Privacy Policy ace33 – Your Data Is Safe With Us

Ace33 ("we", "Platform" or "ace33") takes personal data protection very seriously. This Privacy Policy is designed to clearly and transparently explain how we handle the personal information you share with us when using the ace33 online gaming platform.

This document applies to all users of the ace33 platform, including those accessing ace33.vu, using the ace33 mobile app, or interacting with any service offered by ace33. It covers all data collected through any medium, including the website, iOS app, Android app, and our customer support channels.

We believe privacy is a fundamental right of every individual. As such, we build data handling systems and procedures that prioritize the security and confidentiality of your information at every level of our platform's operations — from the moment you register to after you close your account.

Ace33 only collects personal data that is strictly necessary to operate the platform securely and comply with applicable legal requirements. The following are the categories of data we collect:

We do not collect sensitive data such as medical information, political views, or religious beliefs. All data collected is the minimum necessary for legitimate operational purposes only.

In addition to data you provide directly, we also collect data automatically via cookies and other tracking technologies while you use our platform. Further details on cookies are explained in Section 6 of this document.

Ace33 uses collected personal data solely for legitimate purposes directly related to delivering our platform services. The following are the primary purposes for which your data is used:

• Account Management: To create, verify, and manage your member account, ensuring it remains secure and accessible only to you.
• Transaction Processing: To process deposits, withdrawals, and any other financial transactions you carry out on the ace33 platform securely and accurately.
• Identity Verification (KYC): To verify your identity in compliance with Anti-Money Laundering (AML) and Know Your Customer (KYC) legal requirements applicable in the financial and online gaming industry.
• Customer Support: To help you resolve any issues, answer your enquiries, and handle complaints submitted to our support team.
• Platform Security: To detect, investigate, and prevent fraudulent activity, money laundering, account abuse, and other security threats that could affect the platform or other members.
• Responsible Gaming: To monitor gaming patterns and identify early signs of problem gambling, enabling us to provide appropriate assistance and support to members who need it.
• Service Communications: To send you important account notifications, terms updates, relevant promotions, and platform changes you need to know about.
• Platform Improvements: To analyse usage patterns in aggregate (not at an individual level) in order to improve product quality, introduce new features, and enhance the overall user experience.
• Legal Compliance: To comply with any legal requirements, regulations, or court orders that require us to disclose or retain certain information.

Every personal data processing activity carried out by ace33 has a solid and lawful legal basis. The following are the legal bases we rely on:

• Contract Performance: Data processing necessary to fulfill our contractual obligations to you as a member — including account management, transaction processing, and the provision of gaming services.
• Legal Obligation: Data processing required by applicable law, including KYC and AML requirements, financial record-keeping, and reporting to relevant authorities.
• Legitimate Interest: Data processing for platform security, fraud prevention, and product improvement purposes — where ace33's legitimate interests do not override your fundamental rights and freedoms.
• Consent: In certain cases where no other legal basis applies, we will seek your explicit consent before processing your data. You have the right to withdraw that consent at any time.

Ace33 does not sell, rent, or disclose members' personal data to third parties for their own marketing purposes. However, in the course of operating the platform, we may share your data with the following limited categories of third parties:

• Payment Service Provider: Banks, FPX providers, digital wallet operators, and payment processors that handle your deposit and withdrawal transactions. They receive only the minimum data necessary to process the relevant transaction.
• Identity Verification Provider: Third-party KYC services we use to verify member identities. These services are bound by strict data protection agreements with ace33.
• Gaming Software Provider: Software companies that supply games to the ace33 platform. These providers may receive non-identifiable member IDs for game operation purposes — not full names or personal information.
• Technical Infrastructure Provider: Cloud computing and server hosting providers that store our platform data in a secure, encrypted environment.
• Sovereign Authority: Law enforcement agencies, regulatory bodies, or courts issuing lawful requests for information. In such cases, we disclose only what is legally required.

The ace33 platform uses cookies and similar tracking technologies to enhance user experience, maintain login session security, and collect analytics data that helps us understand how the platform is used.

