Grab333 Privacy Policy — Our Commitment Data Protection Every Malaysian Member

Grab333 collects your personal data through three main channels: (1) information you provide directly during registration and use of the platform, (2) data generated automatically through your platform activity, and (3) information we receive from legitimate third-party service providers such as your Malaysian e-wallet payment provider.

Information you provide directly:

• Registration details: full name, Malaysian phone number, email address, and the password you create (stored in encrypted, unreadable form).
• Identity verification (KYC) information: a copy of your identity card (MyKad), passport, or other identity documents requested for anti-money laundering compliance purposes.
• Payment method details: the account holder name of your e-wallet (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay) or Malaysian bank account (Maybank, CIMB, Public Bank) registered for deposits and withdrawals.
• Feedback and communications: customer support conversation records, complaints, and any written correspondence between you and the Grab333 team.

Automatically generated data:

• Log and technical data: IP address, device type, operating system, browser type, and login/logout times on the Grab333 platform.
• Gaming activity data: betting records, game results, and deposit and withdrawal transaction history in MYR (RM).
• Cookie and session data: information collected through platform cookies for session security purposes and to improve user experience.

Grab333 uses your personal data only for the purposes stated below. Each use has a clear legal basis under Malaysia's PDPA 2010 — whether based on your consent, contractual necessity, legal obligation, or Grab333's legitimate interests that do not override your privacy rights.

Grab333 does not sell, rent, or share your personal data with any third party for their own marketing or commercial purposes. However, certain categories of third parties may receive a portion of your data within a strictly limited scope and for legitimate purposes only:

• Payment Service Providers: Payment gateway providers handling your Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and other Malaysian e-wallet transactions receive the data necessary to process your deposits and withdrawals. This sharing is required to fulfil the service agreement between you and Grab333.
• Third-Party Game Providers: Game content providers such as PG Soft, Pragmatic Play, and other partners receive only the minimum data required to operate games and verify betting transactions. All such providers are bound by strict data confidentiality agreements with Grab333.
• Malaysian Regulatory Authorities: Grab333 is required by Malaysian law to disclose certain information to the relevant government agencies upon lawful request — including the Malaysian Communications and Multimedia Commission (MCMC), the police, or financial crime prevention bodies.
• Identity Verification Services: Third-party KYC (Know Your Customer) service providers that assist Grab333 in verifying member identities and meeting AML requirements. They receive only the data necessary for verification purposes.
• Legal Counsel & Audit: Legal firms or external auditors appointed by Grab333 may have access to certain data within the scope of their engagement, subject to professional confidentiality obligations.

Grab333 continuously invests in the latest security technologies and procedures to protect your personal data. Data security is not an add-on feature at Grab333 — it has been a core part of our platform's design since day one.

• Encryption in Transit: All communications between your device and Grab333's servers are secured with TLS 1.3 protocol using 256-bit encryption. This covers all web pages, financial transactions, and customer support communications.
• Storage Encryption: Sensitive data stored on Grab333's servers — including passwords (stored in an irreversible hash format) and KYC documents — is encrypted using AES-256 standard.
• Internal Access Controls: Only Grab333 staff who require access to specific data in order to perform their authorised duties are permitted to access it, based on a strict need-to-know principle. All internal access is logged and monitored.
• 24/7 Monitoring: Grab333's automated threat-detection system monitors platform activity around the clock for unauthorised access, phishing attempts, or suspicious activity patterns. Our cybersecurity team can respond within minutes of a threat being detected.
• Regular Security Audits: Grab333 conducts penetration testing and security audits by independent cybersecurity firms at least twice a year to identify and patch any vulnerabilities before they can be exploited.
• Disaster Recovery Procedures: Grab333 data is regularly backed up to geographically separate data centres. Comprehensive disaster recovery procedures ensure your data remains intact even in the event of a serious technical failure.

