Privacy Policy
Sultan33 — Your Data, Protected
Sultan33 is committed to protecting the privacy and personal data of every member. This Privacy Policy explains clearly what information we collect, how we use it, who we share it with, and what rights you hold as a data subject under applicable privacy principles.
Introduction
This Privacy Policy ("Policy") describes how Sultan33 ("we", "us", "our", "the Platform") collects, processes, stores, and protects personal data relating to individuals ("you", "Member", "User") who access or use the sultan33 website at sultan33.cam, including its associated mobile interface, gaming services, promotional programmes, and customer support channels.
Sultan33 is committed to handling your personal data with care, transparency, and in accordance with applicable international data protection principles. This Policy is designed to ensure that you fully understand what personal information we hold about you and how it is used to deliver, secure, and continuously improve your experience on the sultan33 platform.
By creating an account or continuing to use the sultan33 platform, you acknowledge that you have read and understood this Privacy Policy in full. If you do not agree with how we process your personal data as described in this Policy, you should discontinue your use of the platform and close your account.
This Policy is effective as of 1 January 2026. It should be read alongside our Terms & Conditions, which govern the overall contractual relationship between sultan33 and its members. In the event of any conflict between this Policy and the Terms & Conditions, this Policy shall prevail in respect of data privacy matters.
Definitions
For the purposes of this Privacy Policy, the following terms have the meanings assigned to them below:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person — including name, email address, phone number, date of birth, payment details, IP address, and device identifiers. |
| Processing | Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, and destruction. |
| Data Controller | Sultan33, which determines the purposes and means of processing personal data collected through the platform. |
| Data Processor | Any third-party service provider that processes personal data on behalf of Sultan33 pursuant to a data processing agreement. |
| Cookies | Small text files placed on your device by the sultan33 platform to enable platform functionality, analytics, and personalisation features. |
| KYC Data | Identity and document verification information collected as part of the Know Your Customer process, including government-issued ID (e.g., MyKad, passport) and proof of address documentation. |
| Sensitive Data | A subset of personal data requiring heightened protection — such as financial account information, transaction records, and identity documents. Sultan33 applies additional security controls to sensitive data categories. |
Personal Data We Collect
Sultan33 collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include:
3.1 Registration & Identity Data
- Full legal name as it appears on your government-issued identification document.
- Date of birth (used strictly to verify that you meet the 21+ age requirement).
- Email address used as your primary account identifier and communication channel.
- Mobile phone number for account security and optional SMS notifications.
- Username selected during registration.
- Country of residence and, where applicable, state or city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).
3.2 KYC & Verification Data
- Government-issued photo identification (MyKad, Malaysian passport, or equivalent document).
- Proof of residential address (utility bill, bank statement, or equivalent, dated within 3 months).
- Proof of ownership of the payment method used for deposits (where required by our AML compliance programme).
- Facial biometric data collected during automated identity verification where this process is implemented (processed by third-party KYC service providers subject to data processing agreements).
3.3 Financial & Transaction Data
- Deposit and withdrawal transaction records including amounts, dates, and payment method references.
- Payment method identifiers such as e-wallet account IDs (Touch 'n Go eWallet, Boost, GrabPay), bank account references (Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect), DuitNow IDs, FPX transaction references, and cryptocurrency wallet addresses (USDT TRC20).
- Account balance history and bonus credit records.
3.4 Gaming Activity Data
- Game session records including games played, bet amounts, game outcomes, and session durations.
- Sports betting selections including markets, odds accepted, stake amounts, and settlement outcomes.
- Bonus and promotional claim history.
- Responsible gambling tool usage, including deposit limits set and self-exclusion requests.
3.5 Technical & Device Data
- IP address and approximate geographic location derived from IP.
- Device type, operating system, and browser or app version.
- Session timestamps, login history, and access logs.
- Cookie data and analytics identifiers as described in Section 8.
3.6 Communications Data
- Live chat conversation transcripts with our customer support team.
- Email correspondence sent to or received from sultan33 support.
- Feedback, complaints, or survey responses submitted by you.
