Privacy Policy

3 Data We Collect

rokok33 collects the following categories of Personal Data from Platform users. Collection occurs only where relevant and necessary for the purposes described in this Policy.

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification —21+ requirement)
• Malaysian IC number (MyKad) or passport number
• Registered email address
• Mobile phone number
• Username and encrypted password
• Residential address in Malaysia

3.2 KYC & Verification Documents

• Scanned copy or photograph of valid government-issued ID (MyKad front and back, passport, or driver's licence)
• Proof of address document (utility bill, bank statement, or official correspondence dated within three months)
• Selfie photograph taken whilst holding your identification document
• Payment method ownership documentation where required for withdrawal processing

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts, dates, and payment methods used
• Payment method details (e-wallet identifiers, bank account reference data, card type and last four digits — full card numbers are never stored by rokok33)
• Cryptocurrency wallet addresses used for deposits and withdrawals (BTC, ETH, USDT, LTC)
• Account balance history and bonus credit/debit records

3.4 Behavioural & Usage Data

• Betting history, game session records, and wagering activity on the Platform
• Pages visited, features accessed, and time spent on the Platform
• Search queries and filter selections within the Platform
• Responsible gambling tool usage including deposit limit settings and self-exclusion activations

3.5 Technical & Device Data

• IP address and approximate geolocation derived from it
• Device type, operating system, and browser version
• Device identifiers (where applicable for fraud prevention purposes)
• Session tokens, login timestamps, and access logs

3.6 Communications Data

• Records of customer support interactions via live chat, WhatsApp, and email
• Feedback, complaints, and dispute correspondence
• Responses to surveys or promotional communications where you have participated

4 How Data Is Collected

rokok33 collects Personal Data through the following mechanisms:

• Directly from you: When you register an account, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions.
• Automatically: Through cookies, session tracking technologies, and server logs when you access or interact with the Platform. See Section 8 for full details on our cookie practices.
• From third-party payment processors: Transaction confirmation data and, where required for AML compliance, supplementary identity data from payment service providers including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, and Public Bank.
• From fraud prevention and identity verification services: We may receive supplementary verification data from KYC and identity verification service providers used to confirm the authenticity of submitted documents.
• From public sources: Publicly available information that may be used to verify or supplement identity and address data provided by you where there is a legitimate compliance purpose for doing so.

5 Data Processing & Use

rokok33 processes your Personal Data for the following defined purposes. We do not process data for any purpose incompatible with those set out below:

6 Legal Basis for Processing

rokok33 processes Personal Data one or more of the following lawful bases, consistent with the requirements of the PDPA and applicable data protection principles:

• Contractual necessity: Processing that is necessary to perform the contract between you and rokok33 (i.e., operating your account, processing payments, and delivering the Platform's services).
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including AML, KYC, and data retention obligations imposed by law.
• Legitimate interests: Processing carried out for the legitimate interests of rokok33, including fraud prevention, security, Platform improvement, and responsible gambling monitoring — provided such interests are not overridden by your fundamental rights.
• Consent: Processing based on your freely given, informed consent — primarily in the context of marketing communications and optional analytics. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7 Data Sharing & Disclosure

rokok33 does not sell, rent, or disclose your Personal Data to third parties for their own commercial or marketing purposes. We may share your data only in the following limited circumstances:

• Payment service providers: We share transaction-relevant data with payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency payment gateways, solely for the purpose of processing your deposits and withdrawals.
• Identity verification providers: KYC document data may be shared with third-party identity verification service providers engaged by rokok33 to verify submitted documentation. These providers operate under strict data processing agreements and are not permitted to use your data for any other purpose.
• Fraud prevention and security partners: Technical and behavioural data may be shared with fraud detection service providers to identify and prevent account abuse, automated access, and financial crime.
• Professional advisers: Legal advisers, auditors, and compliance consultants may access Personal Data where strictly necessary for the services they provide to rokok33, subject to professional confidentiality obligations.
• Regulatory and law enforcement authorities: rokok33 will disclose Personal Data to relevant authorities where required to do so by law, court order, or regulatory direction, including but not limited to requests from Malaysian financial intelligence or law enforcement agencies.
• Business transfers: In the event of a merger, acquisition, or sale of rokok33's business assets, Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the Privacy Policy of the acquiring entity prior to any change in data controller.

8 Cookies & Tracking Technologies

The rokok33 Platform uses cookies and similar tracking technologies to operate core site functionality, remember your preferences, analyse usage, and support our fraud prevention measures. The following categories of cookies may be set on your device:

• Strictly necessary cookies: Essential for the Platform to function correctly. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings, display preferences, and previously selected payment methods. These improve the usability of your rokok33 experience.
• Analytics cookies: Used to collect anonymised data about how users navigate and interact with the Platform, including pages visited, session duration, and feature engagement. This data informs Platform improvement decisions.
• Security and fraud prevention cookies: Used to identify and prevent automated access, bot activity, and other security threats. These help rokok33 protect the integrity of the Platform and your account.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. rokok33 does not use third-party advertising or behavioural tracking cookies.

9 Data Retention

rokok33 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active account, plus minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission, consistent with applicable AML regulations.
• Transaction records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with Malaysian financial record-keeping requirements.
• Customer support communications: Retained for up to three (3) years from the date of the last interaction, unless relevant to an ongoing dispute or regulatory matter.
• Marketing consent records: Retained for the period during which consent is active, plus one (1) year following withdrawal of consent for audit purposes.
• Technical and device logs: Retained for up to twelve (12) months for security and fraud analysis purposes, after which they are deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted, anonymised beyond re-identification, or rendered inaccessible, in accordance with our internal data lifecycle management procedures.

10 Data Security

rokok33 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encryption of sensitive data at rest using industry-standard cryptographic algorithms
• Multi-factor authentication (2FA) available for all registered accounts
• Role-based access controls limiting internal access to Personal Data to authorised staff only
• Regular security audits and penetration testing of Platform infrastructure
• Continuous monitoring for suspicious access patterns and anomalous account activity
• Secure data centre facilities with physical access controls

In the event of a data breach that poses a significant risk to your rights or interests, rokok33 will notify affected users and, where required, relevant regulatory authorities, without undue delay and in accordance with applicable notification obligations.

11 Your Rights

As a Data Subject, you hold specific rights in relation to your Personal Data held by rokok33. These rights are exercisable by contacting our Data Protection team via the channels set out in Section 15. We will respond to all verified requests within thirty (30) calendar days of receipt.