Privacy Policy

This Privacy Policy ("Policy") describes how padu33 ("we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "User") who access or use the padu33 online casino and sports betting platform at padu33.cam, including all associated services, customer support channels, and marketing communications.

padu33 is committed to handling your personal data responsibly, transparently, and in compliance with applicable data protection laws, including our obligations under the licensing framework governing our operations. This Policy applies to all registered users of the padu33 platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

By creating an account with padu33 or by continuing to use the platform after this Policy has been made available to you, you acknowledge that you have read, understood, and consent to the collection and use of your personal data as described herein. If you do not agree with this Policy, you should discontinue use of the platform and contact us to request account closure.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, IP address, and behavioural data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means padu33, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party that processes personal data on behalf of padu33 under a contractual agreement, including payment processors, KYC verification providers, and IT service providers.
• "KYC" means Know Your Customer — the regulatory process by which padu33 verifies the identity and age of registered users to comply with anti-money laundering (AML) and responsible gambling obligations.
• "Cookies" means small text files placed on your device by the padu33 platform to facilitate session management, analytics, and personalisation features.
• "Sensitive Personal Data" means special categories of personal data attracting heightened protection under applicable law, including government-issued identification numbers (such as Malaysian IC/MyKad numbers).

padu33 collects only the personal data that is necessary and proportionate to the purpose for which it is collected. The categories of personal data we collect are set out in the table below.

padu33 collects your personal data through the following channels and methods:

4.1 Direct Collection

Information you provide directly when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or submit a formal complaint. This includes information entered into registration forms, support chat windows, and identity document uploads.

4.2 Automated Technical Collection

Technical and behavioural data is collected automatically when you access the padu33 platform through cookies, web beacons, and server log files. This data is collected whether or not you are logged in to your account, and includes your IP address, browser fingerprint, and session activity data.

4.3 Third-Party Sources

We may receive certain personal data from authorised third-party sources, including:

• KYC and identity verification service providers who cross-reference the documents you submit against authoritative data sources;
• Payment processors and financial institutions (including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX) who provide transaction confirmation data;
• Fraud prevention and AML screening services that flag accounts against sanctions lists or known fraud indicators;
• Marketing attribution partners who identify how you first found the padu33 platform (e.g., through an affiliate referral link).

padu33 processes your personal data for the following specific and legitimate purposes:

• Account Management: Creating, operating, and maintaining your padu33 account, including authentication, account settings, and profile management.
• Transaction Processing: Processing deposits and withdrawals via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, and cryptocurrency).
• Identity Verification (KYC): Verifying your identity and age in compliance with our licensing authority's requirements and applicable anti-money laundering regulations.
• Regulatory Compliance: Complying with our obligations under our international gaming licence, including AML/CFT programme requirements, sanctions screening, and responsible gambling obligations.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, collusion, bonus abuse, and account security breaches.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance.
• Responsible Gambling: Monitoring gaming behaviour to identify indicators of problem gambling and to administer deposit limits, self-exclusion requests, and responsible gambling tools at the User's request.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game offerings, and user experience.
• Marketing Communications: Sending you relevant promotions, bonus offers, and platform updates by email, where you have consented to receive such communications. You may opt out at any time.

padu33 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform our obligations to you under the Terms and Conditions you accepted on registration — including account management, payment processing, and game access.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering legislation, gaming licence conditions, and KYC requirements.
• Legitimate Interests: Processing undertaken to pursue our legitimate business interests — including fraud prevention, platform security, and statistical analysis — where these interests are not overridden by your data protection rights.
• Consent: Processing based on your explicit, freely given consent — in particular, the sending of direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

padu33 does not sell, rent, or otherwise transfer your personal data to third parties for their own marketing or commercial use. We share your data only in the limited circumstances described below, and only to the extent necessary for the specified purpose.

7.1 Essential Service Providers

We engage trusted third-party service providers who process personal data on our behalf as Data Processors, under binding confidentiality and data processing agreements. These include:

• Payment processing partners and financial institutions facilitating MYR transactions (including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay);
• KYC and identity verification providers;
• AML screening and fraud prevention services;
• Cloud infrastructure and hosting providers;
• Customer support platform providers;
• Email delivery service providers (for transactional and marketing communications).

7.2 Regulatory and Legal Disclosure

We may disclose your personal data to competent regulatory authorities, law enforcement agencies, or courts of law where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of padu33, our users, or the public.

