Ap33my Privacy Policy – Data Protection for Malaysian Players

Introduction & Scope of Privacy Policy

This Privacy Policy is issued by ap33my and applies to all members who register for and use the ap33my platform in Malaysia. By registering an account, logging in or using any ap33my service, you agree to the terms of this Privacy Policy as set out herein.

Ap33my understands that privacy is more than a legal obligation — it is the foundation of trust between the platform and its members. Without that trust, no meaningful long-term relationship can be built. That is why ap33my invests seriously in security infrastructure and privacy practices that go beyond the minimum requirements mandated by law.

This Privacy Policy outlines the types of personal data ap33my collects, the purposes for which it is collected, how it is stored and protected, which parties may access it under limited circumstances, your rights as the data owner, and how to contact ap33my regarding privacy matters.

Personal Data We Collect

Ap33my collects members' personal data through three main channels: information you provide directly during registration and use of the platform, data generated automatically through your use of the platform, and in limited cases, information obtained from legitimate third-party sources for identity verification purposes.

Information you provide directly to ap33my:

• Full name as it appears on your official identification document.
• Date of birth for 18+ age verification purposes.
• Malaysian mobile number for OTP verification and account communications.
• Email address used for platform communications, account notices, and security purposes.
• Payment method information — including the bank account holder's name, account number (partial only) or e-wallet username for DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost and ShopeePay.
• Any identity documents requested for the KYC (Know Your Customer) verification process for accounts with high transaction limits.

Data automatically generated during your use of the ap33my platform:

• The IP address of the device used to access ap33my.
• Device information includes device type, operating system, browser version, and screen resolution.
• In-platform navigation history on ap33my — pages visited, games played, and time spent.
• A complete record of all financial transactions, including deposits, withdrawals and bets.
• Game session logs for dispute resolution and internal security auditing purposes.
• Communication records with ap33my's customer support team via live chat or email.

Purposes for Using Personal Data

Ap33my uses members' personal data solely for legitimate and transparent purposes. The following is a complete list of data usage purposes on the ap33my platform:

• Identity and age verification — to verify that all members are 18 years of age or older and that the information provided is accurate and truthful.
• Financial transaction processing — processing deposits via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, as well as processing winning withdrawals to members' Malaysian bank accounts or e-wallets.
• Account management — generating and maintaining member accounts, processing logins, managing security settings and enabling access to all platform features.
• Platform security — detecting and preventing fraud, money laundering, unauthorised access, bonus abuse, and violations of ap33my's Terms & Conditions.
• Customer support — enabling the ap33my support team to respond to enquiries, resolve technical issues, and handle disputes accurately and efficiently.
• Platform improvements — analysing usage patterns on an aggregated and anonymised basis to improve the user experience, add relevant games, and enhance the platform interface.
• Important communications — sending security notices, policy updates, transaction confirmations, and other important account information directly related to your use of the platform.
• Legal compliance — to fulfil reporting and compliance obligations that may be required by law or directive from the relevant authorities.

Ap33my does not use members' personal data for third-party advertising, distribution to other companies for marketing purposes, or any other purpose not listed above, without first obtaining your explicit consent.

How ap33my Protects Your Data

Member data security is something ap33my takes extremely seriously. The following are the technical and organisational measures we use to protect your personal data:

Technical measures:

• All data transmitted between your device and ap33my's servers is protected by TLS 1.3 — the latest and most secure version of the Transport Layer Security protocol.
• Data stored in ap33my's databases is protected with AES-256 encryption, ensuring it remains unreadable even in the event of a physical breach of the servers.
• Member payment information — including bank account details for FPX or Maybank2u, as well as e-wallet details for Touch 'n Go, GrabPay, Boost, and ShopeePay — is managed in accordance with PCI DSS (Payment Card Industry Data Security Standard).
• Member passwords are stored as one-way hashes using the bcrypt algorithm — meaning ap33my never stores passwords in plain text and cannot reveal your password to anyone, including ap33my staff.
• Intrusion detection (IDS) and intrusion prevention (IPS) systems operate around the clock to monitor incoming traffic to ap33my's servers.
• Two-factor authentication (2FA) is available and encouraged for all ap33my member accounts for added protection.

Organisational measures:

• Access to ap33my member personal data is strictly limited to staff who require it to perform their duties — in line with the "least privilege access" principle.
• All ap33my staff with access to member data are required to sign confidentiality agreements and undergo regular data security training.
• Internal and external security audits are conducted on a regular basis to identify and address any vulnerabilities in the system.
• A comprehensive incident response plan is in place to ensure swift action can be taken in the event of any data security incident.

Data Sharing With Third Parties

Ap33my does not sell, rent or share members' personal data with third parties for marketing or commercial gain. This is an unconditional, non-negotiable commitment.

