Privacy Policy grab33 — Malaysian Player Data Protection

1 Introduction & Scope of This Policy

Grab33 ("we", "our platform") operates through the grab33.click website and provides online entertainment services to Malaysian players, including slots, Live Casino, blackjack, poker, table games, digital lottery, Sports Betting for the Malaysia Super League and EPL, and badminton betting.

This Privacy Policy explains in detail how grab33 collects, uses, stores, discloses, and protects your personal data when you use our platform. It also outlines your rights regarding that personal data and how to reach us if you have any questions or concerns about your privacy.

By registering a grab33 account or using any of our services, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please discontinue use of the grab33 platform and contact us to close your account.

2 Types of Personal Data We Collect

Grab33 collects several categories of personal data depending on how you interact with our platform. Below is a detailed breakdown of the types of data involved:

Grab33 does not collect sensitive data such as medical information, political views, or religious beliefs. All data collected is limited to what is necessary to provide the grab33 platform's services safely and effectively.

3 How We Collect Your Personal Data

Grab33 collects your personal data through a variety of channels:

• Account registration: When you complete the grab33 registration form, we collect your name, Malaysian phone number, email address, and other basic information you provide directly.
• KYC verification process: Where identity verification is required, you may be asked to upload an identification document such as a Malaysian identity card (MyKad) or passport.
• Financial transactions: Each time you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks), your transaction details are automatically recorded for financial records and security purposes.
• Gaming activity: The grab33 platform automatically records your gaming activity — including bets placed, games played, and game outcomes — for game integrity purposes and the VIP programme.
• Communications with us: When you contact grab33 customer support via live chat or email, the contents of those communications are retained for service record and quality training purposes.
• Cookies and tracking technologies: The grab33.click website uses cookies and similar technologies to enhance the user experience, maintain login sessions, and understand platform usage patterns.

4 How We Use Your Personal Data

Grab33 uses the personal data collected solely for legitimate, stated purposes. The primary purposes are as follows:

• Service delivery: To enable you to access and use all features of the grab33 platform, including slots, Live Casino, blackjack, poker, lottery, Sports Betting, and e-sports.
• Identity verification and fraud prevention: To verify that you are who you claim to be, prevent duplicate account creation, and detect any suspicious activity that could compromise your account security or the integrity of the platform.
• Payment processing: To process your deposits and withdrawals in MYR securely and accurately via your chosen Malaysian payment method.
• Legal compliance: To comply with applicable Malaysian legal requirements, including anti-money laundering (AML) obligations and Know Your Customer (KYC) procedures.
• Service improvement: To understand how Malaysian players use the grab33 platform and to make improvements that enhance the overall gaming experience.
• VIP programme and promotions: To manage the grab33 VIP rewards programme, determine bonus eligibility, and send relevant promotional offers to players who have consented to receive them.
• Responsible gaming: To monitor gaming patterns and identify players who may need responsible gaming support, and to enforce limits set by players themselves.

5 Disclosure of Data to Third Parties

Grab33 does not sell or rent players' personal data to any third party. However, in certain limited situations, grab33 may need to share data with trusted third parties:

• Payment service providers: Information required to process transactions is shared with providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and banks supporting FPX. Such disclosure is limited strictly to the information needed to complete the transaction.
• Game software providers: Certain game data may be shared with third-party game software providers that support the grab33 platform for technical and game delivery purposes.
• Relevant authorities: grab33 will disclose personal data to Malaysian legal authorities, regulators, or government agencies when required by law or a valid court order.
• Technical service providers: Companies that assist us in managing technical infrastructure, cloud services, or analytics tools may have limited access to data for technical purposes only, and are bound by strict confidentiality agreements.

6 Data Security & Protective Measures

Protecting players' personal data is a core technical and operational priority at grab33. We continuously invest in security infrastructure to keep your data safe from unauthorised access, loss, or misuse.

