Privacy Policy — Naga303

This Privacy Policy ("Policy") is issued by Naga303 ("Naga303", "the Company", "we", "us", "our") and governs the collection, use, storage, disclosure, and protection of personal data in connection with your use of the Naga303 online casino and sports betting platform, accessible at naga303.cam and all associated mobile-optimised interfaces, subdomains, and services (collectively, "the Platform").

Naga303 is committed to handling personal data responsibly, transparently, and in accordance with applicable international data protection standards. This Policy has been prepared to ensure that members — including registered users across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout Malaysia — fully understand how their personal information is handled throughout their relationship with the Platform.

By registering an account on the Platform, completing the Know Your Customer (KYC) verification process, or otherwise using any services provided by Naga303, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with this Policy, you must discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably identify a living natural person, directly or indirectly, including but not limited to name, identification number, contact details, financial information, IP address, device identifiers, and behavioural data.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, alteration, restriction, erasure, or destruction.
• "Data Controller" means Naga303, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of Naga303 under a written agreement, such as payment processing partners, KYC verification providers, and IT infrastructure operators.
• "Member" / "User" means any registered user of the Platform.
• "KYC" means Know Your Customer — the identity, age, and source-of-funds verification process required for account activation and withdrawal processing.
• "Cookies" means small data files stored on your device by the Platform for session management, analytics, and functionality purposes.
• "Sensitive Data" means Personal Data that by its nature requires enhanced protection, including identity document data, financial account details, and data relating to problem gambling status collected in the context of responsible gambling tools.

Naga303 collects Personal Data that is necessary to provide the Platform's services, comply with legal obligations, and maintain platform security. The categories of data we collect include, but are not limited to:

A. Identity & Registration Data

• Full legal name as appearing on your government-issued identity document.
• Date of birth (used for mandatory age verification — 21+ requirement).
• National identification number (Malaysian MyKad number or passport number).
• Nationality and country of residence.
• Username and account preferences.

B. Contact & Communication Data

• Email address (primary communication channel for account notifications, transaction confirmations, and promotional communications where consent is provided).
• Mobile phone number (used for account security, two-factor authentication, and support communications).
• Residential address (collected as part of KYC verification).

C. Financial & Transaction Data

• Details of payment methods registered to your account, including e-wallet account identifiers (Touch 'n Go eWallet, Boost Wallet, GrabPay), bank account names associated with DuitNow/FPX transfers, and partial card details where applicable.
• Deposit and withdrawal transaction history including amounts (MYR), timestamps, and payment method used.
• Cryptocurrency wallet addresses used for BTC or USDT transactions, where applicable.

D. Betting & Gaming Activity Data

• Sports betting history including market selections, stake amounts, odds accepted, and settlement outcomes across Liga Super Malaysia, EPL, La Liga, UFC, and other markets.
• Casino and live table game play history including game titles, wager amounts, and session duration.
• Bonus and promotion usage history.
• Responsible gambling tool settings and usage (deposit limits, session limits, self-exclusion requests).

E. Technical & Device Data

• IP address and geolocation data at the time of login and transaction.
• Device identifiers, operating system version, browser type and version.
• Session logs including login timestamps, page navigation data, and error logs.
• Cookie and tracking data as described in Section 10.

F. KYC & Compliance Documentation

• Copies of identity documents submitted for verification (MyKad, passport, or equivalent).
• Proof of address documents (utility bills, bank statements, or official government correspondence).
• Source-of-funds documentation where requested for high-value accounts or in compliance with anti-money laundering (AML) procedures.

Naga303 collects Personal Data through the following means:

• Directly from you: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, placing bets, using responsible gambling tools, or contacting our support team via live chat, email, or WhatsApp.
• Automatically through Platform use: Technical and device data is collected automatically via server logs, cookies, and similar tracking technologies when you access and interact with the Platform.
• From third-party verification providers: Where you authorise or are required to complete identity verification through an approved third-party KYC or AML screening provider, data from that verification process may be shared with us.
• From payment processing partners: Transaction confirmation data is received from approved Malaysian payment partners including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-affiliated banking institutions including Maybank, CIMB, Public Bank, and Hong Leong Bank.
• From fraud prevention systems: Risk assessment data may be received from fraud detection and AML screening systems used to protect the integrity of the Platform and comply with regulatory obligations.

