Welcome to the my36 Privacy Policy. This document is a legally binding agreement between you ("User", "Member") and my36 ("Company", "we", "Platform") that describes our practices in managing the personal information you provide or that we collect during your use of the my36 platform at my36.vin.
This policy applies to all users of the my36 platform regardless of access method — whether via web browser, mobile app, or any service offered under the my36 brand. By registering an account or using any of our services, you are deemed to have read and agreed to this privacy policy in full.
We are committed to handling your information responsibly, transparently, and securely at all times. Should any significant changes be made to this policy, you will be notified via your registered email or an in-platform notification. Continued use following such notification will be deemed as acceptance of the changes.
Note: This Privacy Policy should be read together with
Terms and Conditions my36, which forms part of the overall agreement between you and my36.
My36 collects your personal information through several means in order to provide the best service, fulfil our legal compliance responsibilities, and protect platform security. The following are the categories of information we collect:
| Data Categories |
Example Information |
Collection Method |
| Identity Data |
Full name, date of birth, identification number (MyKad) |
During registration & the KYC process |
| Contact Data |
Email address, phone number, residential address |
During registration & profile updates |
| Financial Data |
Bank account number, bank name, transaction records |
During the deposit & withdrawal process |
| Technical Data |
IP address, device type, web browser, general location |
Automatically during platform use |
| Usage Data |
Game records, betting history, login activity |
Automatically during gaming sessions |
| Communication Data |
Support chat logs, emails, feedback |
When you contact our support team |
We never collect sensitive information such as health data, religious beliefs, or political views unless required by applicable law. All data collection is carried out on a necessity basis and in accordance with data minimisation principles.
Every piece of information we collect is used for lawful and specific purposes. We will not use your data for any other purpose without giving you prior notice. The following are the primary data usage purposes at my36:
- Account management: To create, verify, and maintain your player account, including the KYC process and age verification.
- Transaction processing: To securely and accurately process deposits, withdrawals, bonuses, and all financial transactions.
- Service provision: To enable you to access all games and features on the my36 platform, including Live Casino, Slots, wagering, and Sports Betting.
- Platform Security: To detect and prevent fraud, money laundering, duplicate accounts, and suspicious activity.
- Legal compliance: To fulfil our obligations under the PDPA 2010, anti-money laundering (AML) laws, and applicable regulatory requirements.
- Service communications: To send important information regarding your account, transactions, policy changes, and security updates.
- Platform improvements: To analyse usage patterns in order to improve the user experience, develop new features, and optimise platform performance.
- Permitted marketing: To send promotions, exclusive offers, and VIP programme information — only if you have given your consent to receive marketing communications.
Marketing Controls: You may withdraw marketing consent at any time by updating your notification settings in your account or contacting our support team. Withdrawal of consent will not affect any data processing carried out prior to that point.
The security of your personal information is a responsibility we take seriously. my36 implements multiple layers of technical and organisational protection to ensure your data remains safe at all times:
- Data-in-transit encryption: All communications between your device and the my36 servers are secured by TLS 1.3 protocol with AES-256 encryption. This means that even if someone were to intercept your network traffic, they would be unable to read its contents.
- Data-at-rest encryption: Sensitive data stored in our databases — including KYC information and financial details — is encrypted using military-grade encryption algorithms.
- Two-factor authentication (2FA): We support and encourage the use of 2FA for all accounts, adding an extra layer of security beyond passwords.
- 24/7 Monitoring: The my36 cybersecurity team monitors platform activity around the clock to detect any unauthorised access attempts or system anomalies.
- Periodic security assessments: my36 conducts regular penetration testing and security audits through certified independent third parties.
- Staff training: All my36 staff who handle personal data undergo rigorous data protection training and are bound by confidentiality agreements.
While we take all reasonable precautions, no system is entirely 100% secure against cyber threats. In the event of any data breach that affects your information, we will notify you promptly in accordance with applicable legal requirements.
