Privacy Policy — How RoyalBet Protects Your Personal Data

1 Introduction

This Privacy Policy ("Policy") is published by royalbet ("royalbet", "we", "us", "our"), the operator of the online sports betting and casino platform accessible at royalbet.casa. This Policy applies to all personal data that royalbet collects, processes, stores, and in certain circumstances shares, in connection with the use of the royalbet platform by registered users ("Users", "Players", "you").

royalbet is committed to safeguarding the privacy and personal data of every individual who interacts with our platform, including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. We recognise that trust is fundamental to the relationship between royalbet and its players, and that trust begins with transparent, responsible handling of your data.

By accessing royalbet.casa or registering an account on our platform, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the royalbet platform.

2 Definitions

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably identify a natural person, either directly or in combination with other data.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means royalbet, the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of royalbet under a contractual data processing agreement.
• "User" or "Player" means any natural person who has registered an account on the royalbet platform.
• "Platform" means the royalbet website at royalbet.casa and all associated services and features.
• "KYC" means the Know Your Customer identity verification process required by royalbet for regulatory compliance.
• "Cookies" means small text files stored on your device by a web browser to track session and preference information.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by a data subject to the processing of their personal data.

3 Personal Data We Collect

royalbet collects personal data that is necessary to provide our services, verify player identities, process financial transactions, and comply with applicable legal and regulatory obligations. The categories of personal data we collect include:

4 How We Collect Your Data

royalbet collects personal data through the following channels and mechanisms:

• Direct Collection: Information you provide when registering an account, submitting KYC documents, making deposits or withdrawal requests, contacting our support team, or completing any other form or interaction on the platform.
• Automated Technical Collection: Data collected automatically when you access the platform, including IP address, device identifiers, browser fingerprint, session timestamps, and usage logs generated by your interaction with platform features.
• Payment Processors: Transaction confirmation data received from third-party payment service providers when you make deposits or withdrawals via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, or cryptocurrency channels. royalbet does not store full payment credentials — these are handled by the respective payment processors.
• Cookies and Tracking Technologies: As described in Section 10, royalbet uses cookies and similar technologies to collect session data and improve platform functionality.
• Third-Party Verification Services: In limited cases, royalbet may use third-party identity verification service providers to cross-reference information you supply during KYC, in compliance with applicable anti-money laundering requirements.

5 Data Processing & Legal Basis

royalbet processes your personal data only where there is a valid legal basis for doing so. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between royalbet and the User — including account registration, deposit processing, bet placement, game access, and withdrawal fulfilment. Without this processing, royalbet cannot provide its services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, fraud prevention obligations, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out in the legitimate interests of royalbet or third parties, where those interests are not overridden by your rights and interests. This includes platform security monitoring, fraud detection, service improvement, and responsible gambling risk identification.
• Consent: Where royalbet relies on your consent as the legal basis for processing — such as for certain marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent can be managed through your account settings or by contacting support.

6 How We Use Your Personal Data

royalbet uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, and administering your royalbet account, including processing login authentication, account preferences, and communication preferences.
• Identity Verification (KYC): Verifying your identity and age (21+ requirement) in accordance with our regulatory obligations before processing withdrawals or upon reasonable request.
• Transaction Processing: Processing deposits in MYR via supported Malaysian payment methods and fulfilling withdrawal requests to your designated payment account.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions.
• Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance through our live chat and email support channels.
• Responsible Gambling Monitoring: Monitoring account activity to identify potential indicators of problem gambling, and facilitating the application of deposit limits, self-exclusion requests, and other responsible gambling tools.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve platform functionality, game performance, and user experience.
• Legal and Regulatory Compliance: Fulfilling our obligations under applicable laws, responding to lawful requests from authorities, and maintaining records as required by law.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications, and updates about royalbet services — only where you have provided explicit consent. You may opt out at any time.

7 Data Sharing & Disclosure

royalbet does not sell, rent, or trade your personal data to third parties for commercial purposes. However, we may share your data in the following limited and controlled circumstances:

• Payment Service Providers: We share transaction data with payment processors — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX — to the extent necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and data protection obligations.
• Identity Verification Providers: Third-party KYC and identity verification service providers may receive your identity documents and personal data to facilitate verification checks, under contractual data processing agreements with royalbet.
• Fraud Prevention and Security Partners: We may share data with fraud detection and cybersecurity service providers to protect the platform and our players from fraudulent activity.
• Regulatory and Legal Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or government authorities where required by applicable law, a court order, or a lawful regulatory request. Where permitted, we will notify you of such disclosure.
• Professional Advisers: In the context of legal, accounting, or audit services, professional advisers may have access to personal data under strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of business assets, personal data held by royalbet may be transferred to the relevant successor entity, subject to the same privacy protections described in this Policy.