Types of cookies used by ace33:

• Essential Cookies: These cookies are required for the platform's basic operations, including login session authentication, security, and basic navigation. They cannot be disabled as the platform will not function without them.
• Preference Cookies: Saving your preferences such as language, display theme, and account settings so you do not need to reconfigure them every time you log in.
• Analytics Cookies: Helps us understand how members use the platform by collecting aggregate information on pages visited, time spent, and navigation paths. This data does not directly identify individuals.
• Security Cookies: Used to detect and prevent suspicious activity such as login attempts from unrecognised locations or devices.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the ace33 platform. For more information on managing cookies, please refer to your web browser's help documentation.

Ace33 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction, or accidental disclosure.

• Data Encryption in Transit: All communications between your device and ace33 servers are protected by TLS 1.3 — the latest encryption standard ensuring data cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive data such as financial information and KYC documents are encrypted using AES-256 while stored on our servers.
• Tiered Access Control: Access to member personal data is restricted using the principle of least privilege – only staff who require access for specific tasks are permitted.
• Regular Security Audits: ace33 conducts regular security assessments and penetration testing through independent security firms to identify and address any vulnerabilities.
• Incident Response Plan: We have detailed incident response procedures in place. In the event of a data breach that may affect your rights, we will notify you within a reasonable timeframe in accordance with legal requirements.

Ace33 retains your personal data only for as long as necessary to fulfil the original purpose of collection, or for as long as required by applicable law.

• Active Account Data: Retained for the duration your account is active and for the required period following account closure to comply with legal requirements.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with applicable financial and AML legal requirements.
• KYC Documents: Retained for 5 years after your business relationship with us ends, or longer if required by law.
• Security Logs: Retained for 12 months for security incident investigation and fraud prevention purposes.
• Support Communication Records: Retained for 2 years for service quality and dispute resolution purposes.

Upon expiry of the retention period, your data will be securely deleted using data erasure methods that ensure it cannot be recovered. You may also request early deletion of your data, subject to legal requirements obligating us to retain it.

As an ace33 member, you have strong rights regarding your personal data. ace33 fully respects and facilitates the exercise of these rights:

To exercise any of the above rights, please contact the ace33 customer support team via Live Chat. We will respond to your request within 30 business days. For complex cases, this period may be extended to 60 days, and we will notify you in advance.

The ace33 platform is strictly for individuals aged 18 and above. We do not knowingly collect, store, or process any personal data from individuals under the age of 18.

All ace33 account registrations require age verification through a rigorous KYC procedure. Should we discover that a child's personal data has been collected without valid parental or guardian consent, we will immediately take the following steps:

• Suspending the account in question immediately while an investigation is conducted.
• Permanently deleting all personal data associated with the account.
• Refunding any deposits made, subject to identity verification procedures of the true account owner.
• Reporting the incident to the relevant authorities if required.

In operating the ace33 platform, your personal data may be transferred to and stored on servers located outside Malaysia. This includes transfers to cloud infrastructure providers and technical service partners operating across various global locations.

Ace33 ensures that all international data transfers are safeguarded with appropriate protection mechanisms, including:

• Data Processing Agreement (DPA): All third-party providers that receive member data are required to sign a comprehensive DPA establishing strict data protection standards.
• Standard Contractual Clauses: For data transfers to countries without an adequacy determination, we use approved standard contractual clauses to ensure equivalent protection.
• Encryption in Transit: All data transferred across borders is fully encrypted using the TLS 1.3 protocol to prevent any interception during transmission.

By using the ace33 platform, you consent to this international data transfer, provided it is carried out in accordance with the safeguards described above.

Ace33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or platform service improvements.

When significant changes are made to this Privacy Policy, we will:

• Updating the "Updated" date at the top of this document.
• Displaying a prominent notice on the ace33 platform homepage for at least 7 days after the changes are published.
• Sending notifications via email or in-app messages to members affected by significant changes.

Continued use of the ace33 platform after changes are published constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request data deletion as outlined in Section 9.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, we encourage you to contact us directly. The ace33 Data Protection Team is ready to assist you.

We aim to respond to all privacy-related inquiries within 5 business days. For more complex cases involving data subject rights, the response period may take up to 30 business days. We will keep you informed of your case progress throughout the process.