Privacy Policy — rokok33

1Data Controller

1.1 For the purposes of this Privacy Policy, the data controller responsible for your personal data is rokok33, the operator of the online gaming platform accessible at rokok33.co ("the Platform", "We", "Us", "Our").

1.2 rokok33 processes personal data in connection with the provision of online casino, sports betting, esports, and ancillary gaming services to Members located in Malaysia and other permitted jurisdictions.

1.3 If you have any questions or concerns regarding the processing of your personal data by rokok33, you may contact our data protection team at the address provided in Article 14 of this Policy.

2Personal Data We Collect

2.1 rokok33 collects the following categories of personal data in connection with your use of the Platform:

2.2 rokok33 does not knowingly collect sensitive personal data (such as racial or ethnic origin, political opinions, or health data) except where strictly required for regulatory compliance (e.g., responsible gaming assessments).

3How We Collect Your Data

3.1 rokok33 collects personal data through the following means:

• Direct provision: Data you voluntarily provide during registration, identity verification, payment setup, or when contacting customer support;
• Automated collection: Technical and usage data collected automatically through cookies, server logs, and similar tracking technologies when you access the rokok33 platform;
• Third-party sources: Identity verification data from KYC service providers; fraud prevention data from risk management partners; payment confirmation data from payment processors including FPX, DuitNow, Touch 'n Go, and banking partners.

3.2 Where rokok33 collects data from third-party sources, it ensures that such third parties have obtained the data lawfully and are authorised to share it with rokok33 for the stated purposes.

4Legal Basis for Processing

4.1 rokok33 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), know-your-customer (KYC), and gaming regulatory obligations;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics for service improvement, where such interests are not overridden by your rights;
• Consent: Processing for direct marketing communications, where we have obtained your express prior consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5How We Use Your Personal Data

5.1 rokok33 uses the personal data it collects for the following purposes:

• To create, verify, and administer your rokok33 Member account;
• To process deposits, withdrawals, and all financial transactions in MYR;
• To verify your identity and age (minimum 21 years) in compliance with our licensing obligations;
• To detect and prevent fraud, money laundering, and other prohibited activities on the Platform;
• To provide and improve customer support services, including live chat assistance;
• To monitor and enforce responsible gaming obligations, including identifying Members who may be at risk of problem gambling;
• To personalise your experience on the rokok33 platform, including recommending relevant games and promotions;
• To send you transactional communications related to your account, including security alerts and payment confirmations;
• To send marketing communications where you have provided consent, including information about rokok33 promotions, new games, and special offers;
• To comply with all applicable legal, regulatory, and licensing requirements.

5.2 rokok33 will not use your personal data for purposes materially different from those listed above without providing prior notice and, where required, obtaining your consent.

6Data Sharing & Disclosure

6.1 rokok33 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors and financial institutions: To process deposits and withdrawals, including Touch 'n Go, DuitNow, Boost, GrabPay, Maybank2u, CIMB, Public Bank, and FPX operators;
• Identity verification and KYC providers: To perform age and identity verification as required by our licensing obligations;
• Fraud prevention and security partners: To detect and prevent fraudulent activity, money laundering, and other security threats;
• Game content providers: Limited technical data required for game functionality and RNG certification purposes;
• Regulatory and law enforcement authorities: Where required by Applicable Law, court order, or regulatory demand, rokok33 will disclose personal data to competent authorities;
• IT infrastructure and hosting providers: Technical service providers who process data on rokok33's behalf under contractual data processing agreements.

6.2 All third-party service providers who process personal data on behalf of rokok33 are required to handle such data in accordance with this Privacy Policy and applicable data protection law, and are prohibited from using the data for any independent purpose.

7Cookies & Tracking Technologies

7.1 The rokok33 platform uses cookies and similar tracking technologies to operate and improve the platform experience. The following categories of cookies are used:

• Strictly necessary cookies: Essential for platform functionality, including session management, login state persistence, and security features. These cannot be disabled without impacting platform functionality.
• Performance and analytics cookies: Used to collect aggregated usage statistics to help rokok33 understand how the platform is used and identify areas for improvement. Data collected is anonymised where possible.
• Functionality cookies: Used to remember your preferences such as language settings, preferred payment method, and display options.
• Marketing and targeting cookies: Used only where you have provided consent, to deliver relevant promotional content within the rokok33 platform.

