Privacy Policy

1. Introduction

grap333 ("grap333", "we", "us", "our") operates the online gaming platform accessible at grap333.org (the "Platform"), which is primarily targeted at English-speaking players in Malaysia. grap333 is committed to protecting the privacy and security of all personal data processed in connection with the Platform and the services it offers, including sports betting, live casino, slots, poker, bingo, and lottery.

This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by grap333. Please read this Policy carefully to understand our practices regarding your personal data and how we will treat it.

By accessing or using the grap333 Platform, registering an account, or otherwise engaging with our services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described herein, you should not use the Platform.

2. Data Controller

For the purposes of applicable data protection legislation, grap333 acts as the data controller in respect of personal data collected and processed via the Platform. This means grap333 determines the purposes and means of processing your personal data.

grap333 operates under an international gaming licence issued by a recognised regulatory authority. Our data processing activities are conducted in accordance with the data protection requirements of our licensing jurisdiction and, where applicable, the Personal Data Protection Act 2010 (PDPA) of Malaysia insofar as it applies to our processing activities involving Malaysian data subjects.

3. Personal Data We Collect

grap333 collects the following categories of personal data in connection with the operation of the Platform:

3.1 Registration and Identity Data

• Full legal name;
• Date of birth (for age verification — all players must be 21 or older);
• Email address;
• Mobile phone number (Malaysian number);
• Username and hashed password;
• Residential address.

3.2 Identity Verification (KYC) Data

• Government-issued identification documents (e.g., MyKad, passport);
• Proof of address documents;
• Selfie or live verification images where required;
• Payment method ownership documentation.

3.3 Financial Data

• Deposit and withdrawal transaction records in MYR;
• Payment method identifiers (masked card numbers, e-wallet references, bank account numbers);
• Wallet balance history;
• Bonus and promotional credit records.

3.4 Gaming and Behavioural Data

• Game session history, bet amounts, game outcomes;
• Time and duration of Platform access;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status);
• Customer support interaction records.

3.5 Technical and Device Data

• IP address;
• Device type, operating system, and browser;
• Cookies and session identifiers;
• Geolocation data (country/region level, not precise location).

4. How We Collect Your Data

grap333 collects personal data through the following means:

• Direct provision — information you provide when registering, completing KYC, making a deposit or withdrawal, or contacting support;
• Automated technical collection — data collected automatically when you access the Platform, including IP addresses, cookies, and session logs;
• Third-party verification providers — identity and age verification data returned by licensed KYC and anti-fraud service providers;
• Payment processors — transaction confirmation and reference data from payment service providers including e-wallet operators and banking intermediaries.

5. Legal Basis for Processing

6. How We Use Your Personal Data

grap333 uses the personal data we collect for the following purposes:

• To create, manage, and maintain your grap333 Account;
• To verify your identity and age in compliance with our licensing obligations;
• To process MYR deposits and withdrawals and maintain accurate financial records;
• To operate, maintain, and improve the grap333 Platform and its games and services;
• To detect, prevent, and investigate fraud, money laundering, and other prohibited conduct;
• To administer responsible gaming controls, including monitoring for problem gambling indicators;
• To provide customer support and respond to enquiries;
• To send transactional communications (account notifications, security alerts, withdrawal confirmations);
• To send promotional communications where you have opted in to receive them;
• To comply with applicable laws, regulatory requirements, and directions from competent authorities;
• To enforce our Terms & Conditions and other applicable policies.

grap333 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by our fraud detection and responsible gaming systems, in which case you may request human review of any such decision by contacting grap333 support.

7. Data Sharing and Disclosure

grap333 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your personal data with the following categories of recipients in the circumstances described below:

• Identity verification and KYC providers — third-party providers engaged by grap333 to perform age and identity checks. These providers process data under contract and are bound by confidentiality obligations;
• Payment processors and e-wallet operators — including Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and online banking intermediaries, to facilitate deposits and withdrawals;
• Game content providers — licensed game studios and aggregators who supply games to the grap333 Platform may receive session-level data necessary to operate those games;
• Regulatory and licensing authorities — grap333 is required to disclose certain information to its licensing authority and, where legally required, to law enforcement or government agencies;
• Professional advisors — legal, accounting, or audit professionals engaged by grap333, subject to professional confidentiality obligations;
• Fraud prevention and anti-money laundering bodies — industry fraud databases and financial intelligence networks where grap333 has a reporting obligation.

