Privacy Policy

spin321 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who registers for or accesses the spin321 platform. This Privacy Policy sets out, in clear and accessible language, what personal data spin321 collects, how that data is used, with whom it may be shared, how long it is retained, and what rights you hold over it.

spin321 processes personal data in accordance with its obligations under applicable data protection legislation, including the Malaysian Personal Data Protection Act 2010 (PDPA) and any equivalent legislation in jurisdictions where spin321 holds a gaming licence. Where processing occurs under multiple regulatory frameworks, spin321 applies the higher standard.

This Policy applies to all Players, prospective players, and website visitors. By registering for a spin321 account or using the spin321 website, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you should not register for or use the spin321 platform.

spin321 collects personal data through several channels: directly from you when you register, from your interactions with the platform, and in some cases from third-party verification providers. The categories of personal data we collect include:

• Full legal name as it appears on your Malaysian MyKad or other government-issued identity document;
• Date of birth (used to verify that you are 21 years of age or older);
• Residential address, including state and postcode within Malaysia;
• Email address (used as your primary account identifier and for communications);
• Mobile phone number;
• Copy of your Malaysian MyKad (front and back) or equivalent identity document, submitted during KYC verification;
• Selfie or facial image submitted for identity matching during KYC.

• Payment method details — including Touch 'n Go eWallet account reference, Boost account reference, GrabPay account reference, DuitNow/FPX bank account details, Maybank2u or CIMB account references, or USDT TRC20 wallet addresses, as applicable;
• Deposit and withdrawal history;
• Transaction reference numbers and timestamps;
• Source-of-funds documentation where required under anti-money laundering (AML) procedures.

• Game session logs, including games played, stakes placed, outcomes, and session duration;
• Sportsbook bet history, including markets, odds, amounts, and settlement outcomes;
• Bonus and promotion usage history;
• Responsible gaming tool settings, including any deposit limits, self-exclusion periods, or cooling-off periods you have activated.

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type;
• Session identifiers and authentication tokens;
• Pages visited, time spent on each section, and navigation paths within the spin321 platform;
• Cookie and similar tracking data as described in Section 6.

• Records of communications between you and spin321's support team via live chat, WhatsApp, or email, including the content of those communications;
• Your marketing communication preferences.

spin321 uses personal data collected from Players for the following purposes:

• Account administration: to create, manage, and maintain your spin321 account, including verifying your identity and age;
• Service delivery: to provide access to the games, sportsbook, and other services available on the spin321 platform;
• Payment processing: to process deposits and withdrawals via your selected MYR payment method, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank2u, CIMB, and USDT TRC20;
• Regulatory compliance: to fulfil spin321's obligations under applicable gaming regulations, AML legislation, and PDPA requirements, including KYC identity verification and transaction monitoring;
• Fraud prevention and security: to detect, investigate, and prevent fraud, money laundering, and other forms of prohibited conduct on the platform;
• Responsible gaming: to monitor gaming patterns for indicators of problem gambling and to administer self-exclusion, deposit limits, and other responsible gaming tools;
• Customer support: to respond to your queries, complaints, and support requests;
• Marketing communications: to send you promotional offers, bonus notifications, and updates about spin321 — but only where you have provided consent and not opted out;
• Platform improvement: to analyse usage patterns and improve the spin321 platform's functionality, performance, and user experience.

spin321 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and spin321, including account registration, payment processing, and game delivery;
• Legal obligation: Processing required to comply with spin321's legal obligations, including KYC verification, AML transaction monitoring, and regulatory reporting;
• Legitimate interests: Processing that is necessary for spin321's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your data protection rights;
• Consent: Processing based on your express consent, including the sending of marketing communications. You may withdraw consent for marketing communications at any time by contacting spin321 support.

spin321 does not sell your personal data to third parties. spin321 may share your data with the following categories of recipients in limited, defined circumstances:

