Privacy Policy

1. Introduction

Arsenal33 ("Arsenal33", "we", "us", or "our") operates the online casino and sports betting platform accessible at https://arsenal33.cam. As a platform that collects and processes personal data in the course of providing gambling entertainment services to players across Malaysia — including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations — Arsenal33 takes its responsibilities as a data controller seriously.

This Privacy Policy ("Policy") sets out the basis on which personal data collected from you — or provided by you — will be processed by Arsenal33. Please read this Policy carefully to understand our practices regarding your personal data and how we will treat it.

By registering an account on Arsenal33 or by continuing to use the platform after this Policy has been made available to you, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, to the extent that consent is the applicable legal basis for any such processing.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject") — including but not limited to name, email address, phone number, date of birth, identification document number, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, Arsenal33 is the data controller with respect to all personal data collected from platform users.
• "Data Processor" means a third party that processes personal data on behalf of the data controller in accordance with the controller's instructions.
• "KYC" means Know Your Customer — the identity and document verification process conducted by Arsenal33 in compliance with applicable anti-money-laundering (AML) obligations.
• "Player" / "You" means any registered user of the Arsenal33 platform.
• "Third Party" means any natural or legal person other than the Player and Arsenal33.

3. Personal Data We Collect

Arsenal33 collects the following categories of personal data:

3.1 Registration Data

At the point of account registration, Arsenal33 collects: your chosen username, email address, mobile phone number, date of birth, and preferred currency (MYR). This data is mandatory — without it, an account cannot be created or maintained.

3.2 Identity Verification (KYC) Data

As part of our KYC obligations, we collect: a copy of a valid government-issued photographic ID (Malaysian MyKad, passport, or equivalent), proof of residential address (utility bill, bank statement dated within 90 days), and where required, documentation confirming ownership of the payment method used. KYC data is collected when a player first requests a withdrawal or when triggered by risk-based checks.

3.3 Financial Transaction Data

Arsenal33 records transaction metadata for every deposit and withdrawal processed, including: transaction date and time, payment method type (e.g., Touch 'n Go eWallet, Maybank2u, DuitNow, FPX, CIMB Clicks, cryptocurrency), transaction amount in MYR, and transaction reference identifiers. Arsenal33 does not store raw payment card numbers, e-wallet access credentials, or bank account passwords.

3.4 Usage and Activity Data

Arsenal33 collects data relating to your activity on the platform including: games played and betting history, session duration and frequency, deposit and withdrawal patterns, promotional bonuses claimed, and responsible gambling tool usage. This data is used for account management, regulatory compliance, responsible gambling monitoring, and platform improvement purposes.

3.5 Technical and Device Data

When you access Arsenal33, our systems automatically collect certain technical data including: IP address, browser type and version, device type and operating system, screen resolution, referring URL, and pages visited on the platform. This data is used for security monitoring, fraud prevention, and platform analytics.

3.6 Communications Data

Where you contact Arsenal33 via live chat or email, we retain records of those communications — including your name, contact details, the content of your query, and our response — for quality assurance and dispute resolution purposes.

4. How We Collect Your Data

Arsenal33 collects personal data through the following channels:

• Directly from you — through account registration, KYC submission, deposit and withdrawal requests, responsible gambling tool settings, and communications with our support team.
• Automatically — through cookies, web beacons, and server log files when you access and use the Arsenal33 platform.
• From third-party service providers — including identity verification agencies, payment processors (such as the certified Malaysian gateways that process your DuitNow, FPX, and e-wallet transactions), and fraud prevention services that share data with us for security purposes.

5. Data Processing & Use

Arsenal33 processes your personal data for the following purposes:

Arsenal33 does not use automated decision-making processes that produce legally significant effects on players without human review. Where automated systems flag accounts for security review, a member of our compliance team reviews the case before any account action is taken.

6. Legal Basis for Processing

Arsenal33 processes personal data on the following legal grounds:

• Contractual necessity: Processing that is required to perform our contract with you — including account creation, payment processing, game provision, and customer support.
• Legal obligation: Processing required to comply with applicable laws — including KYC/AML obligations, responsible gambling regulations, and regulatory reporting requirements.
• Legitimate interests: Processing for purposes that are in Arsenal33's legitimate interests or those of our players, provided those interests are not overridden by your fundamental rights — including fraud prevention, security monitoring, and platform analytics.
• Consent: Where we rely on your consent as the legal basis for processing (for example, optional marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

7. Data Sharing & Disclosure

Arsenal33 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors and financial institutions: Certified Malaysian payment gateway operators — including those supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong, and cryptocurrency networks — receive transaction data to facilitate your deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML verification services may receive your identity documents for the purpose of verifying your identity and age as required by compliance obligations.
• Technology and infrastructure providers: Cloud hosting, security monitoring, and platform technology partners who process data on our behalf as data processors under binding contractual arrangements.
• Regulatory authorities: Arsenal33 may be required to disclose personal data to competent regulatory or law enforcement authorities where required to do so by applicable law, court order, or legal process.
• Professional advisers: Legal, financial, and audit advisers bound by professional confidentiality obligations, where disclosure is necessary for compliance, litigation, or professional services purposes.

