Rusa33 Privacy Policy —
How We Handle Your Data

Introduction

Rusa33 ("we", "our", "us") is committed to protecting and respecting the privacy of every individual who accesses or uses the Rusa33 platform, accessible at https://rusa33.asia (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed, stored, used, and protected.

This Policy applies to all users of the Platform, including registered account holders, visitors, and any individual who interacts with Rusa33 services — whether based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere in Malaysia or beyond.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the Platform immediately.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Data We Collect

Rusa33 collects personal data across several categories, depending on how you interact with the Platform. The categories of data we may collect include:

3.1 Identity & Account Data

• Full legal name as shown on your government-issued identification document;
• Date of birth (for age verification — you must be 21 or above to register);
• Gender (where voluntarily provided);
• Username and account credentials (password stored in encrypted form only);
• Copies of identification documents submitted for KYC purposes (e.g., Malaysian MyKad, passport).

3.2 Contact & Communication Data

• Email address;
• Mobile phone number (where provided);
• Residential address (including city — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam);
• Records of correspondence between you and Rusa33 support, including live chat transcripts and email exchanges.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records;
• Payment method identifiers (e.g., masked bank account details, e-wallet identifiers for Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect);
• Transaction amounts in Malaysian Ringgit (MYR/RM);
• Cryptocurrency transaction hashes where BTC or USDT deposits are made.

3.4 Gaming & Activity Data

• Game session records, bet history, win and loss records;
• Sports betting selections (EPL, Liga Super Malaysia, UFC, and other events);
• Bonus and promotion redemption history;
• Self-exclusion and responsible gambling tool settings;
• VIP tier status and loyalty programme activity.

3.5 Technical & Usage Data

• IP address and approximate geolocation (country/city level);
• Device type, operating system, browser type and version;
• Pages visited, session duration, and clickstream data;
• Referral source and marketing attribution data;
• Error logs and crash reports.

How We Collect Your Data

Rusa33 collects personal data through the following means:

• Direct provision: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically when you access and interact with the Platform, via server logs, analytics tools, and cookies;
• Third-party sources: Data received from payment processors (including Malaysian payment providers such as FPX gateway operators and e-wallet providers), identity verification services engaged for KYC purposes, and fraud detection partners;
• Publicly available sources: In limited circumstances, data sourced from public records or databases to verify identity or comply with anti-money laundering (AML) obligations.

Data Processing & Purpose of Use

Rusa33 processes personal data only for defined, legitimate purposes. The table below sets out the primary purposes for which your data is processed and the category of data involved:

Rusa33 does not process your personal data for purposes beyond those listed above without obtaining your prior consent or where otherwise permitted by applicable law.

Legal Basis for Processing

Where applicable data protection legislation requires Rusa33 to identify a lawful basis for processing personal data, we rely on one or more of the following grounds:

• Contractual necessity: Processing required to perform the contract between you and Rusa33, including account management, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations and responsible gambling requirements;
• Legitimate interests: Processing necessary for the legitimate business interests of Rusa33, including fraud prevention, platform security, and service improvement — where such interests are not overridden by your rights and interests;
• Consent: Where you have provided explicit consent for a specific processing activity, such as receiving marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

Rusa33 does not sell your personal data to unaffiliated third parties for their own marketing or commercial purposes. We may share your personal data with the following categories of recipients strictly for the purposes described in this Policy:

7.1 Service Providers & Processors

We engage carefully selected third-party service providers who process personal data on our behalf, including: payment processing partners (including Malaysian payment rails such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay); identity verification and KYC service providers; IT infrastructure, hosting, and security providers; customer support platform providers; and analytics and fraud detection services. All such providers are contractually bound to process data only for permitted purposes and to maintain appropriate security measures.

7.2 Game Studio Partners

Certain technical data (such as session tokens and game identifiers) may be shared with our licensed international game studio partners to facilitate game delivery and fair-play auditing. These partners are not provided with your full personal profile.