Naga303 processes your Personal Data only for defined, legitimate purposes. The specific purposes for which your data is processed are as follows:

• Account creation and management: To register your account, verify your identity and age, maintain your account profile, and provide access to Platform services.
• KYC and age verification: To fulfil our strict 21+ minimum age verification obligation and comply with applicable identity verification requirements.
• Transaction processing: To process MYR deposits and withdrawals via Supported Payment Methods, maintain accurate transaction records, and prevent payment errors.
• Service delivery: To provide access to sports betting markets (including Liga Super Malaysia, EPL, and UFC), live casino tables, RNG games, and all other Platform features.
• Fraud prevention and AML compliance: To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct in accordance with applicable regulatory requirements.
• Responsible gambling: To operate and enforce deposit limits, session limits, loss limits, cooling-off periods, and self-exclusion requests requested by Members, and to identify signs of problem gambling behaviour for early intervention where appropriate.
• Customer support: To respond to support requests, resolve disputes, and improve the quality of our support services.
• Security and access control: To protect Member accounts from unauthorised access, detect suspicious login activity, and enforce platform security measures.
• Legal compliance: To comply with applicable laws, regulatory requirements, court orders, and government authority requests.
• Platform improvement: To analyse aggregated usage patterns, identify technical issues, and improve the performance and features of the Platform.
• Marketing communications (with consent only): To send promotional offers, bonus notifications, and relevant betting information to Members who have expressly opted in to marketing communications. Members may withdraw consent at any time by contacting support or updating account communication preferences.

Naga303 relies on the following legal bases for processing your Personal Data, consistent with applicable data protection principles:

• Contractual necessity: Processing required to fulfil our obligations under the Member Agreement, including account management, KYC, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, age verification requirements, and regulatory reporting.
• Legitimate interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and platform improvement, where such interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and certain non-essential cookie categories, which is carried out only where you have provided explicit, freely given consent that may be withdrawn at any time.

Naga303 does not sell, rent, or share your Personal Data with third parties for their own marketing purposes. We may share Personal Data with the following categories of recipients, strictly for the purposes described in this Policy:

• KYC and identity verification providers: Third-party identity verification services used to conduct KYC checks, age verification, and document authentication as required for account activation.
• Payment processing partners: Malaysian payment processors and financial institutions including Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX network banks, and cryptocurrency processing partners, for the purpose of executing deposit and withdrawal transactions.
• Fraud prevention and AML compliance services: Third-party screening and monitoring services used to detect and prevent fraud, money laundering, and other illegal activity.
• IT infrastructure and hosting providers: Data centre operators, cloud hosting providers, and platform technology vendors who process data on our behalf under strict data processing agreements and are bound by the same data protection obligations as the Company.
• Customer support tools: Live chat, email, and messaging platform providers used to deliver support services to Members.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory direction, we may disclose Personal Data to governmental authorities, regulatory bodies, or law enforcement agencies. We will, where permitted by law, notify affected Members of such disclosures.
• Professional advisors: Legal, accounting, and audit professionals bound by professional confidentiality obligations, where access to Personal Data is necessary for the provision of their services.

All third-party Data Processors engaged by Naga303 are required to maintain appropriate technical and organisational security measures and to process Personal Data only in accordance with our written instructions.

Naga303 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any extended retention requirements imposed by applicable law or regulatory obligation.

Specific retention periods include:

• Account and registration data: Retained for the duration of the Member's account and for a period of five (5) years following permanent account closure, to satisfy AML record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from the date of collection or account closure, whichever is later, in accordance with applicable AML regulations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required for AML compliance and financial record-keeping.
• Betting and gaming activity logs: Retained for a period of three (3) years from the date of each session, for purposes of dispute resolution and responsible gambling monitoring.
• Marketing consent records: Retained for the duration of the consent period plus a period sufficient to demonstrate compliance in the event of a query.
• Technical and access logs: Typically retained for ninety (90) days to one (1) year, depending on the nature of the log and the operational or security purpose for which it is maintained.

Following the expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be associated with an identified individual.

