Privacy Policy grap33 — Data Protection & Your Information Security

1 Introduction and Scope of This Policy

Welcome to the grap33 Privacy Policy page. This document is written with the intention of giving you full clarity on how our platform manages the personal information you share with us. We understand that privacy is a fundamental right of every individual, and we do not take this responsibility lightly.

This Privacy Policy applies to all users who register, browse, or use any grap33 service — whether through the official website at grap33.com or the grap33 mobile app. By using our platform, you agree that the collection and use of your information will be carried out as described in this document.

2 Types of Information We Collect

Grap33 only collects information that is genuinely necessary to provide you with a safe, responsible, and high-quality service. The information we collect can be grouped into several main categories:

We do not collect sensitive information such as medical records, religious beliefs, or political views unless required by law. You may choose not to provide certain information, but this may limit your access to some platform features.

3 How We Use Your Information

Every piece of information we collect has a clear and legitimate purpose. grap33 does not use your data for purposes unrelated to platform operations. The following are the primary purposes for which your information is used:

• Identity Verification (KYC): Verifying that you are at least 18 years of age and meet the eligibility requirements to use the grap33 platform.
• Account Management: Creating and managing your account, processing deposits and withdrawals, and updating account information.
• Platform Security: Detecting and preventing fraud, money laundering, unauthorized access, and suspicious activity.
• Customer Support: Providing technical assistance and support services whenever you contact us through any communication channel.
• Service Communications: Sending important account-related notifications, policy updates, promotions you have opted into, and security alerts.
• Legal Compliance: Fulfilling reporting obligations and compliance requirements with the relevant regulatory authorities.
• Platform Enhancement: Analyzing usage patterns in aggregate (anonymized) form to improve the performance and user experience of the grap33 platform.
• Responsible Gaming: Monitoring gameplay patterns to identify players who may need support and early intervention.

4 Information Sharing and Disclosure

Grap33 takes a highly cautious approach to sharing your personal information. As a general rule, we do not share your information with external parties except in the following permitted situations:

• Trusted Service Providers: We work with payment providers, licensed gaming platforms, and technology service providers required for platform operations. All such parties are bound by strict confidentiality agreements and are only permitted to access the information necessary for their specific services.
• Legal Requirements: When required by a court, law enforcement authority, or regulatory body with lawful jurisdiction, grap33 will disclose the necessary information in accordance with legal requirements.
• Fraud Prevention: In situations where there is a serious risk of fraud, money laundering, or security threats, we may share information with relevant authorities for protective purposes.
• Your Consent: In other cases not mentioned above, we will obtain your explicit consent before sharing any of your personal information.

5 Data Retention Period

Grap33 retains your personal information only for as long as necessary to fulfil the purposes stated in this policy or as required by applicable law. The following are general guidelines for our data retention periods:

• Active Account Information: Throughout the period your account is active on the grap33 platform.
• Financial Transaction Records: Minimum 7 years from the transaction date, in accordance with Malaysia's financial and taxation legal requirements.
• KYC Documents: Minimum 5 years after account closure, or longer if required by the relevant authorities.
• Support Communication Logs: 2 years from the date of last communication.
• Technical Log Data: 90 days, unless an active security investigation is ongoing.
• After Account Closure: We will delete or anonymize your information within 90 days of account closure, except for information that must be retained for legal purposes.

6 Cookies and Tracking Technologies

The grap33 platform uses cookies and similar tracking technologies to enhance the user experience, ensure security, and understand how our platform is used. Cookies are small text files stored on your device when you visit our website.

The types of cookies we use are as follows:

• Essential Cookies: Required for core platform functions such as login verification, session security, and navigation. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Helping us understand how players interact with the platform — most visited pages, time spent, and navigation patterns — for improvement purposes.
• Functional Cookies: Saving your preferences such as language, currency denomination, and display settings so you don't need to reconfigure them every time you log in.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and protect your account from unauthorized access.

You can manage or disable cookies through your web browser settings at any time. However, disabling certain cookies may affect the functionality and your experience on the grap33 platform.

7 Personal Information Security

Protecting your personal information is grap33's top priority. We continuously invest in the latest security infrastructure to ensure your data is always safeguarded. Our implemented security measures include:

• Encryption of Data at Rest and in Transit: All data is encrypted both at rest in the database and in transit over the network using the latest TLS 1.3 protocol.
• Strict Access Controls: Only authorized grap33 staff who require access to perform their duties are permitted to view players' personal information. All access is logged and audited.
• Two-Factor Authentication (2FA): grap33's internal systems require multi-factor authentication for all access to databases containing players' personal information.
• Regular Security Audits: grap33 conducts regular penetration testing and independent security audits to identify and address vulnerabilities.
• 24/7 Monitoring: An automated security monitoring system operates around the clock to detect and respond to any emerging threats in real time.

8 Your Rights as a User

As a grap33 user, you have certain rights regarding your personal information under applicable data protection laws. grap33 is committed to respecting and facilitating the exercise of these rights:

• Right of Access: You have the right to know what personal information we hold about you and how it is used. You may request a copy of this information at any time.
• Right to Rectification: If any information we hold is inaccurate or outdated, you have the right to request an immediate correction.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal information. Such requests will be processed in accordance with applicable legal limitations.
• Right to Object to Processing: You have the right to object to the processing of your information for specific purposes, such as direct marketing.
• Right to Restriction of Processing: In certain situations, you may request that we restrict how we use your information while a dispute is being resolved.
• Right to Data Portability: You have the right to receive your personal information in a machine-readable format for transfer to another service provider.

To exercise any of the above rights, please contact the grap33 support team by submitting a written request. We will process your request within 30 business days. In complex cases, this period may be extended to up to 60 days, with prior notification to you.

9 Amendments to the Privacy Policy

Grap33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or service improvements. All amendments take effect upon publication of the updated version on this page.

When significant changes are made to this policy, we will notify you via:

• In-account notification when you log in to the grap33 platform.
• Notification email to the address registered in your account (for material changes).
• A prominent banner notice on the grap33 homepage for an appropriate duration.

We encourage you to review this page regularly to stay informed about how we protect your privacy. The "Updated" date at the top of this page indicates when the last revision was made.

10 Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding your privacy and data protection, grap33's Data Protection Officer (DPO) team is ready to assist. We take every privacy inquiry seriously and strive to provide a comprehensive response within the stipulated timeframe.

You can reach us via live chat available 24/7 on the platform, or through our support email. For detailed inquiries or formal data rights requests, please use the email channel to ensure complete records and more efficient case management.

For more information about your rights and how we manage our platform responsibly, you may also visit the Responsible Gaming and Terms and Conditions us.