Key security measures implemented by grab33 include:

• Data encryption in transit: All communications between your browser and grab33's servers are protected by 256-bit TLS/SSL protocols, ensuring that your data cannot be intercepted by third parties.
• Data encryption at rest: Sensitive data such as passwords is stored using strong one-way hashing algorithms — meaning even grab33 staff cannot view your original password.
• Strict access controls: Only authorised personnel who require access to carry out their duties may access players' personal data, and all such access is logged for audit purposes.
• 24/7 security monitoring: Intrusion detection systems and suspicious activity monitoring operate around the clock to identify and respond to security threats promptly.
• Regular security testing: The grab33 platform undergoes regular penetration testing and security audits by independent security experts to identify and address any potential vulnerabilities.
• Incident response plan: grab33 has clear procedures in place to respond to any data security incidents, including notification procedures for affected players where required.

7 Cookies & Tracking Technologies

The grab33.click website uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit our website.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect your ability to use certain features of the grab33 platform, including the login function.

8 Cross-Border Data Transfers

In the course of its operations, grab33 may need to process or store players' personal data on servers located outside Malaysia, particularly for cloud storage and the provision of certain technical services.

In all such cases, grab33 ensures that:

• Data transfers are carried out with safeguards that meet or exceed the standards required under Malaysia's data protection laws.
• Legally binding data processing agreements are in place with all third parties that handle grab33 players' data outside Malaysia.
• Data recipients are bound by strict confidentiality and security obligations equivalent to those upheld by grab33 itself.

9 Your Personal Data Rights

As a grab33 player in Malaysia, you have certain rights regarding your personal data. grab33 respects and supports the exercise of these rights:

• Right of Access: You have the right to request a copy of the personal data grab33 holds about you at any time.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request a correction. Some information can be updated directly through your grab33 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data — however, this right is subject to grab33's legal obligations to retain certain records.
• Right to Object to Marketing: You may withdraw your consent to receive marketing communications from grab33 at any time without affecting your access to the platform.
• Right to Lodge a Complaint: If you believe that grab33 has processed your personal data unlawfully, you have the right to lodge a complaint with us or with the relevant authority.

To exercise any of the rights above, please contact the grab33 data protection team by email at support@grab33.click, clearly stating your request. grab33 will respond within 30 business days.

10 Data Retention & Deletion

Grab33 retains players' personal data for as long as an account is active and for the required period following account closure, in accordance with applicable legal and regulatory requirements. In general:

• Active account data: Retained for the lifetime of the active account and for 7 years after account closure to comply with financial and tax legal requirements
• Financial transaction records: Retained for a minimum of 7 years in compliance with anti-money laundering (AML) requirements and Malaysian accounting laws
• Customer support communication logs: Retained for 3 years for service record and dispute resolution purposes
• Analytics and usage data: Anonymised data (which cannot be linked to any individual identity) may be retained for a longer period for platform improvement purposes

When data is no longer required, grab33 ensures it is securely deleted or anonymised using methods that make recovery impossible.

11 Changes to This Privacy Policy

Grab33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, relevant legislative updates, or improvements to grab33's services.

When significant changes are made, grab33 will notify players via in-platform notifications, an email to the registered address, or a prominent notice on the grab33.click website. The "Last Updated" date at the top of this document will be revised with each amendment.

Your continued use of the grab33 platform following any amendments to this Privacy Policy constitutes acceptance of the revised terms. We encourage players to review this Privacy Policy periodically to stay informed.

12 Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how grab33 handles your personal data, please contact our data protection team:

• Email: support@grab33.click (mark the subject line "Privacy Inquiry")
• Live Chat: Available on the grab33.click platform, 24 hours a day, 7 days a week

Grab33 is committed to responding to all privacy-related enquiries within 30 business days of receipt. For cases involving data breaches or urgent security concerns, we will respond more promptly.

For more information about your rights and responsibilities as a grab33 user, please also refer to Terms & Conditions and Responsible Gaming Guide grab33.