Privacy Policy – royal36

1. Data Controller

Royal36 is the data controller responsible for the personal data processed through the royal36 Platform. As data controller, royal36 determines the purposes and means by which your personal data is processed. Where royal36 engages third-party service providers to process data on its behalf, those providers act as data processors subject to contractual obligations that prohibit use of your data for any purpose beyond the specific service they provide to royal36.

For all data protection enquiries, contact the royal36 Data Protection team via the support channels listed in Section 14 of this Policy.

2. Personal Data We Collect

Royal36 collects and processes the following categories of personal data in connection with the operation of the Platform:

Royal36 does not knowingly collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where directly relevant to responsible gaming obligations (for example, self-exclusion requests may involve health-related context).

3. How We Collect Your Data

Royal36 collects personal data through the following mechanisms:

• Direct collection: Data you provide when registering a royal36 account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, log files, and session recording technologies. See Section 8 for full details.
• Third-party sources: Identity verification and fraud screening data from licensed third-party KYC and AML service providers; payment data from eWallet operators including Touch n Go eWallet, Boost, and GrabPay; and banking data from Maybank, CIMB, and Public Bank in connection with transaction processing.
• Publicly available sources: Sanctions screening databases, politically exposed persons (PEP) registries, and adverse media databases consulted as part of royal36's AML compliance obligations.

4. Purpose & Legal Basis for Processing

Royal36 processes personal data only where a lawful basis exists under applicable data protection law. The primary purposes and corresponding legal bases are as follows:

• Contract performance: Processing necessary to register your account, operate your Player Account, process deposits and withdrawals, and deliver the gaming services you have contracted to receive from royal36.
• Legal obligation: Processing required to comply with anti-money laundering (AML) legislation, know-your-customer (KYC) requirements, age verification obligations under royal36's gaming licence, and requests from competent regulatory or law enforcement authorities.
• Legitimate interests: Fraud detection and prevention, platform security monitoring, responsible gaming surveillance (including detection of problem gambling indicators), internal audit and compliance, and improvement of the Platform's features and performance.
• Consent: Marketing communications, including promotional emails and SMS notifications. You may withdraw consent to marketing at any time via your account settings or by contacting support.

Royal36 does not sell your personal data to third parties for their own marketing purposes.

5. Data Sharing & Disclosure

Royal36 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: eWallet operators and banking partners necessary to process your deposits and withdrawals. Data shared is limited to what is required to complete the relevant transaction.
• KYC and AML service providers: Licensed identity verification and fraud screening vendors who perform document verification and sanctions screening on royal36's behalf.
• Gaming software providers: Game studios and platform technology providers whose software powers the royal36 sportsbook, live casino, and slots. These providers may process technical and gaming data as part of delivering the relevant game services.
• Regulatory and law enforcement authorities: Government agencies, gaming regulators, financial intelligence units, and law enforcement bodies where disclosure is required by applicable law or the terms of royal36's gaming licence.
• Professional advisers: Legal, audit, and compliance advisers engaged by royal36 on a confidential basis in connection with its business operations.
• Business successors: In the event of a merger, acquisition, or transfer of substantially all of royal36's business assets, personal data may be transferred to the acquiring entity subject to equivalent data protection commitments.

All third-party processors engaged by royal36 are required under contract to process personal data only for the specified purpose, to maintain appropriate security standards, and not to sub-process data without royal36's prior written authorisation.

6. International Data Transfers

Royal36 is an internationally operated platform and your personal data may be transferred to, stored in, or processed by parties located outside Malaysia. Where such transfers occur, royal36 ensures that appropriate safeguards are in place to protect your data, including contractual protections equivalent to applicable data protection standards.

By using the royal36 Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia where the data protection laws may differ from those applicable in your country of residence. Royal36 does not make such transfers without first satisfying itself that adequate protections are in place.

7. Data Retention

Royal36 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and in any event for no longer than required by applicable legal, regulatory, or contractual obligations. Specific retention periods are as follows:

• Player Account data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, to comply with AML record-keeping requirements and gaming licence obligations.
• Financial transaction records: Retained for a minimum of seven (7) years in accordance with financial record-keeping legislation.
• KYC verification documents: Retained for a minimum of five (5) years following the end of the business relationship, or longer if required by a specific regulatory request.
• Support communications: Retained for three (3) years from the date of the most recent interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until consent is withdrawn, and for two (2) years thereafter as evidence of the consent given.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with royal36's data destruction procedures.

