Privacy Policy top1 – Malaysia Member Personal Data Protection

01Introduction

Top1 (operating via top1.express) is an online Sports Betting and casino platform serving Malaysian players. We value the privacy of our members and are committed to protecting the personal information you share with us.

This Privacy Policy sets out in detail the types of personal data we collect from you, how that data is used, who it may be shared with, how long it is retained, and the rights you hold in relation to that data. This Policy covers all your interactions with the top1 platform, including through our website, mobile app and customer support channels.

We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection principles. This Privacy Policy was last updated in January 2026 and supersedes all previous versions.

02Personal Data We Collect

Top1 collects various types of personal data depending on how you interact with our platform. Below are the main categories of data we collect:

Top1 does not collect sensitive data such as your health information, religious beliefs, sexual orientation, or political views. The only potentially sensitive data we collect is a copy of your MyKad for identity verification (KYC) purposes, as required under anti-money laundering procedures.

03How We Collect Data

Your personal data is collected through several channels:

• Account Registration: You provide data directly when completing the top1 registration form, including your name, phone number, email address, and any other required information.
• Identity Verification (KYC): You submit a copy of your MyKad during the identity verification process required prior to your first withdrawal.
• Platform Usage: Data is collected automatically when you use the top1 platform – including games played, bets placed and transactions made.
• Communication with Us: When you contact top1 customer support via live chat, email or WhatsApp, the content of those communications is stored for record-keeping and service improvement purposes.
• Cookies & Tracking Technologies: Technical information and usage data are collected automatically via cookies and similar technologies when you browse the top1 platform.
• Third-Party Payment Processors: When you make a deposit or withdrawal via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, the respective payment provider may share the necessary transaction information with top1 to verify your payment.

04Purposes for Using Personal Data

Top1 uses your personal data solely for the following legitimate purposes:

• Account Management: Creating, verifying and managing your top1 account, including handling registration, login and account settings.
• Transaction Processing: Processing your deposits and withdrawals in MYR via your preferred payment methods, including Touch 'n Go, GrabPay, DuitNow and FPX.
• Identity Verification: To fulfil legal obligations relating to anti-money laundering (AML) and know your customer (KYC) requirements.
• Service Provision: Giving you full access to everything top1 has to offer — from Pragmatic Play and PG Soft slots to live baccarat, and Sports Betting on EPL football, badminton, cricket and e-sports.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance to members.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, bot usage, and other unlawful activities on the platform.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may need support and to ensure that betting limit tools are functioning correctly.
• Platform Enhancements: Analysing usage data (in aggregate and anonymised form) to improve the functionality, design and user experience of the top1 platform.
• Marketing Communications: Sending you promotional information, bonuses, and special offers — but only with your prior consent, and you may unsubscribe at any time.
• Legal Compliance: Fulfilling legal obligations and regulatory requirements, and complying with directives from relevant authorities.

05Sharing Data with Third Parties

Top1 does not sell or trade your personal data. However, in certain limited circumstances, we may share data with trusted third parties:

• Payment Processors: Payment providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow and FPX partner banks receive only the transaction information necessary to process your deposits and withdrawals.
• Game Providers: Third-party game providers such as Pragmatic Play, PG Soft, Habanero and Evolution Gaming may receive limited account information necessary to enable you to play their games on the top1 platform.
• Technology Service Providers: Companies providing infrastructure, analytics, cybersecurity and technical support services to top1. All such providers are bound by strict confidentiality agreements.
• Regulatory Authority: Law enforcement agencies, regulatory bodies or courts when we are legally required to do so by law or court order.
• Identity Verification Provider: Accredited third-party services engaged to assist with identity verification (KYC) and anti-money laundering checks.

All third parties that receive your personal data from top1 are bound by equivalent or stricter data protection obligations, and are prohibited from using that data for any purpose other than those permitted.

06Data Security

Top1 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, deletion, or inadvertent disclosure:

• 256-bit SSL Encryption: All communications between your device and top1's servers are encrypted using the latest SSL/TLS standards, equivalent to the security used by banking institutions.
• Data Encryption at Rest: Sensitive personal data stored in top1's databases is also encrypted at rest, not only during transmission.
• Internal Access Controls: Only top1 staff who require access to your data to perform their duties are permitted to do so. All access is logged and monitored.
• Two-Factor Authentication: Member accounts are protected with two-factor authentication (2FA) to prevent unauthorised access even if a password is compromised.
• 24/7 Security Monitoring: Intrusion detection systems and active monitoring operate around the clock to identify and respond to any security threats promptly.
• Regular Security Audits: top1 conducts regular penetration testing and security audits by independent experts to identify and address any vulnerabilities.
• Fund Segregation: Member funds are held in accounts completely separate from the company's operational funds, providing an additional layer of protection for your money.

07Cookies & Tracking Technologies

Top1 uses cookies and similar tracking technologies to enhance the user experience and gather analytics data. The following types of cookies are used:

• Essential Cookies: Required for core platform functions — including login sessions, security, and language preferences. Without these cookies, the platform cannot function properly. These cookies cannot be disabled.
• Performance / Analytics Cookies: Collects information on how you use the platform — pages visited, time spent, and features used. This data is aggregated and anonymised to help us improve the platform.
• Functional Cookies: Saving your preferences — such as language selection, display theme and other settings — so you don't have to reconfigure them every time you visit.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and ensure the security of your login session.

