Privacy Policy

01 Introduction

This Privacy Policy ("Policy") is issued by naga26 ("we", "us", "our") and applies to all personal data collected from users ("you", "User", "Player") who access, register on, or interact with the naga26 online platform located at https://naga26.click ("Platform").

naga26 operates as an online entertainment platform offering casino games, live dealer tables, sports betting, and related services to players in Malaysia and other permitted jurisdictions. We recognise that the personal data you entrust to us when creating an account and using our services is sensitive, and we are fully committed to handling it responsibly, lawfully, and transparently.

This Policy describes in plain and accessible terms: the categories of personal data we collect; the purposes for which that data is processed; the legal basis for processing; with whom data may be shared; how long data is retained; the security measures we apply; and the rights available to you as a data subject. Please read this Policy carefully. By registering an Account on naga26 or by continuing to use the Platform, you acknowledge that you have read and understood this Policy.

02 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

03 Data We Collect

naga26 collects personal data in three principal ways: directly from you when you register and use the Platform; automatically through your device and browser when you access the Platform; and from trusted third-party service providers such as payment processors and KYC verification services. The categories of data we collect are as follows:

3.1 Account Registration Data

• Full legal name
• Date of birth (to verify you are aged 21 or above)
• Residential address in Malaysia (including city — Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or other)
• Email address
• Malaysian mobile phone number
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued identity documents (Malaysian MyKad, Passport, Driver's Licence)
• Proof of address documents (utility bills, bank statements dated within three months)
• Selfie photographs taken while holding an identity document
• Additional documents requested for enhanced due diligence where applicable

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and reference numbers
• Payment method details (e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; bank account/FPX transaction references for Maybank, CIMB, Public Bank, Hong Leong Bank; masked card numbers for Visa/Mastercard; cryptocurrency wallet addresses for BTC/USDT transactions)
• Account balance history

3.4 Gaming Activity Data

• Games played, bet amounts, game outcomes, session durations
• Sports betting selections, stake amounts, and settlement records
• Bonus claims, wagering progress, and promotional activity

3.5 Technical & Device Data

• IP address and approximate geographic location
• Device type, operating system, and browser type and version
• Session identifiers, login timestamps, and activity logs
• Cookie and tracking data (see Section 10)

3.6 Communication Data

• Records of live chat interactions with support agents
• Email correspondence with naga26 support or compliance teams
• Feedback, complaints, and dispute records

04 How We Use Your Data

naga26 processes your personal data for the following purposes:

05 Legal Basis for Processing

naga26 processes your personal data only where there is a valid legal basis for doing so. The applicable legal bases are:

• Contractual Necessity: Processing necessary for the performance of the contract between you and naga26 — i.e., to provide the gaming and payment services you have registered for.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC, AML, and fraud prevention obligations.
• Legitimate Interests: Processing necessary for the legitimate interests of naga26, including platform security, fraud prevention, and service improvement, provided those interests do not override your fundamental rights and freedoms.
• Consent: Where you have given explicit, freely withdrawn, and revocable consent — primarily in the context of direct marketing communications.

06 Sharing & Disclosure of Personal Data

naga26 does not sell, rent, or trade your personal data to third-party marketing organisations under any circumstances. Personal data may be shared with the following categories of third parties solely for the purposes described in this Policy:

• Payment Service Providers: Malaysian e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), bank transfer facilitators (DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank), card processors (Visa/Mastercard), and cryptocurrency exchange processors — for the purpose of processing your deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Third-party identity verification services used to process your KYC documents and confirm your identity, age, and residency.
• Game Studios: Licensed international game studios that supply games to the naga26 platform may receive limited technical data (such as session identifiers and game activity logs) necessary to deliver their games and calculate outcomes.
• IT Infrastructure & Security Providers: Cloud hosting providers, content delivery networks, DDoS protection services, and security monitoring providers that host and protect the naga26 Platform.
• Legal & Compliance Advisors: Legal counsel and compliance consultants engaged to advise naga26 on regulatory matters where access to relevant data is required.
• Regulatory & Law Enforcement Authorities: Where naga26 is legally required or compelled by a court order, regulatory directive, or other lawful authority to disclose personal data, we will do so to the extent required and will endeavour to notify you where permitted by law.

All third-party Data Processors engaged by naga26 are subject to contractual obligations requiring them to process personal data only for the specified purposes, to maintain appropriate security standards, and to prohibit any further disclosure or use of your data beyond what is strictly necessary.

07 International Data Transfers

Some of the third-party service providers engaged by naga26 may be located in or may process personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, naga26 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia.

Appropriate safeguards may include: contractual clauses binding the recipient to data protection standards consistent with this Policy; certification under recognised international data protection frameworks; or transfers to jurisdictions that have been recognised as providing an adequate level of data protection.

Where you would like further information about the specific safeguards applicable to international transfers of your personal data, you may contact us using the details in Section 16 of this Policy.

