o3309 Privacy Policy
for Malaysian Platform Users

This Privacy Policy applies to the o3309 website, account services, casino and sports betting features, payment functions, customer support communications and related technical systems. It describes the handling of personal information belonging to registered users, visitors and people who communicate with o3309.

By accessing o3309 or creating an account, you acknowledge that your information may be processed as described in this Privacy Policy. Where consent is legally required for a particular activity, o3309 will request it separately. Consent may be withdrawn for future processing where applicable, although withdrawal does not invalidate processing that was lawful before the request was received.

This Privacy Policy is intended for adults. Casino-style gambling through o3309 is restricted to users aged 21 and above. The platform does not knowingly invite or permit children to register. If information associated with an underage person is identified, o3309 may restrict the account, investigate the circumstances and remove information unless retention is required for fraud prevention, safeguarding or legal purposes.

Malaysian users should read this policy together with the Terms & Conditions. References to privacy requirements include applicable data protection principles and, where relevant, requirements reflected in Malaysia's Personal Data Protection Act 2010. The exact legal basis and rights available may depend on the user's location, the operating entity and the nature of the processing.

o3309 processes personal information to create and manage accounts, confirm that users meet the 21+ age requirement, authenticate access, display balances, settle wagers and maintain transaction histories. This processing is necessary to provide the features requested by users and to administer the relationship established under the Terms & Conditions.

Information is also used to review deposits and withdrawals, detect unusual transaction patterns, prevent account takeover and investigate suspected fraud, collusion, bonus abuse or money laundering. Risk assessment may combine identity, device, payment and activity signals. Where automated tools identify a concern, o3309 may place a temporary restriction on an account while an authorised reviewer examines the circumstances.

Service data helps o3309 diagnose errors, measure page performance and improve mobile access for users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and elsewhere. Aggregated statistics may be created to understand general patterns, such as the popularity of EPL markets or payment categories. Where information is genuinely anonymised so that a person can no longer be identified, it is not treated as personal information.

o3309 may send essential messages concerning password security, account restrictions, updated legal terms, successful transactions or pending verification. These operational notices are different from optional promotional communications. Users may object to or withdraw consent from direct marketing where applicable, but they may still receive necessary account and security notices.

Legal Grounds for Processing

Depending on the circumstances, processing may be based on performance of a contract, compliance with a legal obligation, consent, protection of vital interests or legitimate interests pursued by o3309 or another party. Legitimate interests may include platform security, prevention of financial crime, service improvement and the protection of users. o3309 should balance these interests against the rights and reasonable expectations of affected individuals.

When a Malaysian user selects Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow or FPX, o3309 may receive a transaction reference, payment status, amount, time and limited account information from the relevant payment channel. Full banking credentials, card security codes and wallet passwords should never be requested through ordinary o3309 support communications.

Payment providers process information under their own operational and privacy arrangements. o3309 shares only the information reasonably needed to initiate, confirm, reverse or investigate a transaction. For example, a withdrawal of RM500 may require a verified account name and destination details so the funds are returned to the account holder rather than an unrelated person.

KYC checks may involve identity documents, proof of address, payment ownership evidence and, where risk justifies it, information about source of funds. Documents may be reviewed by authorised o3309 personnel or specialist verification providers. Users should obscure unrelated information only where instructed; altering required identity details may prevent verification.

Financial records may need to be retained after an o3309 account is closed. This allows the platform to respond to disputes, demonstrate transaction history, investigate fraud and satisfy applicable record-keeping duties. Closing an account therefore does not always permit immediate deletion of every associated record.

o3309 may use cookies, local storage and comparable technologies to maintain sessions, remember preferences, support account security and understand technical performance. Essential technologies are required for functions such as keeping a user signed in, protecting a transaction and preventing repeated unauthorised login attempts.

Performance information may include page response times, error reports, browser type and general interaction patterns. Where non-essential analytics or preference technologies require consent, users should be given an appropriate choice before those technologies are activated. Changing browser settings may block some cookies, but doing so can affect account authentication and other o3309 features.

