Privacy Policy — grab333

1. Introduction

This Privacy Policy ("Policy") sets out the practices of grab333 ("we", "us", "our", "the Platform") with respect to the collection, use, storage, disclosure, and protection of personal data belonging to registered players and website visitors ("you", "your", "the Data Subject").

grab333 operates the online casino and sports betting platform accessible at grab333.cam, serving players across Malaysia including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other Malaysian states and territories. We are committed to processing personal data responsibly and in a manner that respects your privacy rights.

By registering an Account on grab333 or by otherwise accessing or using the Platform, you acknowledge that you have read this Policy and understand how your personal data will be processed. This Policy should be read in conjunction with our Terms & Conditions.

2. Definitions

For the purposes of this Policy, the following terms carry the meanings specified below:

Term	Meaning
"Personal Data"	Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
"Processing"	Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, disclosure, erasure, or destruction.
"Data Controller"	grab333, which determines the purposes and means of processing your Personal Data.
"Data Processor"	Any third party engaged by grab333 to process Personal Data on its behalf and under its instruction.
"KYC"	Know Your Customer — the identity verification process requiring submission of government-issued identification and supporting documents.
"Consent"	A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.

3. Data We Collect

grab333 collects the following categories of personal data in the course of operating the Platform and providing Services to registered players:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification.
• Date of birth (used to verify that you are aged 21 or above).
• MyKad number or passport number (for Malaysian players and international players respectively).
• Nationality and country of residence.
• Gender (where provided during registration).

3.2 Contact Data

• Email address.
• Mobile phone number (used for OTP verification and account security).
• Mailing address (where required for KYC verification purposes).

3.3 Financial & Transaction Data

• Payment method details (e-wallet phone numbers registered with Touch 'n Go eWallet, Boost, or GrabPay; bank account numbers for Maybank, CIMB, Public Bank, and Hong Leong Bank; crypto wallet addresses for USDT TRC20 and BTC transactions).
• Deposit and withdrawal transaction records, including amounts in MYR, timestamps, and transaction reference numbers.
• Account balance history and wagering activity.

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser version.
• Session identifiers and authentication tokens.
• Cookies and similar tracking technologies (see Section 9).

3.5 KYC & Verification Documents

• Scanned or photographed copies of government-issued identification documents (MyKad, passport).
• Proof of address documents where required.
• Selfie or biometric comparison images where requested during enhanced verification.

3.6 Communications Data

• Records of support chat conversations and email correspondence with our team.
• Feedback, complaints, and dispute correspondence.

4. How Data Is Collected

grab333 collects personal data through the following channels:

• Direct provision: Data you enter into registration forms, deposit screens, withdrawal requests, KYC submission portals, and support contact forms on the Platform.
• Automated technologies: Data collected automatically when you access the Platform via cookies, session logs, server logs, and device fingerprinting techniques.
• Payment processors: Transaction confirmation data received from FPX, DuitNow, e-wallet providers, and banking partners as part of payment processing.
• KYC and identity verification services: Data returned by third-party identity verification providers engaged by grab333 to process KYC document submissions.
• Anti-fraud and AML systems: Risk signals and flags generated by our internal and third-party fraud detection and anti-money laundering monitoring systems.

5. Purpose & Legal Basis for Processing

grab333 processes your personal data on the following legal bases and for the following purposes:

Purpose	Legal Basis	Examples
Account registration and management	Performance of contract	Creating your Account, maintaining your balance, processing bets.
Identity verification (KYC)	Legal obligation / contract	Verifying you are aged 21+, processing withdrawal requests, AML compliance.
Payment processing	Performance of contract	Processing MYR deposits via FPX, DuitNow, TNG, Boost, GrabPay, bank transfer, crypto.
Fraud prevention & AML monitoring	Legal obligation / legitimate interest	Detecting suspicious transactions, monitoring for multi-accounting, investigating chargebacks.
Customer support	Performance of contract / legitimate interest	Responding to queries, resolving disputes, handling complaints.
Platform improvement & analytics	Legitimate interest	Analysing usage patterns to improve game performance and platform stability.
Regulatory compliance & reporting	Legal obligation	Retaining transaction records, responding to lawful regulatory enquiries.
Promotional communications	Consent	Sending bonus and promotion notifications where you have opted in.

6. Data Sharing & Disclosure

grab333 does not sell your personal data. We may share your personal data with third parties only in the following limited and controlled circumstances:

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process personal data on our behalf and under our instruction. These include: payment gateway operators (FPX, DuitNow network participants, e-wallet providers); KYC and identity verification platforms; cloud hosting and infrastructure providers; customer support software providers; and anti-fraud and AML screening services. All Data Processors are bound by contractual data processing agreements that restrict their use of your data to the specific service they provide.

