topup33 Privacy Policy for Malaysian Adult Players

1 Introduction and Scope

This Privacy Policy describes how topup33 collects, uses, discloses, retains and protects personal data in connection with the operation of the topup33 website and associated services. References to "topup33", "we", "us" or "our" mean the operating entity responsible for the topup33 service. References to "you", "your" or "user" mean any individual who accesses or interacts with topup33.

This policy covers personal data provided directly, collected automatically during use or received from third-party service providers in connection with account administration, payment processing, fraud prevention or legal compliance. It applies regardless of whether the user accesses topup33 from Kuala Lumpur, Penang, Johor Bahru, Shah Alam, Petaling Jaya or any other location.

This policy should be read together with the topup33 Terms & Conditions. Where a specific product rule or consent notice addresses a particular data use in greater detail, that specific notice supplements this general policy to the extent of any difference.

2 Definitions

Personal Data

Any information relating to an identified or identifiable individual. In the topup33 context this includes registration details, contact information, identity documents, payment records, gaming activity and device identifiers that can, alone or in combination, identify a specific user.

Processing

Any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction, whether by automated or manual means.

Data Controller

The topup33 operating entity that determines the purposes and means of processing personal data collected through the topup33 website and related services.

Third-Party Processor

An organisation that processes personal data on behalf of topup33 under a written arrangement, such as a payment gateway, identity verification provider, hosting company or analytics platform.

Consent

A freely given, specific, informed and unambiguous indication of a user's agreement to the processing of personal data for a stated purpose. Consent may be withdrawn at any time where it forms the sole legal basis for a processing activity, though withdrawal does not affect the lawfulness of processing carried out before that withdrawal.

3 Personal Data We Collect

Registration and Identity Information

When a user creates a topup33 account we may collect full legal name, date of birth, residential address, email address, mobile number, username and password hash. Date of birth and identity verification are required because topup33 is restricted to users aged 21 and above.

Identity Verification Documents

Where required for KYC compliance or payment verification, topup33 may request a copy of a government-issued identity document, proof of address or bank statement. These are processed in line with the retention and security provisions of this policy.

Payment and Transaction Data

topup33 may receive transaction references, payment method identifiers, MYR amounts, timestamps and processing status from payment channels such as Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay and supported card schemes. Full card numbers are handled directly by the payment provider and are not stored by topup33 in unmasked form.

Gaming and Betting Activity

Records of game sessions, wager amounts in MYR, outcomes, bonuses claimed, responsible-gaming limit settings, self-exclusion choices and account preference changes may be retained to operate the service, resolve disputes, detect abuse, honour responsible-play commitments and meet legal obligations.

Device and Technical Data

topup33 may automatically collect IP address, browser type, operating system, device identifiers, referring URL, session duration and pages visited. This information supports security monitoring, fraud detection, service performance and analytics.

Communications

Where a user contacts topup33 support by email or chat, records of those communications may be retained to resolve the query, improve service quality, train staff and satisfy any applicable legal preservation requirement.

4 Legal Bases for Processing

topup33 processes personal data under one or more of the following legal bases depending on the specific activity:

• Contractual necessity: processing required to create and manage an account, execute MYR deposits and withdrawals, resolve disputes and provide the services described in the Terms & Conditions.
• Legal obligation: processing required to comply with identity verification, anti-money-laundering, fraud prevention, tax reporting or other obligations imposed by applicable law or a competent authority.
• Legitimate interests: processing necessary for fraud detection, network security, product analytics, service improvement and responsible-gambling monitoring, where those interests are not overridden by user rights and expectations.
• Consent: processing for specific optional communications or uses described at the point of collection. Consent may be withdrawn without affecting prior lawful processing.

5 How We Use Personal Data

topup33 uses collected personal data for the following purposes:

• Creating, administering and securing user accounts;
• Verifying age eligibility and compliance with the 21+ requirement;
• Processing MYR deposits and withdrawals through supported payment channels;
• Settling casino game results, sports-market outcomes and bonus calculations;
• Responding to support queries, complaints and dispute investigations;
• Detecting and preventing fraud, collusion, money laundering and security threats;
• Operating, testing and improving topup33 features and infrastructure;
• Managing responsible-gaming limits, cooling-off periods and self-exclusion requests;
• Sending essential service, security and account communications; and
• Meeting applicable legal, regulatory and record-keeping obligations.

6 Disclosure to Third Parties

topup33 does not sell personal data. We may share personal data only in the following circumstances:

Service Providers and Processors

Third-party processors acting under written agreements may handle data on topup33's behalf for hosting, payment processing, identity verification, fraud detection, analytics and customer support. These providers are contractually required to protect data and use it only for the stated purpose.

Payment Partners

Transaction details are shared with the relevant Malaysian payment provider, such as a bank operating Maybank2u or CIMB Clicks, a DuitNow or FPX participant bank, or an e-wallet operator, to the extent necessary to complete or verify the transaction.

