grab33 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how grab33 ("grab33", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "your", "User", "Player") who access or use the grab33 platform at https://grab33.cam and any associated services, applications, or features (collectively, the "Platform").

grab33 is committed to handling your personal data responsibly and in accordance with applicable data protection principles, including but not limited to the principles of data minimisation, purpose limitation, storage limitation, accuracy, integrity, and confidentiality. We take this commitment seriously across all operations — from the moment you register an account to the moment you withdraw your winnings.

By accessing or using the grab33 Platform, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. If you do not agree to the terms set out herein, please discontinue use of the Platform immediately.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the grab33 Platform.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" means any operation or set of operations performed upon personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, and erasure.
• "Data Controller" means grab33, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third-party service provider that processes personal data on behalf of grab33 in accordance with grab33's instructions and this Policy.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, personalisation, and security.
• "KYC" (Know Your Customer) means the mandatory identity and document verification process required by grab33 to confirm a User's identity, age, and other eligibility criteria.
• "Sensitive Personal Data" means personal data revealing financial account details, government identification numbers (e.g., Malaysian NRIC), biometric data, or other categories of data that warrant heightened protection.

3 Personal Data We Collect

grab33 collects personal data that is necessary to provide the Platform's services, maintain security, and fulfil legal obligations. The categories of personal data we collect include:

4 How We Collect Your Data

grab33 collects personal data through the following means:

4.1 Direct Collection

You provide data directly to grab33 when you: register for an account; complete the KYC verification process by submitting identity documents; make deposits or withdrawal requests; contact our customer support team via live chat or email; participate in promotions or surveys; or update your account preferences and settings.

4.2 Automated Collection

As you use the Platform, we automatically collect technical and behavioural data via cookies, web beacons, server logs, and similar technologies. This includes your IP address, browser configuration, device identifiers, pages visited, session duration, and interaction patterns with games and features.

4.3 Third-Party Sources

In certain circumstances, grab33 may receive personal data from third parties, including: payment processors (e.g., FPX, DuitNow network providers, e-wallet operators such as Touch 'n Go and Boost) for transaction verification; identity verification service providers used in our KYC process; fraud prevention and anti-money laundering screening services; and analytics service providers operating under appropriate data processing agreements with grab33.

5 Data Processing & Use

grab33 uses your personal data for the following specific and legitimate purposes:

• Account Management: To create, maintain, and operate your grab33 account, including processing deposits and withdrawals in Malaysian Ringgit (MYR), managing your Balance, and recording your gaming history.
• Identity & Age Verification: To verify your identity and confirm that you meet the minimum age requirement of 21 years before allowing full account access. This is a mandatory legal obligation under our licensing terms.
• Payment Processing: To process your financial transactions via your chosen payment method, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and supported cryptocurrencies.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, identity fraud, and other financial crimes or platform abuse.
• Legal & Regulatory Compliance: To fulfil our obligations under applicable laws, including anti-money laundering (AML) regulations, licensing conditions, and any lawful requests from competent authorities.
• Customer Support: To respond to your queries, resolve disputes, and deliver effective support via live chat and email through our 24/7 support team.
• Responsible Gambling: To monitor gaming behaviour for indicators of problem gambling and to enforce deposit limits, self-exclusion requests, and other responsible gambling tools you have activated on your account.
• Platform Improvement: To analyse aggregated usage data for the purpose of improving the Platform's features, performance, and overall user experience.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus notifications, and other marketing communications relevant to your account and interests. You may withdraw consent at any time by updating your communication preferences in your account settings.

6 Legal Basis for Processing

grab33 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and grab33 — including operating your account, processing transactions, and delivering the Platform's services.
• Legal Obligation: Processing required to comply with applicable legal obligations, including KYC/AML regulations, age verification requirements, and lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out for grab33's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on consent — such as receiving marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

grab33 does not sell your personal data to third parties. We may share your data only in the following limited circumstances:

7.1 Payment Service Providers

To process your financial transactions, grab33 shares necessary financial data with payment partners including FPX network operators, DuitNow, e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), and cryptocurrency processing partners. These providers operate under data processing agreements and are contractually prohibited from using your data for any purpose other than facilitating your transaction.

7.2 Identity Verification Providers

To complete KYC verification, grab33 may share identity documents and personal details with accredited third-party identity verification services. These providers are bound by strict confidentiality obligations.

7.3 Fraud Prevention & Compliance

grab33 may share data with fraud prevention bureaus, AML screening services, and competent regulatory or law enforcement authorities where required by law or where we have reasonable grounds to believe disclosure is necessary to prevent fraud, money laundering, or other serious misconduct.

7.4 Platform Operators & Technology Partners

Certain technical functions of the Platform — including game delivery, cloud hosting, and analytics — are provided by third-party technology partners. These partners act as Data Processors and may access personal data solely to fulfil their contracted services on behalf of grab33.

