Royal36 Privacy Policy — Personal Data Protection for Malaysian Players

Royal36 collects your personal data only when it is necessary to provide the services you have requested. The categories of data we collect are as follows:

Royal36 does not collect sensitive personal data such as health information, religious beliefs or political views unless required by law. All data collection adheres to the principle of data minimisation — we only collect what is strictly necessary.

Royal36 uses the personal data collected for the following lawful and transparent purposes:

• Account Management: Processing registrations, verifying your identity, managing your player account and granting access to all Royal36 services.
• Transaction Processing: Securely and accurately processing deposits and withdrawals via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u and CIMB Clicks in Malaysian Ringgit (RM).
• Gaming Services Provision: Providing access to slots, Live Casino, baccarat, Sports Betting (Malaysia Super League, EPL, badminton), live matches and virtual sports, all with a personalised experience.
• Customer Service: Handling enquiries, complaints and support requests via live chat, email and WhatsApp in Bahasa Malaysia.
• Security & Fraud Prevention: To detect and prevent fraud, money laundering, system abuse, multi-account activity, and any violations of our Terms & Conditions.
• Legal Compliance: Fulfilling legal obligations under Malaysia's Personal Data Protection Act 2010 (PDPA), anti-money laundering (AML) requirements and other applicable compliance obligations.
• Platform Improvement: Analysing platform usage patterns to improve the design, functionality, performance and overall experience for Royal36 players.
• Marketing Communications: Sending you Royal36 promotions, bonuses and exclusive offers via email or in-platform notifications — only if you have consented to receiving such communications.

Royal36 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, there are limited circumstances in which Royal36 may share your data with specific parties for legitimate reasons:

• Payment Providers: Required transaction information is shared with payment providers such as Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u, and CIMB Clicks solely for the purpose of processing your deposits and withdrawals in MYR.
• Game Providers: Required game data is shared with game software providers that supply slots, live casino, baccarat, and other games on the Royal36 platform to ensure proper game functionality and fairness.
• Technical Service Providers: Third-party companies that provide infrastructure, analytics, cybersecurity and technical support services to Royal36 may have limited access to your data in the course of performing their duties.
• Legal Obligations: Royal36 may disclose your data to government authorities, regulatory bodies or law enforcement agencies when required by applicable Malaysian law, or when necessary to protect the rights, property or safety of Royal36 and its users.
• Business Transfers: If Royal36 is involved in a merger, acquisition or asset sale, player data may be transferred as part of that transaction. You will be notified via a prominent notice before any such transfer takes place.

All third parties that receive data from Royal36 are required to maintain the confidentiality of that data and may not use it for any purpose other than what is specified in their contractual agreement with Royal36.

Royal36 implements a range of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration or destruction:

• 256-Bit SSL Encryption: All communications between your browser and Royal36's servers are encrypted using industry-standard 256-bit TLS/SSL protocol. This ensures that all transmitted data — including login credentials, payment details and personal information — cannot be intercepted.
• Stored Data Encryption: Sensitive data stored in Royal36's databases — including passwords (stored as salted hashes), financial information, and identity verification documents — is encrypted using strong encryption algorithms.
• Strict Access Controls: Internal access to Royal36 player data is restricted on a least-privilege basis. Only staff who require access to specific data to perform their duties are permitted, and all access is logged and audited on a regular basis.
• 24/7 Security Monitoring: Royal36's systems are continuously monitored to detect suspicious activity, unauthorised access attempts and other security threats using real-time monitoring and threat detection tools.
• Regular Security Testing: Royal36 conducts regular penetration testing and vulnerability assessments carried out by independent security experts to identify and address any weaknesses in our systems before they can be exploited.
• Staff Training: All Royal36 staff with access to player data undergo regular privacy and data security training to ensure they understand and comply with best-practice data protection standards.

Royal36 uses cookies and similar tracking technologies to enhance your experience on our platform. The following are the types of cookies we use:

• Essential Cookies: These cookies are essential for the core functionality of the Royal36 platform. Without them, certain services such as login, session management and security cannot function properly. These cookies cannot be disabled.
• Performance / Analytics Cookies: These cookies help us understand how players use the Royal36 platform — which pages are most visited, how long players spend in each section, and where players encounter issues. This information is used to improve the platform.
• Functional Cookies: These cookies allow the Royal36 platform to remember your preferences such as language, display settings and game preferences, in order to deliver a more personalised experience.
• Marketing Cookies: These cookies help us show you relevant Royal36 advertisements and promotions based on your interests and activity. You may opt out of these cookies at any time.

How to Manage Cookies: You can control and manage cookies through your web browser settings. Most modern browsers such as Chrome, Firefox, Safari and Edge allow you to delete, block or receive notifications when cookies are sent. Please refer to your browser's help section for guidance.

Please note that disabling certain cookies may affect the functionality of the Royal36 platform and your overall gaming experience.

As a Royal36 player and under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights with respect to your personal data:

To exercise any of the rights above, contact Royal36's privacy team by emailing support@royal36.click with the subject line "Data Privacy Request". Please include your account number and a brief description of your request. We will respond within 21 working days.

Royal36 retains your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable Malaysian law:

• Active Account Data: For as long as your Royal36 account remains active, we retain the personal data necessary to provide services to you.
• Data After Account Closure: After you close your Royal36 account, we will retain certain data for the minimum period required by law — typically 7 years for financial records under Malaysia's anti-money laundering legislation.
• Communication Data: Customer support communication records are retained for 2 years for dispute resolution and service improvement purposes.
• Technical Data & Logs: Access logs and technical data are retained for 12 months for security and incident investigation purposes.
• Marketing Data: If you unsubscribe from marketing communications, we will delete your marketing data within 30 days of receiving your request.

Once the retention period expires, your data will be securely deleted or anonymised in accordance with Royal36's approved data deletion procedures. Anonymised data can no longer be linked back to you and may be retained for analytical purposes without a time limit.

Royal36's services are strictly for individuals aged 18 and above. Royal36 strictly prohibits the use of its platform by minors and individuals under the legal age.

Royal36 does not knowingly collect personal data from individuals under the age of 18. All registration applicants are required to confirm that they are 18 years of age or older. Additional age verification through official documents may be requested during the KYC (Know Your Customer) process.

Should Royal36 discover that personal data of an underage individual has been collected inadvertently, we will take immediate steps to delete that data and close the account in question without delay.

If you are a parent or guardian and suspect that your child who is underage has registered for or used the Royal36 platform, please contact us immediately at support@royal36.click. We will take immediate action.

The Royal36 platform may contain links to third-party services or content, such as game providers and payment processors. Royal36's Privacy Policy applies solely to the Royal36 platform itself and does not cover the privacy practices of those third parties.

Royal36 is not responsible for the privacy policies or data handling practices of third parties. We encourage you to read the privacy policy of every third-party service you use, including payment providers such as Touch 'n Go eWallet, GrabPay, and DuitNow.

We only work with third parties that have robust privacy policies and adhere to data security standards equivalent to or exceeding those of Royal36. All contracts with third-party providers include data protection clauses that legally bind them to safeguard Royal36 players' data.

If you have any questions, concerns, or requests regarding this Privacy Policy or how Royal36 handles your personal data, please contact us through the following channels:

Royal36 will respond to all privacy enquiries within 21 working days. For urgent matters relating to a suspected data breach or data misuse, please mark your email as "URGENT" and we will endeavour to respond within 48 hours.

If you are not satisfied with Royal36's response to your privacy concerns, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or any other relevant competent authority.