Privacy Policy — dewa303

This Privacy Policy ("Policy") describes how dewa303 ("we", "us", "our", or "the Platform") collects, uses, stores, shares, and protects the personal data of users ("you", "your", or "Player") who access or register on the dewa303 platform at dewa303.lat, including all associated interfaces, APIs, and customer service channels.

dewa303 is committed to processing personal data lawfully, fairly, and transparently — consistent with the principles of internationally recognised data protection frameworks, including but not limited to the General Data Protection Regulation (GDPR) as applied through our licensing jurisdiction. We also acknowledge the obligations arising under Malaysia's Personal Data Protection Act 2010 (PDPA) as relevant to Malaysian users.

By registering an account, using the Platform's services, or submitting personal information in any context, you acknowledge that you have read and understood this Policy, and you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not create an account or use the Platform's services.

The following terms carry specific meanings throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could identify a natural person, directly or indirectly, including name, identification number, contact details, financial information, location data, or online identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — dewa303, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of dewa303 under a formal data processing agreement and in accordance with our instructions.
• "KYC" — Know Your Customer procedures requiring identity verification documents to be submitted by account holders.
• "Sensitive Data" — a subset of Personal Data requiring heightened protection, including government ID numbers, financial account details, and biometric identifiers.
• "Cookies" — small text files stored on your device by the Platform's website, used to maintain session state and collect usage analytics.

dewa303 collects the following categories of personal data in the course of operating the Platform and providing services to Malaysian players. Data is collected only to the minimum extent necessary for the specified purposes.

3.1 Account Registration Data

This information is collected at the point of account registration and is required to create and maintain your account. Providing false information during registration constitutes a breach of our Terms & Conditions.

3.2 KYC Identity Verification Data

KYC documents are collected prior to processing withdrawals and during enhanced due diligence reviews. These documents contain Sensitive Data including government identification numbers. They are processed exclusively for identity verification and AML compliance purposes.

3.3 Financial Transaction Data

We record all financial transactions associated with your account, including deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, USDT TRC20, and other accepted methods. Full payment card numbers are never stored on our systems; tokenised references are maintained by our payment processors.

3.4 Gaming Activity Data

3.5 Technical & Device Data

Technical data is collected automatically when you access the Platform. This data is used for security monitoring, fraud prevention, and platform performance optimisation. It is not used to build marketing profiles.

3.6 Communications Data

Records of your interactions with our customer support team — including live chat transcripts, email correspondence, and WhatsApp messages — are retained for quality assurance, dispute resolution, and regulatory audit purposes.

dewa303 collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit, contact customer support, or respond to a promotional offer.
• Automatically through the Platform — via server logs, cookies, and similar tracking technologies when you browse or use the Platform's website and gaming interfaces.
• From payment processors — confirmation and reference data from payment providers including Touch 'n Go eWallet, Boost, GrabPay, FPX, and bank transfer gateways upon processing of deposits and withdrawals.
• From identity verification providers — KYC verification results and fraud risk scores from authorised third-party identity verification services engaged to process document checks.
• From fraud prevention services — device fingerprinting data, velocity checks, and risk scores from Anti-Fraud and AML screening tools used to protect the integrity of the Platform.

We process personal data for the following clearly defined purposes. Data will not be used for any purpose materially different from those stated below without your prior consent or a new lawful basis.

• Account creation and management — to establish, verify, and maintain your dewa303 account, including password management and session authentication.
• KYC and identity verification — to verify your identity, confirm you meet the 21+ age requirement, and comply with Anti-Money Laundering (AML) obligations applicable under our licensing framework.
• Transaction processing — to facilitate deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, DuitNow, FPX, bank transfer, cryptocurrency, etc.) and maintain accurate financial records.
• Fraud and security monitoring — to detect, investigate, and prevent unauthorised access, fraudulent activity, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms & Conditions.
• Responsible gambling management — to apply and monitor player-configured limits (deposit limits, loss limits, session timers, self-exclusion) and to identify potential problem gambling behaviours for proactive outreach.
• Customer support — to respond to and resolve enquiries, complaints, and technical support requests submitted via live chat, WhatsApp, or email.
• Legal and regulatory compliance — to satisfy obligations under applicable international gaming licences, AML regulations, tax reporting requirements, and court or regulatory orders.
• Platform improvement — to analyse aggregated usage patterns for the purpose of improving the Platform's performance, user experience, and gaming content offering.
• Promotional communications — to send you relevant bonus offers, promotional updates, and account notifications via email or in-platform messages, where you have not opted out.

Each processing activity carried out by dewa303 is grounded in one or more of the following recognised lawful bases:

• Contractual necessity — processing required to fulfil obligations under the account agreement, including registration, transaction processing, and customer support.
• Legal obligation — processing required to comply with applicable laws and regulatory requirements, including KYC, AML obligations, and licensing conditions.
• Legitimate interests — processing for fraud prevention, platform security, and aggregate analytics, where our legitimate interests are not overridden by your rights and freedoms. We conduct balancing tests for all legitimate interest processing activities.
• Consent — processing for marketing communications and non-essential cookies, where your freely given, specific, informed, and unambiguous consent has been obtained. Consent may be withdrawn at any time without detriment.
• Vital interests — in exceptional circumstances, processing to protect the vital interests of an individual (e.g., safeguarding disclosures related to responsible gambling crisis situations).

dewa303 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data with external parties only where strictly necessary and on the following bases:

7.1 Authorised Service Providers (Data Processors)

We engage third-party service providers who process personal data on our behalf under formal data processing agreements, including:

• Payment processors and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow gateways, FPX, cryptocurrency custodians) — for transaction settlement purposes only.
• Identity verification and KYC providers — for document authentication, liveness detection, and AML screening.
• Cloud infrastructure and data hosting providers — for secure storage and processing of Platform data under contractual data protection obligations.
• Customer support platform providers — for management of live chat, WhatsApp, and email communications.
• Fraud detection and cybersecurity services — for real-time risk scoring, device fingerprinting, and anomaly detection.