You can manage your cookie settings through your web browser preferences. However, disabling certain cookies may affect the functionality or user experience of the top1 platform. Continued use of the top1 platform after the cookie notice is displayed will be considered your consent to the use of cookies as described above.

08Cross-Border Data Transfers

Given the global operations of game providers and payment processors, your personal data may in certain circumstances be processed or stored outside Malaysia. top1 ensures that any such cross-border data transfers are conducted with adequate safeguards in place:

• Transfers are only made to countries or parties that provide an equivalent or higher level of data protection.
• Legally binding data processing agreements are established with all recipient parties outside Malaysia.
• International game providers such as Pragmatic Play and PG Soft, which may process your gaming data, are bound by strict confidentiality and data protection agreements.
• Payment processors operating in Malaysia, such as Touch 'n Go, GrabPay, Boost, ShopeePay and DuitNow, are bound by Malaysian law and Bank Negara Malaysia regulations.

09Data Retention Period

Top1 retains your personal data only for as long as necessary for the stated purposes or as required by law. The following are general retention period guidelines:

• Active Account Data: For as long as your account remains active and you continue using top1's services.
• After Account Closure: Financial transaction data and identity verification records are retained for a minimum of 7 years following account closure, in accordance with Malaysia's anti-money laundering legal requirements.
• Customer Service Records: Support communication logs are retained for 3 years for reference and dispute resolution purposes.
• Analytics Data: Anonymised usage data is retained indefinitely for platform analysis and improvement purposes, as it can no longer be linked to any specific individual.
• Marketing Data: Marketing communication data is retained until you withdraw your consent or request its deletion.

Once the applicable retention period has expired, your personal data will be securely deleted or anonymised in a manner that ensures it can no longer be linked to you.

10Your Rights Regarding Personal Data

As a top1 member and data subject in Malaysia, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact us by email at support@top1.express, stating the right you wish to exercise and providing the information required to verify your identity. We will respond within 21 business days of receiving your request.

11Children's Data

The top1 platform is strictly for individuals aged 18 and above. top1 does not knowingly collect or process personal data from anyone under the age of 18.

If we determine that personal data has been collected from a person under the age of 18 without verified parental or guardian consent, we will take the following steps immediately:

• Immediate closure of the account in question.
• Deletion of all personal data associated with that account.
• Placing a temporary hold on fund balances while an investigation is conducted in accordance with established procedures.

12Payment & Financial Data

Top1 applies additional security measures to protect your financial data given its sensitive nature:

• Top1 does not store full account details of your payment method. All sensitive payment information is processed and stored directly by certified payment processors such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX partner banks.
• Top1 stores only tokens or transaction references that allow us to verify transaction status, without retaining your full payment account details.
• All payment processors used by top1 comply with PCI DSS (Payment Card Industry Data Security Standard) and are regulated by Bank Negara Malaysia.
• Your transaction history is stored securely and is accessible only by you (via your account) and authorised top1 staff for support and compliance purposes.

All transactions on top1 are conducted in Malaysian Ringgit (RM). top1 does not engage in any transactions involving foreign currencies or currency exchange.

13Data Breach Notification

In the unlikely event of a data breach that may affect your rights or freedoms, top1 is committed to:

• Identifying and containing the breach as quickly as possible upon discovery.
• Notifying the relevant authorities within 72 hours of becoming aware of the breach, where required by law.
• Directly notifying affected members without undue delay if the breach is likely to result in a high risk to your rights and freedoms.
• Providing clear information about the nature of the breach, the data potentially affected, the steps already taken and recommendations on how to protect yourself.

14Privacy Policy Amendments

Top1 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or service improvements. Every update will:

• Published on this page with the date of the latest update clearly indicated.
• For material amendments — those that significantly affect how we use your data — we will notify you via email or in-platform notification at least 14 days before the changes take effect.
• Previous versions of the Privacy Policy will be archived and are available upon request.

Continued use of the top1 platform after any amendments to the Privacy Policy take effect will be considered your acceptance of the updated policy. If you do not agree with the changes made, you have the right to stop using the platform and request account closure by contacting support@top1.express.

We recommend checking this page periodically to stay informed about how we handle your personal data.

15Contact Us About Privacy

If you have any questions, concerns, or wish to exercise your rights in relation to this Privacy Policy or the processing of your personal data by top1, please reach out to us through the following channels:

• Privacy Email: support@top1.express – please include "Privacy Enquiry" in the subject line. We will respond within 2 business days.
• Live Chat: Available on the top1 platform 24 hours a day, 7 days a week. Average response time under 2 minutes.
• WhatsApp: Via top1's official WhatsApp number listed on the platform for non-urgent enquiries.

All privacy-related communications are handled by staff trained in data protection law. We take every privacy enquiry and complaint seriously and are committed to resolving them fairly and promptly.

If you are not satisfied with our response to your privacy enquiry or complaint, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia or the relevant regulatory authority.