6.2 Legal and Regulatory Disclosure

grab333 may disclose personal data to competent governmental authorities, law enforcement agencies, or regulatory bodies where required to do so by applicable law, court order, or lawful regulatory direction. We will notify you of such disclosure where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the grab333 business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change in data processing practices that results from it.

6.4 No Third-Party Marketing

We will not disclose your personal data to any third party for that third party's own marketing, advertising, or commercial purposes.

7. Data Retention

grab333 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and transaction records: Retained for a minimum of five (5) years from the date of your last transaction or Account closure, to comply with financial record-keeping and AML obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from Account closure or the conclusion of any applicable regulatory obligation, whichever is later.
• Support and communications records: Retained for two (2) years following resolution of the relevant issue or the closure of your Account, unless longer retention is required for legal proceedings.
• Cookie and session data: Session cookies are deleted on browser close; persistent cookies are retained for periods specified in Section 9 of this Policy.
• Marketing consent records: Retained until you withdraw consent, plus a reasonable additional period to evidence that consent was validly given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Data Security

grab333 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the Platform is encrypted using industry-standard TLS with at least 256-bit encryption.
• Encryption at rest: Sensitive personal data and payment information stored on our servers is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data within grab333 is restricted on a strict need-to-know basis, with role-based permissions and multi-factor authentication required for administrative access.
• Regular security assessments: Our platform undergoes periodic security testing and vulnerability assessments conducted by qualified information security personnel.
• Incident response: grab333 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, you will be notified without undue delay in accordance with applicable requirements.

9. Cookies & Tracking Technologies

grab333 uses cookies and similar technologies (such as local storage objects and session identifiers) to operate the Platform, maintain your session, and gather analytics information. The following categories of cookies are used:

Cookie Type	Purpose	Retention
Strictly Necessary	Required for the Platform to function — including session management, authentication, and security tokens.	Session (deleted on browser close)
Functional	Remembers your preferences such as language, currency display, and game lobby layout.	Up to 12 months
Analytics	Aggregated data used to understand Platform usage patterns and improve performance. No personally identifiable data is shared with analytics providers beyond what is necessary.	Up to 24 months

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing your Account. Disabling functional or analytics cookies will not prevent you from using the core Platform features.

10. Your Rights as a Data Subject

Subject to applicable law and the conditions set out in this Policy, you hold the following rights with respect to your personal data held by grab333:

To exercise any of the rights listed above, please contact our Data Protection team at [email protected]. We will respond to all legitimate requests within a reasonable timeframe. We may need to verify your identity before acting on a request.

11. Minors & Age Policy

The grab333 Platform is strictly intended for individuals aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. Date of birth is collected during the registration process and cross-referenced with submitted KYC identity documents as part of our age verification controls.

If we become aware that personal data has been collected from or concerning an individual who is under 21 years of age, we will take immediate steps to delete that data and close the associated Account. Any transactions processed during an unverified or underage period will be subject to investigation and potential reversal.

Parents and guardians who believe that a minor in their care has submitted personal data to grab333 are encouraged to contact us immediately at [email protected] so that appropriate action can be taken.

12. International Data Transfers

In the course of operating the Platform and engaging service providers, grab333 may transfer personal data to jurisdictions outside of Malaysia. Where such transfers occur, grab333 will ensure that appropriate safeguards are in place to protect your personal data, including:

• Transferring data only to jurisdictions that provide an adequate level of data protection as determined by applicable standards;
• Executing data processing agreements with third-party Data Processors that incorporate appropriate contractual protections; and
• Applying technical and organisational security measures equivalent to those described in Section 8 of this Policy, regardless of the jurisdiction in which processing occurs.

You may request further information about the safeguards applicable to any specific international transfer by contacting us at [email protected].

13. Changes to This Privacy Policy

grab333 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. The most current version of this Policy will always be published at grab333.cam/privacy-policy with the effective date displayed at the top of the page.

Where changes are material — that is, where they significantly affect how we process your personal data or alter your rights — we will provide notice to registered players through a prominent notification on the Platform prior to the changes taking effect. Your continued use of the Platform after the stated effective date of an updated Policy constitutes your acceptance of the revised terms.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the manner in which grab333 processes your personal data, please contact our support team through the following channel. We are committed to responding to all data-related enquiries promptly and transparently.

For Account-related queries, please also refer to our FAQ page. For information on responsible gambling tools and self-exclusion, please visit our Responsible Gambling page.