Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by Harta33 ("Harta33", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at harta33.cam (the "Platform"). This Policy explains how we collect, process, store, share, and protect the personal data of individuals who access or use our Platform ("Users", "you", "your").

Harta33 serves Malaysian players with a platform that supports live dealer casino games, slot games, sports betting, crash games, and lottery-style games. All transactions on the Platform are conducted in Malaysian Ringgit (MYR) and processed through Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and selected cryptocurrency options.

We are committed to handling your personal data responsibly, in accordance with applicable privacy and data protection laws. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference.

2 Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can identify a natural person, directly or indirectly, including name, identification number, location data, IP address, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means Harta33, which determines the purposes and means of the Processing of Personal Data.
• "Data Subject" means the natural person to whom Personal Data relates — in this context, you, the User.
• "KYC" means the Know Your Customer identity and address verification process conducted by Harta33 in accordance with applicable regulatory requirements.
• "Cookie" means a small text file placed on your device by the Platform for purposes including session management, analytics, and personalisation.
• "Third-Party Service Provider" means any external entity engaged by Harta33 to provide services that involve the Processing of Personal Data on Harta33's behalf, such as payment processors and KYC verification partners.

3 Data We Collect

Harta33 collects Personal Data in the categories set out below. We collect only data that is necessary for the specific purpose identified and do not process Personal Data beyond what is required for those purposes.

4 How We Collect Your Data

Harta33 collects Personal Data through the following means:

• Direct Collection: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to a promotion.
• Automated Technical Collection: Data collected automatically when you access the Platform, including through cookies, web beacons, log files, and similar tracking technologies. This includes your IP address, browser fingerprint, device identifiers, and behavioural data on the Platform.
• Third-Party Sources: Identity and address verification data received from KYC verification partners in response to verification requests initiated by Harta33. Payment confirmation data received from Malaysian payment processors including Maybank, CIMB, DuitNow, and FPX in connection with deposit and withdrawal transactions.

5 How We Use Your Data

Harta33 processes your Personal Data for the following purposes, each supported by an appropriate legal basis as described in Section 6:

1. Account Management: Creating, maintaining, and closing your Account, including processing registration details and verifying your identity.
2. Transaction Processing: Processing deposits and withdrawals through supported Malaysian payment channels, and maintaining accurate financial records in MYR.
3. Regulatory Compliance: Fulfilling our obligations under applicable anti-money laundering (AML), counter-terrorist financing (CTF), and Know Your Customer (KYC) regulations, including age verification to confirm that all users are aged 21 or above.
4. Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct on the Platform.
5. Responsible Gambling: Monitoring gameplay patterns to identify indicators of problem gambling behaviour, and administering self-exclusion, deposit limits, and loss limits where requested or required.
6. Customer Support: Responding to queries, complaints, disputes, and feedback submitted through any support channel.
7. Service Improvement: Analysing aggregated and anonymised usage data to improve Platform features, game selection, and user experience.
8. Marketing Communications: Sending promotional offers and bonus notifications to Users who have opted in to marketing communications. You may withdraw your consent to marketing communications at any time by contacting our support team.

6 Legal Basis for Processing

Harta33 processes your Personal Data only where we have a valid legal basis to do so. The applicable legal bases are:

• Contractual Necessity: Processing required to perform our obligations under the contract formed when you accept our Terms & Conditions, including account management and transaction processing.
• Legal Obligation: Processing required to comply with applicable laws, including AML, KYC, and age verification requirements.
• Legitimate Interests: Processing required for the legitimate interests of Harta33 or a third party, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent, including marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain session state, and gather analytical information about Platform usage. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including session authentication, security tokens, and shopping cart functionality. These cookies cannot be disabled.
• Analytical / Performance Cookies: Collect anonymised data about how Users interact with the Platform — pages visited, time on page, error occurrences — to help us improve performance and usability.
• Functionality Cookies: Remember your preferences such as language selection, preferred game category, and regional settings.
• Targeting / Marketing Cookies: Used to deliver relevant promotional content. These cookies are only placed with your consent and can be withdrawn at any time via your account settings or browser controls.

You may control cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may impair the functionality of the Platform. For detailed guidance on managing cookies in your browser, refer to your browser's help documentation.

