Your Data, Your Rights
grap333 is committed to handling your personal data responsibly, transparently, and in compliance with applicable privacy legislation. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights as a Malaysian player on our platform.
Privacy at a Glance
grap333 collects only the personal data necessary to operate your account, process payments, comply with KYC obligations, and deliver our gaming services. We do not collect personal data speculatively or in excess of what is required for defined operational purposes.
All personal data held by grap333 is stored on secure, encrypted servers. Access to personal data is restricted to grap333 staff and authorised service providers who require it to perform their specific functions. We apply industry-standard data security measures throughout our infrastructure.
grap333 does not sell your personal data to third parties. We share your data only where required to deliver our services (payment processors, identity verification providers), where required by law, or with your explicit consent. All third-party data processors are contractually bound to protect your data.
Malaysian players have the right to access their personal data held by grap333, request corrections, request deletion (subject to legal retention obligations), and withdraw consent to marketing communications. All data subject requests are handled within 30 days of receipt.
grap333 uses cookies solely for session management, security, and platform functionality. We do not use third-party advertising cookies or sell cookie-derived data to advertising networks. Your browsing activity on grap333 is not used to serve you targeted advertising on other websites.
grap333's data handling practices comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and the data protection requirements of our international gaming licence. Where these standards conflict, we apply the more protective standard to your personal data.
1.1 This Privacy Policy ("Policy") describes how grap333 ("we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data about individuals ("you", "your") who access or use the grap333 online gaming platform at grap333.net (the "Platform").
1.2 This Policy applies to all personal data processed in connection with your registration and use of the Platform, including data collected during account registration, identity verification (KYC), payment transactions, customer support interactions, and general browsing activity on grap333.net.
1.3 By registering an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the collection and processing of your personal data as described in this Policy, you should not register an account or use the Platform.
1.4 This Policy should be read together with the grap333 Terms and Conditions, which are available at /terms-conditions.
2.1 grap333, the operator of the Platform at grap333.net, acts as the data controller in respect of personal data collected through the Platform. As data controller, grap333 determines the purposes and means of processing your personal data.
2.2 For all data protection enquiries and data subject requests, you may contact us via live chat support (available 24/7) or by email at [email protected] (plain text — not a clickable link).
3.1 Registration Data: Full legal name, date of birth, email address, and country and state of residence as provided during account registration.
3.2 Identity Verification (KYC) Data: Government-issued identity document (Malaysian MyKad or passport), selfie photograph or live verification image, and proof of residential address (utility bill or bank statement). This data is required by our gaming licence and anti-money laundering obligations.
3.3 Financial Data: Payment method details (e-wallet identifiers, FPX bank account references), transaction history, deposit amounts, withdrawal amounts, and currency of transactions.
3.4 Gaming Activity Data: Game history, wager amounts, wins and losses, session duration, and game preferences.
3.5 Technical Data: IP address, device type and operating system, browser type and version, session timestamps, and platform interaction logs.
3.6 Communications Data: Records of your interactions with grap333 customer support, including live chat transcripts and email correspondence.
3.7 Responsible Gaming Data: Self-imposed limits, cooling-off periods, self-exclusion records, and any information you voluntarily provide about your gaming behaviour in the context of responsible gaming tools.
4.1 grap333 collects personal data directly from you when you: register an account; complete KYC verification; make a deposit or withdrawal; contact customer support; use responsible gaming tools; or communicate with us in any other manner.
4.2 grap333 collects technical data automatically through your use of the Platform via server logs, session cookies, and standard web server analytics. This technical data collection is necessary for the secure operation of the Platform.
4.3 grap333 may receive data about you from third-party identity verification providers used to conduct KYC checks, and from payment service providers in connection with the processing of your transactions. All such third parties are required to handle your data lawfully.
5.1 grap333 processes your personal data for the following purposes, and on the following legal bases:
6.1 KYC data — including copies of identity documents, selfie photographs, and proof of address — is collected and processed solely for the purpose of complying with our gaming licence requirements and applicable anti-money laundering laws. grap333 does not use KYC data for marketing or any purpose beyond identity and age verification and AML compliance.
