regal33 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how regal33 ("the Platform", "we", "us", "our"), operating through the website regal33.win, collects, uses, stores, discloses, and protects the personal data of individuals ("Members", "you") who register for or use the regal33 platform and associated services.

regal33 is committed to handling personal data responsibly and transparently. This Policy is drafted with reference to the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable international data protection requirements under the Platform's licensing framework. By registering a regal33 account or using our services, you consent to the collection and processing of your personal data as described in this Policy.

This Policy should be read in conjunction with our Terms and Conditions. Capitalised terms used in this Policy that are not defined herein have the meanings given to them in the Terms and Conditions.

2. Personal Data We Collect

regal33 collects the following categories of personal data from Members and, where applicable, from visitors who browse the Platform without registering:

regal33 does not collect sensitive personal data (such as racial or ethnic origin, health data, or biometric data) unless expressly required for legal compliance purposes and with your explicit consent.

3. How We Collect Your Data

regal33 collects personal data through the following methods:

• Directly from you: When you register a regal33 account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or respond to a promotional offer.
• Automatically: When you visit regal33.win, our servers automatically log Technical Data including your IP address, device information, and browsing activity on the Platform. Cookies and similar tracking technologies may also collect this data — see Section 7 for details.
• From third parties: regal33 may receive identity verification data from our licensed KYC service provider, fraud risk scores from our anti-fraud partner, and payment confirmation data from payment processors such as Touch n Go eWallet, Boost, GrabPay, and Malaysian banking institutions (Maybank, CIMB, Hong Leong Bank, Public Bank).

4. How We Use Your Personal Data

regal33 processes personal data for the following specific purposes:

• To create, maintain, and administer your regal33 Member account;
• To verify your identity and age (21+) in compliance with our KYC and AML obligations;
• To process deposits and withdrawals through your selected Malaysian payment channels;
• To provide access to games, sportsbook markets, Toto 4D, and other Platform services;
• To apply bonus credits, manage wagering requirements, and administer promotional campaigns;
• To detect, investigate, and prevent fraud, money laundering, underage gambling, and other prohibited activities;
• To provide customer support via live chat, email, and other communication channels;
• To send transactional notifications (deposit confirmations, withdrawal approvals, security alerts);
• To send marketing communications about regal33 promotions and new features, where you have consented or where a legitimate interest applies — subject to your right to opt out;
• To comply with regulatory reporting obligations under our licensing framework;
• To improve Platform performance, personalise your game recommendations, and conduct internal analytics.

5. Legal Basis for Processing

regal33 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms and Conditions — including account administration, payment processing, and game delivery;
• Legal obligation: Processing necessary to comply with KYC, AML, and regulatory reporting requirements;
• Legitimate interests: Processing for fraud prevention, platform security, internal analytics, and responsible gambling monitoring — where regal33's interests are not overridden by your rights;
• Consent: Processing for marketing communications and non-essential cookies, where your explicit consent has been obtained and may be withdrawn at any time.

6. Disclosure to Third Parties

regal33 does not sell, rent, or trade your personal data to third parties for their independent marketing purposes. We disclose personal data only to the following categories of third-party service providers, who are contractually required to maintain appropriate data protection standards:

• KYC and identity verification providers: To verify your identity and age as required by our licensing obligations;
• Payment processors: Including Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, Hong Leong Bank, Public Bank, and USDT TRC20 processing infrastructure — to facilitate deposits and withdrawals;
• Game studios and content providers: Pragmatic Play, PG Soft, and other certified providers who require session data to deliver game content;
• Anti-fraud and security services: To assess risk, prevent account takeover, and detect AML red flags;
• Customer communication platforms: To deliver live chat, email, and SMS services;
• Regulatory authorities: Where regal33 is legally required to disclose data by applicable law, court order, or regulatory direction.

All third-party service providers operating on behalf of regal33 are bound by data processing agreements that require them to process personal data only for specified purposes and in accordance with applicable privacy law.