8. Data Retention

Arsenal33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account and registration data: Retained for the lifetime of the account and for a minimum of five (5) years following permanent account closure, in accordance with AML record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications: Retained for a period of two (2) years from the date of the communication, or longer where the communication relates to a formal dispute or legal proceeding.
• Technical and device data (logs): Typically retained for ninety (90) days for security monitoring purposes, after which logs are deleted or anonymised.

At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction.

9. Data Security

Arsenal33 implements a range of technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS 1.3 encryption for all data transmitted between your browser and Arsenal33's servers.
• Encryption of personal data at rest on Arsenal33's servers.
• Access controls ensuring that only authorised personnel can access personal data, on a role-based need-to-know basis.
• Two-factor authentication available to all registered players to protect account access.
• Regular security assessments, penetration testing, and vulnerability scanning of our platform infrastructure.
• Staff training and confidentiality obligations imposed on all personnel who handle personal data.

Whilst Arsenal33 implements reasonable security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us promptly if you suspect unauthorised access to your account.

10. Cookies & Tracking Technologies

Arsenal33 uses cookies and similar tracking technologies on the platform. Cookies are small text files placed on your device by our web server when you visit the platform. They are used to enhance your user experience and to support certain platform functions.

10.1 Types of Cookies Used

• Strictly necessary cookies: Required for the platform to function — including session management, authentication, and security. These cannot be disabled.
• Functional cookies: Remember your preferences (such as language settings and responsible gambling limit configurations) to provide a personalised experience.
• Analytics cookies: Collect anonymised data about how players use the platform — including pages visited, session duration, and navigation paths — to help us identify areas for improvement.
• Security cookies: Used to detect and prevent fraud, bot activity, and other security threats by analysing traffic patterns and device fingerprinting signals.

10.2 Cookie Management

You may control the use of non-essential cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Please note that disabling certain cookies may affect the functionality of the Arsenal33 platform — in particular, strictly necessary cookies cannot be blocked without impairing the ability to log in or use core services.

11. Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by Arsenal33. All rights requests should be submitted to Arsenal33 using the contact details provided in Section 15.

12. Minors & Age Restriction

Arsenal33 is strictly an adult entertainment platform. Our services are available exclusively to persons who are 21 years of age or older. Arsenal33 does not knowingly collect, process, or store personal data relating to individuals under the age of 21.

Age verification is a mandatory component of the Arsenal33 KYC process. If Arsenal33 identifies or suspects that an account has been registered by a person under 21 years of age, it will immediately suspend the account, conduct an investigation, and — where the suspicion is confirmed — permanently close the account and return any real-money balance net of any bonus-related adjustments, in accordance with its Terms & Conditions.

If you are a parent or guardian and believe that a minor has provided personal data to Arsenal33 without your knowledge, please contact us immediately at the address in Section 15 so that we may investigate and take appropriate action.

13. Cross-Border Data Transfers

In the course of operating the Arsenal33 platform, your personal data may be transferred to, stored on, or processed by servers or service providers located outside Malaysia. Where such transfers occur, Arsenal33 takes steps to ensure that adequate safeguards are in place — including contractual data processing agreements with receiving parties that impose obligations equivalent to those under applicable data protection law.

Arsenal33's primary data processing infrastructure is hosted in secure data centres operating under internationally recognised security standards. All cross-border transfers are subject to the security and access control measures described in Section 9 of this Policy.

14. Policy Amendments

Arsenal33 reserves the right to amend or update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. The revised Policy will be published on this page at https://arsenal33.cam/privacy-policy with an updated effective date.

Where changes are material — meaning they significantly affect how we process your personal data or the rights you hold — Arsenal33 will provide prior notice on the platform for a minimum period of 14 days before the changes take effect. Your continued use of the Arsenal33 platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

15. Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a concern about how Arsenal33 processes your personal data, please contact us through the following channel:

• Email: [email protected] — for data rights requests, please use the subject line "Data Rights Request" and include your registered username.
• Live Chat: Available 24 hours a day, 7 days a week via the live chat icon on the Arsenal33 platform. For complex data rights matters, we recommend email correspondence to ensure a complete written record.
• Response commitment: We acknowledge all data rights requests within 5 business days. We aim to provide a full response within 30 days of receipt. Where a request is complex or the volume of requests is high, we may extend this period by up to an additional 30 days and will notify you accordingly.