How We Collect Your Data
Sultan33 collects personal data through the following channels and mechanisms:
- Direct Collection: Information you provide directly during account registration, KYC verification, payment processing, support interactions, or survey participation.
- Automated Collection: Technical and device data collected automatically when you access the platform, including via cookies, log files, and session tracking technologies as described in Section 8.
- Third-Party Sources: Where permitted, Sultan33 may receive supplemental identity or fraud-screening data from licensed third-party KYC providers, payment processors, and anti-money laundering screening services. Such data is used solely to fulfil regulatory obligations and verify the accuracy of Member-provided information.
- Payment Processor Data: Transaction reference data received from Malaysian payment processors including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and applicable cryptocurrency network providers.
Purposes of Data Processing
Sultan33 processes your personal data for the following specific and legitimate purposes:
| Purpose | Data Categories Used |
|---|---|
| Account Registration & Authentication | Registration data, device data, login history |
| Age & Identity Verification (KYC) | Identity documents, date of birth, KYC data |
| Payment Processing | Financial & transaction data, payment method identifiers |
| Providing Gaming Services | Gaming activity data, account balance, session data |
| Fraud Prevention & Security | IP address, device data, transaction records, login history |
| Anti-Money Laundering (AML) Compliance | Transaction data, KYC data, gaming activity |
| Customer Support | Communications data, account data, transaction history |
| Promotional & Bonus Administration | Registration data, gaming activity, bonus claim history |
| Responsible Gambling Programme | Gaming activity, deposit data, self-exclusion records |
| Platform Analytics & Improvement | Anonymised technical data, session data, cookies |
| Marketing Communications (with consent) | Email address, preferences, gaming activity (aggregated) |
Legal Basis for Processing
Sultan33 processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:
- Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions — including account provision, payment processing, game delivery, and customer support.
- Legal Obligation: Processing required to comply with applicable anti-money laundering regulations, age verification requirements, and other legal or regulatory obligations applicable to online gaming operators.
- Legitimate Interests: Processing carried out in pursuit of Sultan33's legitimate business interests, including fraud prevention, platform security, responsible gambling programme operation, and platform analytics — where such interests are not overridden by your fundamental rights and freedoms.
- Consent: Processing for marketing communications, optional personalisation features, and non-essential cookies — where your explicit consent has been obtained and can be withdrawn at any time without affecting your ability to use the platform.
Data Sharing & Disclosure
Sultan33 does not sell, rent, or lease your personal data to third parties for their own commercial or marketing purposes under any circumstances. We may disclose your personal data to the following categories of recipients, strictly for the purposes described in this Policy:
7.1 Service Providers (Data Processors)
Trusted third-party providers who process data on Sultan33's behalf under written data processing agreements, including: payment processors (e-wallet operators, Malaysian bank FPX gateways, cryptocurrency network processors), cloud infrastructure providers, KYC and identity verification platforms, fraud detection service providers, and customer support software providers. These providers are contractually required to process personal data only on Sultan33's instructions and to apply appropriate security measures.
7.2 Regulatory & Law Enforcement Authorities
Where required by applicable law, regulation, court order, or lawful request from a competent authority — including anti-money laundering regulators, financial intelligence units, or law enforcement agencies — Sultan33 may disclose personal data to the extent required to fulfil such legal obligations. We will make reasonable efforts to notify affected members of any such disclosure where legally permitted to do so.
7.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of Sultan33's business or assets, personal data held about Members may be transferred to the acquiring entity as part of the transaction. In such circumstances, Sultan33 will ensure that appropriate data protection obligations are imposed on the receiving party and, where required, will notify Members of the transfer in advance.
Sultan33 does not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards such as standard contractual clauses or equivalent protections.
Cookies & Tracking Technologies
Sultan33 uses cookies and similar tracking technologies to enable core platform functionality, improve your experience, and — where you have consented — to deliver personalised content and analyse platform usage patterns.
| Cookie Type | Purpose | Required? |
|---|---|---|
| Essential Cookies | Enable account login, session management, security tokens, and core platform navigation. The platform cannot function without these. | Yes — always active |
| Functional Cookies | Remember your language preference, display settings, and game lobby configurations between sessions. | Optional |
| Analytics Cookies | Collect anonymised data about how Members use the platform — page views, session durations, error rates — to inform platform improvements. No personally identifiable data is included in analytics reports. | Optional (consent) |
| Marketing Cookies | Used to track the effectiveness of Sultan33's own promotional campaigns. Sultan33 does not use third-party advertising cookies for cross-site tracking or behavioural profiling. | Optional (consent) |
You may manage your cookie preferences through your browser settings at any time. Disabling essential cookies will impair the functionality of the sultan33 platform. Disabling optional cookies will not affect your access to games or account features but may reduce platform personalisation.
Data Retention
Sultan33 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable legal or regulatory obligations. The following general retention periods apply:
- Active Account Data: Retained for the duration of the Member's active account relationship with sultan33.
- KYC & Identity Documents: Retained for a minimum of 5 years from the date of collection, or longer where required by applicable anti-money laundering regulations.
- Transaction Records: Retained for a minimum of 5 years from the date of each transaction to meet financial record-keeping obligations.
- Gaming Activity Logs: Retained for a minimum of 3 years for responsible gambling programme purposes and fraud investigation.
- Communications Data: Support interactions and correspondence retained for up to 3 years from the date of the last interaction.
- Marketing Consent Records: Retained for the duration of the marketing relationship plus 1 year following any consent withdrawal.
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with a specific individual.
Data Security
Sultan33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or unlawful processing. These measures include:
- SSL/TLS Encryption: All data transmitted between your device and the sultan33 platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
- Encrypted Data Storage: Personal data and financial records are stored in encrypted form within access-controlled cloud infrastructure environments.
- Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with role-based access permissions and audit logging applied.
- Multi-Factor Authentication: Sultan33 supports and encourages multi-factor authentication (MFA) for Member accounts to reduce the risk of unauthorised account access.
- Security Monitoring: Sultan33 operates 24/7 security monitoring for anomalous access patterns, potential data breaches, and fraud indicators.
- Third-Party Security Standards: All third-party Data Processors engaged by Sultan33 are required to demonstrate compliance with equivalent security standards as a condition of engagement.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Sultan33 will notify affected Members without undue delay in accordance with applicable notification obligations.
Your Rights as a Data Subject
As a Member of sultan33, you have the following rights in respect of your personal data. To exercise any of these rights, please contact us as described in Section 15. Sultan33 will respond to all valid data subject requests within 14 calendar days.
11.1 Right of Access
You have the right to request a copy of the personal data Sultan33 holds about you, together with information about how it is used and with whom it has been shared. Identity verification will be required before we fulfil an access request.
11.2 Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. Members may update most profile information directly through the account settings panel. For corrections to KYC documentation or transaction records, please contact our support team.
11.3 Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (for consent-based processing), or where applicable law provides a right of erasure. Please note that Sultan33 is subject to mandatory data retention obligations under anti-money laundering regulations that may prevent deletion of certain data categories during applicable retention periods.
11.4 Right to Restriction of Processing
In certain circumstances — for example where you contest the accuracy of personal data or have objected to processing pending verification of Sultan33's legitimate grounds — you may request that we restrict our processing to storage only while the matter is resolved.
11.5 Right to Data Portability
Where processing is based on your consent or on contractual necessity, and processing is carried out by automated means, you may request that Sultan33 provide your personal data in a structured, commonly used, machine-readable format.
11.6 Right to Object
You have the right to object to processing of your personal data based on Sultan33's legitimate interests, and to object at any time to processing for direct marketing purposes. Upon receipt of a valid marketing opt-out, Sultan33 will cease sending promotional communications within 5 business days.
To exercise any of your data subject rights, please contact our Privacy team at [email protected] with the subject line "Data Subject Request — [Your Username]". We will verify your identity before processing any request and respond within 14 calendar days.
