Privacy Policy —
321spin Gaming Platform

This Privacy Policy ("Policy") issued by 321spin ("we", "us", "our", "the Operator", "the Platform") and governs the collection, use, storage, and disclosure of personal data in connection with the 321spin online gaming platform accessible at https://321spin.cam (the "Website").

321spin is an English-language online gaming platform developed for players across Malaysia, including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout the country. We understand that the privacy and security of your personal information is of the utmost importance. This Policy sets out our practices transparently so that you can make informed decisions about using the Platform.

By registering an Account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact our support team to close your account.

For the purposes of this Privacy Policy, the following definitions apply:

321spin collects personal data from you through several channels: information you provide directly, data generated by your use of the Platform, and information received from third parties (such as payment processors or identity verification providers).

3.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, email address, username, and password;
• KYC documentation: Copies of government-issued identity documents (Malaysian MyKad, passport, or equivalent), proof of address, and where required, proof of payment method ownership;
• Contact communications: Messages, queries, and complaints submitted via live chat or email to our support team;
• Responsible gambling requests: Information relating to self-exclusion requests, deposit limit settings, or cooling-off applications.

3.2 Data Generated Through Platform Use

• Transaction records: Details of all deposits, withdrawals, and bet placements, including payment method used (e.g., Touch 'n Go, DuitNow, FPX, Maybank, CIMB, Public Bank), amounts in MYR, and timestamps;
• Game activity logs: Records of games played, wagers placed, session durations, and outcomes;
• Device and technical data: IP address, browser type and version, operating system, screen resolution, and device identifiers collected when you access the Platform;
• Cookies and similar tracking data: Session tokens, preference cookies, and anonymised analytics data as described in Section 9.

3.3 Data From Third Parties

• Identity and address verification results from licensed KYC providers;
• Payment confirmation and transaction status information from payment processors including Touch 'n Go, Boost, GrabPay, DuitNow, and FPX-connected banking institutions;
• Fraud screening results from third-party risk assessment services.

321spin processes your personal data for the following specific purposes:

We do not process your personal data for purposes incompatible with those listed above without your explicit consent.

321spin processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to enter into and perform the Terms & Conditions governing your use of the Platform — including account management, payment processing, and customer support;
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC requirements, and responses to lawful requests from regulatory authorities;
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and analytics — where those interests are not overridden by your fundamental rights and freedoms;
• Consent: Where no other legal basis applies, we will seek your explicit consent before processing your data, and you will always have the right to withdraw that consent.

321spin does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We share your data only in the following specific and controlled circumstances:

6.1 Payment Processors

Transaction-related data is shared with licensed payment processing partners to facilitate deposits and withdrawals in MYR. This includes, where applicable, relevant details shared with Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and the banking institutions that operate those payment rails (including Maybank, CIMB, Public Bank, and Hong Leong Bank). These processors are contractually bound to handle your data securely.

6.2 KYC and Identity Verification Partners

Identity documents and verification data are shared with licensed third-party KYC service providers for the purpose of confirming your identity and address as required by our operating obligations.

6.3 Fraud Prevention and Risk Services

Device data, IP addresses, and behavioural signals may be shared with fraud detection services to identify and prevent fraudulent account activity, bonus abuse, money laundering, and other forms of financial crime.

6.4 Legal and Regulatory Authorities

We are obligated to disclose certain personal data to relevant regulatory bodies, law enforcement agencies, tax authorities, or courts when required to do so by applicable law, court order, or regulatory directive. We will always verify the lawfulness of such requests before disclosing any data.

321spin retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. Specific retention periods include:

• Account and registration data: Retained for the duration of your active account and for minimum of five (5) years following account closure, in accordance with AML record-keeping obligations;
• KYC documentation: Retained for a minimum of five (5) years from the date of verification or from the date your account is closed, whichever is later;
• Transaction records: Retained for a minimum of five (5) years for regulatory and audit purposes;
• Customer support communications: Retained for two (2) years from the date of the last interaction, unless a dispute is ongoing;
• Technical and device data (logs): Retained for up to twelve (12) months;
• Cookie data: Retained according to the type of cookie — session cookies are deleted on browser close; persistent analytics cookies expire within twelve (12) months.

