Privacy Policy grap33 – Data Protection & Personal Information

1Personal Information We Collect

Grap33 collects your personal information for legitimate purposes, including identity verification, processing financial transactions, and ensuring a smooth and secure user experience. The following are the categories of information we collect:

2How We Collect Your Information

Your personal information is collected through several channels as you interact with the grap33 platform. We always ensure that this data collection process takes place transparently and with your knowledge.

• Account registration: When you fill in the registration form, basic information such as your name, email, and phone number is collected directly from you.
• KYC Verification: During the identity verification process, you will be asked to upload official documents such as a national ID or passport.
• Financial transactions: Every time you make a deposit or withdrawal, details relating to the payment method and transaction amount are automatically recorded.
• Platform usage: Technical data such as IP address, device type, and usage patterns are collected automatically via cookies and similar tracking technologies.
• Support communications: When you contact our customer support team, the contents of that conversation are stored for customer service and improvement purposes.
• Third-party sources: In certain cases, we may receive information about you from third-party identity verification providers we use for the KYC process.

Each data collection process is carried out on the basis of contractual necessity, legal obligation, or grap33's legitimate interest in operating safely and responsibly.

3Purpose of Personal Information Use

Grap33 uses collected personal information solely for legitimate, stated purposes. We will not use your data for any other purpose without informing you in advance.

• To process account registration and verify the identity of new members through a rigorous KYC process.
• To process deposits, withdrawals, and all financial transactions related to your account.
• To detect, investigate, and prevent fraudulent activity, money laundering, and any misuse of the platform.
• To provide effective customer support and resolve any complaints or disputes.
• To send important notifications relating to your account, transactions, and service terms updates.
• To personalise your experience on the platform based on your preferences and gaming patterns.
• To fulfil legal and regulatory obligations applicable to the operation of the grap33 platform.
• To conduct internal analysis to improve platform products, services, and security.

4Information Sharing & Disclosure

Grap33 deeply respects your privacy. As a matter of principle, we do not sell, rent, or transfer your personal information to any third party for commercial purposes. However, there are limited situations where data sharing may occur:

• Payment service provider: Required financial information is shared with FPX, DuitNow, Touch 'n Go eWallet, and GrabPay providers solely to process your transactions.
• Identity verification provider: Your KYC documents may be shared with approved third-party identity verification providers subject to strict confidentiality agreements.
• Legal authorities: grap33 will disclose required information to government authorities or law enforcement when required to do so by law or court order.
• Audit and compliance: Independent auditors and legitimate regulatory bodies may have limited access to data required for compliance purposes only.

All third parties who receive your data are bound by strict confidentiality agreements and are required to protect that information to the same or higher standards that we ourselves uphold.

5Security & Data Protection

Protecting your data is grap33's top priority. We continuously invest in the latest cybersecurity infrastructure to keep your personal and financial information safe from both external and internal threats.

• All data transmitted between your browser and grap33's servers is protected by 256-bit SSL/TLS encryption — the same industry standard used by leading financial institutions.
• Passwords and sensitive information are stored in a hashed format using modern cryptographic algorithms, ensuring they cannot be read even by internal staff.
• A real-time threat monitoring system operates 24/7 to detect any unauthorised access attempts or suspicious activity.
• Role-based access control (RBAC) ensures that only authorised staff can access sensitive member data, and every access is logged for audit purposes.
• Penetration testing and independent security audits are conducted regularly by third-party experts to identify and address any vulnerabilities.
• A comprehensive cybersecurity incident response procedure is in place to ensure any data breach can be detected and addressed swiftly.

6Cookies & Tracking Technologies

Grap33 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you browse our website.

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled without affecting the platform's primary functionality.
• Performance Cookies: Helps us understand how members interact with the platform so we can improve the overall user experience.
• Functional Cookies: To save your preferences such as language, display settings, and gaming preferences for a more personalised experience.
• Analytics Cookies: Used to analyse platform usage patterns in aggregate (without identifying individuals) for product improvement purposes.

You can manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of some parts of the grap33 platform. For more detailed cookie management options, visit your account settings or contact our support team.

7Your Privacy Rights as a Member

As a grap33 member, you have certain rights regarding the personal information we hold about you. grap33 fully respects these rights and will assist you in exercising them:

• Right of Access: You have the right to request a copy of all personal information we hold about you at any time.
• Right to Rectification: If any of your information is inaccurate or outdated, you have the right to request that it be corrected promptly.
• Right to Erasure: In certain circumstances, you have the right to request that your personal data be deleted from our systems ("right to be forgotten").
• Right to Restriction of Processing: You may request that we restrict how we process your data in certain situations as provided by law.
• Right to Data Portability: You have the right to receive your personal data in a machine-readable format for transfer to another service provider.
• Right to Object: You may object to the processing of your data for specific purposes, including direct marketing.

To exercise any of the above rights, contact our data protection team by email or live chat. We will process your request within 30 business days. Please note that some requests may be subject to legal obligations that prevent us from deleting or restricting certain data.

8Data Retention Period

Grap33 retains your personal information only for as long as it is needed for the purposes stated in this Privacy Policy, or as required by applicable laws and regulations.

• Active account data: Retained for as long as your account remains active on the grap33 platform.
• KYC and verification data: Retained for a minimum of 5 years after account closure to comply with anti-money laundering (AML) legal requirements.
• Financial transaction records: Retained for 7 years in accordance with Malaysia's financial legal requirements.
• Support communication logs: Retained for 2 years for reference and dispute resolution purposes.
• Technical log data: Retained for 12 months for security and fraud detection purposes.

Once the retention period has expired, your data will be securely deleted or anonymised so it can no longer be linked to your identity. The deletion process uses methods that meet recognised data security standards.

9Changes to This Privacy Policy

Grap33 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or improvements to the services we offer.

Any material changes to this Privacy Policy will be communicated to you via a notice displayed on the platform or by email to your registered address. We encourage you to review this page periodically to stay informed about how we protect your data.

The "Updated" date shown at the top of this page indicates when this Privacy Policy was last modified. Your continued use of the grap33 platform after any changes take effect constitutes your acceptance of the updated Privacy Policy.

10Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, grap33's Data Protection Officer (DPO) team is ready to assist you.

• Contact us via Live Chat available 24 hours a day, 7 days a week on the grap33 platform.
• Send your written enquiry to the email address [email protected] for privacy and data protection matters.
• For official requests relating to data rights (access, correction, deletion), please include your account details to facilitate processing.

We are committed to responding to all privacy-related enquiries within 5 business days. Formal data rights requests will be processed within a maximum of 30 business days in accordance with applicable legal requirements. Your privacy matters to us, and we will always strive to address every concern seriously and with the utmost respect.