Arai33 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by Arai33 ("we", "us", "our") and applies to all personal data collected, processed, and stored by arai33 in connection with the operation of the website located at https://arai33.cam ("Platform") and all associated gaming services, mobile applications, live chat systems, promotional communications, and customer support channels.

Arai33 is committed to safeguarding the privacy of all individuals who access our Platform, including registered players, prospective members, and visitors. We process personal data in accordance with applicable data protection legislation and international best practices for data privacy in the online gaming sector.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference and form part of the overall agreement governing your use of the arai33 Platform.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings ascribed to them below:

3. Personal Data We Collect

Arai33 collects personal data that is necessary for the provision of our gaming and sports betting services, fulfilment of regulatory obligations, maintenance of account security, and delivery of customer support. The categories of personal data we collect include:

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used for age verification — 21+ requirement)
• Residential address, including street address, city, postcode, and country
• Email address (primary communication and account recovery channel)
• Mobile phone number
• Username and encrypted password
• Preferred currency (Malaysian Ringgit — MYR)
• Language preference

3.2 KYC & Verification Data

• Scanned copies or photographs of government-issued photo identification (Malaysian MyKad, passport, or equivalent)
• Proof of residential address documents (utility bills, bank statements dated within 90 days)
• Payment method verification documents (bank account statements, eWallet screenshots, card front images)
• Selfie or facial verification images where required for enhanced due diligence

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method used (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank)
• Wallet balance history and betting activity logs
• Bonus and promotional credit records
• Tokenised payment method identifiers (we do not store full payment card numbers)

3.4 Technical & Device Data

• IP address and geolocation data (country and region level)
• Device type, operating system, and browser information
• Session identifiers, login timestamps, and access logs
• Cookie and tracking technology data (see Section 11)

3.5 Communications Data

• Records of customer support interactions conducted via live chat, email, or WhatsApp
• Feedback and survey responses
• Any voluntary disclosures made during responsible gambling self-assessment processes

4. How We Collect Your Data

Arai33 collects personal data through the following channels and mechanisms:

• Directly from you: When you register an account, complete KYC verification, make deposits or withdrawals, contact our support team, participate in promotions, or submit any information through the Platform.
• Automatically: Through cookies, tracking pixels, server logs, and similar technologies when you access and interact with the Platform. This includes page visits, click events, session duration, and device fingerprinting for fraud prevention purposes.
• From payment service providers: Transaction confirmation data from Malaysian payment processors including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, and GrabPay.
• From identity verification services: Confirmation data from third-party KYC verification providers where arai33 uses automated identity verification tools.
• From fraud prevention services: Risk scores and flagging data from third-party fraud detection and anti-money laundering screening services.

5. Data Processing & Use

Arai33 processes your personal data for the following purposes:

6. Legal Basis for Processing

Arai33 processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which we rely are as follows:

• Contractual necessity: Processing necessary for the performance of the contract between you and arai33, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering obligations, age verification requirements, and regulatory reporting duties.
• Legitimate interests: Processing carried out in pursuit of arai33's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided that such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, informed, and specific consent — primarily in relation to marketing and promotional communications. You may withdraw consent at any time by contacting our support team or updating your account communication preferences.

7. Data Sharing & Disclosure

Arai33 does not sell, rent, or trade your personal data. We disclose personal data to third parties only in the following limited and defined circumstances:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers to assist in operating our Platform, including payment processing companies (DuitNow, FPX, and Malaysian banking partners), identity verification providers, cloud hosting and data storage providers, customer support software vendors, and fraud prevention and AML screening services. These providers are permitted to process your data only as instructed by arai33 and are bound by data processing agreements that impose obligations equivalent to those under this Policy.

7.2 Regulatory and Legal Authorities

Arai33 may disclose personal data to regulatory bodies, law enforcement agencies, courts, or other public authorities where required to do so by applicable law, court order, regulatory directive, or where we have a good-faith belief that such disclosure is necessary to protect the rights, property, or safety of arai33, its players, or the public.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of arai33's business, personal data held by arai33 may be transferred to the acquiring entity. In such circumstances, you will be notified in advance of any such transfer and the privacy protections applying to your data.

7.4 With Your Consent

We may share your personal data with third parties in additional circumstances where you have provided your explicit prior consent to such sharing.