Legal and Regulatory Disclosure

topup33 may disclose personal data to a competent court, regulator, law enforcement authority or government body where required by a valid legal process, binding order or applicable law. Where permitted, topup33 will inform the affected user before disclosure.

Business Transfers

In the event of a merger, acquisition, reorganisation or asset sale, personal data may form part of the transferred assets. Users will be notified in advance where practicable, and any successor entity will remain bound by commitments made in this policy unless revised notice is provided.

7 International Data Transfers

topup33 may use infrastructure, processors or support resources located outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, topup33 applies appropriate safeguards, which may include standard contractual clauses or other recognised transfer mechanisms recognised under applicable law.

Users who have questions about international transfer arrangements may submit an enquiry through the support contact details at the end of this policy.

8 Data Retention

topup33 retains personal data for as long as necessary to fulfil the purpose for which it was collected, to satisfy a legal or regulatory obligation, or to resolve a potential dispute. Indicative retention periods include:

• Account and identity records: for the duration of the account relationship and a defined period thereafter to address residual legal and compliance needs;
• Transaction and gaming records: for a period appropriate to anti-money-laundering rules, dispute resolution and tax obligations applicable to the service;
• Support communications: for a reasonable period to allow follow-up and quality review; and
• Device and session logs: for a shorter operational period to support fraud investigation and security monitoring.

When a retention period expires, topup33 deletes or anonymises the relevant data. Where deletion is temporarily constrained by an ongoing investigation or legal hold, access is restricted until deletion can proceed.

9 Cookies and Tracking Technologies

topup33 may use cookies, pixel tags or similar technologies to support session management, security, analytics and, where applicable, optional personalisation. Types of cookies that may be present include:

• Strictly necessary cookies: required for secure login, session continuity and basic site function. These cannot be disabled without affecting core access.
• Analytics cookies: used to understand how pages are navigated and where technical issues may occur. Data is typically aggregated or pseudonymised.
• Preference cookies: used to remember optional display or communication settings chosen by the user.

Where applicable law requires consent for non-essential cookies, topup33 will seek that consent at the appropriate point. Most browser settings allow cookies to be disabled or deleted, though this may affect certain site functions.

10 User Rights

Subject to applicable law, users may exercise the following rights in relation to personal data held by topup33:

• Right of access: request confirmation of whether topup33 holds personal data about you and, if so, obtain a copy;
• Right to rectification: request correction of inaccurate or incomplete personal data;
• Right to erasure: request deletion of personal data where retention is no longer necessary, consent has been withdrawn and no other legal basis applies, or processing is unlawful;
• Right to restriction: request that processing be temporarily limited while an accuracy dispute or objection is assessed;
• Right to data portability: where processing is based on consent or contractual necessity and is carried out by automated means, request a structured and machine-readable copy of data you have provided; and
• Right to object: object to processing based on legitimate interests, including profiling, where your particular circumstances justify that objection.

Requests may be submitted to topup33 support using the email address shown below. We may need to verify your identity before processing a request. Complex requests may require additional time. We will acknowledge receipt and explain any applicable limitations or legal exemptions.

11 Account Security and Your Responsibilities

topup33 implements technical safeguards to protect personal data. However, users are also responsible for maintaining the security of their own accounts. You must keep your password confidential, avoid sharing credentials or verification codes, sign out on shared devices and contact topup33 support promptly if you suspect unauthorised access.

Personal data submitted through the topup33 website travels over an encrypted HTTPS connection. Unencrypted email channels should not be used to transmit sensitive documents. Support may request that certain documents be submitted through a specified secure upload process.

12 Children and Age Eligibility

topup33 is strictly for adults aged 21 and above. topup33 does not knowingly collect personal data from individuals below the minimum age. If we determine that personal data has been collected from an ineligible person, that data will be deleted and the associated account will be closed.

Where age or identity cannot be verified to a reasonable standard, topup33 may withhold account access, restrict deposit activity or suspend features until adequate verification is provided.

13 Changes to This Privacy Policy

topup33 may update this Privacy Policy to reflect changes in the service, processing activities, applicable law or best practice. Material changes will be published on this page with an updated effective date. Where required by law or where the change significantly affects user rights, we will seek fresh consent or provide additional advance notice.

Continued use of topup33 after a revision takes effect constitutes acceptance of the updated policy to the extent permitted by applicable law. Users who do not accept a material revision should stop using the service and may request account closure.

14 Responsible Gambling and Privacy

Personal data related to responsible-gaming choices — including deposit limits, session reminders, cooling-off periods and self-exclusion status — is handled with particular care. This information is used to honour the user's own safety decisions and must not be circumvented by opening another account or requesting that a protective measure be removed during an active exclusion window.

For further information about responsible-gaming controls available at topup33, visit the dedicated Responsible Gambling page. Use of these controls does not reduce the importance of maintaining accurate account information or complying with any identity verification request.

15 Contact Us

To exercise a data right, raise a privacy concern or ask a question about this Privacy Policy, please contact the topup33 support team. The email address is provided as plain text in accordance with site security policy and must not be wrapped as a clickable link.