8 Cookies & Tracking Technologies

grab33 uses cookies and similar tracking technologies to operate and improve the Platform. The following types of cookies are in use:

• Strictly Necessary Cookies: Essential for basic Platform functionality, including maintaining your login session, storing your language preferences, and enabling secure navigation. These cannot be disabled without affecting Platform performance.
• Performance & Analytics Cookies: Used to collect anonymised data about how Users interact with the Platform — pages visited, session duration, error occurrences — to help us improve performance and user experience.
• Functionality Cookies: Allow the Platform to remember your preferences and personalise your experience, such as your preferred game categories or notification settings.
• Security Cookies: Used to detect and prevent fraudulent access attempts, identify unusual session behaviour, and protect your account from unauthorised access.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. grab33 does not use cookies to serve third-party advertising or to track your browsing activity beyond the grab33 Platform.

9 Data Retention

grab33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any overriding legal retention obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your account's existence and for a period of five (5) years following account closure, to satisfy AML and regulatory record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission, in accordance with international AML and licensing standards.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction to comply with financial record-keeping obligations.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, for dispute resolution and service quality purposes.
• Marketing Consent Data: Retained until consent is withdrawn, or for three (3) years from the date of last meaningful engagement, whichever is sooner.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with grab33's data lifecycle management procedures.

10 Data Security

grab33 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard SSL/TLS protocols.
• Data Encryption at Rest: Sensitive personal data stored on our servers — including KYC documents and financial data — is encrypted at rest.
• Access Controls: Access to personal data within grab33 is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for system access.
• Security Monitoring: Our systems are continuously monitored for security anomalies, intrusion attempts, and suspicious activity.
• Payment Security: Financial transactions processed via Touch 'n Go eWallet, DuitNow, FPX, and other payment methods are handled through PCI-DSS-compliant payment infrastructure.
• Incident Response: In the event of a data security incident, grab33 maintains documented incident response procedures and will notify affected Users and relevant authorities as required by applicable law.

11 Your Rights

Subject to applicable data protection law, you hold the following rights with respect to your personal data held by grab33. You may exercise any of these rights by contacting our support team as described in Section 15:

grab33 will respond to all verified data subject requests within a reasonable timeframe. Some requests may be subject to identity verification before processing. Where a request is declined or partially fulfilled, we will provide a clear written explanation of the basis for that decision.

12 Children & Minors

The grab33 Platform is strictly intended for individuals aged 21 years and above. grab33 does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21.

Where grab33 identifies or receives credible notification that personal data belonging to a person under 21 has been submitted to the Platform, we will take immediate steps to: close the relevant account; delete all associated personal data in accordance with our data lifecycle procedures; and return any funds held in the account in accordance with our terms.

If you are a parent or guardian and have reason to believe a minor has created an account on the Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

13 Third-Party Links & Services

The grab33 Platform may contain references to third-party payment services and technology providers in the course of delivering our services. These third parties operate under their own privacy policies and data processing practices, over which grab33 has no control.

Where you interact with third-party services in connection with your use of grab33 — such as authorising a payment through your Maybank, CIMB, or Touch 'n Go eWallet account — any personal data exchanged directly with those providers is subject to their own terms and privacy policies. We encourage you to review the privacy practices of any third-party service provider you engage with.

grab33 is not responsible for the privacy practices, data security, or content of any third-party services accessed in connection with your use of the Platform.

14 Amendments to This Policy

grab33 reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform operations. Where material changes are made, we will notify you by posting a prominent notice on the Platform or by sending an email to your registered address, where practicable.

The revised Policy will display the updated "Last Updated" date at the top of this page. Your continued use of the grab33 Platform following publication of an amended Policy constitutes your acceptance of the revised terms. We therefore encourage you to review this Policy periodically.

If you have any objections to material changes in this Policy, you should discontinue use of the Platform and may request closure of your account by contacting our support team.

15 Contact Us

If you wish to exercise any of your data subject rights, have a question about this Privacy Policy, wish to lodge a complaint regarding our data handling practices, or need to report a potential data security issue, please contact grab33 through the following channel:

• Email: [email protected] — Please mark your subject line "Privacy Request" or "Data Protection" so that our team can route your query to the appropriate person. We aim to respond to all privacy-related queries within 5 business days.
• Live Chat: Available 24/7 through the chat function on the grab33 Platform. Live chat is suitable for general privacy queries but formal data subject access requests should be submitted via email for proper documentation.

All data subject requests will be subject to identity verification to ensure we are disclosing or modifying data only to the rightful account holder. We will not process requests submitted by third parties without appropriate authorisation from the relevant account holder.

This Privacy Policy was last updated on 1 January 2026 and supersedes all prior versions. grab33 is committed to maintaining the highest standards of data privacy for all Players on our platform.