ab33 Privacy Policy

1. Scope and Application

This Privacy Policy applies to all personal data collected and processed by ab33 in connection with your use of the ab33 platform, including the website at ab33.one, any associated subdomains, and all products and services made available thereon, including live casino, sports betting, slots, Lucky Bingo, and virtual sports.

This policy applies to all registered Members of ab33 and to unregistered visitors who access the Platform. It should be read in conjunction with the ab33 Terms & Conditions. In the event of any conflict between this Privacy Policy and the Terms & Conditions with respect to data privacy matters, this Privacy Policy prevails.

2. Data Controller

ab33 acts as the data controller with respect to the personal data of its Members and Platform visitors. As data controller, ab33 determines the purposes for which personal data is processed and the means by which that processing is carried out. ab33 operates under an international gaming authority licence, which imposes ongoing obligations with respect to the handling of Member personal data, including identity verification, anti-money laundering (AML) compliance, and responsible gaming monitoring.

3. Categories of Personal Data Collected

ab33 collects the following categories of personal data:

3.1 Identity Data

• Full legal name as it appears on official identification
• Date of birth (for age verification — all Members must be 21 or older)
• Government-issued identification number (e.g. Malaysian Identity Card (MyKad) number)
• Copies of identity documents submitted for KYC verification
• Nationality and country of residence

3.2 Contact Data

• Email address
• Mobile phone number
• Residential address (for KYC and address verification purposes)

3.3 Financial Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment methods used
• Payment method identifiers (e.g. registered e-wallet account, bank account details where provided for withdrawal)
• Wallet balance history
• Bonus and promotional credit records

3.4 Gaming Activity Data

• Bet history, game rounds, and wagering patterns across all Platform sections
• Game session timestamps, duration, and frequency
• Responsible gaming settings and limit history
• Self-exclusion or cooling-off period records

3.5 Technical and Usage Data

• IP address and approximate geolocation derived therefrom
• Device type, browser type and version, operating system
• Login timestamps, session duration, and pages visited
• Referral source data (where applicable)

3.6 Communication Data

• Records of live chat, email, and other support communications
• Dispute and complaint records
• Marketing communication preferences

4. How We Collect Your Data

ab33 collects personal data through the following means:

• Direct collection: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, or update your account settings.
• Automated collection: Technical and usage data collected automatically through server logs, cookies, and session tracking technologies when you access the Platform.
• Third-party sources: Identity and fraud verification data received from KYC service providers, payment processors, and, where required by our licensing obligations, anti-money laundering databases.

5. Purposes and Legal Basis for Processing

ab33 processes your personal data for the following purposes and on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services to you as a registered Member, including account management, game access, deposit and withdrawal processing, and bonus administration.
• Legal obligation: Processing required to comply with our obligations under our international gaming authority licence, including KYC verification, age verification (21+ requirement), AML screening, responsible gaming monitoring, and regulatory reporting.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, IT systems administration, and internal analytics to improve the Platform. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests.
• Consent: Where you have given explicit consent, for example, for receiving marketing communications from ab33. You may withdraw consent for marketing communications at any time by updating your account communication preferences.

6. Disclosure of Personal Data

ab33 does not sell your personal data to third parties. We may disclose your personal data to the following categories of recipients:

• Payment processors and e-wallet providers: Touch n Go eWallet, Boost, GrabPay, and banking institutions as necessary to process deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to perform document verification, identity checks, and AML screening as required by our licence obligations.
• Game content providers: Where required for the operation of specific games (e.g. Pragmatic Play, PG Soft, Habanero), limited technical and game-round data may be shared with the relevant provider for game resolution and dispute purposes.
• Regulatory authorities: Our international gaming authority licensing regulator and, where legally required, Malaysian governmental or law enforcement authorities pursuant to a valid legal request.
• IT and hosting service providers: Third parties who provide server hosting, platform infrastructure, and technical support services under data processing agreements that impose confidentiality and security obligations on those providers.

