2 account.

6 Cookies & Tracking Technologies

SCR2 uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

Essential Cookies: Required for core platform functions such as login verification and session security. These cookies cannot be disabled.
Preference Cookies: Stores your preferences such as language, theme, and display settings for a more comfortable experience.
Analytics Cookies: Helps us understand how users interact with the platform for continuous improvement. Data collected is aggregated and does not identify individuals.
Security Cookies: Used to detect suspicious activity and prevent fraud during the current session.

You can manage your cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality and your experience on the SCR2 platform.

7 Data Retention Period

SCR2 retains your personal data only for as long as necessary to fulfill the purposes stated in this Privacy Policy and to comply with applicable legal obligations:

Active Account Data: Retained for as long as your account is active at SCR2. After account closure, data is isolated and retained for the period required by law.
Financial Transaction Records: Retained for a minimum of 7 years from the transaction date, in line with Malaysian financial and tax legal requirements.
KYC Documents: Retained for the duration of the active account period plus 5 years after account closure for AML/KYC compliance purposes.
Security Logs: Retained for 12 months for security incident investigation purposes if required.
Communications Data: Customer support communication records are retained for 3 years for quality assurance and reference purposes.

When data is no longer required, it will be securely deleted or anonymised in accordance with established data disposal procedures.

8 Your Rights Regarding Personal Data

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and SCR2's internal policies, you have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of all personal data we hold about you. SCR2 will provide this information within 21 business days of your request.

Right to Rectification

If the data we hold is inaccurate or incomplete, you have the right to request a correction. Log in to your account or contact our support team to update your information.

Right to Erasure

Under certain circumstances, you may request the deletion of your personal data. Please note that some data may need to be retained for legal compliance purposes.

Right to Object

You may object to the processing of your data for direct marketing purposes at any time. Your request will be processed within 10 business days.

Right to Portability

You may request your data in a machine-readable format for transfer to another platform, where technically and legally feasible.

Right to Restriction

In certain situations, such as during a dispute, you may request that we restrict the processing of your data while awaiting resolution.

9 Cross-Border Data Transfers

In some situations, your personal data may be processed or stored outside Malaysia — for example, when we use cloud services or international technology providers. In all such cases, SCR2 ensures that:

Data transfers are only made to countries or organisations that provide an adequate level of data protection equivalent to or higher than Malaysia's PDPA.
Appropriate data transfer agreements are established with all overseas data recipients, including approved standard contractual clauses.
You will be notified of any material cross-border data transfers via updates to this Privacy Policy.

10 Protection of Children's Data

SCR2 is a platform designed exclusively for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If we discover that we have inadvertently collected information from a minor, we will take immediate steps to delete that information and close the associated account.

If you believe a minor has registered at SCR2, please contact our support team immediately so the appropriate action can be taken without delay.

11 Amendments to This Privacy Policy

SCR2 reserves the right to amend or update this Privacy Policy from time to time in line with changes in law, technology, or our business practices. Any material amendments will be handled as follows:

Email notification to all registered members at least 14 days before amendments take effect.
A clear notice within the SCR2 platform when you log in after an update has been made.
The "Updated" date at the top of this document will always reflect the date of the most recent amendment.

Your continued use of the SCR2 platform after amendments take effect will be considered your acceptance of the updated terms. If you do not agree, you have the right to close your account before the amendments come into effect.

12 How to Contact Us Regarding Privacy

If you have any questions, concerns, or wish to exercise your personal data rights as described in this Privacy Policy, please contact the SCR2 Data Protection Officer (DPO) team via:

Live chat within the SCR2 platform (available 24/7)
Email: [email protected] — we aim to respond within 48 business hours

For requests related to data access, correction, or deletion, please provide sufficient identifying information so we can verify your identity before processing the request. This is a necessary security measure to protect your data from unauthorized access.

SCR2's support team, available 24/7, is the fastest way to resolve any privacy-related concerns. We are committed to addressing all privacy requests within a reasonable timeframe.

Our Privacy Commitment

SCR2's Six Core Data Protection Pillars

We do more than comply with privacy laws — we want you to genuinely feel safe and confident every time you interact with the SCR2 platform.

Military-Grade Encryption

Every bit of data you send and receive through the SCR2 platform is protected by 256-bit SSL encryption — the same technology used by Malaysia's major banks to secure their online transactions.

Malaysia PDPA Compliance

SCR2 operates in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). We ensure that all our data handling practices meet or exceed the requirements set out by law.

Strict Internal Controls

Access to members' personal data within SCR2 is restricted to staff with a genuine business need only. All access is systematically logged and monitored to detect any anomalies.

Data Minimisation Principle

SCR2 only collects data that is strictly necessary to deliver our services. We do not collect more information than needed, nor do we retain it longer than required.

Immediate Breach Notification

In the event of any data breach affecting your information, SCR2 is committed to notifying you within 72 hours of detection, in line with industry best practices.

Data Control in Your Hands

You have full control over your data — from communication settings to access or deletion requests. SCR2 provides a straightforward process for exercising all your privacy rights.

Privacy Policy SCR2

Contents