Privacy Policy yes33 – Malaysia Player Data Protection

This Privacy Policy is published by yes33 and applies to all users of the yes33 platform, accessible at https://yes33.best and any associated mobile applications. This Policy explains how we collect, use, process, store, share and protect your personal data.

The yes33 Privacy Policy is prepared in accordance with the requirements of Malaysia Personal Data Protection Act 2010 (PDPA 2010) and international data protection best practices. By using the yes33 platform, you give your consent to the collection and processing of personal data as described in this policy.

In this policy, "personal data" refers to any information that can identify you directly or indirectly as an individual, including your name, phone number, email address, financial information, and platform usage data. "Processing" covers all operations carried out on personal data — collection, storage, use, sharing, and deletion.

Yes33 acts as the Data Controller (Data Controller) for personal data collected through our platform. This means we are responsible for ensuring your data is processed in compliance with applicable laws and established data protection principles.

Yes33 collects various categories of personal data depending on how you interact with our platform. Below is a full breakdown of the data that may be collected:

A. Data You Provide Directly

• Registration Information: Full name, date of birth, Malaysian phone number, email address, and password (stored in encrypted form).
• Identity Verification (KYC): A copy of your Malaysian identity card (MyKad), proof of address (utility bill or bank statement), and proof of payment method when required for account verification.
• Payment Information: Details of the payment method you use — your Touch 'n Go account number, GrabPay ID, Boost account number, ShopeePay ID, DuitNow phone number, or FPX bank account number. We do not store your credit/debit card details directly — this information is handled by licensed payment gateways.
• Communications with yes33: Records of your interactions with our customer support team, including support ticket history, Live Chat logs, and emails.

B. Automatically Collected Data

• Log and Technical Data: IP address, browser type, device operating system, screen resolution and device information.
• Platform Usage Data: Games played, session duration, login frequency, betting history, deposit and withdrawal history.
• Location Data: Approximate location derived from IP address, used solely for security and legal compliance purposes.
• Cookie Data: As stated in Section 8 of this Policy.

Yes33 collects and processes your personal data for legitimate and specific purposes only. We do not process your data for any purpose unrelated to the services you use. The following are the primary purposes for data processing at yes33:

• Account Management: Creating, verifying, managing, and securing your yes33 account — including identity verification (KYC) as required by law.
• Transaction Processing: Processing your deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX, and other Malaysian payment methods, as well as processing withdrawals to your bank account or digital wallet.
• Game Operations: Providing access to casino games, slots, Sports Betting, lottery, e-sports, and live matches on the yes33 platform.
• Security & Fraud Prevention: To detect and prevent suspicious activity, fraud, money laundering, and platform abuse.
• Legal Compliance: Meeting licensing requirements, reporting to relevant authorities, and fulfilling other applicable legal obligations.
• Customer Support: Handling your enquiries, complaints and support requests through yes33's support channels.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and provide appropriate support.
• Platform Improvements: Analysing usage data to improve the performance, user experience, and game library of yes33.
• Marketing Communications: Sending information about yes33 promotions, offers and new features — only where you have given your consent to receive such communications.

Yes33 processes your personal data on one or more valid legal bases as prescribed under Malaysia's PDPA 2010. All data processing activities are grounded in a clear and accountable basis:

• Contract Performance: Processing required to fulfil the service agreement between you and yes33 – such as handling deposits, withdrawals and managing your account.
• Legitimate Interest: Processing for the legitimate business interests of yes33 and our players, such as preventing fraud, ensuring platform security, and analysing usage for improvement purposes.
• Legal Obligation: Processing required to comply with Malaysian legal obligations, including anti-money laundering (AML) laws, licensing requirements, and reporting to the relevant authorities.
• Consent: For certain processing activities such as marketing communications and the use of non-essential cookies, yes33 obtains your explicit consent. You may withdraw this consent at any time.

When you make a deposit using DuitNow, playing slots, or contacting yes33 customer support, the data generated is processed on the basis of contract or legitimate interest. Data collected for direct marketing purposes is only processed with your consent, which may be withdrawn at any time.

Yes33 does not sell or disclose your personal data to third parties for their own commercial purposes. However, there are specific situations where we need to share your data with others in order to operate yes33's services effectively:

A. Third-Party Service Providers (Data Processors)

Yes33 works with trusted service partners to manage certain aspects of our platform. All third-party data processors are bound by data processing agreements that require them to protect your data to a standard equal to or higher than that of yes33:

• Payment Provider: Payment service providers that process transactions via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay and FPX. They receive only the data necessary to complete each transaction.
• Game Providers: Companies such as Pragmatic Play, PG Soft, Evolution Gaming, JILI Games, and others receive the minimum session data necessary to operate their games.
• Infrastructure Provider: Cloud service and data centre providers that store and process data on yes33's instructions.
• Analytics Services: Analytics tools used to understand platform usage and improve the player experience — data shared is aggregated or stripped of personal identifiers wherever possible.
• Anti-Fraud Services: Fraud detection and identity verification technology providers that safeguard the yes33 platform and its players.

B. Legal Requirements

Yes33 may be required to disclose your personal data to the relevant authorities if required by:

• A valid court order or lawful legal process.
• Reporting requirements under Malaysia's anti-money laundering (AML) laws.
• Requests from relevant licensing and regulatory authorities.
• National security or public safety requirements.

In all instances where your data is shared with third parties, yes33 ensures that such sharing is limited to what is strictly necessary (data minimisation principle) and is protected by appropriate data protection agreements.

Yes33 invests seriously in the technology and processes needed to protect our players' personal data. Data security is not merely a legal obligation for us — it is a moral responsibility to the Malaysian player community that entrusts us with their information.

Below are the technical and organisational security measures we have in place:

• 256-bit SSL Encryption: All communications between your browser or app and yes33's servers are encrypted using the latest Transport Layer Security (TLS). Any information you submit cannot be read by any third party while in transit.
• Data-at-Rest Encryption: Sensitive data such as passwords is stored as one-way hashes using robust algorithms. Sensitive financial information is encrypted at rest using AES-256 standards.
• Role-Based Access Control: Only yes33 staff with a legitimate business need are permitted to access player data. All access is logged for audit purposes, and all staff undergo rigorous data protection training.
• Two-Factor Authentication: Players can enable two-factor authentication (2FA) on their accounts for an additional layer of protection against unauthorised access.
• Security Monitoring: yes33's security monitoring system operates 24/7 to detect unusual activity, intrusion attempts, and other security threats.
• Regular Security Audits: The yes33 platform undergoes regular penetration testing and security audits by qualified third parties to identify and address any vulnerabilities.
• PCI-DSS Compliance: All financial transactions are processed through infrastructure that complies with the Payment Card Industry Data Security Standard (PCI-DSS).

Yes33 adheres to the principle of storage limitation — we retain your personal data only for as long as necessary to fulfil the purpose for which it was collected or to meet applicable legal requirements. The following outlines our data retention periods:

• Active Account Data: For the duration of your active account with yes33 and for the additional period stipulated by law following account closure.
• Financial Transaction Records: Minimum 7 years from the date of transaction, in line with Malaysia's tax and anti-money laundering legal requirements.
• KYC Records (Identity Verification): A minimum of 5 years after the business relationship ends, in accordance with anti-money laundering legal requirements.
• Support Communication Logs: 2 years from the date of last communication, for reference and dispute resolution purposes.
• Platform Usage Data & Logs: 12 months from the date of creation for security and analytics purposes.
• Marketing Data: Until you withdraw your consent to receive marketing communications.

Once the retention period expires, yes33 will securely delete or anonymise your personal data using methods that ensure it cannot be recovered. Anonymised data (where all personal identifiers have been fully removed) may be retained for longer periods for statistical and analytical purposes.

Yes33 uses cookies and similar tracking technologies to keep the platform running smoothly, enhance your experience, and understand how players interact with our platform. Cookies are small text files stored on your device by your web browser.

In addition to cookies, yes33 uses other technologies such as web beacons (small tracking pixels) in our marketing emails to detect whether an email has been opened. You can opt out of marketing emails by using the unsubscribe link included in every marketing email from yes33.

The yes33 platform is intended for individuals aged 18 and above only. yes33 does not knowingly collect, store, or process the personal data of children under the age of 18.

If we discover that personal data belonging to an individual under the age of 18 has been collected without the knowledge and consent of a parent or legal guardian, we will take the following steps immediately:

• Immediate closure of the account in question.
• Delete all relevant personal data from our systems within a reasonable timeframe, subject to the minimum retention periods required by law.
• Forfeit all balances, bonuses, and winnings associated with the account.
• Reporting the incident to the relevant authorities where required.

Yes33 makes it straightforward for players to exercise their data rights as provided under Malaysia's PDPA 2010. Below is a practical guide to submitting a data rights request to yes33:

1. Provide Your Request Details: Identify the type of right you wish to exercise (access, correction, erasure, portability, restriction or objection). Please provide your yes33 account number to help us locate your records.
2. Verify Your Identity: To protect your data from unauthorised requests, yes33 is required to verify your identity before processing any request. Please provide a copy of your MyKad and your registered phone number.
3. Submit Request: Contact us by email at support@yes33.best with the subject line "Data Rights Request – [Type: Access/Rectification/Deletion/etc]". Please include all required information in the email.
4. Acknowledgement of Receipt: yes33 will acknowledge receipt of your request within 3 business days and provide an estimated processing timeline.
5. Request Processing: yes33 will process your request within 14 working days. For more complex cases, this period may be extended to up to 30 days, with prior notice to you.

If you are not satisfied with yes33's response to your data rights request, you have the right to file a complaint with the Department of Personal Data Protection Malaysia (JPDP), the data protection supervisory authority in Malaysia.

While yes33 takes all reasonable steps to protect your personal data, we acknowledge that the risk of a data breach cannot be entirely eliminated in an online environment. As such, yes33 has a clear incident response procedure in place to handle any data breach that may occur.

In the event of a data breach involving the personal data of yes33 players, we will take the following steps:

• Detection & Containment: The yes33 security team will respond promptly to identify the source of the breach, halt any unauthorised access, and contain the damage as effectively as possible.
• Risk Assessment: We will assess the scope and impact of the breach — what data was involved, how many players may be affected, and what risks this poses to those players.
• Player Notifications: Players whose personal data may be affected by a serious breach will be notified within 72 hours of breach confirmation via their registered email or in-account notification. The notification will explain what occurred, what data may have been exposed, and what steps players can take to protect themselves.
• Reporting to Authorities: If the breach is material and meets the reporting threshold under applicable law, yes33 will report it to the Department of Personal Data Protection Malaysia (JPDP) and other relevant authorities.
• Recovery & Improvement: Once an incident has been resolved, yes33 will conduct a thorough review to identify the root cause and implement improvements to prevent similar incidents in the future.

Yes33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or improvements to the way we protect your data.

• The latest version of the Privacy Policy is always available at https://yes33.best/privacy-policy.
• The "Updated" date at the top of this document indicates when the last amendment was made.
• For material amendments (significant changes to how we collect or use your data), yes33 will notify registered players via email or in-platform notification at least 7 days before the amendment takes effect.
• Your continued use of the yes33 platform after any amendments take effect will be considered as your acceptance of the revised Privacy Policy.
• If you disagree with any amendments made, you have the right to close your account and request deletion of your data before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how yes33 protects your data.

If you have any questions, concerns, or requests relating to this Privacy Policy or how yes33 handles your personal data, please do not hesitate to reach out. Your privacy is our priority, and we are committed to addressing every enquiry seriously and promptly.

• Privacy Email: support@yes33.best – please use the subject line "Data Privacy – [Type of Enquiry]"
• Live Chat: Available 24/7 within the yes33 platform – the fastest way to get answers to general enquiries
• Email Response Time: We aim to respond to all privacy enquiries within 24 hours

For formal data rights requests (access, erasure, data portability), please send an email including the required identity verification details as specified in Section 10 of this policy.