Grab33 Privacy Policy – Our Full Commitment to Protecting Your Personal Data

1Introduction & Scope of Privacy Policy

Grab33 is an online casino platform serving users in Malaysia. We understand that your trust in us depends greatly on how we handle your personal information. This Privacy Policy is written in clear, plain language — not confusing legal jargon — because we believe you have the right to know exactly what happens with your data.

This policy applies to all information that grab33 collects through:

• The grab33.biz website and all its subpages
• The grab33 mobile app for iOS and Android
• Communications you send to us via email, live chat, or other support channels
• Any interaction you have with the platform in your capacity as a registered member

2Types of Personal Data We Collect

Grab33 collects your personal information in two ways — information you provide directly, and information collected automatically as you use our platform. Below is a detailed breakdown of each category:

Information You Provide Directly:

• A Malaysian phone number at the time of account registration
• Account password (stored as an unreadable hash)
• Full name, identification card number, and date of birth during the KYC (Know Your Customer) verification process, where required
• Payment method details — including your Touch 'n Go eWallet account, GrabPay, DuitNow, or FPX bank information for deposit and withdrawal purposes
• Communication records with the grab33 customer support team
• Feedback, complaints, or requests you submit to us

Automatically Collected Information:

• Your device's IP address and general geographic location (city/state level, not your exact address)
• The type of device, operating system, and web browser you are using
• Session log data including login time, logout time, and session duration
• Gaming activity records — games played, bets placed, winnings, and outcomes
• Complete financial transaction records — all deposits, withdrawals, and account balance movements
• Cookie data and tracking technologies as described in Section 6

3How grab33 Uses Your Personal Data

Grab33 uses the data we collect solely for the following legitimate and transparent purposes. We do not use your data for any purpose beyond what is stated here without first obtaining your consent:

• Account & Platform Operations: Processing registrations, verifying your identity, managing your account, enabling secure login, and providing access to all features on the grab33 platform.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as withdrawals to the same methods. All transaction records are retained for audit and legal compliance purposes.
• Security & Fraud Prevention: Detecting and preventing unauthorized access, fraud, money laundering, and any suspicious activity. This includes analysis of unusual transaction patterns and gaming activity.
• Legal & Regulatory Compliance: Fulfilling Malaysian legal obligations, including KYC and AML (Anti-Money Laundering) requirements, and complying with directions from lawful authorities when required.
• Customer Support: Managing and resolving your enquiries, complaints, and requests effectively. Communication records are retained to ensure consistency and quality of service.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and reaching out to members who may need support through the programme Responsible Gaming grab33.
• Platform Improvements: Analysing anonymised usage data to understand how the grab33 platform is used and to make relevant improvements to the user experience.
• Service Communications: Sending important notifications about your account, changes to our terms or policies, security activity, and service updates you need to be aware of.

4Data Sharing & Disclosure to Third Parties

Grab33 never sells members' personal data to any third party. This is a non-negotiable principle. However, there are limited situations where grab33 needs to share certain information with selected third parties — and every such sharing is carried out under strict controls:

• Technical Service Providers: Companies that help us operate the platform, process payments via Touch 'n Go, GrabPay, and Malaysian banks, and provide hosting and security services. All such providers are bound by strict confidentiality agreements and may only use your data for the purposes we specify.
• Game Providers: Companies such as Evolution Gaming, Microgaming, NetEnt, and PG Soft that supply games to the grab33 platform may receive the session data required for game operation. This data is processed under strict data protection agreements.
• Legal Requirements: grab33 may be required to disclose personal information if directed by a court, regulatory body, or legitimate Malaysian law enforcement authority. In such cases, we will disclose only the minimum information necessary.
• Rights Protection & Security: In circumstances where disclosure is necessary to protect the rights, property, or safety of grab33, our members, or the public — including cases involving fraud or serious threats.