Device and network information may be compared with previous sessions to identify suspicious access. A sudden login from a new device or unusual location may trigger additional verification. Such checks protect the user and o3309, but they do not guarantee that every attempted account takeover will be detected.

o3309 does not sell personal information as an ordinary business activity. Information may be disclosed to carefully selected service providers that perform functions on behalf of the platform, including hosting, security monitoring, identity verification, payment processing, customer support and technical maintenance.

Providers should receive only the information necessary for their assigned role and should be subject to contractual confidentiality and security requirements. Access may also be granted to professional advisers, auditors or insurers where reasonably necessary to protect the interests of o3309 or its users.

Information may be disclosed where required by a valid legal demand, court order or applicable regulatory obligation. o3309 may also share relevant records when necessary to prevent fraud, protect a person from serious harm, investigate prohibited activity or establish, exercise or defend legal claims.

If the ownership or structure of o3309 changes through a merger, acquisition, reorganisation or transfer of assets, personal information may be reviewed or transferred as part of that transaction. Appropriate confidentiality measures should apply, and users will be informed where a material change requires notice under applicable law.

Because o3309 operates within an international service environment, personal information may be processed outside Malaysia. Hosting, verification, game, security or payment providers may maintain systems in other jurisdictions. Those jurisdictions may apply privacy rules that differ from Malaysian requirements.

Where required, o3309 seeks to use appropriate transfer safeguards, contractual protections and access restrictions. The relevant method may depend on the destination, the provider and the applicable law. International processing does not remove the platform's obligation to handle information consistently with this Privacy Policy.

o3309 uses proportionate organisational and technical measures intended to protect information against accidental loss, unauthorised access, misuse, alteration and disclosure. Measures may include encrypted connections, restricted administrative access, credential controls, security logging, vulnerability management and staff confidentiality procedures.

Users also play an important role in security. Passwords should be unique, difficult to guess and kept private. Users should not disclose one-time codes or account credentials to another person. Any suspected unauthorised access should be reported promptly using the plain-text support address shown below.

No website, mobile network or storage platform can provide absolute security. If o3309 confirms a personal data incident, it will assess the nature of the information, likely impact and available protective steps. Affected users and relevant authorities will be notified where required by applicable law.

o3309 retains personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, financial, dispute-resolution, fraud-prevention and responsible-gambling requirements. Different categories therefore have different retention periods.

Account and transaction records may be retained for a period after account closure to address chargebacks, complaints, tax or accounting obligations and financial crime risks. Self-exclusion records may also be retained so that o3309 can recognise and block attempts to reopen an account during or after an exclusion period where continued protection is appropriate.

When information is no longer required, o3309 should securely delete it, anonymise it or isolate it from ordinary use. Backup copies may remain for a limited period until routine replacement cycles are completed.

o3309 may review account activity to identify indicators associated with harmful gambling, such as rapid deposit increases, prolonged sessions, repeated cancelled withdrawals or attempts to bypass established limits. This processing supports player protection and the responsible administration of the platform.

Where a concern is identified, o3309 may display a reminder, offer deposit or session controls, request contact with support, restrict activity or apply self-exclusion. These measures are intended to reduce harm, but automated indicators cannot fully assess an individual's circumstances.

Information about deposit limits, cooling-off periods and self-exclusion may remain on record after account closure to prevent controls from being easily avoided. Casino-style gambling is for players aged 21 and above only. Users can review further guidance on the Responsible Gambling page.

o3309 may revise this Privacy Policy to reflect changes in services, technology, legal requirements or internal practices. The updated version will display a revised date. Where a change materially affects how existing personal information is used, o3309 will provide additional notice where required.

Users should review this page periodically. Continued use of o3309 after an update does not replace consent where fresh consent is legally required, but it may confirm acknowledgement of changes relating to ordinary service administration.

Questions about this Privacy Policy, concerns about personal information or requests to exercise applicable rights may be directed to the o3309 support team. Please state that your message concerns privacy and include your registered username where relevant.