Marketing Communications
Sultan33 may send you promotional communications about new games, bonuses, promotions, and platform features by email or, where you have provided your mobile number, by SMS. We will only send you marketing communications where you have provided your consent at the time of registration, or where we have a legitimate interest basis to contact you about similar services you have previously used.
You may withdraw your consent to marketing communications at any time by:
- Clicking the "Unsubscribe" link included in all Sultan33 email communications.
- Adjusting your notification preferences in your account settings panel.
- Contacting our support team via live chat or at [email protected].
Opting out of marketing communications will not affect your ability to receive transactional communications that are necessary for account management — such as deposit confirmations, withdrawal notifications, KYC request notices, and security alerts.
Children & Minors
The sultan33 platform is strictly intended for adults aged 21 years and above. Sultan33 does not knowingly collect personal data from individuals below the age of 21. Age verification is conducted as part of the account registration and KYC processes.
If Sultan33 becomes aware that personal data has been collected from an individual below the age of 21 — whether through a false declaration during registration or by any other means — the relevant account will be immediately suspended, all transactions will be reversed where possible, and the personal data associated with the account will be deleted in accordance with Section 9, subject to any mandatory retention requirements under applicable law.
If you have reason to believe that a minor has registered on sultan33 or that personal data of a minor has been collected by the platform, please notify us immediately at [email protected].
Policy Amendments
Sultan33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Sultan33's data processing practices, or platform features. Where changes are material — for example where we introduce a new purpose of processing or a new category of data sharing — we will provide notice to Members via email to their registered address or through a prominent on-site notification at least 14 days before the amended Policy takes effect.
The current version of this Policy, together with its effective date, will always be accessible at sultan33.cam/privacy-policy. Your continued use of the platform following the effective date of any amended Policy constitutes your acknowledgement of the amendments. If you do not accept the amended Policy, you should close your account before the effective date.
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or Sultan33's data processing practices, please contact us through any of the following channels:
Live Chat
Available 24 hours a day, 7 days a week. Fastest channel for urgent privacy or account queries. Access via the live chat widget on the sultan33 platform.
Privacy Email
[email protected]
Subject: "Privacy Query — [Your Username]"
Response within 14 calendar days.
For requests to exercise your data subject rights (access, rectification, erasure, portability, objection), please include your registered username and a brief description of your request. Identity verification will be conducted before any request is fulfilled.
How Sultan33 Protects Your Data
Privacy protection at sultan33 is not a compliance checkbox — it is a core operational commitment that touches every part of how we build and run the platform for Malaysian members.
End-to-End Encryption
All data transmitted between your device and the sultan33 platform is protected by TLS encryption. Your login credentials, payment details, and personal information are never transmitted in plain text — on any device, on any connection.
No Third-Party Data Sales
Sultan33 does not sell, rent, or share your personal data with external marketers, data brokers, or analytics companies for their own use. Your data is used only to run and improve the sultan33 platform for you and other members.
Your Data Rights, Respected
Access, correct, or request deletion of your personal data at any time. Sultan33 responds to all valid data subject requests within 14 calendar days, with identity verification to protect your account from unauthorised data disclosure.
Minimal Data Collection
Sultan33 collects only the personal data that is genuinely necessary for account management, payment processing, regulatory compliance, and platform operation. We do not collect data speculatively or build extensive behavioural profiles beyond what is needed for responsible gambling monitoring.
Transparent Processing
Every category of personal data Sultan33 collects and the exact purpose for which it is used is documented in this Policy — clearly, in plain English. There are no hidden data uses or undisclosed partnerships involving your personal information.
Scheduled Data Deletion
Sultan33 operates structured data retention schedules aligned to regulatory requirements. When your data is no longer needed, it is securely deleted or anonymised — not stored indefinitely. Retention periods for each data category are disclosed in Section 9 of this Policy.
Questions About Your Privacy?
Our support team is available around the clock to assist with any privacy queries, data access requests, or marketing opt-out requests. Alternatively, browse our FAQ for quick answers to common questions.
🔞 Sultan33 is strictly for players aged 21 and above. Please play responsibly. Visit our Responsible Gambling page for support tools.