Privacy Policy

This Privacy Policy ("Policy") is issued by oncuci ("oncuci", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "Player", "User") who access or use the oncuci platform at https://oncuci.cam, including all associated services, mobile interfaces, account functions, payment systems, and customer support channels.

oncuci is committed to protecting the privacy and security of your personal information. We process your data in accordance with applicable data protection principles and international privacy standards, including proportionality, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.

By creating an Account or continuing to use the oncuci Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please do not use the Platform and contact us to close your Account.

This Policy should be read in conjunction with our Terms & Conditions. In the event of any conflict between this Policy and the Terms, the Terms shall prevail.

For the purposes of this Policy, the following terms have the meanings set out below:

Term	Meaning
Personal Data	Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, device identifiers, and usage logs.
Processing	Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
Data Controller	oncuci, acting as the entity that determines the purposes and means of processing your Personal Data.
Data Processor	Any third-party service provider that processes Personal Data on behalf of oncuci pursuant to documented instructions and contractual obligations.
KYC Data	Identity verification documents and supporting materials collected in connection with oncuci's Know Your Customer compliance obligations.
Cookies	Small text files placed on your device by the Platform to support session management, analytics, and personalisation functions.

oncuci collects personal data through several channels: directly from you during registration and ongoing account use, automatically through your interaction with the Platform, and from third parties such as payment processors and identity verification services.

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (for age verification — players must be 21 or above)
• Residential address, including postcode and city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Email address and mobile phone number
• Chosen username and encrypted password hash

3.2 Identity Verification (KYC) Data

• Copy of a valid government-issued photo identity document (e.g., Malaysian MyKad, passport)
• Selfie or live photo for facial verification purposes
• Proof of address documentation (e.g., utility bill, bank statement dated within 3 months)
• Proof of payment method (e.g., screenshot of e-wallet account, bank statement showing account name)

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method details
• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay account references)
• Bank account details where used for FPX, DuitNow, or direct bank transfer transactions (Maybank, CIMB, Public Bank, Hong Leong Bank, RHB)
• Cryptocurrency wallet addresses for USDT TRC20 transactions
• Bonus redemption history and promotional participation records

3.4 Gaming Activity Data

• Wagering history, including games played, bet amounts, results, and timestamps
• Session duration and frequency of platform access
• Responsible gambling tool usage (deposit limits set, self-exclusion periods, cooling-off requests)

3.5 Technical & Device Data

• IP address and approximate geolocation at time of access
• Browser type, version, and operating system
• Device type and unique device identifiers
• Platform navigation logs and session timestamps
• Cookie identifiers and analytics data

3.6 Communications Data

• Live chat transcripts, support email correspondence, and any other written communications submitted to oncuci
• Feedback and survey responses submitted voluntarily

oncuci processes your personal data for the following purposes:

Purpose	Description
Account Management	Creating, maintaining, and securing your Account; enabling login, authentication, and session management.
Payment Processing	Processing deposits and withdrawals via your chosen Malaysian payment method (TNG, DuitNow, FPX, Boost, GrabPay, bank transfer, USDT).
Identity Verification	Verifying your identity and age (21+) in compliance with KYC obligations and to prevent underage gambling and fraud.
Regulatory Compliance	Fulfilling anti-money laundering (AML), counter-terrorism financing (CTF), and other applicable legal obligations.
Fraud Prevention	Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and prohibited conduct.
Customer Support	Responding to your support queries, resolving disputes, processing complaints, and improving support quality.
Platform Improvement	Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience.
Responsible Gambling	Monitoring for indicators of problem gambling behaviour and administering self-exclusion, deposit limit, and cooling-off requests.
Marketing Communications	Sending promotional offers and account notifications to Players who have consented to receive such communications. You may opt out at any time.

oncuci processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and oncuci — including Account registration, payment processing, and the provision of gaming services — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification, anti-money laundering reporting, and age verification, is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, abuse detection, and internal analytics is carried out on the basis of oncuci's legitimate interests, balanced against your rights and interests.
• Consent: Processing for marketing communications is carried out on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time by contacting support or updating your communication preferences within your Account settings.

oncuci does not sell your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment Service Providers: Financial institutions and e-wallet operators (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and DuitNow infrastructure providers) that process your deposit and withdrawal transactions.
• Identity Verification Partners: Third-party KYC verification service providers engaged to verify your identity documents and conduct sanctions screening. These providers are bound by strict data processing agreements.
• Technology Infrastructure Providers: Cloud hosting, cybersecurity, and platform infrastructure providers that support the operation of the oncuci Platform under data processing agreements that restrict use to Platform operational purposes only.
• Regulatory & Law Enforcement Authorities: Competent authorities where disclosure is required by law, court order, or regulatory obligation. oncuci will notify you of such disclosures to the extent permitted by applicable law.
• Fraud Prevention Networks: Shared fraud intelligence databases and risk management partners, where disclosure is necessary to prevent or detect financial crime, money laundering, or other prohibited activity.