Grab333 follows a "data minimisation" principle — we do not retain your personal data longer than necessary for the purpose it was collected, or as required under applicable Malaysian law. Once the retention period expires, data is securely disposed of using methods that ensure it cannot be recovered by any party.

• Active account data is retained for the duration of your Grab333 membership, plus the minimum period required by law after account closure.
• Financial transaction records (deposits, withdrawals in MYR, and betting records) are retained for 7 years following the date of each transaction, in accordance with Malaysia's Anti-Money Laundering and Anti-Terrorism Financing Act.
• KYC documents (MyKad copy, passport) are retained for 7 years after account closure or the end of the business relationship, in compliance with Malaysia's AML legal requirements.
• Technical log data and session data are deleted within 90 days unless required for an ongoing security investigation.
• Customer support communication records are retained for 3 years for quality control purposes and to facilitate the resolution of any disputes that may arise at a later date.

Under Malaysia's Personal Data Protection Act (PDPA) 2010 and Grab333's own policies, you have the following rights regarding the personal data held by our platform. Grab333 is committed to making it straightforward and hassle-free for you to exercise these rights.

Grab333 uses cookies and similar tracking technologies to enhance user experience, maintain session security, and understand how members interact with our platform. The following are the types of cookies used by Grab333:

You can manage or block cookies through your web browser settings (Chrome, Firefox, Safari) or your mobile application settings. Please note that blocking essential (session) cookies may affect the functionality of the Grab333 platform and the security of your account.

The Grab333 platform is exclusively for adults aged 21 and above. We do not knowingly collect or process personal data from individuals under the age of 21. This is an absolute commitment by Grab333 that cannot be compromised under any circumstances.

• The Grab333 registration process requires strict age verification. Any application indicating the applicant is under 21 years of age will be automatically rejected by the system without exception.
• If Grab333 discovers that personal data belonging to an individual under 21 has been collected unintentionally (for example, through a registration using false information), that data will be deleted immediately upon detection.
• Parents or guardians who believe their child may have registered a Grab333 account without authorisation are encouraged to contact our support team immediately by email at support@grab333.click. Grab333 will investigate and take appropriate action within 24 hours.

In the course of its operations, Grab333 may transfer or permit the processing of some of your data outside Malaysia — for example, when using international cloud infrastructure or working with global service providers operating across multiple countries. All such data transfers are managed with strict safeguards.

• Grab333 only transfers data to countries or entities that maintain a level of data protection equivalent to or exceeding the standards of Malaysia's PDPA 2010.
• All international data transfers are protected by Data Processing Agreements that legally bind recipients to the security and privacy standards set by Grab333.
• Sensitive financial information such as your MYR transaction records is prioritised for storage within infrastructure operating in the Asia-Pacific region to minimise latency and maximise protection under regional legal frameworks closer to Malaysia.

Grab333 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, applicable Malaysian legal requirements, or evolving platform operational needs. We are committed to providing adequate notice for any material changes.

• For any material changes that affect how we collect, use, or share your personal data, Grab333 will provide at least 14 days' notice before the changes take effect, via in-platform notifications and/or email to your registered address.
• For minor changes such as language improvements, typographical corrections, or clarifications that do not alter the meaning of any provision, changes may take effect immediately upon updating the date at the top of the document.
• Continued use of the Grab333 platform after the effective date of any changes constitutes your acceptance of the amended Privacy Policy. If you do not agree with any changes, you have the right to close your account and request deletion of any data eligible for erasure.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Grab333 handles your personal data, please reach out to us through any of the official channels below. Our team will endeavour to respond within 3 business days for general inquiries and within 24 hours for urgent complaints.

• Live Chat within the Grab333 platform — available 24 hours a day, 7 days a week. Ideal for general privacy inquiries and data access requests.
• Official email: support@grab333.click — suitable for written requests requiring documentation or proof, and for privacy complaints that require a more thorough investigation.
• All data rights requests (access, correction, deletion) must be accompanied by sufficient identity verification before Grab333 can process them, to ensure the security of your account.