Kaya33 Privacy Policy

This Privacy Policy ("Policy") describes how Kaya33 ("we", "us", "the Platform") collects, processes, stores, and protects the personal data of individuals who access or use our online gaming platform at kaya33.buzz.

We take your privacy seriously. This Policy has been prepared in accordance with the requirements of our international gaming licence and reflects our commitment to responsible, transparent data handling. We encourage you to read this Policy carefully before registering an account or submitting any personal information to Kaya33.

By registering an account with Kaya33, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not create an account or submit personal information to us.

For the purposes of this Policy, the following terms shall have the meanings set out below:

Kaya33 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, we are responsible for ensuring that personal data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect it.

Kaya33 operates under an internationally recognised gaming licence. Our data processing activities are designed to align with the data protection requirements imposed by that licensing framework. Where we engage third-party Data Processors, we do so under contractual arrangements that require them to handle personal data in accordance with our instructions and applicable data protection standards.

Kaya33 collects the following categories of personal data from Players and prospective Players:

4.1 Identity and Contact Data

• Full legal name as it appears on government-issued identification
• Date of birth (to verify the minimum age requirement of 21 years)
• Residential address (street, city, postcode, state — including Malaysian cities such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam)
• Email address and mobile telephone number
• Copies of government-issued photo identification (e.g., MyKad, passport)
• Proof of address documentation (e.g., utility bills, bank statements dated within 90 days)

4.2 Financial Data

• Payment method details as necessary for processing deposits and withdrawals (e.g., bank account details for Maybank, CIMB, Public Bank, Hong Leong Connect; e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay; DuitNow and FPX references)
• Transaction history, including deposit amounts, withdrawal requests, and account balance movements denominated in Malaysian Ringgit (MYR / RM)
• Source of funds information where transactions exceed prescribed thresholds under our AML obligations

4.3 Account and Gaming Data

• Account registration details including username, encrypted password, and account preferences
• Gaming history, including bets placed, games played, wager amounts, and win/loss records
• Bonus and promotional activity associated with your account
• Responsible gambling settings and any self-exclusion or limit requests
• Customer support interaction records, including live chat transcripts and email correspondence

4.4 Technical and Device Data

• IP address and approximate geolocation derived from it
• Browser type and version, operating system, and device type
• Session duration, pages visited, and navigation patterns on the Platform
• Cookie identifiers and similar tracking technology data (see Section 9)

Kaya33 collects personal data through the following means:

• Direct provision: Data you enter when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or using responsible gambling tools.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, and session data via cookies and similar technologies.
• Third-party sources: Identity verification data from KYC service providers; fraud detection signals from anti-fraud partners; payment confirmation data from payment processors (Maybank, CIMB, Touch 'n Go eWallet, DuitNow, FPX, and others).
• Public sources: Where permitted, publicly available information used to verify identity or conduct AML screening.

Kaya33 processes personal data one or more of the following legal bases:

We use the personal data we collect for the following purposes:

• Account management: To create, verify, maintain, and secure your Kaya33 account throughout its lifecycle.
• Identity verification (KYC): To confirm your identity, verify your age (minimum 21 years), and satisfy our licensing obligations before processing withdrawals.
• Payment processing: To process deposits from and withdrawals to your chosen Malaysian payment methods, including Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, and others.
• Gaming services: To enable you to access and participate in games, place bets, receive winings, and use all features of the Platform.
• Fraud prevention and AML compliance: To detect, investigate, and prevent fraudulent activity money laundering, and other financial crimes, in accordance with our licensing obligations.
• Responsible gambling: To implement deposit limits, self-exclusion tools, session timers, and other responsible gambling features you request, and to monitor for signs of problem gambling behaviour.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and improve our support services.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the performance and usability of the Platform.
• Marketing communications: To send you promotional offers and news about Kaya33, where you have opted in to receive such communications. You may withdraw consent at any time by contacting our support team.
• Legal compliance: To comply with any applicable legal obligation, court order, or regulatory requirement to which Kaya33 is subject.