6.2 KYC verification is conducted using a reputable third-party identity verification provider. Your identity documents are transmitted securely and processed in accordance with that provider's data processing agreement with grap333. The provider is contractually prohibited from using your KYC data for any purpose other than verification on grap333's behalf.
6.3 KYC data is retained for the period required by our gaming licence and applicable law (typically a minimum of five years from account closure), after which it is securely deleted.
7.1 grap333 does not store full payment card numbers. Financial transactions are processed through PCI-DSS compliant payment service providers. grap333 retains transaction reference data, amounts, and dates for accounting, AML, and dispute resolution purposes.
7.2 Payment method identifiers (e-wallet account references, FPX bank references) are stored to facilitate withdrawals to the same payment method used for deposits, as required by grap333's anti-money laundering procedures.
8.1 grap333 uses the following categories of cookies on the Platform:
8.2 grap333 does not use third-party advertising cookies or participate in cross-site behavioural advertising networks. Your activity on the grap333 Platform is not used to serve you targeted advertisements on third-party websites.
9.1 grap333 does not sell your personal data to third parties under any circumstances. We may share your personal data with the following categories of recipients solely to the extent necessary for the stated purpose:
9.2 All third parties who process your personal data on grap333's behalf are subject to data processing agreements that require them to process your data only in accordance with grap333's instructions and in compliance with applicable data protection law.
10.1 grap333 may transfer your personal data to countries outside Malaysia in connection with the operation of our gaming platform and the use of third-party service providers. Where such transfers occur, grap333 ensures that appropriate safeguards are in place to protect your data, including contractual protections equivalent to those required under Malaysian data protection law.
11.1 grap333 retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to legal and regulatory minimum retention periods. In practice:
12.1 grap333 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include 256-bit SSL encryption for all data in transit, encrypted storage for sensitive data at rest, role-based access controls limiting staff access to personal data on a need-to-know basis, and regular security assessments of our infrastructure.
12.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, grap333 will notify the relevant supervisory authority and, where required, affected players, within the timeframes required by applicable law.
13.1 Subject to applicable law, you have the following rights in relation to your personal data held by grap333:
13.2 To exercise any of these rights, please contact grap333 customer support via live chat or email. We will respond to all data subject requests within 30 days. In complex cases, this period may be extended by an additional 30 days, and you will be notified of any such extension.
13.3 Please note that certain rights — including the right to erasure — may be limited where grap333 is required to retain your personal data to comply with legal obligations (for example, KYC and AML record-keeping requirements imposed by our gaming licence).
14.1 grap333 may send you promotional communications (email newsletters, promotional offers, platform updates) where you have opted in to receive such communications at registration or subsequently through your account settings.
14.2 You may withdraw your consent to marketing communications at any time by updating your communication preferences in your account settings or by contacting grap333 customer support. Withdrawal of consent does not affect the lawfulness of marketing communications sent prior to withdrawal.
14.3 Transactional communications (account verification emails, withdrawal confirmations, security alerts, KYC request notifications) are not marketing communications and are sent regardless of your marketing communication preferences, as they are necessary for the operation of your account.
15.1 The grap333 Platform is strictly for adults aged 21 years and older. grap333 does not knowingly collect personal data from persons under 21 years of age. The mandatory KYC age verification process is designed to prevent underage access to the Platform.
15.2 If grap333 discovers that personal data has been collected from an individual under 21 years of age, all such data will be immediately deleted, the account will be closed, and any deposits returned to the payment method used.
16.1 grap333 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date at the top of this Policy indicates when it was last revised.
16.2 Where changes are material, grap333 will notify registered players via email and by displaying a prominent notice on the Platform. We encourage you to review this Policy periodically. Your continued use of the Platform following notification of a revised Policy constitutes acceptance of the changes.
For all privacy-related enquiries, data subject requests, or complaints relating to grap333's handling of your personal data, please contact us through the following channels:
grap333 takes all privacy complaints seriously and will acknowledge your complaint within 5 business days and provide a substantive response within 30 days of receipt.
Play with Confidence
Join thousands of Malaysian players who trust grap333 with their gaming entertainment. Fully licensed, bank-grade security, and transparent data practices. 21+
Sign In to grap333Please gamble responsibly. See our Responsible Gaming page for player protection tools.