7.3 Business Transfers

In the event that padu33 undergoes a merger, acquisition, reorganisation, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being in place.

padu33 operates as an internationally licensed platform. As a result, certain personal data processing activities may involve the transfer of your data to servers or service providers located outside Malaysia. In all such cases, padu33 takes appropriate safeguards to ensure that your personal data receives an adequate level of protection equivalent to that provided within Malaysia, including:

• Entering into data processing agreements with overseas processors that include standard contractual clauses for the protection of personal data;
• Ensuring that cross-border transfers are made only to jurisdictions with adequate data protection frameworks, or where specific contractual safeguards are in place;
• Conducting periodic reviews of the data protection practices of overseas processors to ensure ongoing compliance.

Where required by applicable law, padu33 will seek your consent prior to transferring your personal data outside Malaysia.

padu33 retains your personal data for only as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing authority's record-keeping obligations.

9.1 Active Accounts

While your padu33 account remains active, we retain all personal data associated with your account in order to operate your account, process transactions, and comply with our ongoing regulatory obligations.

9.2 Closed Accounts

Following the closure or termination of your account, padu33 retains your personal data for the period required under our gaming licence conditions and applicable financial regulations. This retention period is typically a minimum of five (5) years from the date of account closure, to satisfy AML record-keeping, audit, and dispute resolution requirements.

9.3 KYC Documents

Identity verification documents (Malaysian IC, passport copies, selfies) are retained for the minimum period required under our AML programme and licensing obligations, and are securely deleted thereafter.

9.4 Marketing Data

Where you have consented to receive marketing communications, we retain your contact details for marketing purposes until you withdraw your consent. Upon opt-out, your contact details are removed from our active marketing lists within 10 business days.

As a padu33 account holder, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request — [Your Right]".

• Right of Access: You have the right to request a copy of the personal data padu33 holds about you, together with information about how that data is being processed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by padu33 be corrected without undue delay.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that padu33 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request that we provide your personal data to you in a structured, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

The padu33 platform uses cookies and similar tracking technologies to facilitate core platform functionality, remember your preferences, analyse platform usage, and support our fraud prevention programme. This section explains the types of cookies we use and how you can manage them.

11.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for platform operation, including login session management, security tokens, and payment gateway interactions. These cookies cannot be disabled without impacting your ability to use the platform.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gambling tool configurations across sessions.
• Analytics Cookies: Collect aggregated, anonymised data on how users navigate the platform, which pages are visited most frequently, and where users experience errors. This data is used to improve platform performance.
• Security & Fraud Prevention Cookies: Used by our fraud detection systems to identify suspicious patterns of behaviour, including the use of multiple accounts or automated scripts.

11.2 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the padu33 platform — in particular, strictly necessary cookies cannot be disabled without preventing you from logging in. Most modern browsers (including Chrome, Firefox, Safari, and Edge on Android and iOS devices commonly used by Malaysian players) provide cookie management options in their privacy or security settings menu.

padu33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the padu33 servers;
• Encryption at rest for stored sensitive data, including KYC document files and financial records;
• Access controls and role-based permissions limiting staff access to personal data on a strict need-to-know basis;
• Two-factor authentication (2FA) available for all player accounts to prevent unauthorised login;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• 24/7 security monitoring by our internal compliance and technical security team;
• Incident response procedures enabling rapid containment and notification in the event of a data security incident.

While padu33 takes all reasonable precautions to protect your data, no transmission over the internet or electronic storage system is completely secure. We encourage all users to use strong, unique passwords and to enable 2FA on their accounts.

The padu33 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we discover that personal data has been collected from a person under 21, we will immediately suspend the associated account and take all reasonable steps to delete the data from our records.

padu33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our licensing obligations. The most current version of this Policy will always be accessible on this page, with the effective date updated at the top of the document.

Where changes to this Policy are material — meaning they materially affect your rights or how we use your data — we will notify registered users by sending an email to the address associated with your account at least seven (7) days before the changes take effect. Your continued use of the padu33 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way padu33 processes your personal data, please contact our Data Protection team using the details below. All privacy-related communications are handled in English, Bahasa Melayu, and Mandarin Chinese.

• Data Protection Email: [email protected] — use subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: 24/7 via the padu33 platform — reference "Privacy Policy" when initiating the conversation
• Response Time: Data rights requests acknowledged within 3 business days; substantive response within 30 calendar days
• Escalations: If you are unsatisfied with our response to a privacy concern, you may escalate the matter to the relevant regulatory authority in your jurisdiction

padu33 treats all privacy-related requests with the utmost seriousness and discretion. We are committed to ensuring that your personal data rights are respected and that any concerns are addressed promptly and transparently. For responsible gambling-related privacy matters — including data associated with self-exclusion records — please visit our Responsible Gambling page.