My36 does not sell your personal information. However, there are certain situations where we need to share your information with trusted third parties in order for the platform to operate properly:
- Payment processors: Payment service providers such as FPX, Touch 'n Go eWallet, GrabPay, and Boost require certain transaction details to process your deposits and withdrawals.
- Identity verification providers: Our certified KYC partners help us verify player identities and meet AML compliance requirements.
- Game providers: Our game software providers receive only the minimum game data required to deliver a smooth and fair playing experience.
- Legal authorities: We will disclose information to the relevant authorities when required by court order, law, or to support a criminal investigation.
- Analytics services: Third-party analytics tools help us understand platform usage patterns — data transmitted is aggregated and does not contain directly identifiable personal information.
All my36 third-party partners are bound by strict data protection agreements and are only permitted to use your information for agreed purposes. We conduct regular compliance reviews to ensure our partners meet our established data security standards.
International Transfers: Some of our partners may be located outside Malaysia. In such cases, we ensure that data transfers are carried out in accordance with recognised protection mechanisms and meet standards equivalent to the PDPA 2010.
My36 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small data files stored on your device when you visit our website. The following are the types of cookies we use:
- Essential cookies: Required for basic platform operations such as login session verification, security, and core functionality. These cookies cannot be disabled.
- Performance cookies: Helps us understand how visitors use the platform, which pages are most popular, and where users encounter difficulties — all in aggregated form with no individual identification.
- Functional cookies: Remembers your preferences such as interface language, display settings, and login details for your convenience.
- Marketing cookies: Used to display more relevant ads and offers based on your interests and activity — only with your consent.
You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the my36 platform. For more information on managing cookies in your browser, please refer to your browser's help documentation.
Under Malaysia's Personal Data Protection Act 2010 (PDPA) and industry best practices, you have the following rights regarding your personal data processed by my36:
1
Right of Access
Request a copy of the personal data we hold about you in a readily readable format.
2
Right to Rectification
Request correction of inaccurate, incomplete, or outdated information in our records.
3
Right to Erasure
Request the deletion of your personal data under certain circumstances provided for by law.
4
Right to Restriction
Request that we restrict the processing of your data while a dispute or investigation is ongoing.
5
Right to Portability
Request your data in a structured, portable format that can be transferred to another service provider.
6
Right to Object
Object to the processing of your data for direct marketing or profiling purposes at any time.
To submit any request relating to the above rights, please contact our Data Protection Officer (DPO) team via 24/7 live chat or email at . We will process your request within 30 business days.
My36 retains your personal information only for as long as necessary to fulfil the purposes stated in this privacy policy, or as required by applicable law. The following are our general data retention guidelines:
- Active account data: Retained for the duration of your active account and for a minimum of 5 years after account closure to meet AML compliance requirements.
- Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian financial legal requirements.
- KYC Data: Retained for the duration of the active account and for an additional 5 years after account closure.
- Support communication logs: Retained for 2 years for reference and service improvement purposes.
- Technical data and system logs: Retained for 12 months before being automatically deleted or anonymised.
Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be personally associated with you.
Absolutely not. my36 never sells, rents, or trades your personal information to any third party for their own marketing purposes. Data sharing only occurs with trusted, contractually bound operational partners strictly for platform operational purposes.
You may submit a Subject Access Request via 24/7 live chat within your my36 account or by emailing our DPO team. Requests will be processed within 30 business days. Identity verification may be required before data is released to ensure your account security.
Following account closure, my36 will retain your data for the period required by law — typically 5 to 7 years for financial records and KYC data. This is a mandatory compliance requirement under Malaysia's AML legislation. Once the minimum retention period has elapsed, your data will be securely deleted.
Yes, you may withdraw your marketing consent at any time without penalty. Log in to your my36 account, go to the Notification Settings section, and deactivate the desired marketing options. You may also contact our support team to make these changes. Withdrawal of consent will not affect any prior data processing.
Yes. All financial information is encrypted using industry-standard AES-256 encryption and stored in a protected server environment. my36 does not store your credit card numbers or bank PIN. Payment processing is handled by certified payment providers that comply with PCI-DSS standards. In addition, all transactions are monitored in real time to detect any suspicious activity.