8 Data Retention

royalbet retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal, regulatory, and contractual obligations. The following retention principles apply:

• Active Accounts: Personal data associated with an active royalbet account is retained for the duration of the account's existence and for a reasonable period thereafter to handle any post-closure enquiries, disputes, or regulatory obligations.
• KYC and Identity Documents: Identity verification documents are retained in accordance with applicable anti-money laundering regulations, which typically require a minimum retention period of five (5) years following the end of the business relationship.
• Transaction Records: Financial transaction records, including deposit and withdrawal histories in MYR, are retained for a minimum of five (5) years for regulatory and audit compliance purposes.
• Support Communications: Customer service correspondence and support chat transcripts are retained for a period of two (2) years from the date of the interaction, unless retention for a longer period is required for dispute resolution.
• Marketing Data: Where you have consented to marketing communications, data used for that purpose is retained until you withdraw your consent. Following withdrawal, data will be suppressed from marketing use but may be retained in suppression lists to honour opt-out preferences.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

9 Data Security Measures

royalbet implements a comprehensive set of technical, organisational, and operational security measures designed to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security measures include:

• Transport Encryption: All data transmitted between your device and the royalbet platform is encrypted using HTTPS with TLS 1.2 or higher and 256-bit SSL certificates.
• Data Encryption at Rest: Sensitive personal data, including KYC documents and financial information, is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within royalbet's systems is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their royalbet accounts. Internal administrative access to systems containing personal data requires multi-factor authentication.
• Infrastructure Security: royalbet's platform is hosted on enterprise-grade cloud infrastructure with continuous security monitoring, intrusion detection, and automated threat response capabilities.
• Regular Security Reviews: Our security posture is subject to regular internal review and, where appropriate, third-party penetration testing and vulnerability assessments.

10 Cookies & Tracking Technologies

royalbet uses cookies and similar technologies (including web beacons and local storage) to operate the platform effectively, maintain your session, remember your preferences, and gather analytical information about platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the royalbet platform. These include session authentication cookies, security tokens, and load-balancing cookies. The platform cannot function correctly without these cookies and they cannot be disabled.
• Functional Cookies: Used to remember your preferences and settings — such as language preferences, display settings, and session state — to provide a more personalised and consistent experience across visits.
• Analytical / Performance Cookies: Used to collect anonymised and aggregated data about how users interact with the platform — including pages visited, features used, error reports, and session duration — to help royalbet improve platform performance and user experience.
• Security Cookies: Used to detect fraudulent activity, unusual access patterns, and potential account compromise indicators. These cookies are part of royalbet's fraud prevention infrastructure.

royalbet does not use third-party advertising or cross-site tracking cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may impair your ability to use the platform. Detailed cookie management instructions are available via your browser's help documentation.

11 Your Rights as a Data Subject

As a registered player on the royalbet platform, you hold the following rights in respect of the personal data royalbet holds about you. To exercise any of these rights, please contact us at support@royalbet.casa with the subject line "Data Rights Request":

• Right of Access: You have the right to request a copy of the personal data royalbet holds about you, including a description of the categories of data, the purposes of processing, and the parties with whom it has been shared. Requests will be responded to within thirty (30) days.
• Right to Rectification: If any personal data royalbet holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed. Minor corrections (such as address updates) may be made directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and there is no other legal basis for processing), or where processing is unlawful. Note that this right is subject to legal retention obligations — we may be required to retain certain data for regulatory compliance even following an erasure request.
• Right to Restriction of Processing: You may request that royalbet restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data, or where processing is unlawful but you prefer restriction to erasure.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where royalbet relies on legitimate interests as the legal basis, including profiling based on legitimate interests. You may also object at any time to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

12 Minors & Age Restriction

The royalbet platform is strictly intended for adults aged 21 years and above. royalbet does not knowingly collect personal data from or direct services at individuals under the age of 21. Age verification is conducted during account registration and prior to the processing of any withdrawal.

If royalbet becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, we will take immediate steps to delete that data and close the associated account. Any funds deposited by an underage user will be returned to the source payment method following identity confirmation.

Parents and guardians who become aware that a minor under their supervision has registered on the royalbet platform are encouraged to contact us immediately at support@royalbet.casa so that appropriate action can be taken promptly.

13 International Data Transfers

The royalbet platform serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities. In the course of providing our services, personal data may be transferred to and processed in countries other than Malaysia — for example, where royalbet's cloud infrastructure or certain third-party service providers are located.

Where personal data is transferred internationally, royalbet ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Privacy Policy. Safeguards may include:

• Data Processing Agreements that include standard contractual clauses binding the recipient to equivalent data protection obligations;
• Transfers to countries or organisations that maintain an adequate level of data protection as recognised by applicable frameworks;
• Encryption of data in transit and at rest to protect against unauthorised access during international transmission.

14 Amendments to This Privacy Policy

royalbet reserves the right to update, modify, or replace this Privacy Policy at any time in response to changes in applicable law, regulatory requirements, our business operations, or platform functionality. The "Last updated" date at the top of this page reflects the most recent revision.

Where changes are material, royalbet will notify registered Users via email or a prominent notice displayed on the platform, with reasonable advance notice prior to the changes taking effect. We encourage all Users to review this Privacy Policy periodically to remain informed of how royalbet protects their personal data.

Continued use of the royalbet platform following the effective date of any revised Privacy Policy constitutes acceptance of that revised Policy. If you do not agree to the revised terms, you should cease using the platform and may request account closure as described in our Terms and Conditions.

15 Contact & Data Rights Requests

For all privacy-related enquiries, data rights requests, concerns about how royalbet handles your personal data, or to report a suspected data protection issue, please contact our Data Support team using the details below:

Please include your full registered name, account email address, and a clear description of your request or concern in all privacy correspondence. royalbet will acknowledge your request within five (5) business days.

This Privacy Policy was last reviewed and updated on 1 January 2026. The current version is always available at royalbet.casa/privacy-policy.