321spin Privacy Policy – Malaysian Player Data Protection

This Privacy Policy describes how 321spin ("we", "Company" or "Platform") collects, processes, stores and protects your personal information ("User", "Player" or "Member") when you use 321spin's website, mobile app and services.

We are committed to protecting your privacy and ensuring your personal data is handled responsibly, in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and international industry best practices.

By registering an account or continuing to use the 321spin platform, you consent to our collection and processing of your personal data in accordance with this Privacy Policy. If you do not agree, please discontinue use of the platform and contact us to close your account.

321spin only collects data that is strictly necessary to provide a safe, fair, and efficient service to players in Malaysia. The following are the categories of information we collect:

• Account Registration: Information you provide directly when registering a new account at 321spin, including your name, phone number, email and date of birth.
• KYC Process (Identity Verification): Documents you upload for identity verification purposes — such as a copy of your MyKad, bank statement, or other documents required for anti-money laundering (AML) compliance.
• Financial Transactions: Information automatically generated when you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or FPX, or when you request a withdrawal of winnings.
• In-Platform Activity: Data collected automatically while you play slots, live baccarat, poker, roulette, table games, or place sports and e-sports bets on 321spin.
• Cookies & Tracking Technologies: Information collected by cookies and similar technologies as you browse the 321spin website or app. See Section 8 for more details on cookies.
• Customer Support Communications: Chat records, emails, and other interactions between you and 321spin's customer support team are retained for quality assurance and security purposes.
• Legitimate Third-Party Sources: In certain cases for verification purposes, 321spin may receive information from legitimate sources such as licensed third-party identity verification services operating in Malaysia.

321spin uses your personal data only for legitimate, necessary purposes that have been disclosed to you. Below is a summary table:

321spin does not sell or rent players' personal information to any party. However, in certain limited and lawful circumstances, we may share data with the following parties:

• Malaysian Payment Providers: Information required to process transactions is shared with payment providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and banks via FPX (Maybank2u, CIMB Clicks). Only the minimum data necessary to complete each transaction is shared.
• Technical Service Providers: Companies that assist us in operating the 321spin platform — such as hosting providers, game software suppliers and analytics service providers — are bound by strict confidentiality agreements.
• Regulatory Bodies & Law Enforcement: Where required by Malaysian law, court order, or a legitimate regulatory authority, 321spin will disclose the necessary information. This includes financial crime investigations and AML compliance.
• Identity Verification Services: Licensed third-party KYC providers engaged to verify player identities in compliance with legal requirements.
• Corporate Transfers: In the event of a merger, acquisition, or sale of 321spin's assets, user data may be transferred, provided that a privacy policy at least equivalent to this Policy is maintained.

321spin implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction.

• 256-bit SSL Encryption: All communications between your device and 321spin's servers are encrypted using 256-bit TLS/SSL — the same standard used by Malaysia's leading banking institutions.
• Data-at-Rest Encryption: Sensitive data stored in 321spin's databases is encrypted using industry-standard encryption algorithms. Passwords are stored as hashes that cannot be decrypted.
• Strict Access Controls: Only 321spin staff with a legitimate operational need may access player data, and all such access is continuously monitored and audited.
• 24/7 Security Monitoring: Intrusion detection systems (IDS) and threat prevention systems operate around the clock to detect and neutralise any attempted cyberattacks.
• Independent Security Audit: 321spin undergoes independent annual security audits conducted by certified cybersecurity firms to identify and address any vulnerabilities.
• Incident Response Plan: We have tested incident response procedures in place to ensure any data breach is promptly identified, contained and reported.

321spin retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required under Malaysian law.

• Active Account Data: For as long as your account remains active on 321spin, your personal data will be retained to allow you to access all platform services.
• Financial Transaction Data: Financial transaction records are retained for a minimum of 7 years from the date of the transaction, in compliance with Malaysian legal requirements on financial and tax compliance.
• KYC Data: Identity verification documents are retained for a minimum of 5 years after the business relationship ends, in compliance with Malaysia's Anti-Money Laundering Act (AMLA).
• After Account Closure: When an account is closed at your request, non-mandatory personal data will be deleted within 90 days. Data required to be retained by law will be kept until the minimum retention period expires.

321spin uses cookies and similar tracking technologies to enhance your experience on the platform. Below are the types of cookies we use and the controls available to you:

You can also manage cookies through your web browser settings. Disabling certain cookies may affect the functionality of some parts of the 321spin platform.

As a 321spin player who is a Malaysian citizen or resident, you are entitled to rights protected under the Personal Data Protection Act 2010 (PDPA):

The 321spin platform uses several third-party services that may collect data of their own. Each of these services maintains its own privacy policy:

• Game Providers: Third-party game providers supplying slots, table games, and live casino titles on 321spin may collect the minimum technical data required to deliver their games. These providers are carefully vetted and bound by data protection agreements.
• Payment Providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX each maintain their own privacy policies governing the data they process. 321spin shares only the minimum data necessary to complete each transaction.
• Web Analytics: We use analytics services to understand platform usage patterns. Data collected is aggregated and cannot be used to identify individual players.
• Customer Support Services: Our live chat platform is operated by a certified third-party provider bound by strict confidentiality agreements with 321spin.

In certain circumstances, your personal data may be processed or stored on servers located outside Malaysia. When this occurs, 321spin ensures adequate protection through the following mechanisms:

• Data Transfer Agreements: All cross-border data transfers are governed by contractual agreements that ensure a level of protection equal to or exceeding Malaysia's PDPA standards.
• Countries with Adequate Privacy Standards: 321spin only transfers data to countries recognised as having adequate data protection legislation.
• Encryption in Transit: All data transferred across borders is encrypted using strict security protocols, ensuring confidentiality at all times.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data at 321spin, please contact our Data Protection Officer: