Privacy Policy — 22club

22club ("we", "us", "our") is the data controller responsible for personal data collected through the 22club website at https://22club.win and through any related mobile or platform interfaces (collectively, the "Platform"). As data controller, 22club determines the purposes and means by which personal data is processed.

This Privacy Policy applies to all personal data processed in connection with the creation and operation of a 22club account, the use of any product or service offered on the Platform, and the browsing of the 22club website by visitors who have not registered as members. By using the Platform, you acknowledge and accept the data processing practices described in this Policy.

For data-related enquiries, please contact 22club's support team. Contact details are provided in Section 12 of this Policy.

22club collects personal data from you directly (when you provide it during registration or use of the Platform) and indirectly (through automated means during your interaction with the Platform). The categories of personal data we collect include:

22club does not collect special category data (such as health data, racial or ethnic origin, or political opinions) except where required by applicable law or licensing obligations, and only with your explicit consent where required.

22club processes your personal data only where a lawful basis for processing exists under applicable data protection law. The lawful bases we rely upon are as follows:

• Contractual necessity: Processing required to perform the 22club membership agreement — including account creation, game access, payment processing, and withdrawal management;
• Legal obligation: Processing required to comply with applicable laws and our licensing obligations, including KYC, AML, and age verification requirements;
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming programme operation — where such interests are not overridden by your fundamental rights;
• Consent: Processing for optional purposes such as marketing communications and analytics cookies, where your explicit and freely given consent has been obtained.

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

22club uses the personal data we collect for the following purposes:

• To create, verify, and maintain your 22club account;
• To process deposits and withdrawals, including verification of payment method ownership;
• To deliver the games, sports betting, esports, and other services available on the Platform;
• To conduct identity verification, age verification, and Know Your Customer (KYC) checks in compliance with our licensing obligations;
• To detect, investigate, and prevent fraud, money laundering, and other prohibited conduct;
• To operate our responsible gaming programme, including monitoring for problem gambling indicators and facilitating self-exclusion requests;
• To communicate with you regarding your account, transactions, security alerts, and support requests;
• To send you promotional offers and bonus communications where you have consented to receive marketing;
• To analyse platform usage and improve the quality, security, and functionality of 22club's services;
• To comply with legal and regulatory obligations under 22club's international gaming authority licensing.

22club will not use your personal data for any purpose materially different from those described above without first providing you with notice and, where required, obtaining your consent.

22club does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data with third parties only in the following circumstances:

• Service providers: Payment processors (including FPX, Touch 'n Go eWallet, and Boost), game content providers, cloud infrastructure providers, fraud detection services, and customer support tools — all of whom are bound by data processing agreements and may only use your data to provide services to 22club;
• Regulatory and licensing authorities: Where required by our licensing conditions or in response to a lawful request from a regulator or law enforcement agency;
• Legal proceedings: Where disclosure is required by court order, legal process, or to protect the rights, property, or safety of 22club, its members, or the public;
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of 22club's assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

Where personal data is transferred to service providers located outside your jurisdiction, 22club ensures that appropriate safeguards are in place — such as contractual data protection clauses — to protect your data to a standard equivalent to that provided under applicable data protection law.

22club retains personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with AML and licensing record-keeping obligations;
• Transaction and financial data: Retained for a minimum of seven (7) years to comply with applicable financial record-keeping requirements;
• Support and communications data: Retained for three (3) years following the interaction, or longer where relevant to an ongoing dispute or investigation;
• Technical and usage data: Retained for up to two (2) years for security and platform improvement purposes;
• Marketing consent records: Retained for the duration of the account relationship and for one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 22club's data disposal procedures.

22club implements a layered approach to data security, incorporating technical, organisational, and procedural controls designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and 22club's servers;
• Encryption of sensitive data at rest, including financial data and identity verification documents;
• Two-Factor Authentication (2FA) available to all members for account access protection;
• IP-based anomaly detection and login pattern monitoring to identify and respond to suspicious access attempts;
• Role-based access controls restricting internal access to personal data on a need-to-know basis;
• Regular security testing and vulnerability assessments of the Platform's infrastructure.

While 22club takes all reasonable measures to protect your personal data, no method of internet transmission or electronic storage is completely secure. You acknowledge this inherent risk when transmitting data electronically. If you have reason to believe your 22club account has been compromised, you must contact our support team immediately.

22club uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device when you visit the Website. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function correctly — including session management, authentication, and security. These cookies cannot be disabled;
• Functional Cookies: Remember your preferences — such as your chosen language or display settings — to improve your experience on repeat visits;
• Analytics Cookies: Help us understand how members interact with the Platform — which pages are visited most, how long sessions last, and where technical issues occur. These cookies do not identify you personally and may be declined;
• Security Cookies: Support fraud detection, bot prevention, and account security monitoring.

You may control non-essential cookie usage through your browser settings. Disabling certain cookies may affect the functionality of the 22club Platform.

Subject to applicable data protection law and any limitations arising from 22club's licensing and legal obligations, you have the following rights with respect to your personal data:

• Right of Access: To request a copy of the personal data 22club holds about you;
• Right to Rectification: To request correction of inaccurate or incomplete personal data;
• Right to Erasure: To request deletion of your personal data, subject to 22club's legal retention obligations;
• Right to Restriction: To request that 22club restricts the processing of your data in certain circumstances;
• Right to Object: To object to processing based on legitimate interests, including direct marketing;
• Right to Data Portability: To receive your personal data in a structured, machine-readable format where processing is based on contract or consent;
• Right to Withdraw Consent: To withdraw consent for any processing activity based on your consent, at any time, without affecting prior lawful processing.

To exercise any of these rights, contact 22club's support team via Live Chat or at the email address provided in Section 12. 22club will respond to valid requests within 30 calendar days. Where requests are complex or numerous, this period may be extended by a further 60 days, in which case 22club will notify you of the extension and the reasons for it.

The 22club Platform is strictly restricted to persons aged 21 years and above. 22club does not knowingly collect or process personal data of individuals under the age of 21. Age verification is a mandatory component of the 22club registration process, and accounts are subject to closure and fund forfeiture if the account holder is found to be underage.

If 22club becomes aware that personal data of a minor has been collected — whether through a failed age verification process, a complaint, or otherwise — that data will be deleted without delay and the associated account will be permanently closed.

Parents or guardians who believe that a minor may have created a 22club account or provided personal data to the Platform should contact our support team immediately via Live Chat or the contact details in Section 12.

22club reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, our licensing requirements, or the way we operate the Platform. The revised Policy will be published on the 22club website with an updated "Last Updated" date. Continued use of the Platform following publication of a revised Policy constitutes your acceptance of the updated terms.

Where changes are material — meaning they significantly affect the way we process your personal data or the rights available to you — 22club will provide more prominent notice, which may include notification via your registered email address or an in-platform banner, prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how 22club protects your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way 22club processes your personal data, please contact our support team using the following details:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available on the 22club website 24 hours a day, 7 days a week — average response time 3–5 minutes
• WhatsApp Support: Available 24/7 via the contact details provided within your 22club account dashboard

22club is committed to resolving all privacy-related enquiries promptly and transparently. If you are not satisfied with our response to a privacy concern, you may escalate the matter to the relevant regulatory authority under 22club's international gaming authority licensing jurisdiction.