5Security & Data Protection

Grab33 takes serious investment in security infrastructure to ensure your personal data is protected to the highest standard at all times. Our technical and organisational security measures include:

• Data Encryption in Transit: All communications between your device and grab33's servers are encrypted using TLS 1.3 with 256-bit SSL keys — the highest security standard currently available for web applications.
• Data Encryption at Rest: Sensitive data, including password information and payment details, is stored in encrypted format. Passwords are never stored as plain text — only irreversible cryptographic hashes are retained.
• Internal Access Controls: Access to members' personal data within grab33 is restricted to staff who genuinely require it to perform their duties, in accordance with the principle of least privilege access. All access is logged and auditable.
• 24/7 Security Monitoring: A threat and anomaly detection system operates around the clock to identify any suspicious activity within your account or across the platform's infrastructure as a whole.
• Regular Independent Audits: grab33's platform security is regularly audited by independent third parties specialising in cybersecurity to identify and address any potential vulnerabilities.
• Two-Factor Authentication (2FA): Members can enable two-factor authentication for an additional layer of security on their grab33 account, ensuring that only you can access it even if your password is compromised.

While grab33 takes all reasonable steps to protect your data, we want to be transparent: no security system is entirely foolproof. You also play an important role in keeping your account safe — use a strong password, never share your login credentials, and report any suspicious activity to us immediately.

6Cookies & Tracking Technologies

Grab33 uses cookies and similar tracking technologies to enhance your experience on the platform and ensure it functions correctly. Cookies are small text files stored on your device by your web browser when you visit the grab33 platform.

Grab33 uses the following categories of cookies:

• Essential Cookies (Required): These cookies are required for core platform functions such as login authentication, session management, and security. Without them, the grab33 platform will not work properly. These cookies cannot be disabled.
• Performance & Analytics Cookies: We use these cookies to understand how members use the grab33 platform — which pages are visited most often, time spent on each, and navigation patterns. This information is used in anonymised form to improve the platform.
• Functional Cookies: These cookies remember your preferences — such as language, display settings, and game choices — so you don't have to reconfigure them each time you log in to grab33.
• Security Cookies: Used to detect suspicious login attempts, prevent CSRF attacks, and protect your active session.

You can control or delete cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the grab33 platform. Instructions for managing cookies are available in your web browser's help documentation.

7Data Retention Period

Grab33 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under applicable Malaysian law. Our general data retention guidelines are as follows:

• Active Account Data: Retained for the duration your account remains active and for a minimum of three years after account closure for audit and legal compliance purposes.
• Financial Transaction Records: Retained for a minimum of seven years in accordance with Malaysian legal requirements relating to financial record-keeping and AML compliance.
• Support Communication Records: Retained for two years following case resolution to allow for reference should any follow-up be required.
• Security Log Data: Access logs and security logs are retained for a minimum of one year to facilitate investigations in the event of a security incident.
• Cookie Data: Session cookies are deleted when you close your browser. Persistent cookies have a set expiry period, typically between 30 and 365 days depending on the cookie category.

8Your Personal Data Rights

As a grab33 member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data grab33 holds about you:

• Right to Access: You have the right to request a copy of the personal data grab33 holds about you. Such requests will be processed within 21 business days.
• Right to Rectification: If you find that information grab33 holds about you is inaccurate or outdated, you have the right to request a correction. Corrections that require no further verification will be applied immediately.
• Right to Withdraw Consent: For any data processing based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting your general use of the grab33 platform.
• Right to Object: You may object to the processing of your data for specific purposes in certain circumstances, subject to any legal obligations that override this right.
• Right to Request Erasure: Under certain circumstances, you may request the deletion of your personal data. Such requests will be assessed in accordance with the applicable legal and operational requirements.

To exercise any of the above rights, please contact the grab33 support team by email at support@grab33.biz or through the live chat function on the platform. Please state the right you wish to exercise and provide sufficient information for us to verify your identity before processing your request.

9Children's Privacy & Age Restrictions

The grab33 platform is strictly for individuals aged 18 and above. grab33 does not knowingly collect personal data from anyone under the age of 18. Should we discover that we have collected personal data from a minor without valid parental or guardian consent, we will take immediate steps to delete that information from our systems.

10How to Contact grab33 About Privacy

For any questions, concerns, or requests relating to this Privacy Policy or how grab33 handles your personal data, please contact us through the following channels. Our team operates 24 hours a day, seven days a week, and provides full support in Bahasa Malaysia:

If you are not satisfied with grab33's response to your privacy request, you have the right to file a complaint with Malaysia's Personal Data Protection Commissioner under the provisions of the Personal Data Protection Act 2010. grab33 will cooperate fully with any official investigation conducted by the relevant regulatory body.