Naga303 implements comprehensive technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• AES-256 / TLS encryption: All data transmitted between your device and the Platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data at rest is protected using AES-256 encryption.
• Access controls: Personal Data is accessible only to authorised personnel who require access for legitimate operational purposes. Role-based access controls limit exposure to sensitive data on a need-to-know basis.
• Multi-factor authentication: Account login is protected by multi-factor authentication options to prevent unauthorised access.
• Regular security audits: The Platform undergoes regular security assessments and penetration testing by qualified security professionals to identify and remediate vulnerabilities.
• Incident response procedures: Naga303 maintains documented data breach response procedures. In the event of a data breach affecting your Personal Data, we will notify affected Members in accordance with applicable obligations, including the nature of the breach and recommended protective actions.

The Naga303 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, maintain your session state, analyse usage patterns, and where consent is provided, deliver relevant content.

The categories of cookies used on the Platform include:

• Strictly Necessary Cookies: Essential for core Platform functionality, including session management (keeping you logged in), security tokens, and load balancing. These cookies cannot be disabled as the Platform cannot function correctly without them.
• Functional Cookies: Remember your preferences and settings (such as language preference, display settings, and odds format) to provide a personalised experience. These cookies are activated based on your interactions with the Platform.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members interact with the Platform — such as pages visited, session duration, and navigation paths — to help us identify areas for improvement. These are set only with your consent.
• Security Cookies: Support fraud detection and prevention functions by assisting in the identification of unusual login patterns or suspicious account activity.

You may manage your cookie preferences through your browser settings. Please be aware that disabling certain categories of cookies may affect the functionality of the Platform. Strictly Necessary cookies cannot be disabled via browser settings as they are required for basic Platform operation.

As a Member and data subject, you hold specific rights in relation to the Personal Data that Naga303 holds about you. Naga303 is committed to facilitating the exercise of these rights promptly and transparently:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you and information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held about you. For basic account details, you may update information directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (where consent was the processing basis), or where processing is unlawful. This right is subject to applicable legal retention obligations — in particular, KYC and financial records must be retained for the periods set out in Section 8.
• Right to Restriction of Processing: You may request that we restrict processing of your Personal Data in certain circumstances, for example while the accuracy of data is under dispute.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, and to processing for direct marketing purposes. Objection to marketing communications will be actioned immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact our Data Protection team by email at [email protected] (plain text — not a clickable link) or via live chat. We will respond to verified requests within a reasonable period and in accordance with applicable requirements. We may need to verify your identity before processing a data rights request.

The Naga303 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. The Platform incorporates mandatory age verification as part of the KYC process to enforce this restriction.

If Naga303 becomes aware that Personal Data has been collected from a person under the age of 21, we will immediately suspend the relevant account, delete the collected data to the extent permitted by law, and take appropriate further action including notification of relevant authorities where required.

If you believe that a minor has accessed or registered on the Platform, please contact us immediately at [email protected] (plain text only). We will investigate and take immediate action.

The Naga303 Platform may contain references to third-party services, including payment platforms such as Touch 'n Go eWallet, Boost Wallet, GrabPay, and banking institutions. Naga303 does not control the privacy practices of any third-party services and is not responsible for their privacy policies or data handling practices.

When you interact with a third-party payment service — for example, when redirected to a bank's online portal to complete an FPX transaction — that interaction is governed by the privacy policy of the relevant third party. We encourage you to review the privacy policies of any third-party services you use in connection with Platform transactions.

Naga303 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will provide reasonable advance notice to registered Members via the email address associated with their account, and by displaying a prominent notice on the Platform.

The current version of this Policy is always accessible at naga303.cam/privacy-policy. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with a revised Policy, you must discontinue use of the Platform and may request account closure in accordance with the Terms and Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact the Naga303 data protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 on the Platform in English, Bahasa Melayu, and Mandarin. Data protection and privacy requests are handled by our dedicated compliance team.
• WhatsApp Support: Available via the contact details displayed on the Platform's support section.

When submitting a data rights request or privacy enquiry, please include your registered account username and a clear description of your request. For identity verification purposes, we may ask you to confirm additional account details before processing your request.

We aim to acknowledge all privacy-related enquiries within one (1) business day and to resolve data subject access requests within 30 days of receipt of a verified request, in accordance with applicable data protection standards.