8. Cookies & Tracking Technologies

The royal36 Platform uses cookies and similar tracking technologies to ensure proper Platform functionality, deliver a personalised user experience, and analyse Platform performance. The categories of cookies used are:

• Strictly necessary cookies: Required for core Platform functions including session management, royal36 login authentication, and security features. These cannot be disabled without impacting Platform functionality.
• Performance cookies: Collect anonymised data about how Players use the Platform (e.g., pages visited, time on page, error messages) to help royal36 improve the user experience. No personally identifiable information is collected by these cookies.
• Functional cookies: Remember your preferences such as language settings, preferred game view, and responsible gaming tool configurations.
• Analytics cookies: Used to understand aggregate user behaviour on the Platform. Data collected is not used to identify individual users.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to access and use the royal36 Platform, including the royal36 login function.

9. Your Data Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by royal36:

• Right of access: The right to request confirmation of whether royal36 holds your personal data, and to receive a copy of that data together with supplementary information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held about you by royal36.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing is unlawful. This right is subject to royal36's legal retention obligations and may not apply where data must be retained for AML or regulatory purposes.
• Right to restriction: The right to request that royal36 restrict the processing of your personal data in certain circumstances, including while the accuracy of data is contested.
• Right to data portability: The right to receive personal data you have provided to royal36 in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller, where technically feasible.
• Right to object: The right to object to processing of your personal data where that processing is based on royal36's legitimate interests, including profiling for responsible gaming purposes.
• Right to withdraw consent: Where royal36 processes your data on the basis of your consent (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact the royal36 Data Protection team as described in Section 14. Royal36 will respond to verified requests within 30 days. In complex cases, this period may be extended by a further 60 days, in which case you will be notified.

10. Children's Privacy

The royal36 Platform is strictly intended for adults aged 21 years and over. Royal36 does not knowingly collect, process, or store personal data relating to persons under the age of 21. Where royal36 becomes aware that personal data has been collected from a person under 21 without appropriate parental consent, it will take immediate steps to delete that data and close the associated account.

If you believe that a minor has accessed or registered on the royal36 Platform, please contact customer support immediately. Age verification is a mandatory requirement at registration and at any subsequent point where royal36 has reasonable grounds to question a Player's stated age. For more information on our age verification practices, see our Responsible Gaming page.

11. Security Measures

Royal36 implements a multi-layered information security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• SSL/TLS encryption on all data transmitted between your device and the royal36 Platform, including during the royal36 login process and all subsequent session activity.
• Salted cryptographic hashing of all Player account passwords. Royal36 does not store passwords in readable form.
• Segregated network architecture that physically separates player data systems from public-facing Platform infrastructure.
• Role-based access controls ensuring that royal36 staff can only access personal data to the extent required for their specific job function.
• Regular independent security audits and penetration testing conducted as a requirement of royal36's international gaming licence.
• Incident response procedures providing for prompt notification to affected Players and relevant regulatory authorities in the event of a personal data breach.

Notwithstanding these measures, no internet-based data transmission or storage system can be guaranteed to be 100% secure. Royal36 recommends that Players use strong, unique passwords for their royal36 accounts and enable any available account security features.

12. Third-Party Links

The royal36 Platform may contain links to third-party websites or services, including payment providers and gaming software documentation. This Privacy Policy applies exclusively to data processed by royal36 through the royal36 Platform and does not extend to any third-party websites or services. Royal36 accepts no responsibility for the privacy practices of third parties and recommends that you review the privacy policies of any third-party services you access.

13. Policy Updates

Royal36 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our gaming licence obligations. Where changes are material, royal36 will provide notice to Players via the Platform or by email to the registered account address at least 14 days prior to the effective date of the change.

The date of the most recent revision is displayed at the top of this page. Continued use of the royal36 Platform following the effective date of any update constitutes acknowledgement of the revised Privacy Policy. If you do not agree with the updated Policy, you must cease using the Platform and request account closure.

14. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by royal36, please contact our Data Protection team:

If you are not satisfied with royal36's response to your privacy concern, you have the right to escalate your complaint to the data protection supervisory authority in your jurisdiction, or to the dispute resolution mechanism associated with royal36's gaming licence.