kami33 Privacy Policy

1. Introduction

kami33 ("kami33", "we", "our", "us") is committed to protecting the privacy and personal data of all individuals who access or use the kami33 platform at kami33.org, including registered members, prospective members, and general visitors (collectively, "you", "your").

This Privacy Policy ("Policy") describes the categories of personal data kami33 collects, the purposes for which that data is processed, the legal bases on which processing is conducted, and the rights available to you in relation to your personal data. This Policy should be read in conjunction with the kami33 Terms & Conditions and Responsible Gaming Policy.

kami33 processes personal data in accordance with applicable data protection legislation, including the principles reflected in the Malaysian Personal Data Protection Act 2010 (PDPA) and the data protection standards required under the terms of our international gaming authority licence. By accessing the kami33 platform or creating a member account, you acknowledge that you have read and understood this Policy.

2. Data We Collect

kami33 collects personal data from you directly, from your use of the platform, and — in limited circumstances — from third-party sources. The categories of personal data we collect include:

• Identity Data: Full legal name, date of birth, nationality, and national identification number (e.g., MyKad number), as provided during registration and KYC verification.
• Contact Data: Email address, mobile phone number, and residential address.
• Financial Data: Payment method details (e.g., Touch n Go eWallet account reference, Boost account reference, bank account or FPX details), deposit and withdrawal transaction records, and account balance history. kami33 does not store full payment card numbers.
• Account Data: Username, account preferences, session history, login timestamps, and responsible gaming settings.
• Gaming Data: Betting history, game participation records, wagering activity, bonus redemption records, and win/loss records.
• Technical Data: IP address, device type and identifiers, browser type and version, operating system, and geolocation data (at the country or city level) derived from your IP address.
• Communications Data: Records of your communications with kami33 support, including Live Chat transcripts and email correspondence.
• KYC Verification Documents: Copies of government-issued identity documents (e.g., MyKad, passport) and supporting documents (e.g., utility bills, bank statements) submitted for identity and address verification.

Where you provide personal data relating to a third party (for example, a nominated contact for responsible gaming purposes), you confirm that you have obtained the consent of that individual to share their data with kami33 for the stated purpose.

3. How We Use Your Data

kami33 processes your personal data for the following purposes:

• To create and manage your kami33 member account and verify your identity in accordance with our KYC obligations.
• To process deposits, withdrawals, and other financial transactions in Malaysian Ringgit, including via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and FPX.
• To provide access to the kami33 casino, sportsbook, and slots services and to personalise your gaming experience.
• To detect, investigate, and prevent fraud, money laundering, and other unlawful activity — including filing reports with relevant financial intelligence authorities where legally required.
• To enforce the kami33 Terms & Conditions and to manage responsible gaming obligations, including age verification, self-exclusion enforcement, and deposit limit monitoring.
• To communicate with you about your account, including transactional notifications, security alerts, and responses to support enquiries.
• To send promotional communications and bonus offers, where you have opted in to receive marketing communications or where kami33 has a legitimate interest in doing so, subject to your right to opt out at any time.
• To comply with applicable legal obligations, including those arising under our international gaming authority licence and Malaysian law.
• To analyse aggregate and anonymised usage data for platform improvement, game performance analysis, and internal reporting purposes.

4. Legal Basis for Processing

kami33 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the kami33 member agreement, including account management, transaction processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, anti-money laundering (AML), and responsible gaming mandates under our gaming licence.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform improvement, and direct marketing to existing members, where such interests are not overridden by your rights and interests.
• Consent: Processing for optional communications and non-essential cookies, where we have obtained your prior consent. You may withdraw consent at any time by contacting [email protected] or adjusting your account settings.

5. Cookies & Tracking Technologies

kami33 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies used include:

• Strictly Necessary Cookies: Required for core platform functionality, including session management, authentication, and security. These cookies cannot be disabled.
• Functional Cookies: Used to remember your preferences, language settings, and responsible gaming configurations between sessions.
• Analytics Cookies: Used to collect anonymised information about how visitors interact with the kami33 platform, to identify performance issues and improve the user experience.
• Marketing Cookies: Used where you have consented to receive targeted communications related to kami33 promotions and offers.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to access the kami33 platform and its services.

