Privacy at a Glance
Six Commitments That Define Our Privacy Practice
Before you read the full policy below, here is a plain-language summary of our most important data protection commitments to you as an ap33my player.
Minimal Data Collection
We collect only the personal data that is genuinely necessary to operate your account, process payments via Touch 'n Go eWallet, Boost, Maybank, CIMB, and USDT, and comply with our responsible gambling and anti-money laundering obligations.
We Never Sell Your Data
ap33my does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party for their independent marketing or commercial purposes. Your information is not a product here.
256-Bit Encryption
All personal data transmitted between your device and ap33my's servers is protected by 256-bit SSL/TLS encryption. Sensitive data at rest — including payment details and KYC documents — is stored in encrypted form in access-controlled infrastructure.
Your Rights Are Real
You have the right to access, correct, export, or request deletion of your personal data at any time. These are not decorative commitments — ap33my processes verified data subject requests within 30 days of receipt, at no charge.
Transparent Cookie Use
We use strictly necessary cookies to keep you logged in and protect your session. Optional analytics cookies are used only with your consent, set during your first visit. You can manage your cookie preferences at any time through your browser settings.
Marketing You Can Control
Promotional communications from ap33my — including bonus offers and game updates — are sent only to users who have opted in, or existing players where a legitimate interest exists. Unsubscribing from marketing is a one-click action and is always honoured promptly.
Contents
- 1. Introduction
- 2. Definitions
- 3. Data We Collect
- 4. How We Collect Data
- 5. Legal Basis for Processing
- 6. How We Use Your Data
- 7. Data Sharing & Disclosure
- 8. Data Retention
- 9. Data Security
- 10. Cookies & Tracking
- 11. International Transfers
- 12. Your Rights
- 13. Minors & Age Verification
- 14. Policy Amendments
- 15. Contact Us
Introduction
This Privacy Policy ("Policy") is published by ap33my ("we", "us", "our", "the Platform"), the operator of the online gaming website located at https://ap33my.cam. This Policy governs the collection, use, storage, disclosure, and protection of personal data relating to all users ("you", "your", "Player") who access or use the ap33my gaming Services, including the website, gaming platform, payment systems, customer support channels, and any associated mobile interfaces.
ap33my is committed to handling personal data responsibly, lawfully, and transparently. We adhere to internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework and comparable international privacy standards. While ap33my is not subject to Malaysian personal data law in its capacity as an internationally licensed operator, we have voluntarily adopted data protection standards aligned with the Malaysian Personal Data Protection Act 2010 (PDPA) principles where they are consistent with our operational framework, as a gesture of respect to our Malaysian user base across Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and beyond.
By registering an account with ap33my or continuing to use the Services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Services and contact us to close your account.
Definitions
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
- "Personal Data" — any information relating to an identified or identifiable natural person, including name, email address, date of birth, IP address, payment identifiers, and device identifiers.
- "Processing" — any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, transmission, combination, restriction, erasure, or destruction.
- "Data Controller" — ap33my, in its capacity as the entity that determines the purposes and means of processing your personal data.
- "Data Processor" — a third-party entity that processes personal data on ap33my's behalf and under ap33my's instructions (e.g., a payment gateway processing your Touch 'n Go eWallet or DuitNow transaction).
- "Consent" — freely given, specific, informed, and unambiguous indication of your wishes, expressed by a clear affirmative action (such as ticking an opt-in checkbox), by which you agree to the processing of personal data relating to you.
- "KYC Data" — identity verification documents submitted pursuant to our Know Your Customer (KYC) obligations, including MyKad copies, passport copies, proof of address, and source of funds documentation.
- "Cookies" — small text files placed on your device by the ap33my website that store session state, preferences, and behavioural data for the purposes described in Section 10.
Personal Data We Collect
ap33my collects personal data across the following categories, depending on your level of interaction with the platform:
| Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, gender, MyKad / passport number | Registration & KYC verification |
| Contact Data | Email address, mobile number, residential address (city, postcode, state) | Registration |
| Financial Data | Payment method identifiers (e-wallet account reference, bank account last 4 digits), transaction history, deposit and withdrawal amounts in MYR / USDT | Payment processing |
| KYC Documents | Scanned copies of identity documents, proof of address, source of funds documentation | KYC verification process |
| Technical Data | IP address, device type and OS, browser type, session timestamps, geolocation data (country/city level) | Each platform session |
| Behavioural Data | Game history, betting patterns, session duration, bet sizes, bonus usage patterns | Ongoing platform use |
| Communications Data | Support chat transcripts, email correspondence, complaint records | Customer support interactions |
| Marketing Preferences | Opt-in / opt-out status for email promotions, SMS, and push notifications | Registration & account settings |
How We Collect Personal Data
ap33my collects personal data through the following channels and mechanisms:
4.1 Direct Collection
Data provided directly by you during account registration, KYC document submission, payment processing, completion of any forms or surveys, and communications with our customer support team via live chat or email.
