GrandBet Privacy Policy – Our Commitment to Data Protection Every Malaysian Member's Privacy

GrandBet is an online casino and Sports Betting platform operating exclusively for the Malaysian market. In running the platform, we naturally need to collect and process certain personal information about our members. This Privacy Policy is written to explain exactly what happens to that information.

We believe transparency is the foundation of trust. Players on GrandBet — whether at a live casino Baccarat table, placing a bet on a Malaysia Super League match, or spinning slots online — deserve to know exactly how their data is handled. This document is our answer to that right.

This policy applies to all personal information collected by GrandBet through its website, mobile app, and all other services associated with the GrandBet platform.

GrandBet collects data across several categories depending on how you interact with the platform:

Data You Provide Directly:

• Full name as shown on your identity document.
• An active Malaysian mobile number.
• A valid email address.
• Date of birth (for 18+ age verification).
• Bank account numbers or e-wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) used for transactions.
• A copy of your identification document (MyKad or passport) if requested for the KYC process.

Automatically Collected Data:

• The IP address of the device used to access GrandBet.
• Device type, operating system and web browser used.
• Platform activity logs including games played, bets placed, and activity timestamps.
• Financial transaction records including deposits, withdrawals, and bonus history.
• Cookie and session data to ensure a smooth login experience.

Every type of data we collect has a clear purpose. GrandBet does not collect data simply because it can – we only gather what is necessary for the following purposes:

• Account Management: To create, verify, and maintain your GrandBet account, including the login process, two-factor authentication, and account recovery.
• Transaction Processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX or other Malaysian local payment methods, and to process winnings withdrawals to your account.
• Age & Identity Verification (KYC): To verify that all GrandBet members are adults aged 18 and above, and to comply with Know Your Customer (KYC) requirements as prescribed by financial regulations.
• Fraud Detection & Security: To detect and prevent fraudulent activity, money laundering, unauthorised access, and any other security threats to your account and the GrandBet platform as a whole.
• Customer Support: To enable GrandBet's support team to resolve account issues, deposit or withdrawal enquiries, and technical problems efficiently and accurately.
• Platform Improvements: To understand how members use the GrandBet platform and make meaningful improvements to the user experience over time.
• Legal Compliance: To fulfil reporting and record-keeping obligations as required by applicable laws and regulations.

Data security is GrandBet's highest technical priority. We invest seriously in security infrastructure to ensure your personal and financial information remains protected at all times.

Key security measures we have in place:

• 256-bit SSL Encryption: All communications between your browser or app and GrandBet's servers are encrypted using TLS/SSL with a 256-bit key length. This renders transmitted data unreadable even if intercepted.
• Two-Factor Authentication (2FA): GrandBet supports two-factor authentication for account login. We encourage all members to enable this feature for an added layer of protection.
• 24/7 Security Monitoring: An automated monitoring system operates around the clock to detect any unusual access attempts, cyberattacks, or suspicious activity.
• Internal Access Controls: Only GrandBet staff who require access to specific data in order to perform their duties are permitted to do so. All access is logged and audited on a regular basis.
• Encrypted Passwords: GrandBet account passwords are never stored in plain text – they are hashed using an irreversible cryptographic algorithm.
• Regular Security Testing: GrandBet conducts regular penetration testing and security audits by independent security experts to identify and patch any vulnerabilities before they can be exploited.

GrandBet does not sell or trade members' personal information. That said, in the course of operating the platform, there are specific situations where we need to share information with selected third parties:

• Payment Service Providers: Transaction information is shared with local Malaysian payment processors that handle deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX. These processors are bound by strict confidentiality agreements.
• Game Providers: Live casino and game providers such as Evolution Gaming and Pragmatic Play Live receive the session information required to run the games. No unnecessary personal information is shared with these parties.
• Identity Verification Services: For KYC purposes, GrandBet may engage accredited third-party identity verification services to verify the documents you submit.
• Legal Authorities: Where required by law, court order, or direction from a lawful authority, GrandBet will disclose the necessary information to those parties.
• Fraud Detection: GrandBet may share certain information with industry fraud detection services to protect the platform and its members from fraudulent activity.

GrandBet uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Below are the types of cookies we use:

• Essential Cookies (Required): Cookies required for the platform's core functions such as login sessions, security, and authentication. Without these cookies, the GrandBet platform will not function properly. These cookies cannot be disabled.
• Preference Cookies: Cookies that remember your preferences — such as language, currency denomination, and display settings — to deliver a more personalised experience each time you log in to GrandBet.
• Analytics Cookies: Cookies that help us understand how members interact with the platform — which pages are visited most frequently, how long gaming sessions last, and where users encounter difficulties. This information is used in aggregate and anonymised form for improvement purposes only.
• Security Cookies: Cookies that help GrandBet's fraud detection system identify unusual usage patterns and protect your account from unauthorised access.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the GrandBet platform and cause certain features to not work properly.

GrandBet retains your personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by applicable law.

General data retention period guidelines:

• Active Account Data: Retained for as long as your GrandBet account remains active. If your account has been inactive for 24 consecutive months, we may send you a notice before archiving it.
• Financial & Transaction Records: Retained for a minimum of 7 years in accordance with financial compliance and audit requirements. This is the standard retention period within Malaysia's financial industry.
• Platform Activity Log: Retained for 2 years for fraud detection and compliance purposes.
• KYC Documents: Retained for the duration of the active account plus 5 years after account closure, in accordance with AML (Anti-Money Laundering) compliance requirements.
• Customer Support Data: Conversation records and support tickets are retained for 3 years for reference and service quality purposes.

Once the mandatory retention period has ended, your data will be securely deleted using methods that ensure it cannot be recovered. If you close your GrandBet account, we will follow a structured data deletion procedure within the designated timeframe.

Under Malaysia's Personal Data Protection Act (PDPA) and the privacy principles we uphold, you have the following rights regarding your personal data at GrandBet:

• Right to Access: You have the right to request a list of the personal data we hold about you. GrandBet will provide a summary of that data within 14 business days of receiving your request.
• Right to Rectification: If you find that any personal data we hold about you is inaccurate or out of date, you have the right to request a correction. Corrections will be made within a reasonable timeframe once verification is complete.
• Right to Erasure: You have the right to request deletion of your personal data, subject to certain limitations where data retention is required by law (such as financial records).
• Right to Object to Processing: In certain circumstances, you have the right to object to the way we process your data, particularly for direct marketing purposes.
• Right to Withdraw Consent: Where the processing of certain data is based on your consent, you have the right to withdraw that consent at any time. Withdrawing your consent does not affect the validity of any processing that took place before the withdrawal.
• Right to Complain: If you believe GrandBet has violated your privacy rights, you have the right to lodge a complaint with us and with the relevant data protection authority in Malaysia.

To exercise any of the rights above, please contact the GrandBet privacy team by email at support@grandbet.best with the subject line "Data Privacy Request". Please include your account number and details of your request. We will verify your identity before processing any request involving personal data.

The GrandBet platform is strictly for adults aged 18 and above. GrandBet does not knowingly collect or store personal information from individuals under the age of 18.

If we discover or suspect that we have collected personal data from a minor without proper age verification, we will take immediate steps to:

• Closing the relevant account immediately.
• Delete all personal data associated with the account from our systems.
• Refund the account balance to the original deposit method once the investigation is complete.

GrandBet reserves the right to update or amend this Privacy Policy from time to time to reflect changes in how we operate, applicable legal developments, or improvements to our data protection practices.

For material or significant amendments, GrandBet will:

• Send email notifications to all active members at least 7 days before the changes take effect.
• Displaying a clear notice on the GrandBet platform's main page.
• Update the "Last Updated" date at the top of this document.

For minor amendments such as spelling corrections or clarifications that do not alter the substantive meaning, we may update this document without prior notice. We encourage you to review this page periodically.

Your continued use of the GrandBet platform after any amendments are published will be considered acceptance of the updated policy.

If you have any questions, concerns or requests regarding GrandBet's Privacy Policy or how we handle your personal data, please get in touch with us:

• Email: support@grandbet.best (use the subject line "Data Privacy Request")
• Live Chat: Available on the GrandBet platform 24 hours a day, 7 days a week

GrandBet's privacy team will acknowledge receipt of your enquiry within 2 business days and provide a substantive response within 14 business days from the date the enquiry is received.