Privacy Policy

This Privacy Policy ("Policy") describes how 26m ("we", "us", "our", "the Company") collects, processes, stores, and protects the personal data of individuals ("you", "your", "Player") who access or use the 26m Platform at https://26m.cam, including all associated services, games, promotional content, and customer support channels.

26m is committed to handling personal data in a responsible, transparent, and lawful manner. We recognise the importance of data privacy to our players — particularly those based in Malaysia — and we design our data practices accordingly. This Policy has been prepared in compliance with applicable international data protection standards and the data privacy expectations of Malaysian residents.

By registering an account on 26m or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood its contents and that you consent to the collection and processing of your personal data as described herein.

If you do not agree with any part of this Policy, please discontinue use of the Platform and contact our support team to close your account.

The following terms carry the meanings assigned to them throughout this Policy:

26m collects the following categories of personal data from players:

We collect only the data that is necessary for the purposes described above. We do not collect sensitive categories of personal data (such as racial or ethnic origin, political opinions, or health data) unless specifically required for responsible gambling assessment with your explicit consent.

26m collects Personal Data through the following means:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion, you provide data to us directly.
• Automated collection: When you browse the Platform, our systems automatically collect technical and behavioural data via cookies, server logs, and analytics tools. This includes your IP address, device identifiers, and in-session activity.
• Payment providers: When you transact via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX (Maybank, CIMB, Public Bank, Hong Leong), transaction confirmation data is shared with us by the respective payment service provider to verify your deposit or withdrawal.
• Third-party verification services: Our KYC verification partners may return identity confirmation data and risk scores to us as part of the verification process.
• Referral programme: If you are referred to 26m by an existing player, we may receive your contact details from that player solely for the purpose of attributing the referral bonus.

26m processes your Personal Data on the following legal grounds:

• Performance of a contract: Processing your data is necessary to operate your account, process transactions, and deliver the services you have requested as a registered player.
• Legal obligation: We are required to collect and retain certain data — including KYC documents and transaction records — to comply with applicable anti-money laundering (AML) regulations and gaming licence conditions.
• Legitimate interests: We process technical and behavioural data for fraud prevention, platform security, and responsible gambling monitoring, where these interests do not override your fundamental rights.
• Consent: Where required — for example, for marketing communications or the use of non-essential cookies — we will obtain your explicit consent before processing. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

26m uses the personal data we collect for the following purposes:

• To create, maintain, and administer your player account on the Platform.
• To process deposits and withdrawals via your selected Malaysian payment methods and to maintain accurate financial records of all transactions.
• To conduct KYC identity and age verification to confirm that you are at least 21 years of age and are who you claim to be.
• To detect, investigate, and prevent fraudulent activity, account compromise, money laundering, and other prohibited activities as defined in our Terms and Conditions.
• To monitor your gambling behaviour for responsible gambling purposes and to proactively contact you if our systems identify patterns consistent with problem gambling.
• To deliver customer support services in English, including resolving account queries, withdrawal disputes, and technical issues.
• To send you transactional communications — including deposit confirmations, withdrawal notifications, and account security alerts.
• To send promotional communications about bonuses, events, and platform updates — only where you have consented to receive such communications or where we have a legitimate interest in doing so.
• To improve the Platform through analytics, A/B testing, and user experience research using anonymised or aggregated data.
• To comply with our legal and regulatory obligations as an internationally licensed gaming operator.

26m does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We share your data with third parties only in the following limited circumstances:

• Payment service providers: Your financial transaction data is shared with the relevant payment provider (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX) solely to process your requested transaction. Each provider operates under its own privacy policy and data security standards.
• KYC and identity verification partners: Identity documents and data submitted for KYC are processed by licensed third-party verification services engaged by 26m. These processors are contractually bound to handle your data securely and only for verification purposes.
• Regulatory and law enforcement authorities: We may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where we are required to do so by applicable law, regulation, or legal process.
• Anti-fraud and AML services: Anonymised or pseudonymised risk signals may be shared with fraud prevention and anti-money laundering service providers as part of our security and compliance obligations.
• Technology and infrastructure providers: Certain technical service providers — such as cloud hosting, data analytics, and communications platform vendors — may process data on our behalf as Data Processors. All such providers are subject to data processing agreements ensuring appropriate safeguards.
• Corporate transactions: In the event of a merger, acquisition, or asset sale involving 26m, your Personal Data may be transferred to the relevant successor entity, subject to equivalent data protection commitments.

In all cases where data is shared with third parties, 26m takes reasonable contractual and technical measures to ensure your data is handled with appropriate care and in accordance with applicable data protection standards.