However, there are limited circumstances where ap33my may need to share certain member data with specific parties in order for the platform to operate safely and properly:

• Payment processors — information required to process your deposit and withdrawal transactions is shared with the relevant payment providers, including FPX, DuitNow, Touch 'n Go eWallet, GrabPay, Boost and ShopeePay. This sharing is kept to the minimum necessary solely for the purpose of processing the relevant transactions.
• Game providers — the required information (typically only a player ID, without full name) is shared with third-party game providers operating within the ap33my platform to ensure game sessions function correctly.
• Identity verification services — in cases where KYC verification is required, certain identity documents may be shared with approved third-party identity verification service providers who are bound by strict confidentiality agreements.
• Legal authorities — ap33my may be required by law or court order to disclose certain information to the relevant authorities. In such cases, ap33my will disclose only the minimum information necessary and will endeavour to notify the member concerned where permitted by law.

All third parties with access to any portion of ap33my member data are bound by strict data processing agreements, requiring them to use that data solely for the specific permitted purposes and to implement security measures consistent with ap33my's standards.

Cookies & Tracking Technologies

Ap33my uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Cookies are small text files stored on your device when you visit the ap33my platform.

Ap33my uses three types of cookies:

• Essential cookies — required for the ap33my platform to function properly. This includes login session cookies that keep you signed in during your gaming session, and security cookies that protect against CSRF (Cross-Site Request Forgery) attacks. These cookies cannot be disabled without affecting core platform functionality.
• Performance cookies — helps ap33my understand how members use the platform, which pages are visited most frequently and where technical issues may arise. This data is collected in aggregate and is not used to identify any individual personally.
• Functional cookies — saving your preferences such as interface language, favourite game types, and display settings to deliver a more personalised experience while using ap33my.

You can manage your cookie settings through your web browser. Please note that disabling essential cookies may affect the login functionality and account security of ap33my.

Data Retention Period

Ap33my retains member personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The following are ap33my's data retention guidelines:

• Active account data — retained for as long as your account remains active on the ap33my platform.
• Data after account closure — after an account is closed at a member's request, ap33my will retain transaction records and identity information for the period required by applicable law (typically five to seven years) for compliance and audit purposes.
• Game session logs — retained for 12 months from the session date for dispute resolution purposes. After this period, session logs are automatically deleted from ap33my's systems.
• Support communication records — live chat conversation logs and emails with the ap33my support team are retained for 24 months for quality training purposes and future reference should recurring issues arise.
• Unverified data — incomplete registrations or accounts that have never been verified will be automatically deleted after 90 days.

Your Rights Regarding Personal Data

As an ap33my member, you have the following rights regarding your personal data, which ap33my is obligated to respect and uphold:

• Right to access data — you have the right to receive a copy of the personal data ap33my holds about you. This request will be processed within seven working days.
• Right to rectification — if you find that any personal information ap33my holds about you is inaccurate or out of date, you have the right to request a correction. Some corrections can be made directly through the profile settings in your ap33my account.
• Right to delete data — also known as the "right to be forgotten", you have the right to request deletion of your personal data, subject to any applicable legal retention obligations.
• Right to restrict processing — under certain circumstances, you have the right to request that ap33my restrict the processing of your personal data, for example during a period of investigation into the accuracy of that data.
• Right to data portability — you have the right to receive your personal data in a machine-readable format for transfer to another platform should you choose to do so.
• Right to object to processing — you have the right to object to the processing of your personal data for certain purposes, including its use for direct marketing.

To exercise any of the rights above, please contact ap33my's privacy team by email at support@ap33my.click with the subject line "Privacy Rights Request" and a description of your request. ap33my will acknowledge receipt within 24 hours and fulfil the request within seven business days.

Children's Privacy

The ap33my platform strictly does not accept members under the age of 18. ap33my does not knowingly collect any personal information from individuals under 18. Age verification is rigorously enforced during the registration process, and ap33my reserves the right to request proof of identification at any time.

Should ap33my discover that personal data belonging to an individual under the age of 18 has been collected inadvertently, we will take immediate steps to delete that information and close the relevant account. If you believe a minor may have registered an account on ap33my, please notify us at support@ap33my.click without delay.

Privacy Policy Amendments

Ap33my reserves the right to amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or updates to the services we offer. The "Last updated" date at the top of this page will always reflect the latest version in effect.

For material amendments — meaning changes that significantly affect how we use members' personal data — ap33my will send notice to members via their registered email address at least 14 days before the changes take effect, giving you sufficient time to review them and decide whether to continue using the platform.

Your continued use of the ap33my platform after an amended Privacy Policy takes effect will be considered acceptance of the updated terms. If you do not agree with the changes, you have the right to close your account before the amendment comes into effect.

Contact the ap33my Privacy Team

If you have any questions, concerns, or complaints regarding how ap33my handles your personal data, we strongly encourage you to reach out to us directly:

• Privacy Email: support@ap33my.click (use the subject line "Privacy Enquiry" or "Data Rights Request")
• Live Chat: Available 24/7 directly within the ap33my platform — the fastest way to get a response
• Response Time: Under 5 minutes via live chat; up to 48 working hours via email for privacy-related enquiries

The ap33my privacy team is able to communicate in both Bahasa Melayu and English. We are committed to addressing all privacy-related enquiries and complaints seriously and within a reasonable timeframe. Your satisfaction and trust in ap33my is something we do not take lightly.