6. Data Sharing & Disclosure

kami33 does not sell your personal data to third parties. We may share your personal data in the following limited circumstances:

• Service Providers: We engage trusted third-party service providers for payment processing, identity verification (KYC), fraud detection, IT infrastructure, and customer support operations. These providers are contractually bound to process data only on kami33's instructions and in compliance with applicable data protection standards.
• Regulatory Authorities: We may disclose personal data to our gaming licence regulator, financial intelligence authorities, or other competent authorities where required by law or in connection with our AML obligations.
• Responsible Gaming Bodies: Where a member has invoked self-exclusion, kami33 may share relevant data with shared exclusion registry systems operated under our licensing framework.
• Business Transfers: In the event of a merger, acquisition, or sale of kami33 assets, member personal data may be transferred to the successor entity, subject to the same privacy protections set out in this Policy.

7. Data Retention

kami33 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Member account data and gaming records: for the duration of the account relationship and a minimum of five (5) years following account closure, consistent with AML regulatory requirements.
• KYC verification documents: for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Financial transaction records: for a minimum of seven (7) years, consistent with standard financial record-keeping obligations.
• Support and communications data: for a minimum of three (3) years from the date of the communication.

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with kami33's data disposal procedures.

8. Data Security

kami33 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include 256-bit SSL/TLS encryption for all data in transit, encrypted storage for sensitive data at rest, access controls limiting data access to authorised personnel on a need-to-know basis, regular security assessments and penetration testing, and incident response procedures to detect and address security breaches promptly.

Notwithstanding these measures, no method of data transmission or storage is entirely infallible. You are responsible for maintaining the confidentiality of your kami33 account credentials and should notify us immediately at [email protected] if you suspect any unauthorised access to your account.

9. Your Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by kami33:

• Right of Access: To request a copy of the personal data kami33 holds about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data, subject to our legal retention obligations.
• Right to Restriction: To request that processing of your personal data be restricted in certain circumstances.
• Right to Portability: To receive your personal data in a structured, machine-readable format where processing is based on consent or contract.
• Right to Object: To object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: To withdraw consent for any processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact kami33 at [email protected]. We will respond to verified requests within thirty (30) days. Identity verification may be required before we are able to fulfil a request.

10. Children & Minors

The kami33 platform is strictly intended for adults aged 21 years and above. kami33 does not knowingly collect or process personal data from individuals under the age of 21. Age verification is conducted at registration and prior to withdrawal processing as a mandatory safeguard.

If kami33 becomes aware that personal data has been collected from an individual under 21 years of age, that data will be immediately deleted and the associated account closed. If you believe that kami33 may have inadvertently collected data from a minor, please contact us immediately at [email protected].

11. Cross-Border Data Transfers

kami33 may transfer your personal data to service providers and infrastructure partners located outside of Malaysia. Where such transfers occur, kami33 ensures that appropriate safeguards are in place — including contractual data protection clauses consistent with applicable data protection standards — to protect the security and integrity of your personal data during and after transfer.

By using the kami33 platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia for the purposes described in this Policy, subject to the safeguards described above.

12. Changes to This Policy

kami33 reserves the right to amend this Privacy Policy at any time. Where changes are material, we will notify members via the platform or by email to the registered account address at least fourteen (14) days before the amended Policy takes effect. The current version of this Policy is always accessible at kami33.org/privacy-policy. Continued use of the kami33 platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way kami33 handles your personal data, please contact our Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 on the kami33 platform.

kami33 will acknowledge all formal data protection enquiries within 5 business days and provide a substantive response within 30 days. Where a complaint cannot be resolved internally, you may have the right to escalate to the relevant data protection authority or the dispute resolution body under our gaming licence.