Privacy Policy — rokok33 Online Gaming Platform

This Privacy Policy ("Policy") is published by rokok33 ("we", "us", "the Platform") and applies to all personal data collected from individuals ("you", "Player", "User") who access the rokok33 website at rokok33.club, register an account, use any gaming product, contact the support team, or otherwise interact with rokok33 services in any capacity.

rokok33 is committed to processing personal data lawfully, fairly, and transparently, and to protecting the privacy rights of all players — particularly those based in Malaysia, where data protection obligations are governed primarily by the Personal Data Protection Act 2010 (PDPA) and associated subsidiary legislation.

This Policy should be read alongside the rokok33 Terms & Conditions and the Responsible Gaming policy, both of which form part of the agreement between you and rokok33. By using the rokok33 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

rokok33 collects personal data through the following channels:

• Direct provision: Information you provide when registering an account, completing identity verification, making a deposit or withdrawal request, submitting a support query, or responding to a promotional offer.
• Automated collection: Technical and behavioural data collected automatically when you access the platform, including IP address, device identifiers, browser type, session timestamps, pages visited, and betting activity.
• Third-party sources: Identity and financial verification data obtained from fraud prevention agencies, KYC service providers, and payment processors including FPX, DuitNow, and e-wallet operators, where required to fulfil our legal obligations.
• Cookies and similar technologies: Browsing data collected through cookies placed on your device when you access rokok33.club. See Section 5 for full details.

We do not knowingly collect special category data (such as health, biometric, or political opinion data) unless specifically required for responsible gaming assessments, in which case we will seek your explicit consent and handle such data with heightened protection.

rokok33 processes your personal data for the following purposes:

• Creating and managing your rokok33 player account, including verifying your identity, age, and eligibility.
• Processing deposits and withdrawals in Malaysian Ringgit through your chosen payment method, including Touch 'n Go eWallet, Boost, DuitNow, or FPX.
• Providing and improving rokok33 gaming products, including the sportsbook, live casino, Toto 4D service, and slots library.
• Detecting, investigating, and preventing fraud, money laundering, multi-accounting, and other prohibited activities under the rokok33 Terms & Conditions.
• Complying with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations under Malaysian law and any applicable international regulatory framework.
• Monitoring gaming activity to identify indicators of problem gambling and to facilitate the delivery of responsible gaming tools including deposit limits and self-exclusion.
• Responding to your support enquiries, processing complaints, and resolving betting disputes.
• Sending transactional communications including deposit confirmations, withdrawal updates, and account security alerts.
• Sending promotional and marketing communications where you have provided consent or where permitted under applicable law (see Section 9).
• Maintaining records as required by applicable law, including tax reporting obligations and regulatory record-keeping mandates.

rokok33 does not sell your personal data. We may disclose your personal data to the following categories of third parties in the ordinary course of platform operations:

• Payment processors: Malaysian banks, FPX network operators, Touch 'n Go, Boost, GrabPay, DuitNow, and other payment service providers to process your financial transactions.
• Identity verification providers: KYC and document verification service providers engaged to confirm player identity and age.
• Fraud prevention and AML screening services: Providers that screen transactions and account activity against watchlists and risk indicators as required by applicable AML regulations.
• Game software providers: Licensed game developers and live casino operators whose software is integrated into the rokok33 platform. These providers may receive session data necessary to deliver their games to your device.
• Regulatory and law enforcement authorities: Where rokok33 is legally required to disclose data to a competent authority, including in response to a lawful court order, regulatory investigation, or AML reporting obligation.
• Professional advisors: Legal, accounting, and auditing firms engaged by rokok33 who require access to data in the course of providing professional services, subject to confidentiality obligations.

All third-party service providers engaged by rokok33 are required to process your personal data only on rokok33's documented instructions and to maintain appropriate technical and organisational security measures. We do not transfer personal data to third parties for their own independent marketing purposes.

rokok33 uses cookies and similar tracking technologies on rokok33.club to operate the platform, maintain your session, and improve service quality. The following types of cookies are used:

• Strictly necessary cookies: Required for the platform to function. These enable session management, authentication state, and security features. They cannot be disabled without affecting platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred sports markets, and display configurations between sessions.
• Analytics cookies: Collect aggregated, anonymised data about how players use the platform — page views, navigation paths, feature usage — to help rokok33 improve the player experience.
• Security cookies: Used for fraud detection, multi-account identification, and bot activity prevention.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use rokok33. Disabling other cookie types may affect your experience but will not prevent basic access to the platform.

rokok33 implements a comprehensive information security programme to protect personal data against unauthorised access, disclosure, alteration, and destruction. Security measures include:

• 256-bit SSL/TLS 1.3 encryption for all data in transit between your device and rokok33 servers.
• AES-256 encryption for personal and financial data stored in rokok33 databases.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for all rokok33 staff with access to player data systems.
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent security specialists.
• Comprehensive access logging and anomaly detection systems to identify and respond to potential data breaches.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, rokok33 will notify affected players and relevant authorities without undue delay and in accordance with applicable breach notification obligations.

