grab333 Privacy Policy

1.1 This Privacy Policy ("Policy") is issued by the operator of the grab333 platform accessible at grab333.one ("grab333," "we," "us," "our"). It applies to all personal data collected from persons who visit, register with, or otherwise interact with the grab333 platform, including the website, all associated services, and any communications between grab333 and its players.

1.2 grab333 is committed to handling personal data responsibly and in accordance with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA) and any additional obligations imposed by our international gaming licence. This Policy is designed to give you clear, transparent information about our data practices so you can make informed decisions about your personal data.

1.3 By registering for a grab333 account or using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

2.1 Data You Provide Directly. When you register for or use your grab333 account, we collect the following categories of personal data that you provide to us directly:

2.2 Data Collected Automatically. When you use the grab333 Platform, certain data is collected automatically through standard web and mobile technologies:

• Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and connection type;
• Usage Data: pages visited, games played, session duration, bet history, in-game actions, and navigation patterns;
• Location Data: general geolocation derived from your IP address, used for jurisdictional compliance checks;
• Cookie Data: session identifiers and functional preference data as described in Section 6.

2.3 Data From Third Parties. grab333 may receive personal data about you from third-party sources, including: identity verification providers (for KYC purposes); fraud prevention and anti-money-laundering screening services; and payment processors confirming transaction status. Data received from third parties is handled in accordance with this Policy.

grab333 uses personal data collected from you for the following purposes:

• Account Administration: Creating and managing your grab333 account, authenticating your identity on login, and maintaining account security;
• Service Delivery: Processing deposits and withdrawals, settling bets, crediting bonuses, and providing access to all platform features;
• Identity Verification & KYC: Verifying that you are who you say you are, that you are 21 years of age or older, and that your source of funds is legitimate — as required by our gaming licence obligations;
• Regulatory Compliance: Meeting anti-money-laundering (AML) obligations, reporting requirements under our gaming licence, and responding to lawful requests from regulatory authorities or law enforcement;
• Fraud Prevention: Detecting and preventing fraudulent activity, bonus abuse, collusion, and other forms of Platform misuse;
• Responsible Gaming: Monitoring play patterns to identify potential problem gambling indicators and applying responsible gaming interventions where necessary;
• Customer Support: Responding to your queries, resolving disputes, and improving our support quality;
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience;
• Marketing Communications: Sending promotional offers and platform updates where you have provided consent, as described in Section 10.

Under applicable data protection law, grab333 processes personal data on the following legal bases:

• Contractual Necessity: Processing your identity, contact, financial, and account data is necessary to perform our contract with you — i.e., to operate your grab333 account and deliver the services you have requested;
• Legal Obligation: KYC verification, AML screening, age verification, and regulatory reporting are required by our gaming licence and applicable law — we are legally obligated to collect and retain this data;
• Legitimate Interests: Fraud prevention, platform security monitoring, and aggregated analytics are conducted on the basis of our legitimate interest in operating a secure, fair, and financially sound platform — balanced against your privacy rights;
• Consent: Marketing communications and any non-essential cookie usage are conducted only where you have given clear, informed consent, which you may withdraw at any time.

5.1 No Sale of Data. grab333 does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes under any circumstances.

5.2 Authorised Third-Party Processors. grab333 shares personal data with carefully selected third-party service providers who process data on our behalf and under our instructions, subject to written data processing agreements. These include:

• Payment Processors: Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX — for processing deposits and withdrawal transactions;
• KYC & Identity Verification Providers: Third-party services that verify government-issued ID documents and screen against sanctions and politically exposed persons (PEP) lists;
• Fraud Prevention & AML Services: Providers that screen transactions and account activity for patterns associated with fraud, money laundering, and bonus abuse;
• Cloud Infrastructure Providers: Data hosting and processing infrastructure providers operating under certified security standards;
• Customer Support Tools: Live chat platform providers used to facilitate 24/7 support — support chat data is retained for quality assurance and dispute resolution purposes.

5.3 Regulatory Disclosure. grab333 may disclose personal data to regulatory authorities, gaming licence supervisory bodies, law enforcement agencies, or courts where required by applicable law or by binding legal process. grab333 will notify you of such disclosure where legally permitted to do so.

5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or part of grab333's business, personal data held by grab333 may be transferred to the successor entity as part of the transaction. Affected players will be notified in advance where required by applicable law.