4.2 Automated Technical Collection
As you use the ap33my platform, we automatically collect certain technical and behavioural data via server logs, cookies, and session tracking technologies. This includes your IP address, device fingerprint, page visit sequences, and interaction timing data. This data is used primarily for security, fraud prevention, and platform performance optimisation.
4.3 Third-Party Sources
In certain circumstances, ap33my may receive personal data about you from third-party sources, including: identity verification service providers used during KYC processing; payment gateway providers (solely for transaction status and fraud screening purposes); and fraud detection or anti-money laundering screening services. Data received from third parties is handled with the same protections as data collected directly.
Legal Basis for Processing
ap33my relies on the following legal bases to process your personal data, in accordance with international data protection principles:
- Contractual Necessity: Processing required to perform the contract between you and ap33my — including account creation, payment processing, game delivery, and withdrawal management.
- Legal Obligation: Processing required for ap33my to comply with applicable legal requirements, including anti-money laundering (AML) obligations, KYC requirements imposed by our licensing jurisdiction, and fraud reporting obligations.
- Legitimate Interests: Processing for purposes that reflect ap33my's legitimate business interests, including platform security, fraud prevention, internal analytics, and responsible gambling monitoring — provided these interests are not overridden by your fundamental privacy rights.
- Consent: Processing for optional purposes such as direct marketing communications, where you have provided clear affirmative consent. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
How We Use Your Personal Data
ap33my uses your personal data for the following specific and documented purposes:
- Account Management: Creating and maintaining your player account, authenticating your identity at login, and managing your account settings and preferences.
- Payment Processing: Facilitating deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, or USDT TRC20), verifying transaction ownership, and maintaining financial records.
- KYC & Compliance: Verifying your identity and age, conducting anti-money laundering screening, and maintaining records required by our licensing obligations.
- Responsible Gambling: Monitoring your gaming behaviour to identify patterns consistent with problem gambling, applying self-imposed limits you have set, and facilitating self-exclusion requests.
- Platform Security & Fraud Prevention: Detecting and preventing fraudulent activity, multi-accounting, bonus abuse, and any other conduct that threatens the integrity of the platform or the safety of other players.
- Customer Support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality and training purposes.
- Platform Improvement: Analysing aggregated and anonymised usage data to improve game selection, performance, and user experience — including the placement of Liga Super Malaysia and EPL betting markets relevant to Malaysian players.
- Marketing Communications (consent-based): Sending you promotional offers, bonus notifications, and product updates where you have opted in to receive such communications.
- Legal Compliance: Meeting any applicable reporting, record-keeping, or disclosure obligations imposed by law or our licensing jurisdiction.
Data Sharing & Disclosure
ap33my does not sell, rent, or otherwise commercially transfer your personal data to third parties. We share personal data only in the following limited and specific circumstances:
7.1 Service Providers (Data Processors)
We engage carefully selected third-party service providers who process personal data on our behalf and under our instructions, including: payment gateway operators (for processing transactions via Boost, GrabPay, Maybank, DuitNow, and others); identity verification service providers (for KYC document processing); cloud infrastructure providers (for secure data hosting); fraud detection service providers; and customer communication platforms. All service providers are subject to contractual data processing agreements that prohibit independent use of your data.
7.2 Legal & Regulatory Disclosure
ap33my may disclose personal data to regulatory authorities, law enforcement agencies, or other governmental bodies where required by applicable law, a valid court order, or our licensing obligations. In such cases, disclosure is limited to what is strictly required and we will notify you where legally permitted to do so.
7.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of all or part of ap33my's business, personal data held by ap33my may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and your rights will be preserved under the incoming privacy framework of the acquiring entity.
Data Retention
ap33my retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following retention periods apply as a general framework:
- Account and Identity Data: Retained for the duration of your active account relationship with ap33my, plus a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements.
- KYC Documents: Retained for a minimum of five (5) years following the date of verification, or longer where required by our licensing jurisdiction.
- Financial Transaction Records: Retained for a minimum of five (5) years following each transaction, consistent with standard financial record-keeping obligations.
- Behavioural and Gaming Data: Retained for two (2) years following the date of the relevant activity, used for responsible gambling monitoring, fraud prevention, and platform analytics.
- Support Communications: Retained for two (2) years following the resolution of the relevant interaction.
- Marketing Preferences: Retained until you withdraw consent or request erasure, whichever occurs first.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that renders it permanently unidentifiable.