You also have a role in keeping your data secure. You should maintain the confidentiality of your rokok33 account credentials, use a strong and unique password, and contact rokok33 support immediately if you suspect unauthorised access to your account.

rokok33 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, including compliance with applicable legal, regulatory, tax, and audit obligations. Our retention periods are guided by the following principles:

• Active accounts: Personal data associated with active rokok33 accounts is retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with Malaysian AML record-keeping requirements.
• Transaction records: Financial transaction data including deposit and withdrawal records is retained for a minimum of seven (7) years following the transaction date.
• KYC documents: Identity verification documents are retained for the period required under applicable AML regulations, which is typically five (5) years from the end of the customer relationship.
• Support communications: Customer support records are retained for three (3) years from the date of the interaction, or longer where the record relates to an unresolved complaint or ongoing investigation.
• Technical and log data: Server logs and security event records are retained for twelve (12) months, unless a longer retention period is required by an ongoing investigation.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised, such that it can no longer be associated with any individual.

Subject to applicable law and any overriding legal obligations, you have the following rights in relation to your personal data held by rokok33:

• Right of access: You may request a copy of the personal data rokok33 holds about you. We will respond to verified access requests within 21 days.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some corrections can be made directly through your account profile; others require support team assistance.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. We cannot delete data that we are legally required to retain.
• Right to restriction: You may request that we restrict processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful.
• Right to data portability: You may request a copy of personal data you have provided to rokok33 in a structured, commonly used, and machine-readable format.
• Right to object: You may object to processing of your personal data where rokok33 relies on legitimate interests as the legal basis, and where your particular circumstances warrant an override of those interests.
• Right to withdraw consent: Where rokok33 processes your personal data on the basis of your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, contact the rokok33 Data Protection team at support@rokok33.club with the subject line "Data Rights Request — [Your Username]". We may require identity verification before processing your request. Requests will be acknowledged within five (5) business days and responded to fully within 21 days.

rokok33 may send you promotional communications including information about bonuses, new games, sports betting promotions, and platform updates via email, SMS, or in-platform notifications. We will only send marketing communications where:

• You have expressly consented to receiving marketing communications from rokok33 during account registration or subsequently through your account preferences; or
• We have a legitimate interest basis to contact you about closely related rokok33 products and services, and you have not opted out.

You may opt out of marketing communications at any time by updating your communication preferences in your rokok33 account settings, or by contacting support at support@rokok33.club. Opting out of marketing communications does not affect transactional messages such as deposit confirmations, withdrawal updates, or security alerts, which are sent as part of the rokok33 service contract.

Players who have registered a self-exclusion with rokok33 will be removed from all marketing communications immediately upon the self-exclusion taking effect.

Some of rokok33's third-party service providers — including game software developers, cloud infrastructure providers, and KYC verification services — may be located in jurisdictions outside Malaysia. Where personal data is transferred outside Malaysia, rokok33 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to, or higher than, that required under Malaysian data protection law. Such safeguards may include:

• Standard contractual data transfer clauses incorporated into agreements with recipient parties.
• Transfers to jurisdictions recognised as providing an adequate level of data protection.
• Binding corporate rules or equivalent transfer mechanisms where applicable.

The rokok33 platform is strictly intended for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. All account registrations undergo automated and manual age verification procedures to enforce this restriction.

If rokok33 becomes aware that personal data has been collected from a person who is under 21 years of age, we will immediately close the associated account, void any associated bets and transactions, and securely delete the personal data in accordance with our data deletion procedures, subject to any legal obligations to retain records of the underage access attempt.

Parents and guardians who believe their child has registered or attempted to register an account on rokok33 should contact support immediately at support@rokok33.club.

rokok33 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, platform operations, or data processing practices. Where amendments are material — meaning they substantively change how we collect, use, or share your personal data — we will provide advance notice by posting a prominent notice on the rokok33 homepage and, where practicable, notifying registered players via their registered email address.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the rokok33 platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you should cease using the platform and contact support to arrange account closure and withdrawal of any available balance.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to make a complaint about how rokok33 has handled your personal data, please contact us using the following details:

We will acknowledge your enquiry within five (5) business days and aim to resolve all privacy complaints within 30 days. If you are not satisfied with rokok33's response to your complaint, you may refer the matter to the relevant data protection authority in your jurisdiction.

For Malaysian players, the relevant supervisory authority for personal data protection complaints is the Department of Personal Data Protection (JPDP), Ministry of Communications and Multimedia Malaysia.