12spin Privacy Policy

1. About This Policy

This Privacy Policy ("Policy") applies to all personal data collected and processed by 12spin in connection with the operation of the online gaming platform at https://12spin.win ("Platform"). This Policy covers all players registered on the Platform, visitors to the website who have not yet registered, and any individuals who interact with 12spin through its customer support channels or marketing communications.

This Policy is incorporated by reference into the 12spin Terms & Conditions. Capitalised terms used in this Policy that are not defined herein carry the meanings assigned to them in the Terms & Conditions, available at https://12spin.win/terms-conditions.

12spin is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection laws and the requirements of our international gaming authority licensing obligations.

2. Data Controller

For the purposes of applicable data protection legislation, 12spin acts as the data controller in respect of the personal data of players and visitors collected through the Platform. As data controller, 12spin determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully.

You may contact 12spin's data controller representative using the contact details set out in Section 15 of this Policy.

3. Data We Collect

12spin collects the following categories of personal data from players and visitors:

3.1 Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you meet the minimum age requirement of 21 years).
• Gender (where voluntarily provided during registration).
• Copies of identity documents submitted for Know Your Customer (KYC) verification, including national identity card, passport, or driving licence.

3.2 Contact Data

• Email address (primary identifier for your 12spin Account).
• Correspondence address or residential address (where required for verification purposes).
• Contact telephone number (where provided).

3.3 Financial Data

• Payment method identifiers (e.g., Touch n Go eWallet account reference, Boost wallet reference, bank account details for Maybank / CIMB / Public Bank transfers, masked card numbers for Visa or Mastercard).
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method used.
• Wallet balance and bonus fund balance within your 12spin Account.

3.4 Gaming & Behavioural Data

• Game session history including titles played, stake amounts, win/loss outcomes, and session duration.
• Sportsbook and esports betting history including markets wagered on, stakes, and outcomes.
• Bonus utilisation records including bonus claimed, wagering progress, and conversion status.
• Responsible gaming tool settings including deposit limits, session timer preferences, and any self-exclusion requests.

3.5 Technical & Device Data

• IP address and approximate geographic location derived from IP address.
• Device type, operating system version, and browser type and version.
• Session login timestamps and logout times.
• Cookie identifiers and similar tracking technologies as described in Section 8.

3.6 Communications Data

• Records of communications between you and 12spin customer support, including live chat transcripts and email correspondence.
• Records of your preferences with respect to marketing communications.

4. How We Collect Data

12spin collects personal data through the following channels:

• Direct submission — Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, or contacting customer support.
• Automated collection — Technical and device data collected automatically through your use of the Platform, including through cookies and server-side logging systems.
• Third-party providers — Identity verification data returned by our KYC service providers; payment data received from payment gateway providers (Touch n Go eWallet, Boost, and banking partners); fraud detection data from third-party anti-fraud systems.
• Publicly available sources — Where permitted by law, 12spin may supplement your data with information from publicly available databases for the purposes of fraud prevention and anti-money laundering compliance.

5. How We Use Your Data

12spin uses personal data for the following purposes:

• To create, verify, and administer your 12spin Account, including processing deposits and withdrawals in Malaysian Ringgit (MYR).
• To verify your identity and age (21+ requirement) as required by our international gaming authority licensing obligations.
• To process and settle bets, casino games, and sports and esports markets on the Platform.
• To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct under our Terms & Conditions.
• To administer promotions, bonuses, and loyalty programmes to eligible players.
• To send transactional communications including deposit confirmations, withdrawal notifications, and account security alerts.
• To send promotional communications where you have provided consent or where permitted under applicable law — you may opt out at any time.
• To monitor gaming behaviour for responsible gaming purposes and to apply responsible gaming tools at your request or, where required, at our regulatory discretion.
• To comply with our obligations under applicable law and our international gaming authority licensing conditions, including mandatory reporting obligations.
• To improve Platform functionality, user experience, and game offering through anonymised analytics and aggregated usage data.