• Game providers and software vendors: spin321's game providers (such as Pragmatic Play, PG Soft, Habanero, and others) may receive limited session data necessary to authenticate your session and deliver games. These providers process data under contractual obligations with spin321.
• Payment processors: Your payment method details are processed by the relevant payment gateway operators (Touch 'n Go, Boost, GrabPay, FPX/DuitNow, Maybank, CIMB) for the purpose of executing deposits and withdrawals. spin321 does not store full payment credentials.
• KYC and identity verification providers: spin321 works with licensed identity verification service providers to authenticate Players' identity documents and facial data during the KYC process.
• Regulatory and law enforcement authorities: spin321 may disclose personal data to its licensing authority, Malaysian regulatory bodies, or law enforcement agencies where required to do so by law or court order.
• AML compliance services: Transaction data may be shared with third-party AML screening providers to fulfil spin321's anti-money laundering obligations.
• Fraud prevention networks: Where fraud is suspected, spin321 may share relevant data with fraud prevention services to protect Players and the platform.

All third parties with whom spin321 shares personal data are required to handle that data securely, in compliance with applicable data protection law, and solely for the purpose for which it was shared.

spin321 uses cookies and similar tracking technologies to operate the platform, maintain your login session, and improve your experience. The categories of cookies used include:

• Strictly necessary cookies: Required for the platform to function, including session cookies that maintain your login state. These cannot be disabled without preventing use of the platform.
• Functional cookies: Used to remember your preferences, such as language settings and display preferences.
• Analytics cookies: Used to collect aggregated, anonymised data about how Players interact with the spin321 platform, enabling spin321 to identify and improve areas of the site. Analytics data is not linked to your personally identifiable information.
• Security cookies: Used to detect and prevent fraudulent access attempts and to protect the integrity of your account session.

By using the spin321 platform, you consent to the placement of strictly necessary and security cookies. For functional and analytics cookies, you may manage your preferences via your browser settings. Note that disabling certain cookies may impair the functionality of the platform.

spin321 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to any longer retention periods required by spin321's licensing authority or applicable law.

As a general guide:

• Account registration and KYC data: retained for a minimum of five (5) years following account closure, as required under AML regulations;
• Transaction records: retained for a minimum of five (5) years following the date of the transaction;
• Customer support communications: retained for a minimum of three (3) years;
• Marketing preferences: retained until you withdraw consent or for two (2) years from your last interaction with spin321, whichever is earlier.

Following expiry of the applicable retention period, personal data is securely deleted or anonymised.

spin321 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security);
• Encryption of sensitive data at rest, including payment reference data and identity documents;
• Access controls restricting internal access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of the spin321 platform;
• Segregation of Player funds from spin321's operational accounts.

No system is entirely immune to breach. In the event of a personal data breach that poses a risk to your rights and freedoms, spin321 will notify you and the relevant regulatory authorities in accordance with applicable law.

Subject to applicable law and spin321's regulatory obligations, you have the following rights in respect of your personal data held by spin321:

• Right of access: You may request a copy of the personal data spin321 holds about you.
• Right to rectification: You may request that spin321 correct any inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where spin321 no longer has a lawful basis for retaining it, subject to regulatory retention obligations.
• Right to restrict processing: You may request that spin321 restrict processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that spin321 provide your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to object: You may object to processing based on spin321's legitimate interests, subject to spin321 demonstrating compelling grounds to continue processing.

To exercise any of the above rights, contact spin321's support team. Requests will be addressed within a reasonable timeframe and no later than thirty (30) days of receipt. spin321 may require you to verify your identity before processing a data rights request.

spin321's primary player base is in Malaysia, and we take steps to ensure personal data is processed within appropriate jurisdictions. Where data is transferred outside Malaysia — for example, to game providers or identity verification services with infrastructure in other countries — spin321 ensures that such transfers are made with appropriate safeguards in place, including contractual data processing agreements that meet the standard required under the PDPA and applicable gaming licence conditions.

spin321 reserves the right to update this Privacy Policy at any time. Where changes are material, spin321 will notify registered Players via their registered email address prior to the changes taking effect. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the spin321 platform following notification of changes constitutes acceptance of the updated Privacy Policy. If you do not accept the revised Policy, you should close your account before the changes take effect.