mu33 Privacy Policy

This Privacy Policy ("Policy") is issued by mu33 ("mu33", "we", "us", "our") and applies to all personal data collected, processed, stored, and used in connection with the mu33 website located at mu33.win, its subdomains, mobile interfaces, and all gaming and wagering services offered therein (collectively, "the Platform" or "the Services"). By accessing or using the Platform, you acknowledge that you have read and understood this Policy and that your personal data will be handled as described herein.

This Policy should be read alongside mu33's Terms & Conditions and Responsible Gaming Policy.

1 Introduction and Data Controller

1.1 mu33 is the data controller in respect of personal data collected and processed through the Platform. As data controller, mu33 determines the purposes for which and the means by which personal data is processed, and is responsible for ensuring that processing is carried out in accordance with applicable data protection standards.

1.2 mu33 operates under internationally recognised gaming authority standards and applies data protection principles consistent with those standards to all data processing activities.

1.3 If you have any queries or concerns regarding this Policy or mu33's data practices, please refer to Section 14 (Contact and Complaints) for contact details.

2 Personal Data We Collect

2.1 mu33 collects personal data across several categories depending on how you interact with the Platform:

Identity Data

• Full legal name as provided during registration.
• Date of birth (used for age verification).
• National identity card number, passport number, or equivalent government-issued identifier provided during KYC verification.
• Photograph or copy of identity document where submitted for KYC purposes.

Contact Data

• Email address registered to the account.
• Malaysian mobile phone number registered to the account.
• Residential address provided during registration or KYC verification.

Financial Data

• Payment method identifiers (e.g., e-wallet account references, bank account name) used for deposits and withdrawals.
• Transaction history including deposit amounts, withdrawal amounts, dates, and methods.
• Verification data associated with payment reversals or chargeback investigations.

Gaming Data

• Bet history, game participation records, stakes, outcomes, and session durations across all game categories.
• Bonus and promotion uptake and utilisation records.
• Responsible gaming settings including deposit limits, self-exclusion status, and session limit configurations.

Technical and Usage Data

• IP address and approximate geographic location derived from IP data.
• Device type, operating system, browser type, and version.
• Login timestamps, session duration, and pages accessed within the Platform.
• Cookie identifiers and similar tracking technology data as described in Section 6.

Communications Data

• Records of support interactions via live chat.
• Correspondence submitted via the Platform's support channels.

3 How We Collect Your Data

3.1 mu33 collects personal data through the following means:

• Direct provision by you — when you register an account, complete KYC verification, make deposits or withdrawals, set responsible gaming preferences, or contact support.
• Automated technical collection — through cookies, server logs, and similar technologies that operate when you access the Platform. See Section 6 for details.
• Third-party sources — from identity verification service providers, payment processors, fraud prevention agencies, and regulatory databases where necessary to verify your identity, process payments, or fulfil compliance obligations.

4 Purposes and Legal Basis for Processing

4.1 mu33 processes personal data only where there is a lawful basis for doing so. The table below summarises the primary processing purposes and the corresponding legal basis for each:

• Account registration and management — necessary for the performance of the contract between you and mu33.
• Identity verification and age verification — necessary for compliance with our legal and regulatory obligations.
• Processing deposits, withdrawals, and gaming transactions — necessary for the performance of the contract.
• Fraud detection, AML screening, and security monitoring — necessary for compliance with legal obligations and for the legitimate interests of mu33 in protecting the integrity of the Platform.
• Customer support — necessary for the performance of the contract and for our legitimate interest in providing effective player assistance.
• Responsible gaming monitoring and intervention — necessary for compliance with our gaming authority obligations and for the legitimate interest of protecting player welfare.
• Marketing communications (where opted in) — based on your consent, which may be withdrawn at any time from account settings.
• Analytics and platform improvement — based on our legitimate interest in improving the Services, provided such processing does not override your rights and freedoms.

5 Sharing of Personal Data

5.1 mu33 does not sell, rent, or otherwise commercially transfer your personal data to third parties. Personal data may be shared in the following limited circumstances:

• Service providers — including payment processors (such as those facilitating Touch 'n Go eWallet, Boost, DuitNow, and FPX transactions), identity verification providers, IT infrastructure providers, and fraud prevention services. All service providers are bound by contractual obligations to process data only as instructed by mu33 and to maintain appropriate security standards.
• Gaming software providers — game providers integrated into the Platform may receive the minimum data necessary to authenticate your session and record game outcomes. Providers are contractually required to handle such data in compliance with applicable data protection standards.
• Regulatory and law enforcement bodies — where mu33 is required by law, court order, or regulatory direction to disclose personal data. mu33 will, where legally permissible, notify affected users of any such disclosure.
• Business transfers — in the event of a merger, acquisition, or sale of substantially all of mu33's assets, personal data held by mu33 may be transferred to the successor entity, subject to equivalent data protection commitments being maintained.

5.2 mu33 does not transfer personal data to any third party for independent marketing purposes without your explicit consent.

6 Cookies and Tracking Technologies

6.1 mu33 uses cookies and similar tracking technologies to operate, secure, and improve the Platform. Cookies used on the Platform fall into the following categories:

• Strictly necessary cookies — required for the Platform to function. These include session authentication cookies and security cookies. They cannot be disabled without affecting core functionality.
• Functional cookies — enable the Platform to remember your preferences such as language settings, responsible gaming configurations, and previously selected game categories.
• Analytics cookies — used to collect anonymised information about how players use the Platform, helping mu33 identify usability improvements. These cookies do not identify you personally.
• Security cookies — support fraud detection and bot prevention systems operating on the Platform.