8. International Data Transfers

Arai33 operates internationally and may transfer your personal data to countries outside Malaysia for the purposes of service delivery, technical infrastructure, and regulatory compliance. Where personal data is transferred to countries that do not provide an equivalent level of data protection to that available under Malaysian law, arai33 will implement appropriate safeguards to ensure that your data remains protected to the standards set out in this Policy.

Such safeguards may include contractual clauses binding the recipient to data protection obligations equivalent to those applicable in Malaysia, technical security measures, and access controls limiting the use of transferred data to specified purposes.

9. Data Retention

Arai33 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, to meet legal and regulatory obligations, or to resolve disputes and enforce our agreements. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your account and for a minimum of five (5) years following account closure, to comply with anti-money laundering, regulatory reporting, and audit requirements.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, whichever is later, in accordance with applicable regulatory requirements.
• Financial and transaction records: Retained for a minimum of seven (7) years from the date of the transaction for accounting, tax, and regulatory compliance purposes.
• Customer support communications: Retained for a period of three (3) years from the date of the interaction, or longer if the communication relates to an ongoing dispute or investigation.
• Marketing consent records: Retained for the duration of your consent and for three (3) years thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with arai33's data disposal procedures.

10. Your Rights as a Data Subject

Subject to applicable law and certain limitations, you have the following rights with respect to your personal data held by arai33. To exercise any of these rights, please contact our support team in writing with sufficient detail to identify your request.

11. Cookies & Tracking Technologies

Arai33 uses cookies and similar tracking technologies to operate the Platform effectively, remember your preferences, prevent fraud, and improve the overall user experience. A "cookie" is a small text file stored on your device by your web browser when you visit our site.

11.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Platform. These enable core functions such as secure login session management, fraud prevention, and payment processing. These cookies cannot be disabled without impacting platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and responsible gambling limit configurations across sessions.
• Analytical Cookies: Used to collect anonymised data about how visitors interact with the Platform, helping us identify and fix usability issues and improve performance. Data collected is aggregated and does not identify individual users.
• Security Cookies: Used for device fingerprinting, bot detection, and suspicious activity identification to protect your account and our platform from fraud and unauthorised access.

11.2 Managing Cookies

Most web browsers allow you to manage cookie preferences through their settings. You can set your browser to refuse cookies, delete existing cookies, or alert you when cookies are being set. Please note that disabling strictly necessary cookies may impair your ability to log in to or use the arai33 Platform. For specific cookie management instructions, consult your browser's help documentation.

12. Children's Privacy

The arai33 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in our account registration process, and we employ additional checks during the KYC verification procedure to detect and prevent underage access.

If we become aware that personal data has been collected from an individual under the age of 21 — whether through an account registration or any other means — we will immediately suspend the relevant account, delete all associated personal data (subject to any mandatory legal retention obligations), and return any deposited funds to the originating payment method.

If you believe that a person under the age of 21 has registered an account on the arai33 Platform, please contact our support team immediately so that we can take prompt action.

13. Data Security

Arai33 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records
• Tokenisation of payment card data — full card numbers are never stored on arai33's systems
• Two-factor authentication (2FA) available for all registered accounts
• Role-based access controls limiting internal data access to authorised personnel on a need-to-know basis
• Regular penetration testing and security audits conducted by independent third-party security professionals
• Continuous monitoring of network traffic for anomalous activity, intrusion attempts, and fraud indicators
• Physical security controls at all data centre locations used by arai33's infrastructure providers

While arai33 employs industry-leading security measures, no data transmission or storage system can be guaranteed to be completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable legal requirements.

14. Amendments to This Policy

Arai33 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or business operations.

Material changes to this Policy will be communicated to registered users via their registered email address and displayed as a prominent notice on the Platform at least 14 calendar days before the revised Policy takes effect. We will also update the "Last Updated" date at the top of this page to reflect the date of the most recent revision.

Your continued use of the arai33 Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, please discontinue use of the Platform and contact our support team to request account closure.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by arai33, please contact our Data Privacy team through the following channels. We are committed to responding to all data-related enquiries within 30 calendar days of receipt.

• Live Chat: Available 24/7 within the Platform — select "Privacy & Data" as the enquiry type for routing to the appropriate team.
• Email: [email protected] — please include "Data Privacy Request" in the subject line and provide your full registered name and registered email address.
• WhatsApp: Available via contact details shown within your account dashboard.

For requests to exercise your data subject rights (access, rectification, erasure, portability, objection, or restriction), please submit your request in writing via email with sufficient detail to identify your account and the specific right you wish to exercise. We may need to verify your identity before processing the request.