Data Security
ap33my implements a layered security architecture to protect your personal data against unauthorised access, loss, misuse, alteration, or destruction. Our technical and organisational security measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and ap33my's servers
- AES-256 encryption for sensitive data stored at rest, including KYC documents and financial identifiers
- Access controls limiting internal staff access to personal data on a strict need-to-know basis, with all access logged and audited
- Multi-factor authentication required for all administrative access to systems containing personal data
- Regular penetration testing and security audits conducted by qualified independent security professionals
- Geographically redundant, access-controlled data centre infrastructure for platform hosting
- Documented incident response procedures ensuring timely detection, containment, and notification of any personal data breach
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ap33my will notify affected users without undue delay and, where required, report the breach to the relevant supervisory authority.
Cookies & Tracking Technologies
ap33my uses the following categories of cookies and similar tracking technologies on the platform:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Session management, login authentication, CSRF protection, load balancing. Cannot be disabled without breaking core platform functionality. | No — essential to service delivery |
| Functional | Remembering your language preference, game view settings, and last-used payment method for a smoother experience. | No — legitimate interest |
| Analytics | Aggregated, anonymised data on page performance, user journey flows, and feature engagement — used to improve the platform for Malaysian users. | Yes — consent required |
| Marketing / Attribution | Tracking which promotional channel brought you to ap33my (e.g., an affiliate partner or organic search). Used for marketing spend attribution only. | Yes — consent required |
You can manage or withdraw your consent for optional cookies at any time by adjusting your browser settings or contacting our support team. Withdrawing consent for optional cookies will not affect the functioning of your account or any services you use.
International Data Transfers
Given that ap33my operates under international online gaming licensing and uses global cloud infrastructure and service providers, your personal data may be transferred to, stored in, or processed in countries outside Malaysia. These countries may not have data protection laws equivalent to those in Malaysia or in your country of residence.
Where personal data is transferred internationally, ap33my implements appropriate safeguards to ensure your data receives an equivalent level of protection, including: contractual data processing agreements incorporating standard contractual clauses recognised under international data protection frameworks; transfer only to jurisdictions with adequacy determinations under applicable privacy standards; and application of additional technical safeguards (encryption, pseudonymisation) where heightened transfer risks exist.
Your Data Rights
Subject to applicable law and our legitimate operational requirements, you hold the following rights in respect of your personal data held by ap33my. All requests are processed within 30 calendar days of receipt and are provided free of charge for one request per 12-month period.
Right of Access
Request a copy of all personal data ap33my holds about you, including the categories, purposes, and retention periods.
Right of Rectification
Request correction of any inaccurate or incomplete personal data, including your registered name, address, or contact details.
Right of Erasure
Request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing was unlawful. Subject to our legal retention obligations.
Right to Restrict Processing
Request temporary restriction of processing while a correction request or objection is being assessed by ap33my.
Right to Data Portability
Receive your personal data in a structured, machine-readable format (JSON or CSV) for transfer to another service provider.
Right to Object
Object to processing based on legitimate interests, including direct marketing. Marketing opt-outs are honoured immediately upon receipt.
Right to Withdraw Consent
Withdraw any consent you have given for optional processing (such as marketing emails) at any time, without affecting prior lawful processing.
Right to Lodge a Complaint
Lodge a formal complaint with ap33my's data protection contact or with the supervisory authority in the relevant licensing jurisdiction.
Minors & Age Verification
The ap33my platform is strictly restricted to individuals who are 21 years of age or older. ap33my does not knowingly collect personal data from any person under the age of 21. Age verification is conducted as part of the KYC process, and accounts where the registered user is determined or suspected to be under 21 years of age will be immediately suspended, all funds will be returned, and the personal data associated with the account will be securely deleted (subject only to the minimum legal retention required for anti-money laundering compliance).
If you believe that a person under the age of 21 has registered on ap33my, please notify us immediately at the contact details provided in Section 15. We take all such reports seriously and will act on them promptly.
Policy Amendments
ap33my reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or operational structure. When material amendments are made, we will publish a revised version of this Policy on the ap33my website with an updated Effective Date, and where practicable, we will notify registered users via their registered email address at least seven (7) days before the changes take effect.
Your continued use of the Services following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you should cease using the Services and request account closure. Archived versions of previous policies are available on request by contacting our support team.
Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or ap33my's data processing practices, please contact our data protection team using the details below. Our support team is available 24 hours a day, 7 days a week, including Malaysian public holidays.
Data Protection Enquiries
Subject line: "Privacy Enquiry" or "Data Rights Request"
Live Chat Support
Available 24/7 — average first response under 90 seconds
Accessible via the chat widget on any ap33my page
Response Commitment
Data rights requests processed within 30 calendar days
Languages
English, Bahasa Melayu, and Mandarin