Kaya33 does not sell your personal data to any third party. We may share your personal data with third parties only in the following circumstances:

8.1 Service Providers and Data Processors

We engage trusted third-party service providers to perform functions on our behalf, including: payment processing (Maybank, CIMB, Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Public Bank, Hong Leong Connect); identity verification services; cloud hosting and infrastructure providers; fraud detection and AML screening partners; and customer support platform operators. All such providers are contractually bound to process your data only our instructions and to maintain appropriate security standards.

8.2 Game Providers

To enable access to games on the Platform, limited technical data (such as a pseudonymous player identifier and session token) may be shared with our licensed third-party game providers. These providers do not receive your name, contact details, or financial information.

8.3 Regulatory and Legal Obligations

We may disclose personal data to our licensing authority, law enforcement agencies, financial intelligence units, or other regulatory bodies where required by law, court order, or our licensing obligations. Where possible and legally permissible, we will notify you of such disclosure.

8.4 Business Transfers

In the event of a merger, acquisition, or sale of Kaya33 or substantially all of its assets, your personal data may be transferred to the acquiring entity, subject to that entity assuming the obligations set out in this Policy.

Kaya33 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may impair Platform functionality. Analytical and marketing cookies may be declined without affecting your ability to play or transact on the Platform.

Kaya33 retains personal data only for as long as is necessary for the purposes for which it was collected, or for such longer period as is required by our licensing obligations or applicable law.

As a general guide, the following retention periods apply:

• Account and identity data: Retained for the duration of your account, plus a minimum of 5 years after account closure, as required by AML regulations under our gaming licence.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with our financial record-keeping obligations.
• Customer support records: Retained for 3 years from the date of each interaction, unless forming part of an ongoing dispute or regulatory matter.
• Marketing preferences: Retained until you withdraw consent, at which point marketing communications will cease and preference records updated accordingly.
• Technical logs: Retained for up to 12 months from collection, unless required for a specific security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

Kaya33 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your browser and our servers
• Encryption at rest for sensitive data stored in our databases, including financial records and identity documentation
• Multi-factor authentication options for player accounts
• Role-based access controls restricting internal access to personal data on a strict need-to-know basis
• Regular security assessments and penetration testing of our Platform infrastructure
• Incident response procedures to detect, investigate, and notify affected individuals of any data breach in a timely manner

While we take all reasonable precautions, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your account has been compromised, please contact our support team immediately via live chat.

Subject to applicable law and our regulatory obligations, you hold the following rights in respect of your personal data held by Kaya33. To exercise any of these rights, please contact our support team using the details in Section 16.

We will respond to all data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 30 days with notification to you. We reserve the right to verify your identity before fulfilling any data rights request.

Kaya33 strictly prohibits access to or use of its Platform by persons under the age of 21. We do not knowingly collect personal data from any individual under 21 years of age. Age verification is a mandatory step in our KYC process before withdrawal rights are granted.

If we become aware that personal data has been collected from a person under the age of 21, we will immediately close the relevant account, void any associated winings, return deposited funds to the payment source, and delete the collected data to the extent not required for regulatory reporting.

Kaya33 operates on an internationally licensed basis. This means that your personal data may be transferred to, stored in, and processed in countries other than Malaysia. Where such transfers occur, we take steps to ensure that appropriate safeguards are in place to protect your data.

These safeguards include: data processing agreements with our service providers incorporating internationally recognised standard contractual clauses; ensuring that any third-party processor operating in a jurisdiction outside Malaysia provides a level of data protection equivalent to that afforded under our licensing framework; and limiting international transfers to what is strictly necessary for the provision of our services.

Malaysian players should be aware that the data protection laws of the country to which their data is transferred may differ from those in Malaysia under the Personal Data Protection Act 2010 (PDPA). By using the Kaya33 Platform, you acknowledge and consent to such international transfers on the basis described in this Policy.

Kaya33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform features. Where changes are material, we will notify registered Players via the email address on their account or through a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the Kaya33 Platform after any amendments to this Policy constitutes acceptance of the revised terms. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

If you disagree with any change to this Policy, you must cease using the Platform and may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to report a concern about how your personal data has been handled, please contact us using the details below. All contact details are provided as plain text — email addresses are not clickable links.