26m uses cookies and similar tracking technologies (including web beacons and local storage objects) to provide, maintain, and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential to the operation of the Platform. These cookies maintain your login session, remember your authentication status, and enable core functionality such as the game lobby and cashier. They cannot be disabled without impairing the Platform's operation.
• Preference cookies: Remember your settings and preferences — such as your selected language, currency display (MYR), and notification preferences — to provide a more personalised experience on return visits.
• Analytics cookies: Collect anonymised data about how players interact with the Platform — pages visited, session duration, click paths, and game engagement — to help us understand usage patterns and improve our services.
• Security cookies: Used to detect and prevent fraudulent account activity, including session hijacking and credential stuffing attempts.

You can manage or disable non-essential cookies through your browser settings. Please note that disabling cookies may affect the functionality of certain features on the Platform. Your browser documentation will explain how to manage cookie preferences for your specific browser.

26m does not use third-party advertising cookies for the purpose of displaying targeted advertisements on external websites.

26m retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Active account data: Retained for the full duration that your account remains open and active on the Platform.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure, as required by applicable anti-money laundering regulations and our gaming licence conditions.
• Financial transaction records: Retained for a minimum of five (5) years following the date of the transaction, for regulatory and audit purposes.
• Support communications: Live chat transcripts and email correspondence are retained for a minimum of two (2) years following the date of the interaction.
• Behavioural and analytics data: Anonymised or aggregated analytics data may be retained indefinitely for platform improvement purposes, as it can no longer be linked to any individual player.
• Closed accounts: Following the closure of your account — whether voluntary or otherwise — personal data is retained for the minimum period required by applicable law and regulatory obligations before being securely deleted or anonymised.

26m implements a multi-layered approach to data security, combining technical, organisational, and procedural safeguards to protect your Personal Data against unauthorised access, loss, alteration, disclosure, or destruction.

Our key security measures include:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and our servers.
• Encryption at rest for sensitive data categories, including identity documents, financial records, and authentication credentials.
• Two-factor authentication (2FA) available to all registered players for additional account protection.
• Strict role-based access controls ensuring that only authorised personnel can access Personal Data, and only to the extent necessary for their specific duties.
• Real-time intrusion detection and monitoring systems to identify and respond to potential security incidents.
• Regular internal security reviews and vulnerability assessments of the Platform infrastructure.
• Secure disposal and destruction protocols applied to physical and digital data upon expiry of retention periods.

In the event of a data security incident that is likely to result in a risk to your rights and freedoms, 26m will notify affected players within a reasonable timeframe and take all necessary steps to contain and remediate the incident. We will cooperate fully with any regulatory investigations arising from such an event.

While we employ robust security measures, no data transmission over the internet or storage system can be guaranteed as completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly if you believe your account has been compromised.

As a player on the 26m Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team via live chat or email at [email protected]:

We will respond to all verified data rights requests within 30 calendar days. In complex cases we may extend this by a further 30 days, in which case we will notify you of the extension and the reason for it. We do not charge a fee for standard requests.

Please note that certain rights are subject to limitations — for example, where data must be retained to fulfil a legal obligation or to defend a legal claim. Where a request cannot be fulfilled in full, we will explain the specific reason in our response.

The 26m Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21.

All registration processes include mandatory age declaration and are subject to KYC age verification. Where we discover or are notified that an account has been registered by a person under 21 years of age, we will immediately suspend the account, delete all associated Personal Data to the extent permitted by law, and forfeit any funds held in the account in accordance with our Terms and Conditions.

If you believe that a minor has registered an account on 26m using false age information, please contact our support team immediately so that we can take prompt action.

The Platform may contain references to third-party services — including payment providers such as Touch 'n Go eWallet, Boost, Maybank, CIMB, and others — in the context of describing supported payment methods. Any data you provide directly to a third-party service is governed by that third party's own privacy policy and is outside the scope of this Policy.

26m is not responsible for the privacy practices, security standards, or content of any third-party services or websites. We recommend that you review the privacy policy of any third-party service before submitting personal information to them.

26m reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or our service offerings. Material changes will be communicated to registered players by posting a notice on the Platform homepage and, where practicable, by email notification to your registered address, with a minimum of 7 days' advance notice.

The effective date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, please discontinue use of the Platform and contact our support team to request account closure.

We encourage you to review this Policy periodically to stay informed of how we are protecting your information.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way 26m processes your Personal Data, please contact our support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform homepage.
• Email: [email protected] (plain text — not a clickable link)

For data rights requests — including access, rectification, erasure, or portability requests — please state clearly in your message that you are submitting a data rights request and specify which right you wish to exercise. We may require you to verify your identity before processing any such request.

Our support team communicates in English and is dedicated to serving the Malaysian market. All privacy-related correspondence should be submitted in English to ensure accurate and prompt handling.

We are committed to working constructively with you to resolve any privacy concerns you may have. If you are not satisfied with our response, you may have the right to raise a complaint with the relevant data protection authority in your jurisdiction.