Any third party with whom grap333 shares personal data is required to process that data only for the specified purpose and in accordance with appropriate data protection safeguards.

8. Cookies and Tracking Technologies

The grap333 Platform uses cookies and similar tracking technologies to operate certain Platform functions, analyse usage, and enhance the user experience. The following categories of cookies are used:

• Strictly necessary cookies — required for the Platform to function. These include session authentication cookies and security tokens. These cannot be disabled without preventing Platform use;
• Functional cookies — used to remember your preferences, such as language settings and responsible gaming configurations;
• Analytics cookies — used to collect aggregated, anonymised information about how users interact with the Platform, enabling grap333 to improve the service.

grap333 does not use third-party advertising or tracking cookies. You may manage cookie preferences through your browser settings. Disabling certain cookies may affect your ability to use some features of the grap333 Platform.

9. Data Retention

grap333 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by our licensing and regulatory obligations:

• Account and KYC records — retained for a minimum of five (5) years from the date of account closure;
• Financial transaction records — retained for a minimum of five (5) years from the date of each transaction;
• Gaming history records — retained for a minimum of three (3) years from the date of each session;
• Customer support records — retained for a minimum of two (2) years from the date of each interaction;
• Marketing preference records — retained until you withdraw consent or close your account.

Where retention is required beyond these periods due to ongoing legal proceedings, regulatory investigation, or dispute resolution, grap333 will retain the relevant data until such matter is concluded.

10. Data Security

grap333 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the grap333 Platform;
• Encryption of sensitive data at rest, including payment information and KYC documents;
• Access controls restricting personal data access to authorised grap333 personnel on a need-to-know basis;
• Regular security assessments and penetration testing by independent security professionals;
• Intrusion detection and anomaly monitoring on all Platform infrastructure.

While grap333 employs robust security measures, no system is entirely immune to the risk of a security breach. In the event of a data breach that poses a risk to your rights and freedoms, grap333 will notify you and the relevant supervisory authority in accordance with applicable legal requirements.

11. Your Data Protection Rights

Subject to applicable law and our obligations as a licensed gaming operator, you have the following rights in relation to your personal data held by grap333:

To exercise any of these rights, please contact grap333 support via live chat or by emailing [email protected]. grap333 will respond to verified requests within 30 calendar days. We may need to verify your identity before processing a data subject request.

12. Third-Party Services and Links

The grap333 Platform may contain links to or embed services operated by third parties, including game content providers and payment processors. This Privacy Policy applies only to data processed by grap333 directly. grap333 is not responsible for the privacy practices of third-party services, and you should review the privacy policies of those parties separately.

Where grap333 engages third-party processors to handle personal data on our behalf, we do so under written data processing agreements that impose appropriate data protection obligations on those processors.

13. Children and Age Restrictions

The grap333 Platform is strictly for individuals aged 21 and above. grap333 does not knowingly collect personal data from persons under the age of 21. If we become aware that we have inadvertently collected data from an underage individual, we will delete that data promptly and close the associated account.

If you have reason to believe that a person under the age of 21 has provided personal data to grap333, please notify us immediately via the support contact details in Section 15.

14. Changes to This Privacy Policy

grap333 reserves the right to update or amend this Privacy Policy at any time. Revised versions will be posted on this page with an updated "Last updated" date. Where changes are material, grap333 will notify registered Members by email to their registered address or via a notice displayed upon next login to the Platform.

Your continued use of the grap333 Platform following the posting of any amendment constitutes your acknowledgement of the revised Policy. We encourage you to review this Policy periodically.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or grap333's handling of your personal data, please contact us:

• Email: [email protected] (displayed as plain text — not a clickable link)
• Live Chat: Available 24/7 via the widget on the grap333 Platform

grap333 will acknowledge data protection enquiries within five (5) business days and endeavour to provide a substantive response within 30 calendar days. For complex requests, we will notify you if a longer period is required.