7.3 Legal & Regulatory Authorities

Rusa33 may disclose personal data to competent legal, regulatory, tax, or law enforcement authorities where required to do so by applicable law, court order, or binding regulatory requirement. We will take reasonable steps to notify you of such disclosure where legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a material part of Rusa33's business assets, personal data held by Rusa33 may be transferred to the acquiring or succeding entity as part of that transaction. Affected users will be notified in advance of any such transfer and of any changes to this Privacy Policy that result from it.

Data Retention

Rusa33 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. General retention periods are as follows:

• Account and identity data: Retained for the duration of your active account relationship with Rusa33 and for a minimum of five (5) years following account closure, to comply with AML and regulatory record-keeping requirements;
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of each transaction, in compliance with financial reporting and anti-money laundering obligations;
• KYC documentation: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later;
• Correspondence and support records: Retained for a minimum of three (3) years from the date of the final communication;
• Technical and usage data: Retained in anonymised or aggregated form for analytical purposes; individually identifiable technical data typically deleted within twelve (12) months of collection.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Rusa33's data disposal procedures.

Data Security

Rusa33 implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. Security measures in place include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your device and Rusa33 servers;
• Encrypted password storage using industry-standard hashing algorithms — your password is never stored in plain text;
• Access controls ensuring that personal data is accessible only to authorised Rusa33 personnel who require access for legitimate business purposes;
• Regular security assessments, penetration testing, and vulnerability management processes;
• Data minimisation practices to limit the volume of personal data collected and retained to what is strictly necessary;
• Incident response procedures to detect, investigate, and respond to personal data breaches in a timely manner.

Notwithstanding the above, no method of electronic transmission or storage is completely secure. While Rusa33 takes commercially reasonable measures to protect your data, we cannot guarantee absolute security against all threats. You are responsible for maintaining the security of your account credentials and for notifying Rusa33 promptly of any suspected unauthorised access.

Cookies & Tracking Technologies

Rusa33 uses cookies and similar tracking technologies (including web beacons and local storage objects) to operate and improve the Platform, personalise your experience, and analyse usage patterns. The categories of cookies used are:

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. For Strictly Necessary cookies, no opt-out is available as they are essential for Platform operation.

Your Rights Over Your Data

Subject to applicable law and Rusa33's legal and regulatory obligations, you hold the following rights in respect of your personal data:

To exercise any of the above rights, please contact Rusa33 via the details in Section 15. We will respond to verified requests within 30 days. Some rights are subject to exemptions under applicable law — particularly where processing is required to fulfil legal obligations or to establish, exercise, or defend legal claims.

International Data Transfers

Rusa33 operates under international gaming licensing and engages service providers located in multiple jurisdictions. As a result, your personal data may be transferred to stored in, or processed in countries outside Malaysia. Where such transfers occur, Rusa33 takes steps to ensure that adequate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable data protection principles, including:

• Entering into data processing agreements with service providers incorporating appropriate contractual protections;
• Utilising service providers certified under recognised international data security standards;
• Ensuring that any transfer to jurisdictions without adequate data protection laws is governed by binding contractual clauses that protect your rights.

By using the Platform, you acknowledge and consent to the transfer of your personal data outside Malaysia where necessary for the operation of the Platform and the provision of its services.

Minors & Age Verification

The Rusa33 Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is a mandatory step during account registration and KYC processes.

If Rusa33 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted promptly, the associated account will be suspended, and any deposited funds will be returned to the verified payment source where operationally possible.

Amendments to This Privacy Policy

Rusa33 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform functionality. Where material changes are made, we will notify registered users via email, Platform notification, or prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically to stay informed of how Rusa33 handles your personal data.

Contact Us

If you wish to exercise your data rights, have questions about this Privacy Policy, wish to raise a data protection concern, or request deletion of your account data, please contact Rusa33's Privacy team through the following channel:

We acknowledge all data rights requests within five (5) business days and aim to resolve them within thirty (30) days of receipt of a verified request. Complex or high-volume requests may require up to an additional thirty (30) days, of which you will be notified.

For responsible gambling queries and self-exclusion requests, please visit our Responsible Gambling page where dedicated tools and support resources are available.