08 Data Retention

naga26 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be linked to any individual. Requests for early deletion are considered under Section 11 (Your Rights), subject to any overriding legal obligations that require continued retention.

09 Security Measures

naga26 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the naga26 Platform is encrypted using industry-standard SSL/TLS protocols. The presence of HTTPS and a padlock icon in your browser address bar confirms this encryption is active.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted when stored on naga26's servers.
• Access Controls: Access to personal data is restricted to authorised naga26 personnel and contracted third parties on a strict need-to-know basis. All access is logged and subject to regular review.
• Two-Factor Authentication (2FA): 2FA is available for all Player accounts and is mandatory for administrative access to internal systems containing personal data.
• Regular Security Audits: naga26 conducts periodic security assessments, penetration testing, and vulnerability scans to identify and remediate potential weaknesses in our systems.
• Data Breach Response: naga26 maintains an incident response protocol to detect, contain, and manage data security incidents. Affected individuals will be notified promptly where legally required.

While naga26 takes all reasonable precautions to safeguard your data, no online platform can guarantee absolute security. You are also responsible for maintaining the confidentiality of your login credentials and for notifying us immediately if you suspect any unauthorised access to your Account.

10 Cookies & Tracking Technologies

naga26 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit the Platform. They enable core functionality (such as keeping you logged in), help us understand how the Platform is used, and support security monitoring.

The categories of cookies used by naga26 are:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies enable core functions such as account authentication, session management, and security features. They cannot be disabled without impacting Platform functionality.
• Functional Cookies: Allow the Platform to remember your preferences (such as language settings and display options) to provide a more personalised experience.
• Analytics Cookies: Used to collect aggregated and anonymised information about how visitors use the Platform — including pages visited, session duration, and navigation paths. This data helps us improve Platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot traffic and brute-force login attempts.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may affect your ability to use the Platform. Most modern browsers allow you to view, delete, and block cookies from specific websites. Please refer to your browser's help documentation for instructions.

11 Your Data Protection Rights

As a User of the naga26 Platform, you hold a number of rights with respect to the personal data we hold about you. These rights are exercisable by contacting us using the details in Section 16. naga26 will respond to all valid rights requests within a reasonable timeframe, typically within 30 days.

To exercise any of these rights, please contact the naga26 support team via live chat or by email at [email protected] (plain text — not a clickable link). We may need to verify your identity before processing your request. naga26 does not charge a fee for processing rights requests in ordinary circumstances.

12 Children & Minors

The naga26 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Registration on the Platform by a minor is a breach of our Terms & Conditions and will result in immediate account closure and deletion of all associated personal data, except where retention is required for fraud prevention or legal compliance purposes.

If you have reason to believe that a minor has registered an account on naga26 or provided personal data to us, please contact our support team immediately so that the matter can be investigated and resolved without delay.

13 Marketing Communications

Where you have provided explicit consent at the time of registration or at a later stage, naga26 may send you promotional communications relating to bonuses, new game releases, sports betting offers, and other platform updates. These communications may be delivered via email or SMS to the contact details registered on your account.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your Account settings;
• Clicking the "unsubscribe" link included in any marketing email; or
• Contacting our support team via live chat or at [email protected] (plain text) with a request to opt out.

Please note that opting out of marketing communications does not affect transactional communications — you will continue to receive account-related notifications such as deposit confirmations, withdrawal receipts, KYC updates, and security alerts, which are necessary for the operation of your Account.

14 Third-Party Links & Services

The naga26 Platform may contain references to third-party payment services and financial institutions (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and others). When you interact with these third-party payment providers as part of a deposit or withdrawal transaction, you are also subject to their own privacy policies and terms of service.

naga26 is not responsible for the privacy practices or content of any third-party service or platform. We encourage you to review the privacy policy of any third-party service you use in connection with your naga26 account. This Policy applies exclusively to personal data collected and processed by naga26 in connection with the naga26 Platform.

15 Changes to This Privacy Policy

naga26 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform services. Material changes to the Policy will be communicated to registered Users via email notification and/or a prominent notice on the Platform prior to the effective date of the change.

The date at the top of this document reflects when the Policy was last updated. We encourage you to review this Policy periodically to remain informed about how naga26 protects your personal data. Continued use of the Platform following the effective date of an updated Policy constitutes your acknowledgement of the changes.

The most current version of this Privacy Policy is always accessible from the footer navigation of the naga26 website at naga26.click/privacy-policy.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by naga26, please contact our Data Protection team through any of the following channels:

• 24/7 Live Chat: Available directly on the naga26 Platform — typically the fastest channel for privacy-related queries. Our support agents can escalate your enquiry to our Data Protection team where required.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" for data protection-related enquiries to ensure prompt routing to the appropriate team.

When submitting a data rights request, please provide your registered Account username and a clear description of your request to allow us to process it efficiently. We will acknowledge receipt of your request and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it.