Privacy Policy

Introduction

This Privacy Policy (hereinafter referred to as the "Policy") is issued by ace33 (hereinafter referred to as "ace33", "we", "us", or "our") and governs the collection, use, storage, disclosure, and protection of personal data obtained from users (hereinafter referred to as "you", "the User", or "the Member") of the ace33 online gaming platform accessible at https://ace33.cam (the "Platform").

ace33 is committed to protecting the privacy and personal data of its users and to meeting applicable data protection standards. This Policy applies to all personal data processed by ace33 in connection with your registration, use of the Platform, and any communications between you and ace33.

This Policy is effective as of 1 January 2026. The most recent version of this Policy will always be accessible via the privacy-policy page on the ace33 Platform.

Definitions

For the purposes of this Privacy Policy, the following definitions shall apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including but not limited to name, identification number, contact details, location data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. In the context of this Policy, the Data Controller is ace33.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under a written agreement.
• "KYC Documents" means identity verification documents submitted by a User, including government-issued photo ID, proof of address, and selfie photographs.
• "Cookies" means small data files placed on a User's device by the Platform to support functionality, analytics, and session management.
• "Platform" means the ace33 website and mobile web application accessible at https://ace33.cam and all associated services.

Data Controller

ace33 is the Data Controller responsible for personal data collected through the Platform. As the Data Controller, ace33 determines the purposes for which your personal data is processed and the manner in which it is processed.

ace33 operates under an international gaming license. Where personal data processing involves third-party service providers acting as Data Processors (such as payment processors, KYC verification providers, and fraud detection services), those processors are bound by data processing agreements that require them to protect personal data to standards consistent with this Policy.

For all data protection inquiries, including requests to exercise your rights under Section 13 of this Policy, please contact our data protection team at the details provided in Section 16.

Personal Data We Collect

ace33 collects the following categories of personal data from Users of the Platform:

4.1 Registration Data

• Full legal name
• Date of birth (used to verify the 21+ age requirement)
• Email address
• Mobile phone number
• Chosen username and encrypted password
• Country and city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)

4.2 KYC Verification Data

• Copies of government-issued photo identification (MyKad / NRIC, driver's license, or passport)
• Proof of residential address (utility bill, bank statement, or telco bill)
• Selfie photograph holding the submitted ID document
• Additional documentation as may be requested for compliance purposes

4.3 Financial Data

• Payment method details (e.g., bank account identifiers associated with Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX transactions)
• Transaction history — deposits, withdrawals, and wager records
• Account balance information

4.4 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session duration, pages visited, and features used
• Login timestamps and access logs
• Cookie identifiers and similar tracking data (see Section 12)

4.5 Communications Data

• Content of support interactions via live chat or email
• Feedback, complaints, and survey responses
• Marketing preferences and communication consent records

How We Collect Personal Data

ace33 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in promotions;
• Automatically — through the use of cookies, server logs, and similar technologies when you access and navigate the Platform;
• From third parties — including payment processors, identity verification service providers, fraud detection services, and where permitted by applicable law, from publicly available sources for compliance screening purposes.

Purposes of Processing

ace33 processes your personal data for the following purposes:

Legal Basis for Processing

ace33 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing that is necessary to perform the contract between you and ace33, including account management, payment processing, and the provision of gaming services;
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC, anti-money laundering obligations, and regulatory reporting requirements under our international gaming license;
• Legitimate Interests: Processing that is necessary for the legitimate interests of ace33, including fraud prevention, platform security, and responsible gambling monitoring, where those interests are not overridden by your fundamental rights and freedoms;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, in particular for the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Third-Party Disclosure

ace33 does not sell, rent, or trade your personal data to third-party marketers. Personal data may be shared with third parties only in the following circumstances:

• Payment Processors: To facilitate deposits and withdrawals via Supported Payment Methods including Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX. Only the minimum data necessary for transaction processing is shared;
• KYC & Identity Verification Providers: To process identity documents and verify User eligibility in accordance with our compliance obligations;
• Fraud Detection & Security Services: To identify and prevent fraudulent transactions and unauthorized access;
• Game Content Providers: Limited session and account data may be shared with licensed game software providers to deliver game content and resolve game-related disputes;
• Legal & Regulatory Authorities: Where required by law, court order, or at the direction of a competent regulatory authority, ace33 may be obligated to disclose personal data without prior notice to you;
• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to this Policy continuing to apply.

