grab33 Privacy Policy

1. Who We Are

grab33 (referred to in this Privacy Policy as "grab33", "we", "us" or "our") is the operator of the online sportsbook and casino platform accessible at grab33.win (the "Platform"). grab33 is the data controller responsible for personal data collected through the Platform.

If you have any questions about this Privacy Policy or the way your personal data is handled by grab33, please contact our Data Protection team using the contact details set out in Section 14 of this Policy.

2. Categories of Personal Data We Collect

In the course of operating the Platform and providing our Services to Members located in Malaysia and other jurisdictions, grab33 may collect the following categories of personal data:

• Identity Data: Full legal name, date of birth, gender, nationality, copy of government-issued identity document (MyKad, passport or equivalent), and any other information provided during the Know Your Customer (KYC) verification process.
• Contact Data: Malaysian mobile phone number, email address, and residential address (including postcode, city and state).
• Account Data: Username, account registration date, account status, account settings, self-imposed limits, and responsible gaming tool elections.
• Financial Data: Payment method details (including bank account details, Touch 'n Go eWallet identifiers, Boost account identifiers, and card details where applicable), transaction history, deposit amounts, withdrawal amounts, and running account balance.
• Transaction Data: Details of all bets placed, games played, wagering amounts, winnings, losses, bonus usage, and promotion participation history.
• Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, time zone, language settings, and other technical information transmitted by your device when connecting to the Platform.
• Usage Data: Pages visited, time spent on Platform pages, features accessed, search queries, click patterns, session duration, and other behavioural data collected during Platform sessions.
• Communications Data: Records of all communications between you and grab33, including customer support conversations, complaint records, and any other correspondence.

grab33 does not intentionally collect special category personal data (such as health data, biometric data, religious beliefs, or political opinions) except where expressly required for responsible gaming assessments or regulatory compliance, and only with your explicit consent where required by law.

3. How We Collect Your Data

grab33 collects personal data through the following means:

• Direct collection: Data you provide when registering an Account, completing KYC verification, making a deposit, placing a bet, participating in a promotion, or contacting customer support.
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access and interact with the Platform. See Section 9 for our Cookies Policy.
• Third-party sources: Identity verification data from KYC/AML service providers; fraud and risk data from fraud prevention agencies; payment data from payment processors including banks, Touch 'n Go eWallet, and Boost; and publicly available information from sanctions screening databases.

4. Purposes for Which We Process Your Data

grab33 processes your personal data for the following purposes:

• Account management: To register and maintain your grab33 Account, verify your identity, authenticate your logins, and manage your account settings and preferences.
• Service delivery: To provide access to the Sportsbook, Slots, grab33 Casino and other Platform features, process bets and game rounds, settle winnings, and credit your Account balance.
• Financial processing: To process deposits and withdrawals via Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, Visa/Mastercard and other supported Malaysian payment methods, and to maintain accurate financial records.
• Legal and regulatory compliance: To fulfil Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, comply with tax reporting requirements, respond to regulatory inquiries, and meet obligations imposed by our international gaming authority licensing conditions.
• Fraud prevention and security: To detect, investigate and prevent fraudulent activity, multi-account abuse, bonus abuse, money laundering, underage gambling and other prohibited conduct described in the grab33 Terms & Conditions.
• Responsible gaming: To monitor gambling patterns for indicators of problem gambling, administer responsible gaming tools (deposit limits, loss limits, self-exclusion), and discharge our duty of care obligations under our licensing framework.
• Customer support: To respond to your queries, complaints and support requests, and to improve our customer service processes.
• Marketing communications: Subject to your marketing preferences, to send you information about grab33 promotions, new products and special offers relevant to Malaysian members. You may opt out of marketing communications at any time via your Account Settings.
• Platform improvement: To analyse Platform usage, conduct A/B testing, measure feature performance, and improve the overall user experience for Malaysian bettors.

5. Legal Basis for Processing

Where applicable data protection law requires grab33 to identify a legal basis for processing personal data, we rely on the following:

• Performance of contract: Processing that is necessary to register and maintain your Account, deliver the Services you have contracted for, and process financial transactions.
• Legal obligation: Processing required to comply with KYC/AML obligations, regulatory reporting requirements, licensing conditions, tax law, and any directive from a competent authority.
• Legitimate interests: Processing for fraud prevention, security, responsible gaming monitoring, platform improvement, and analytics, where such processing does not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications, where required by law. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Sharing Your Personal Data

grab33 does not sell your personal data to any third party. We may share your data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC/AML service providers: Third-party identity verification and anti-money laundering screening services used to fulfil our regulatory obligations.
• Payment processors: Banks, e-wallet operators (Touch 'n Go, Boost) and card network processors necessary to process your financial transactions.
• Game suppliers: Licensed game providers (such as Pragmatic Play, PG Soft, Evolution Gaming) who supply casino and slot content through the Platform and who may process transaction-level data as necessary to deliver game outcomes.
• IT and infrastructure providers: Cloud hosting, content delivery, cybersecurity and technical support providers who process data on our behalf under strict data processing agreements.
• Regulatory authorities: Our international gaming authority licensing body, tax authorities, and law enforcement agencies, where disclosure is required by law or regulatory obligation.
• Fraud prevention agencies: Organisations that maintain shared databases of confirmed or suspected fraudulent activity, multi-accounting abuse and self-excluded individuals.

All third-party processors engaged by grab33 are contractually required to process personal data only for the specified purposes, maintain appropriate security standards, and comply with applicable data protection laws.

7. International Data Transfers

The operation of an international online gaming platform may necessitate the transfer of personal data to servers or service providers located outside Malaysia. Where such transfers occur, grab33 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Malaysian and international data protection law. These safeguards may include standard contractual clauses, adequacy decisions or equivalent legally recognised transfer mechanisms.

8. Data Retention

grab33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. In practice, this means:

• Account and transaction data is retained for a minimum of seven (7) years from the date of account closure, in compliance with AML record-keeping obligations.
• KYC documentation is retained for a minimum of five (5) years from the completion of a transaction or the end of the business relationship, whichever is later.
• Customer support communications are retained for three (3) years from the date of the relevant communication.
• Marketing preference records are retained for the duration of your Account plus two (2) years after closure, to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Cookies & Tracking Technologies

The grab33 Platform uses cookies and similar tracking technologies to provide a functional and personalised user experience. The categories of cookies used include:

• Strictly necessary cookies: Required for the Platform to function — session management, login authentication, security tokens, and load balancing. These cannot be disabled without impairing core Platform functionality.
• Performance cookies: Collect anonymised data on how Members navigate the Platform to help us identify and fix usability issues and improve page performance for Malaysian users.
• Functionality cookies: Remember your preferences such as language settings, display options and responsible gaming tool configurations.
• Analytics cookies: Track aggregate usage patterns to help grab33 understand which features are most valued by members in Kuala Lumpur, Penang, Johor Bahru and other regions of Malaysia.

You may manage your cookie preferences through your browser settings. Disabling cookies other than strictly necessary ones may limit certain Platform features. grab33 does not use advertising or cross-site tracking cookies.

10. Security Measures

grab33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss or destruction:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive data at rest, including financial data and identity documents.
• Two-factor authentication (2FA) available and encouraged for all Member accounts.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Comprehensive incident response procedures, including Member notification procedures where required by law.

While grab33 takes all reasonable precautions to protect your data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying grab33 immediately if you suspect any unauthorised access to your Account.

11. Your Data Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by grab33:

• Right of access: To request a copy of the personal data grab33 holds about you.
• Right to rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure: To request deletion of your personal data, subject to our legal retention obligations (particularly those arising from AML and licensing requirements).
• Right to restriction: To request that we restrict processing of your data in certain circumstances, such as while a rectification request is under review.
• Right to data portability: To receive a machine-readable copy of the personal data you have provided to grab33, where processing is based on consent or contract.
• Right to object: To object to processing based on our legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact grab33 using the details in Section 14. We will respond to all verified requests within 30 days. We may require identity verification before processing a data rights request.

12. Children and Minors

The grab33 Platform is strictly for adults aged 21 years and over. grab33 does not knowingly collect personal data from individuals under the age of 21. If we become aware that an Account has been registered by a person under 21, or that personal data of a person under 21 has been collected, the Account will be immediately closed and the data deleted, subject to any legal retention obligations.

If you believe that personal data of a minor has been collected through the Platform, please contact us immediately at the address in Section 14.

13. Amendments to This Policy

grab33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing requirements. Material changes will be communicated to Members via email to the registered address or by prominent notice on the Platform at least 14 days before taking effect, except where immediate amendment is required for security or regulatory reasons.

The current version of the Privacy Policy is always available at grab33.win/privacy-policy. The effective date at the top of this document indicates when the current version took effect.

14. Contact Us

For all privacy-related queries, data rights requests, or complaints regarding grab33's handling of your personal data, please contact our Data Protection team:

If you are not satisfied with grab33's response to a privacy complaint, you may escalate the matter to the supervisory authority or data protection regulator in your jurisdiction.