6. Legal Bases for Processing

12spin processes personal data under the following legal bases:

• Contractual necessity — Processing required to perform our contract with you (the Terms & Conditions), including Account administration, bet settlement, and payment processing.
• Legal obligation — Processing required to comply with our legal and regulatory obligations under applicable law and international gaming authority licensing requirements, including anti-money laundering (AML), KYC, and responsible gaming obligations.
• Legitimate interests — Processing carried out in pursuit of our legitimate business interests, including fraud prevention, platform security, and improving the gaming experience, where these interests are not overridden by your rights and interests.
• Consent — Processing of personal data for marketing communications and non-essential cookies, where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

12spin does not sell personal data to third parties. We may share personal data in the following limited circumstances:

• Payment processors and e-wallet providers — Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, Visa, Mastercard, and USDT processing services, for the purpose of processing deposits and withdrawals.
• Identity verification providers — Third-party KYC service providers engaged by 12spin to verify player identity and age.
• Game content providers — Licensed game studios and platform providers whose games are made available on 12spin. Shared data is limited to the minimum required for game session functionality and fair play monitoring.
• Regulatory and law enforcement bodies — Where required by law, court order, or as part of our mandatory reporting obligations under our international gaming authority licence.
• Anti-fraud and security services — Third-party providers assisting in fraud detection and prevention, operating under strict data processing agreements.

All third parties with whom 12spin shares personal data are required to process such data only for the purposes for which it was shared and in accordance with applicable data protection standards.

8. Cookies & Tracking Technologies

8.1 What We Use

The 12spin Platform uses cookies and similar tracking technologies including session cookies, persistent cookies, and local storage objects. These technologies are used for the following purposes:

• Essential cookies — Required for the Platform to function correctly, including maintaining your login session, storing your wallet state, and preserving your game session across page loads.
• Analytics cookies — Used to collect anonymised and aggregated data about how players navigate and use the Platform, helping us identify performance issues and improve user experience.
• Security cookies — Used to detect and prevent fraudulent login attempts and other security threats.

8.2 Cookie Control

You may control non-essential cookies through your browser settings. Please note that disabling essential cookies may impair the functionality of the 12spin Platform, including preventing you from logging in or completing transactions.

9. Data Retention

12spin retains personal data for the periods set out below, or such longer periods as may be required by applicable law or our international gaming authority licensing obligations:

• Account and identity data — Retained for the duration of your Account and for a minimum of five (5) years following Account closure, as required for anti-money laundering compliance.
• Transaction and gaming records — Retained for a minimum of five (5) years from the date of each transaction or gaming session.
• Customer support communications — Retained for three (3) years from the date of the last communication.
• Marketing preferences — Retained until you withdraw consent or opt out of marketing communications.
• Technical and device logs — Retained for twelve (12) months in aggregate form for security and platform analytics purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 12spin's data disposal procedures.

10. Data Security

12spin implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and 12spin's servers.
• Encryption of sensitive data at rest, including payment method details and identity verification documents.
• Role-based access controls limiting internal access to personal data to authorised personnel only.
• Regular security assessments and penetration testing of Platform infrastructure.
• Segregation of player funds in accordance with our international gaming authority licensing requirements.

No security measure is entirely foolproof. In the event of a data breach that is likely to result in high risk to your rights and freedoms, 12spin will notify affected players in accordance with applicable notification obligations.

11. Your Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by 12spin:

• Right of access — You have the right to request a copy of the personal data 12spin holds about you.
• Right to rectification — You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure — You have the right to request deletion of your personal data in certain circumstances, subject to our legal retention obligations.
• Right to restrict processing — You have the right to request restriction of processing in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability — Where processing is based on consent or contractual necessity, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — You have the right to object to processing based on legitimate interests, including for direct marketing purposes.
• Right to withdraw consent — Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact 12spin using the details in Section 15. We will respond to valid requests within 30 days. Requests may require identity verification before processing.

12. International Data Transfers

As an internationally operated gaming platform, certain personal data processed by 12spin may be transferred to and stored in jurisdictions outside Malaysia. Where such transfers occur, 12spin ensures that appropriate safeguards are in place, including data processing agreements incorporating standard contractual clauses or equivalent transfer mechanisms recognised under applicable data protection law.

12spin will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards.

13. Children's Privacy

The 12spin Platform is strictly intended for individuals who are 21 years of age or older. 12spin does not knowingly collect, process, or retain personal data from individuals under the age of 21. If 12spin becomes aware that personal data of an individual under 21 has been collected, that data will be deleted immediately and the associated Account will be permanently closed.

If you believe that a person under the age of 21 has registered on the Platform, please contact us immediately at [email protected].

14. Changes to This Policy

12spin reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes will be communicated to registered players by email to the address on file and/or by a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the 12spin Platform following notification of material changes constitutes acknowledgement of the updated Policy. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which 12spin processes your personal data, please contact our support team. We are available 24 hours a day, 7 days a week.

Email: [email protected]

For data subject access requests, please include "Data Access Request" in your subject line and provide sufficient information to verify your identity. We will acknowledge your request within 72 hours and respond in full within 30 days.