All third parties who receive your personal data are required to handle it in accordance with applicable data protection standards and are prohibited from using it for purposes other than those for which it was disclosed.

7. International Data Transfers

ab33 operates internationally and your personal data may be stored or processed on servers located outside of Malaysia. Where personal data is transferred outside Malaysia, ab33 ensures that appropriate safeguards are in place, including contractual protections equivalent to applicable data protection standards. By using the Platform, you acknowledge and consent to such transfers where necessary for the delivery of the Platform's services.

8. Data Retention

ab33 retains your personal data for as long as is necessary for the purposes for which it was collected, subject to the following retention principles:

• Active account data: Retained for the duration of your membership with ab33.
• Transaction and gaming records: Retained for a minimum of five (5) years from the date of the transaction or gaming activity, as required by our licensing authority for audit and compliance purposes.
• KYC documents: Retained for a minimum of five (5) years from account closure or the date of last transaction, whichever is later, in accordance with AML compliance obligations.
• Self-exclusion records: Retained indefinitely where a permanent self-exclusion has been applied, to prevent re-registration.
• Support communications: Retained for a minimum of two (2) years from the date of the communication.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

9. Security Measures

ab33 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform.
• Encryption at rest for sensitive personal data including identity documents and financial records.
• Access controls restricting access to personal data to authorised personnel on a need-to-know basis.
• New-device verification for account login to prevent unauthorised account access.
• Regular security assessments and penetration testing of the Platform infrastructure.
• Incident response procedures for detecting, assessing, and responding to personal data breaches.

Notwithstanding the above, no security system is impenetrable. ab33 cannot guarantee the absolute security of your personal data and is not liable for security breaches that result from factors outside its reasonable control. You are responsible for maintaining the security of your account credentials.

10. Cookies and Tracking Technologies

ab33 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the operation of the Platform, including session management, authentication, and security. These cannot be disabled without affecting Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and responsible gaming limit displays.
• Analytics cookies: Used to collect aggregated, anonymised data about how Members use the Platform to help us improve the user experience. No personally identifiable data is shared with analytics providers.

You may configure your browser to refuse non-essential cookies. Disabling essential cookies will affect your ability to use the Platform. ab33 does not use third-party advertising or behavioural targeting cookies.

11. Your Data Rights

Subject to applicable data protection law and the limitations imposed by our licensing obligations, you have the following rights with respect to your personal data held by ab33:

• Right of access: You may request confirmation of whether ab33 holds personal data about you and, if so, a copy of that data.
• Right to rectification: You may request correction of inaccurate or incomplete personal data held about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our retention obligations under applicable law and licensing requirements.
• Right to restriction: You may request that ab33 restrict the processing of your personal data in certain circumstances, for example while a dispute is being investigated.
• Right to data portability: Where processing is based on your consent or contract performance and carried out by automated means, you may request a copy of your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact ab33 via live chat or by emailing [email protected]. ab33 will respond to data rights requests within 30 days. We may require identity verification before processing a data rights request.

12. Third-Party Services

The ab33 Platform may contain links to third-party services or integrate with third-party game providers. This Privacy Policy does not apply to third-party websites or services. ab33 is not responsible for the privacy practices of third-party providers. You should review the privacy policies of any third-party services you access in connection with your use of the Platform.

13. Changes to This Policy

ab33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or platform functionality. Where material changes are made, ab33 will notify Members via the contact details held on their account or via a notice published on the Platform. The effective date of the current version of this Privacy Policy is stated at the top of this page. Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the updated terms.

14. Contact and Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ab33, please contact us:

• Email: [email protected] (plain text — not a link)
• Live Chat: Available 24 hours a day, 7 days a week, accessible from within your logged-in Account

If you are not satisfied with ab33's response to a privacy complaint, you may refer the matter to the dispute resolution body of ab33's licensing authority or to the relevant data protection authority in your jurisdiction.