7.2 You may manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the core rokok33 platform, though certain personalisation features may be unavailable.

8Data Retention

8.1 rokok33 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

• Account data and transaction records are retained for a minimum of five (5) years following account closure to satisfy AML and gaming regulatory record-keeping requirements;
• Identity verification documents are retained in accordance with the minimum periods prescribed by applicable KYC regulations;
• Customer support communications are retained for a period of three (3) years following resolution of the relevant matter;
• Technical and usage data is retained in identifiable form for up to twenty-four (24) months, after which it is anonymised or deleted.

8.2 Where retention of your personal data is no longer necessary, rokok33 will securely delete or anonymise that data in accordance with our internal data disposal procedures.

9Data Security

9.1 rokok33 implements technical and organisational measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the rokok33 platform;
• Industry-standard password hashing — rokok33 does not store passwords in plain text and staff cannot retrieve your password;
• Access controls limiting personal data access to authorised personnel on a need-to-know basis;
• Rate-limiting and anomaly detection to prevent brute-force attacks and unauthorised login attempts;
• Regular security assessments and penetration testing of platform infrastructure.

9.2 While rokok33 takes reasonable steps to protect your personal data, no digital transmission or storage system is entirely immune from security risks. You are responsible for maintaining the confidentiality of your rokok33 account credentials and should notify us immediately if you suspect any unauthorised access to your account.

10Your Data Protection Rights

10.1 Subject to applicable law and our regulatory obligations, you have the following rights with respect to your personal data held by rokok33:

• Right of access: You may request a copy of the personal data rokok33 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where rokok33 no longer has a legal basis for retaining it (subject to regulatory retention obligations);
• Right to restrict processing: You may request that rokok33 limit its processing of your personal data in certain circumstances;
• Right to data portability: You may request a machine-readable copy of personal data you have provided to rokok33;
• Right to object: You may object to processing based on legitimate interests, including direct marketing communications;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

10.2 To exercise any of the above rights, please contact the rokok33 data protection team using the contact details in Article 14. rokok33 will respond to verifiable requests within a reasonable timeframe and in accordance with applicable law. We may require identity verification before processing a data rights request.

11International Data Transfers

11.1 rokok33 may transfer your personal data to service providers and infrastructure partners located outside Malaysia in connection with the delivery of its services. Where such transfers occur, rokok33 ensures that appropriate safeguards are in place to protect your personal data at a standard equivalent to that required under applicable Malaysian data protection law.

11.2 Applicable safeguards for international transfers may include standard contractual clauses, data processing agreements incorporating equivalent data protection obligations, or transfers to jurisdictions that provide an adequate level of data protection as determined by the relevant regulatory authority.

12Minors

12.1 The rokok33 platform is strictly intended for adults aged 21 years and above. rokok33 does not knowingly collect personal data from individuals under the age of 21. Age verification is enforced at registration and prior to any real-money transaction.

12.2 If rokok33 becomes aware that personal data has been collected from an individual below the minimum age, that data will be deleted and the associated account closed immediately. If you believe a minor has accessed the rokok33 platform, please contact us immediately using the details in Article 14.

13Amendments to This Privacy Policy

13.1 rokok33 reserves the right to amend this Privacy Policy at any time. Where changes are material, rokok33 will notify registered Members via email or prominent platform notification prior to the effective date of the amendment.

13.2 The date of most recent revision is displayed at the top of this page. Continued use of the rokok33 platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not accept the amended policy, you must cease using the platform and may close your account in accordance with the Terms & Conditions.

14Contact & Data Enquiries

14.1 For questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by rokok33, please contact the rokok33 data protection team:

14.2 rokok33 will acknowledge your enquiry within a reasonable time and aim to resolve all data protection matters promptly and fairly.