The oncuci Platform uses cookies and similar tracking technologies to support essential functionality, measure platform performance, and improve your experience. We do not use cookies to serve third-party advertising.

Cookie Type	Purpose	Duration
Essential Cookies	Required for session management, authentication, and basic platform functionality. Cannot be disabled without impairing core service operation.	Session / up to 30 days
Performance Cookies	Collect anonymised analytics data about page load times, error rates, and navigation patterns to help oncuci identify and fix technical issues.	Up to 12 months
Preference Cookies	Remember your platform preferences such as language settings, display options, and responsible gambling reminder frequency.	Up to 12 months
Security Cookies	Support fraud detection, bot prevention, and authentication integrity functions.	Session

You can manage cookie preferences through your browser settings. Please note that disabling essential cookies may prevent certain Platform features from functioning correctly. Detailed cookie settings can also be reviewed in your Account preferences.

oncuci retains your personal data for the minimum period necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and operational obligations:

• Account and KYC Data: Retained for the duration of your active Account and for a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years from the date of the transaction, in accordance with applicable financial regulations.
• Gaming Activity Logs: Betting history and session logs are retained for a minimum of three (3) years for dispute resolution, fraud investigation, and regulatory audit purposes.
• Communications Records: Support correspondence is retained for a minimum of two (2) years to facilitate quality assurance and dispute resolution.
• Marketing Preferences: Consent records are retained for as long as you maintain an Account, plus a period of three (3) years, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, data is securely deleted or permanently anonymised such that it can no longer be associated with any individual.

oncuci implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security programme includes:

• Encryption: All data in transit is protected by TLS 1.2 / 1.3 (256-bit SSL). Sensitive data at rest, including KYC documents and payment credentials, is stored in AES-256 encrypted storage systems.
• Access Controls: Personal data is accessible only to oncuci personnel with a legitimate need. Role-based access controls and privilege management limit data access to authorised individuals, and all access is logged.
• Two-Factor Authentication: oncuci supports 2FA for Player accounts to reduce the risk of unauthorised access resulting from compromised credentials.
• Vulnerability Management: The Platform undergoes regular security assessments, including penetration testing and vulnerability scanning, to identify and remediate security weaknesses.
• Incident Response: oncuci maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with our legal obligations.

You have the following rights in relation to your personal data held by oncuci. To exercise any of these rights, please contact our support team at [email protected] or via live chat. oncuci will respond to all data rights requests within 30 days of receipt.

Please note that certain rights are subject to limitations where oncuci has overriding legitimate interests or is required to retain or process data by law — for example, KYC and transaction records subject to regulatory retention obligations cannot be deleted on request prior to their mandatory retention period expiry.

The oncuci Platform is strictly intended for adults aged 21 years and above. oncuci does not knowingly collect, store, or process personal data from any individual under the age of 21.

Age verification is conducted as part of the registration and KYC process. Accounts identified as belonging to individuals under 21 will be immediately suspended, all associated data will be deleted, and any deposited funds will be returned through the original payment method where technically feasible.

If you believe that a minor has registered an Account on the oncuci Platform, please contact us immediately at [email protected] so that we may investigate and take appropriate action without delay.

oncuci reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, or regulatory guidance. The current version of this Policy is always available at https://oncuci.cam/privacy-policy.

Where we make a material change to this Policy — one that meaningfully affects how we process your personal data or the rights available to you — we will provide advance notice through in-platform notifications and/or email to your registered address at least 14 days prior to the changes taking effect.

Your continued use of the oncuci Platform after the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you do not agree with any change, you have the right to close your Account and request deletion of your data subject to applicable retention obligations.

For all privacy-related queries, data rights requests, or concerns about how oncuci processes your personal data, please contact our support team through the following channels. All privacy-specific correspondence should include your full registered name, Account username (if applicable), and a description of your request or concern.

We aim to acknowledge all privacy requests within 5 business days and to provide a substantive response within 30 days. In complex cases, we may extend the response period by up to a further 60 days, in which case we will notify you of the extension and the reason for it.

For further information on our terms of service, please refer to our Terms & Conditions. For responsible gambling support, please visit our Responsible Gambling page.