6.2 You may configure your browser to refuse or delete cookies, though doing so may impair your ability to use certain features of the Platform including account login.

6.3 mu33 does not use third-party advertising cookies or permit third-party advertisers to set cookies on the Platform without your explicit consent.

7 Data Retention

7.1 Personal data is retained for as long as necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by law or regulation. The following general retention periods apply:

• Account and identity data — retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with applicable anti-money laundering and gaming regulatory obligations.
• Financial transaction data — retained for a minimum of 7 years following the transaction date, in accordance with applicable accounting and AML obligations.
• Gaming and bet history — retained for a minimum of 5 years following the relevant gaming activity.
• Support communications — retained for 3 years following the closure of the relevant support case.
• Technical and usage data — typically retained for 13 months on a rolling basis.
• Marketing consent records — retained until consent is withdrawn and for 3 years thereafter as evidence of the consent record.

7.2 Data that is no longer required is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

8 International Data Transfers

8.1 Some of mu33's service providers operate infrastructure located outside Malaysia. Where personal data is transferred to servers or processors in other jurisdictions, mu33 ensures that appropriate safeguards are in place including standard contractual clauses, data processing agreements, or equivalent mechanisms that provide a level of protection consistent with applicable data protection standards.

8.2 mu33 does not transfer personal data to any jurisdiction that does not provide adequate data protection standards without implementing appropriate contractual safeguards.

9 Your Data Rights

9.1 Subject to applicable law and regulation, you have the following rights in respect of your personal data held by mu33:

• Right of access — you may request a copy of the personal data mu33 holds about you.
• Right of rectification — you may request correction of any inaccurate or incomplete personal data.
• Right of erasure — you may request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to retention obligations under applicable law.
• Right to restrict processing — you may request that mu33 limit the processing of your personal data pending resolution of a dispute or objection.
• Right to data portability — you may request receipt of personal data you have provided to mu33 in a structured, machine-readable format where processing is carried out by automated means.
• Right to object — you may object to processing carried out on the basis of legitimate interests, including profiling for direct marketing purposes.
• Right to withdraw consent — where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

9.2 To exercise any of the rights listed above, submit a request to mu33 support via the live chat at mu33.win or by email to [email protected]. mu33 will respond within 30 calendar days. In complex cases, this period may be extended by a further 30 days with prior notification.

9.3 mu33 reserves the right to verify your identity before processing a data rights request. This is to protect your personal data from unauthorised disclosure.

10 Data Security

10.1 mu33 implements technical and organisational security measures appropriate to the risk profile of the personal data processed. These measures include:

• 256-bit TLS encryption for all data in transit.
• Encryption of sensitive data at rest on mu33 servers.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Multi-factor authentication for all administrative access to systems processing personal data.
• Regular security audits, penetration testing, and vulnerability assessments.
• Incident response procedures including breach notification protocols.

10.2 In the event of a data breach affecting your personal data in a manner likely to result in a risk to your rights and freedoms, mu33 will notify you without undue delay and will take immediate steps to contain and investigate the breach.

10.3 Notwithstanding the foregoing, no internet-based system is wholly immune from security risk. mu33 cannot guarantee the absolute security of data transmitted to or from the Platform and encourages all players to maintain strong, unique passwords and to enable two-factor authentication on their accounts.

11 Children and Underage Users

11.1 The mu33 Platform is strictly intended for individuals aged 21 years and above. mu33 does not knowingly collect personal data from persons under the age of 21. If mu33 becomes aware that an account is held by or has been used by a person under 21, that account will be immediately suspended, any balance will be handled in accordance with our Terms & Conditions, and all associated personal data will be deleted unless retention is required by law.

11.2 If you believe that a person under the age of 21 has registered an account on the Platform, please notify mu33 support immediately via live chat at mu33.win.

12 Third-Party Links

12.1 The mu33 Platform does not contain links to external third-party websites as a matter of policy. To the extent that any third-party content is accessible through the Platform (for example, game content hosted by licensed providers), those providers operate their own privacy practices. mu33 is not responsible for the privacy practices of third-party game providers, though all providers are required to meet minimum data protection standards as a condition of integration with the Platform.

13 Changes to This Policy

13.1 mu33 reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered users via the email address on record or through an in-platform notification. The date of the most recent update is indicated at the top of this Policy.

13.2 Your continued use of the Platform following the publication of any amendments constitutes your acceptance of the updated Policy. If you do not accept the updated Policy, you must cease use of the Platform and may close your account in accordance with the process described in the Terms & Conditions.

14 Contact and Complaints

14.1 For questions, data rights requests, or privacy concerns, contact mu33 via:

• Live Chat: Available 24/7 at mu33.win
• Email: [email protected] (plain text only — not a clickable link)

14.2 If you are not satisfied with mu33's response to a privacy complaint, you may escalate the matter to the relevant data protection authority or regulatory body applicable in your jurisdiction. mu33 will cooperate fully with any regulatory investigation.

14.3 mu33 aims to resolve all privacy-related enquiries fairly and promptly. We take data protection seriously and welcome feedback that helps us improve our practices.