Privacy Policy – royal36

1. Introduction

royal36 ("royal36", "we", "us", "our") operates the online gaming platform accessible at https://royal36.asia ("Platform"). We are committed to protecting the personal data of all registered players and visitors, and to processing that data in a manner that is transparent, fair, and consistent with our obligations under applicable data protection laws and our international gaming licence requirements.

This Privacy Policy applies to all personal data collected through the Platform, including via account registration, deposits and withdrawals, gameplay, customer support interactions, and use of our website. It should be read together with our Terms & Conditions and Responsible Gaming Policy.

If you have any questions about how royal36 handles your personal data, please contact our support team via the live chat accessible from any page of the Platform. Our support team is available 24 hours a day, 7 days a week.

2. Personal Data We Collect

royal36 collects personal data in several ways during your use of the Platform. The categories of data we collect are described below:

We do not collect special categories of sensitive personal data (such as health data or racial or ethnic origin) except where required by our responsible gaming obligations (for example, self-exclusion records) or where you voluntarily provide such information in a support context.

3. How We Use Your Personal Data

royal36 uses the personal data we collect for the following purposes:

• Account management — creating, verifying, and maintaining your royal36 player account
• Identity and age verification — confirming that you are 21 years of age or older and that your identity matches your registration details, as required under our licensing obligations
• Payment processing — processing MYR deposits and withdrawals via your chosen payment method (Touch n Go, Boost, Maybank, CIMB, Public Bank, or cryptocurrency)
• Fraud prevention and security — detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, and other prohibited conduct
• Regulatory compliance — meeting our obligations under our international gaming licence, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements
• Responsible gaming — monitoring gameplay patterns for indicators of problem gambling and administering deposit limits, cooling-off periods, and self-exclusion tools
• Customer support — responding to enquiries, resolving disputes, and improving service quality
• Marketing communications — sending promotional offers and bonus notifications to players who have opted in. You may opt out at any time via your account settings
• Platform improvement — analysing aggregated and anonymised usage data to improve the Platform's performance, user experience, and game offering

4. Legal Basis for Processing

royal36 processes your personal data on the following legal bases:

• Contractual necessity — processing required to fulfil our obligations to you under the royal36 Terms & Conditions, including account management and payment processing
• Legal obligation — processing required to comply with our licensing conditions, AML/KYC regulations, and other applicable laws
• Legitimate interests — processing necessary for fraud prevention, platform security, and service improvement, where those interests are not overridden by your data protection rights
• Consent — processing for direct marketing communications, where you have opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing

5. Data Sharing & Third Parties

royal36 does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment processors and e-wallet providers — to facilitate MYR transactions (Touch n Go, Boost, Maybank, CIMB, Public Bank, cryptocurrency processors)
• Identity verification providers — third-party KYC and AML service providers who assist in verifying player identities and screening against sanctions and fraud databases
• Game software providers — licensed game studios and live dealer operators who provide game content to the royal36 platform, under data processing agreements that restrict their use of your data
• Regulatory and licensing authorities — our licensing authority and other competent regulators, where required by law or regulation
• Law enforcement — where we are required by law, court order, or regulatory direction to disclose data to law enforcement agencies
• Group companies — where royal36 operates within a corporate group, data may be shared with affiliated entities for internal administrative purposes under the same data protection standards

All third-party recipients are required to process your personal data in accordance with applicable data protection laws and the terms of their agreements with royal36.

6. Cookies & Tracking Technologies

royal36 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us provide a functional and personalised experience. We use the following types of cookies:

• Essential cookies — required for the Platform to function correctly, including login session management and security token validation. These cannot be disabled.
• Functional cookies — remember your preferences such as language, display settings, and responsible gaming tool configurations.
• Analytics cookies — collect aggregated, anonymised data about how players navigate and use the Platform, used to improve performance and user experience.
• Marketing cookies — used with your consent to deliver relevant promotional content. These may be managed through your browser settings or by contacting support.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality.

7. Data Retention

royal36 retains your personal data for as long as necessary to fulfil the purposes described in this Policy and to meet our legal and regulatory obligations. The following retention periods apply as a general guide:

• Account and identity data — retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with AML and licensing requirements
• Transaction and gaming records — retained for a minimum of 5 years from the date of each transaction or gaming session
• Customer support communications — retained for 3 years following resolution of the relevant interaction
• Marketing consent records — retained until you withdraw consent plus 1 year for record-keeping purposes
• Self-exclusion records — retained for the full duration of the exclusion period plus 5 years

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

8. Your Data Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by royal36:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete personal data
• Right to erasure — request deletion of your personal data, subject to our legal retention obligations
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — request transfer of your data in a structured, machine-readable format where processing is based on consent or contract
• Right to object — object to processing based on legitimate interests, including direct marketing
• Right to withdraw consent — withdraw consent for marketing communications at any time without penalty

To exercise any of these rights, please contact our support team via the 24/7 live chat on the Platform. We will respond to your request within 30 days. In some cases, we may be required to retain certain data to fulfil our regulatory obligations even following a deletion request — we will explain this when it applies.

9. Data Security

royal36 implements technical and organisational security measures proportionate to the risk to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers
• Encryption of sensitive data at rest, including financial and identity records
• Role-based access controls ensuring that staff access only the data necessary for their role
• Multi-factor authentication for internal administrative systems
• Regular third-party security audits and penetration testing of the Platform
• Incident response procedures with mandatory notification timelines in the event of a qualifying data breach

While royal36 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for ensuring your own device security.

10. Children's Privacy

11. Changes to This Privacy Policy

royal36 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via email or in-platform notification at least 7 days before the amended Policy takes effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following the effective date of any update constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or royal36's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly from any page of the royal36 Platform
• Email (plain text): [email protected]

Our data protection team will respond to privacy-related enquiries within 5 business days. Requests to exercise data subject rights will be addressed within 30 calendar days, with notification if an extension is required.