8 Data Sharing & Disclosure

Harta33 does not sell, rent, or trade your Personal Data to third parties for commercial or marketing purposes. We may share Personal Data in the following limited circumstances:

• Payment Processors: We share financial transaction data with Malaysian payment service providers (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX operators) solely to process deposits and withdrawals on your behalf.
• KYC Verification Partners: Identity documents submitted during the KYC process may be shared with accredited third-party verification services engaged by Harta33 to authenticate your identity and address. These partners are contractually bound to process data only for the specified verification purpose.
• Regulatory and Legal Authorities: We may disclose Personal Data to government authorities, regulators, law enforcement agencies, or courts where we are legally required to do so, including in connection with AML / CTF compliance obligations.
• Fraud Prevention Agencies: We may share data with fraud prevention and detection agencies where we reasonably suspect fraudulent activity, money laundering, or other prohibited conduct.
• Professional Advisers: We may share data with legal, accounting, or audit professionals under strict confidentiality obligations where necessary for Harta33's business operations.

All Third-Party Service Providers engaged by Harta33 are required to maintain the confidentiality and security of any Personal Data processed on our behalf, and are permitted to use such data only for the specific purpose for which it was shared.

9 Data Retention

Harta33 retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to the following considerations:

• Active Account Data: Retained for the duration of your Account and for a period of five (5) years following Account closure, in accordance with applicable AML and regulatory record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following the conclusion of the business relationship, as required under anti-money laundering legislation.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years in accordance with financial reporting and regulatory obligations.
• Support Communications: Retained for two (2) years from the date of the communication, unless retention is required in connection with an ongoing dispute or investigation.
• Marketing Consent Records: Retained for the duration of your consent and for a period of one (1) year following withdrawal of consent.

Upon the expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised such that it can no longer be linked to any identifiable individual.

10 Data Security

Harta33 implements appropriate technical and organisational measures to protect your Personal Data against unauthorised access, loss, alteration, disclosure, or destruction. Our security measures include:

• 256-bit SSL / TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage of sensitive data including passwords (hashed and salted) and KYC documents;
• Access controls restricting Personal Data to authorised personnel on a strictly need-to-know basis;
• Regular security audits and penetration testing of Platform infrastructure;
• Two-factor authentication (2FA) available to all Users for Account login;
• Firewalls, intrusion detection systems, and real-time monitoring of suspicious activity.

Notwithstanding the above, no data transmission over the internet or storage system can be guaranteed to be 100% secure. If you have reason to believe that your Account has been compromised, please notify us immediately at [email protected].

11 International Data Transfers

In the course of operating the Platform, Personal Data may be transferred to and processed in countries or territories other than Malaysia. This may occur where Harta33 engages Third-Party Service Providers who operate from or store data in jurisdictions outside Malaysia.

Where such international transfers occur, Harta33 takes appropriate steps to ensure that your Personal Data receives a level of protection equivalent to that required under applicable Malaysian privacy law, including through the use of contractual safeguards with recipient entities and the selection of Third-Party Service Providers located in jurisdictions with adequate data protection standards.

12 Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your Personal Data held by Harta33. These rights may be exercised by submitting a written request to our support team at [email protected]. We will acknowledge your request within 48 hours and aim to respond substantively within 30 calendar days.

Please refer to the User Rights summary in the section below this Policy document for a visual overview. The full description of each right is as follows:

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data held about you.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances, for example while the accuracy of data is disputed.
• Right to Object: You may object to the processing of your Personal Data where such processing is based on legitimate interests, including objecting to the use of your data for direct marketing purposes.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that we provide your Personal Data to you in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

13 Children and Minors

The Platform is strictly intended for adults aged 21 years and above. Harta33 does not knowingly collect Personal Data from any person under the age of 21. If we become aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete that information and close the associated Account.

If you believe that a minor has registered an Account or provided Personal Data on the Platform, please notify us immediately at [email protected] so that we may investigate and take appropriate action.

14 Third-Party Links

The Platform may contain references to third-party services, including payment providers and support tools. While Harta33 takes reasonable care in the selection of third-party service providers, we are not responsible for the privacy practices or content of any third-party website or service that is accessed via the Platform.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of the Platform, particularly payment providers such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, and others, as these operate under their own independent privacy frameworks.

15 Changes to This Privacy Policy

Harta33 reserves the right to update or amend this Privacy Policy at any time. In the event of material changes to how we process your Personal Data, we will provide reasonable advance notice by posting a prominent notice on the Platform or by notifying you via your registered email address, no fewer than seven (7) calendar days prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects the date on which the most recent revision was made. We recommend that you review this Policy periodically to remain informed of how Harta33 handles your Personal Data. Your continued use of the Platform following any update to this Policy constitutes your acceptance of the revised terms.

16 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the Harta33 data support team using the following details:

• Email: [email protected]  (mark the subject line: "Privacy / Data Request")
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform.
• Response Time: Data-related enquiries — within 30 calendar days of receipt; general support — within 24 hours.
• Support Languages: English, Bahasa Melayu, Mandarin Chinese.