All service providers are subject to contractual obligations to process data only on our instructions, maintain appropriate security standards, and refrain from using your data for their own purposes.

7.2 Legal and Regulatory Disclosure

dewa303 may disclose personal data to competent authorities, regulators, law enforcement agencies, or courts where we are legally required or compelled to do so, including in the context of AML investigations, fraud enquiries, or valid legal process. We will notify you of such disclosures where permitted by law.

7.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, personal data held by dewa303 may be transferred to the relevant successor entity. You will be notified of any such transfer and the privacy implications prior to its taking effect, and your rights as described in Section 8 will be preserved.

Subject to applicable law and certain limited exceptions (such as where data must be retained for legal compliance), you hold the following rights with respect to your personal data held by dewa303. Requests are fulfilled within thirty (30) calendar days unless extended for complex cases, with prior notification.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Account Username]". We may require identity verification before processing your request to protect against unauthorised access.

dewa303 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal, licensing, or regulatory obligations. The following table summarises our standard retention schedules:

Upon expiry of the applicable retention period, personal data is either securely deleted or rendered permanently anonymous such that it can no longer be linked to any individual. Data held solely for statistical analysis is anonymised at the earliest practicable opportunity.

The dewa303 Platform uses cookies and similar technologies to ensure the site functions correctly, maintain your session state, and collect aggregate analytics data. The following categories of cookies are deployed:

• Strictly Necessary Cookies — required for the Platform to operate. These include session authentication tokens and security cookies. These cannot be disabled without affecting core functionality.
• Functional Cookies — store your preferences such as language settings, deposit limit display, and table game configurations to improve your experience on return visits.
• Analytics Cookies — collect anonymised data on how users interact with the Platform (pages visited, features used, session durations) to enable performance improvements. No personally identifiable data is transmitted in analytics payloads.
• Security Cookies — used for device fingerprinting and bot detection to protect the integrity of the Platform and detect fraudulent access attempts.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain functional cookies may impair your experience on the Platform. dewa303 does not deploy third-party advertising or behavioural tracking cookies.

As an internationally licensed platform serving users including those based in Malaysia, dewa303 may transfer personal data to service providers and infrastructure partners located in jurisdictions outside Malaysia. Such transfers are conducted only where:

• The destination country provides an adequate level of data protection as recognised by applicable international frameworks;
• Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or binding corporate rules;
• The transfer is necessary for the performance of the contract between you and dewa303 (e.g., processing a payment via an internationally hosted gateway).

All international data transfers are documented and reviewed for risk on an ongoing basis. You may request details of specific international transfer safeguards by contacting our data protection contact at [email protected].

The dewa303 Platform is strictly prohibited for use by individuals under the age of 21 years. We do not knowingly collect or process personal data from individuals under 21. If we become aware that personal data has been submitted by or on behalf of a person under 21, we will take immediate steps to delete such data and close the associated account.

If you are a parent or guardian and believe your child under the age of 21 has registered on or accessed the Platform, please notify us immediately at [email protected]. We will investigate and take appropriate action within 48 hours of receiving your notification.

dewa303 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our Platform servers.
• AES-256 encryption for personal data stored at rest in our database infrastructure.
• Role-based access control (RBAC) limiting access to personal data to personnel with a documented operational need.
• Multi-factor authentication (MFA) requirements for all administrative access to systems containing personal data.
• Regular vulnerability assessments, penetration testing, and security audits conducted by independent third-party specialists.
• Automated intrusion detection and real-time alerting systems monitoring for anomalous access patterns.
• Formal data breach response procedures, including notification obligations to relevant authorities and affected users within applicable legal timeframes.

Notwithstanding these measures, no transmission over the internet or data storage system is absolutely secure. You are responsible for maintaining the security of your own account credentials. In the event of a suspected security incident affecting your account, contact us immediately at [email protected].

dewa303 may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or operational requirements. Material updates — those that materially affect your rights or the nature of data processing — will be communicated to registered users via email and/or a prominent notification on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this document will be revised with each update. We encourage you to review this Policy periodically. Continued use of the Platform following publication of a revised Policy constitutes your acceptance of the updated terms, except where your explicit consent is required by law for specific new processing activities.

For all privacy-related enquiries, data rights requests, or concerns about how we handle your personal data, please contact the dewa303 data protection team using the details below. All contact information is provided as plain text — please do not attempt to use it as a clickable link.

• Email: [email protected] — include "Privacy Request" in the subject line for priority handling.
• Live Chat: Available 24/7 via the Platform. Request to speak with a compliance team member for data protection matters.
• Response Timeframe: All data rights requests are acknowledged within 3 business days and fulfilled within 30 calendar days. Complex requests may require an extension of up to a further 60 days with prior notification.
• Identity Verification: To protect your data against unauthorised third-party access, we will require identity verification before processing access, erasure, or portability requests.

For full information on our overall terms of service, please refer to our Terms & Conditions. For information on responsible gambling tools available to Malaysian players, please visit our Responsible Gambling page.