When data is no longer required for the purpose it was collected and the applicable retention period has expired, it is securely deleted or anonymised in accordance with our data destruction procedures.

321spin employs a layered approach to data security designed to protect your personal information against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the Platform is encrypted in transit using industry-standard TLS encryption;
• Encrypted data storage: Sensitive personal data including KYC documents and financial records are stored in encrypted form on secured server infrastructure;
• Access controls: Internal access to personal data is restricted on a need-to-know basis. Staff who handle personal data receive regular data protection training;
• Two-factor authentication: Account access is protected by optional two-factor authentication, which we strongly encourage all Members to enable;
• Penetration testing and monitoring: Our infrastructure is subject to regular security assessments and real-time monitoring to detect and respond to threats promptly.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed to be completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and, where required, relevant authorities in accordance with applicable law.

321spin uses cookies and similar tracking technologies on the Platform for the following purposes:

Essential Cookies

These are strictly necessary for the operation of the Platform. They maintain your login session, remember your preferences (such as language settings), and ensure the security of your account. These cookies cannot be disabled without affecting Platform functionality.

Analytics Cookies

We use anonymised analytics tools to understand how users navigate the Platform — which pages are most visited, how long sessions last, and where users encounter difficulties. This data helps us improve the Platform experience for all Malaysian players. Analytics data is aggregated and does not identify you personally.

Functional Cookies

These cookies remember choices you make (such as preferred payment method or display settings) to provide a more personalised experience. They do not track your activity outside of the 321spin Platform.

321spin does not use third-party advertising cookies or behavioural targeting trackers. We do not share cookie data with social media platforms or advertising networks.

You can manage or delete cookies through your browser settings at any time. Note that disabling essential cookies may impair your ability to log in or use certain Platform features. For instructions on managing cookies, refer to your browser's help documentation.

Subject to applicable law and our legal obligations, you have the following rights with respect to your personal data held by 321spin. To exercise any of these rights, please contact our support team via live chat or the email address provided in Section 14.

We will respond to all valid data rights requests within a reasonable timeframe. We may need to verify your identity before processing the request. Certain rights may be limited where compliance would conflict with legal obligations or the rights of third parties.

321spin's services are strictly intended for individuals who are at least 21 years of age. We do not knowingly collect personal data from persons under the age of 21. The collection of data from minors is not permitted under any circumstances.

As part of our registration process and KYC verification, we take active steps to confirm that all Members meet the minimum age requirement. Any account found to belong to a person under 21 will be immediately suspended, all associated data will be flaged for review, and the matter may be escalated to relevant authorities.

In the course of operating the Platform and fulfilling our service obligations, your personal data may be transferred to and processed in countries other than Malaysia. This can occur, for example, when your KYC documents are reviewed by a verification partner whose servers are located overseas, or when transaction data is processed through international payment networks.

Where such transfers occur, 321spin ensures that appropriate safeguards are in place to protect your data to a standard equivalent to the protections it would receive in its country of origin. These safeguards may include contractual clauses, data processing agreements with third parties, or reliance on adequacy decisions where applicable.

By using the Platform, you acknowledge and consent to the transfer of your personal data as described in this section, with the assurance that such transfers are governed by appropriate protections.

321spin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or operational needs. When material changes are made, we will provide notice to registered Members via email or a prominent notice on the Platform prior to the changes taking effect.

The effective date at the top of this Policy indicates when the current version was last updated. We recommend reviewing this Policy periodically. Your continued use of the Platform following the publication of a revised Policy constitutes your acceptance of the updated terms.

If you disagree with any changes to this Policy, you should discontinue use of the Platform and may request account closure through our customer support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 321spin, please contact our Data Support team through the following channels:

• Live Chat: Available 24/7 directly on the Platform — recommended for the fastest response;
• Email (plain text — not a clickable link): [email protected] — use the subject line "Privacy Request" for data-related queries;
• Support Hours: 24 hours per day, 7 days per week, Malaysia Time (MYT, UTC+8).

When submitting a data rights request, please include your registered email address and account username so that we can locate your records and verify your identity before processing the request. We aim to acknowledge all data rights requests within 72 hours.