International Data Transfers

ace33 operates under an international gaming license and may engage service providers located outside of Malaysia. As a result, your personal data may be transferred to, stored in, or processed in countries other than Malaysia.

Where personal data is transferred internationally, ace33 takes appropriate steps to ensure that your data receives adequate protection. These steps include entering into standard contractual clauses with data processors, implementing technical security measures, and verifying that recipient jurisdictions provide an adequate level of data protection.

By using the ace33 Platform, you consent to the transfer of your personal data to jurisdictions outside Malaysia in accordance with the safeguards described in this section.

Data Retention

ace33 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account Data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering and licensing requirements;
• KYC Documents: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later;
• Transaction Records: Retained for a minimum of five (5) years following the date of the transaction;
• Communications Data: Retained for a minimum of two (2) years from the date of the last communication;
• Technical & Usage Data: Retained for up to twelve (12) months in an identifiable form, after which it may be anonymised and retained for analytical purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Where deletion is not technically feasible, ace33 will implement appropriate measures to prevent further processing.

Security Measures

ace33 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest within our systems;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security audits and penetration testing;
• Multi-factor authentication requirements for system access by authorised personnel;
• Staff training on data protection obligations and security practices.

Whilst ace33 takes all reasonable precautions to safeguard your personal data, no method of electronic transmission or storage is completely secure. You also play a role in protecting your data: maintain a strong, unique password for your Account and do not share your login credentials with any third party. ace33 will never ask for your password.

Cookies & Tracking Technologies

The ace33 Platform uses cookies and similar tracking technologies to support Platform functionality, maintain your session, analyse usage patterns, and improve the user experience. The following types of cookies may be in use:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable session management, authentication, and basic Platform security features. They cannot be disabled without significantly impairing your ability to use the Platform.
• Analytics Cookies: Used to collect aggregated information about how Users navigate and interact with the Platform, enabling ace33 to identify areas for improvement. Data collected via analytics cookies is anonymised or pseudonymised where possible.
• Preference Cookies: Used to remember your Platform preferences, such as language settings, so that the Platform behaves in a manner consistent with your previous choices.
• Marketing Cookies: Used only where you have provided explicit consent, to enable personalised promotional communications and to measure the effectiveness of marketing campaigns.

You may configure your browser to decline non-essential cookies or to alert you when cookies are being sent. Please be aware that disabling certain cookies may affect the functionality of the Platform. For instructions on managing cookie settings in your browser, please refer to your browser's help documentation.

Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ace33. To exercise any of these rights, please contact our support team using the details in Section 16. ace33 will respond to verified requests within thirty (30) days.

Please note that certain rights are subject to limitations. For example, ace33 may be required to retain certain personal data to comply with legal obligations (such as anti-money laundering laws) even where a deletion request is submitted. ace33 will inform you if any limitation applies to your request.

Minors & Age Policy

The ace33 Platform is intended exclusively for individuals aged 21 years and above. ace33 does not knowingly collect or process personal data of persons under the age of 21. The 21+ age requirement is enforced through mandatory KYC verification for all registered Users.

If ace33 becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, any balance will be returned to the originating payment method following due diligence, and all personal data associated with that account will be deleted as soon as legally permissible.

If you believe that a minor has registered on the ace33 Platform, please contact us immediately via the support channels detailed in Section 16.

Policy Amendments

ace33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our business practices, or the services provided through the Platform. The date of the most recent revision is stated at the top of this page as the "Last Updated" date.

Where amendments are material — such as changes to the categories of data collected, the purposes of processing, or your rights — ace33 will notify registered Users by email or through a prominent notice on the Platform prior to the changes taking effect, where practicable.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the amended terms. It is your responsibility to review this Policy periodically.

Contact Us

For all privacy-related inquiries, data subject access requests, or complaints regarding the handling of your personal data by ace33, please contact us using the following channels:

• Data Protection Inquiries (Email): [email protected] — please include "Privacy Request" in the subject line of your email (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the Platform in English, Bahasa Melayu, and Chinese
• Website: ace33.cam

ace33 commits to acknowledging privacy-related requests within 5 business days and to providing a substantive response within 30 days of receipt of all relevant information. Where a request is complex or involves a large volume of data, ace33 may extend this period by an additional 30 days, in which case you will be notified of the extension.