7. Cookies & Tracking Technologies

regal33 uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function — including session authentication, security tokens, and login state. These cannot be disabled.
• Performance cookies: Collect anonymised data on how Members navigate the Platform to help us optimise user experience and page performance.
• Functionality cookies: Remember your language preferences, display settings, and other personalisation choices between sessions.
• Marketing and analytics cookies: Used to understand traffic sources and, where consented, to deliver relevant promotional content. These are only activated with your explicit consent.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair Platform functionality including the ability to log in to your regal33 account.

8. Data Retention

regal33 retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal and regulatory obligations. The following general retention periods apply:

• Account data: Retained for the duration of your active regal33 account and for a minimum of five (5) years following account closure, as required by AML regulations;
• Financial transaction records: Retained for a minimum of seven (7) years from the date of the transaction;
• KYC documentation: Retained for a minimum of five (5) years from account closure or from the date of last transaction — whichever is later;
• Customer support communications: Retained for three (3) years from the date of the last interaction, unless a longer period is required for legal proceedings;
• Technical and usage data: Retained for thirteen (13) months from collection for analytics purposes, then anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

9. Security Measures

regal33 implements appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and regal33 servers;
• Encryption of sensitive data fields at rest within regal33's database infrastructure;
• Role-based access controls ensuring that staff access to Member data is limited to what is required for their specific job function;
• Multi-factor authentication required for administrative access to systems holding personal data;
• Regular penetration testing and security audits of the regal33 platform and backend infrastructure;
• Documented incident response procedures for data breach detection, containment, and notification.

Despite these measures, no data transmission over the internet can be guaranteed to be 100% secure. regal33 cannot be held liable for interceptions or unauthorised access that are outside our reasonable control. Members are responsible for maintaining the security of their own login credentials.

10. Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by regal33:

• Right of access: You may request a copy of the personal data regal33 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data, subject to our legal retention obligations — note that regulatory data retention requirements may prevent full deletion in some cases;
• Right to restrict processing: You may request that regal33 restrict processing of your data in certain circumstances;
• Right to data portability: Where technically feasible and legally required, you may request your data in a structured, machine-readable format;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time — this does not affect the lawfulness of processing prior to withdrawal;
• Right to opt out of marketing: You may unsubscribe from marketing communications at any time via account settings or by contacting support.

To exercise any of these rights, contact us at [email protected]. regal33 aims to respond to all data rights requests within 30 calendar days. Where a request is complex or numerous, the response period may be extended by up to a further 60 days — you will be notified if this applies.

11. Minors

regal33 strictly prohibits access by individuals under the age of 21. The Platform does not knowingly collect personal data from minors. All account registrations are subject to age and identity verification (KYC). If regal33 becomes aware that personal data has been collected from a person under 21 without parental consent or in circumvention of our age verification controls, the account will be immediately closed, all data will be securely deleted (except where retention is required for regulatory purposes), and any deposits will be handled in accordance with applicable AML procedures.

If you believe a minor has registered a regal33 account, please notify us immediately at [email protected].

12. Cross-Border Data Transfers

regal33 may transfer personal data to third-party service providers and hosting infrastructure located outside Malaysia. Where such transfers occur, regal33 ensures that appropriate safeguards are in place — including contractual data protection clauses that provide equivalent protections to those required under Malaysian law and the Platform's licensing jurisdiction data protection requirements.

By using regal33 and providing your personal data, you acknowledge that your data may be processed in jurisdictions outside Malaysia. regal33 takes reasonable steps to ensure that cross-border data recipients maintain data security standards equivalent to those described in this Policy.

13. Changes to This Privacy Policy

regal33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform services. When material changes are made, regal33 will publish the revised Policy on this page with an updated "Last Updated" date and, where appropriate, notify active Members via email or in-platform notification. Continued use of the regal33 Platform following the effective date of any revised Policy constitutes your acceptance of the changes.

We encourage Members to review this Policy periodically to remain informed about how regal33 protects your personal data.

14. Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or regal33's handling of your personal data, please contact our Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 via the in-platform support widget at regal33.win

regal33 aims to acknowledge all privacy complaints within 5 business days and to resolve them within 30 calendar days. If you are not satisfied with regal33's response to your privacy complaint, you may have the right to lodge a complaint with the relevant supervisory authority under your jurisdiction, including the Department of Personal Data Protection (JPDP) in Malaysia.