6.1 Types of Cookies Used. The grab333 platform uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. These cannot be disabled without affecting your ability to use the Platform;
• Functional Cookies: Used to remember your preferences — such as your preferred language, display settings, and responsible gaming configurations. These improve your experience but are not strictly required;
• Analytics Cookies: Aggregated, anonymised data on how players navigate the Platform, used solely for internal performance improvement. No personally identifiable information is stored in analytics cookies.

6.2 No Third-Party Advertising Cookies. grab333 does not use third-party advertising trackers, social media pixel tags, or cross-site tracking technologies. Your browsing behaviour on grab333 is not shared with advertising networks.

6.3 Managing Cookies. You may manage or disable non-essential cookies through your browser settings. Note that disabling functional cookies may affect certain Platform features. Disabling strictly necessary cookies will prevent you from using the Platform.

7.1 Technical Measures. grab333 implements the following technical security measures to protect personal data:

• TLS 1.3 with 256-bit SSL encryption for all data transmitted between your device and the grab333 platform;
• AES-256 encryption for personal data stored at rest on grab333 servers;
• Passwords stored as salted cryptographic hashes — never in plain text;
• Two-factor authentication available for all player accounts;
• Automated intrusion detection and anomalous access pattern monitoring.

7.2 Organisational Measures. Access to personal data is restricted on a strict need-to-know basis. All grab333 staff and third-party processors with access to personal data are bound by confidentiality obligations. Security awareness training is conducted regularly.

7.3 Data Breach Response. In the event of a personal data breach that poses a risk to player rights, grab333 will notify affected players and relevant supervisory authorities within the timeframes required by applicable law, and will take immediate steps to contain and remediate the breach.

8.1 Retention Principles. grab333 retains personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by applicable law or our gaming licence obligations. When data is no longer required, it is securely deleted or anonymised.

8.2 Standard Retention Periods. The following indicative retention periods apply:

• Account & Identity Data: Retained for the duration of your account and for 5 years following account closure, as required by AML and gaming licence obligations;
• Transaction Records: Retained for 7 years following the transaction date, as required by financial regulation;
• Support Communications: Retained for 2 years after the closure of the relevant support case;
• Marketing Consent Records: Retained for 3 years from the date consent was given or last refreshed;
• Technical & Log Data: Retained for up to 12 months for security monitoring purposes.

Subject to applicable law and any overriding obligations imposed by our gaming licence or AML requirements, you have the following rights in respect of your personal data held by grab333:

• Right of Access: You may request a copy of the personal data grab333 holds about you;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Note that corrections to KYC data may require supporting documentation;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Restrict Processing: You may request that grab333 restrict processing of your personal data in certain circumstances, for example while a rectification request is under review;
• Right to Object: You may object to processing based on legitimate interests, including direct marketing — objection to marketing will be actioned immediately;
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact the grab333 support team via 24/7 live chat or by email at [email protected]. Requests will be acknowledged within 3 business days and fulfilled within 30 days, subject to verification of your identity.

10.1 Consent-Based Marketing. grab333 sends promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. Consent is obtained at registration and may be given or withdrawn at any time through Account Settings or by contacting support.

10.2 Opting Out. You may unsubscribe from marketing communications at any time by: (a) updating your communication preferences in Account Settings; (b) clicking the unsubscribe link in any marketing email; or (c) contacting 24/7 live chat support. Opt-out requests are processed within 5 business days. Transactional communications (such as withdrawal confirmations and security alerts) are not affected by marketing opt-out.

10.3 No Third-Party Marketing. grab333 does not share personal data with third parties for their own marketing purposes, and does not engage in cross-platform behavioural advertising.

The grab333 Platform is strictly for persons who are 21 years of age or older. grab333 does not knowingly collect or process personal data from persons under 21 years of age. If grab333 becomes aware that personal data has been collected from a person under 21 without appropriate consent, we will delete that data promptly and close the associated account. If you believe that a minor has registered on the Platform, please contact our 24/7 support team immediately.

grab333 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or gaming licence requirements. Material changes will be communicated to registered players via email and by a prominent notice on the Platform at least 14 days prior to the effective date. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the Platform following any update constitutes acceptance of the revised Policy.

For any questions regarding this Privacy Policy, to exercise your data rights, or to raise a data protection concern, please contact the grab333 data team through the following channels:

• Live Chat: 24/7 live chat support accessible directly from the grab333 platform — fastest response channel, typically under 2 minutes;
• Email: [email protected] — include "Privacy Request" in the subject line for prioritised routing.

grab333 will respond to data queries within 3 business days of receipt and will fulfil subject access requests within 30 days, subject to identity verification. If you are not satisfied with our response to a data concern, you may escalate the matter to the relevant data protection supervisory authority in Malaysia.