Introduction
raja328 operates an English-language online entertainment platform serving Malaysian players aged 21 and above. As a data controller, raja328 is committed to handling all personal information it receives in a transparent, lawful and secure manner in accordance with applicable international data protection principles.
This Privacy Policy applies to all personal data processed by raja328 in connection with the raja328 website, account registration, payment processing, customer support interactions and marketing communications. It does not apply to third-party websites or services that may be linked to or accessible through the Platform.
Malaysian users: Malaysia's Personal Data Protection Act 2010 (PDPA) applies to the processing of personal data in commercial transactions. While raja328 operates under an international licensing framework, it seeks to observe the principles of the Malaysian PDPA as a baseline standard of respect for user privacy. Users retain responsibility for understanding their own data rights under local law.
By registering an account or otherwise using the raja328 platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should not create an account or continue to use the Platform.
Definitions
The following terms carry the meanings set out below throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identification number, email address, device identifiers and financial account details. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure or destruction. |
| "Data Controller" | raja328, as the entity that determines the purposes and means by which Personal Data is processed. |
| "Data Processor" | A third-party service provider that processes Personal Data on behalf of raja328 under a contractual obligation to comply with this Policy and applicable data protection laws. |
| "User" / "You" | Any natural person who visits, registers on or otherwise interacts with the raja328 platform. |
| "KYC Data" | Identity and age verification documents and information collected from Users as part of the Know Your Customer process, including government-issued identification and proof of address. |
| "Platform" | The raja328 website and all associated digital services accessible at raja328.cam. |
Data We Collect
raja328 collects Personal Data in several categories depending on the nature of your interaction with the Platform. The following table outlines the primary data categories and specific examples of the information held within each:
| Category | Examples of Data Held |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, MyKad or passport number (where submitted for KYC). |
| Contact Data | Email address, mobile phone number, residential address including city (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam). |
| Account Data | Registered username, account status, login timestamps, security question responses (hashed), language and currency preferences. |
| Financial Data | Deposit and withdrawal history, preferred payment method labels (e.g., Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank), transaction amounts in MYR and transaction status. |
| Gaming Activity | Game session logs, wagering history, bonus usage records, win/loss summaries and responsible gambling tool selections. |
| Technical Data | IP address, browser type and version, operating system, device identifiers, referring URLs and session duration. |
| Communications Data | Records of customer support interactions, complaint submissions, email correspondence and live chat transcripts. |
| Marketing Data | Opt-in or opt-out preferences for promotional communications, promotion redemption history and survey responses (where voluntarily provided). |
raja328 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes or health-related information, unless specifically required by applicable KYC or responsible gambling obligations.
How Data Is Collected
raja328 collects Personal Data through the following channels and mechanisms:
- Direct provision: Information you enter voluntarily during account registration, KYC verification, payment submissions, customer support requests or competition entries.
- Automated collection: Technical Data collected automatically when you access the Platform through cookies, server logs, session identifiers and analytics tools. Please refer to Section 9 for details on cookie usage.
- Third-party sources: Identity verification agencies, fraud prevention services, payment processing providers and, where applicable, publicly available records used to verify the accuracy of information you have provided.
- Behavioural inference: Platform-generated summaries derived from your gaming activity, navigation patterns and service interaction history, used to improve service delivery and support responsible gambling monitoring.
Payment data note: raja328 does not store full payment card numbers on its own servers. Payment transactions processed through channels such as FPX, DuitNow, Maybank, CIMB or Public Bank are handled by PCI-DSS compliant payment processors. raja328 retains only transaction reference data and masked payment identifiers.
Data Processing & Purpose
raja328 processes Personal Data only for specified, explicit and legitimate purposes. The primary purposes for which your data is processed are set out below:
- Account creation and management: To register your account, verify your identity, maintain your account settings and provide access to Platform services.
- Service delivery: To operate casino games, sports betting markets, payment processing, loyalty programme administration and customer support.
- Age and identity verification (KYC): To confirm that all registered users meet the 21+ age requirement and to comply with anti-money laundering obligations.
- Payment processing and fraud prevention: To process deposits and withdrawals in MYR through supported Malaysian channels and to detect, investigate and prevent fraudulent transactions.
- Responsible gambling: To monitor gaming patterns for signs of potentially harmful behaviour and to administer deposit limits, session reminders and self-exclusion requests.
- Legal and regulatory compliance: To meet obligations under the Platform's international licensing framework, including record retention, reporting and co-operation with lawful authorities.
- Marketing communications: To send promotional offers, platform updates and loyalty programme notifications where you have opted in to receive such communications. You may withdraw consent at any time through your account settings.
- Platform improvement: To analyse usage patterns, diagnose technical issues, improve game performance and develop new features based on aggregated and anonymised insights.
Legal Basis for Processing
raja328 processes Personal Data on the following legal bases, consistent with internationally recognised data protection principles:
- Contractual necessity: Processing required to fulfil the obligations set out in the Terms & Conditions that govern your account, including account registration, payment processing and service delivery.
- Legal obligation: Processing required to comply with applicable licensing requirements, anti-money laundering rules, age verification mandates and lawful authority requests.
- Legitimate interests: Processing carried out in the legitimate interests of raja328, including fraud detection, platform security, responsible gambling monitoring and service optimisation, provided these interests are not overridden by your privacy rights.
- Consent: Processing of data for optional marketing communications and non-essential cookies, where your explicit consent has been obtained and can be withdrawn at any time without affecting the lawfulness of prior processing.
Data Sharing
raja328 does not sell Personal Data to third parties. Data may be shared with the following categories of recipient only as necessary for the purposes described in this Policy:
- Payment service providers: Processors facilitating MYR transactions through Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX and direct bank channels. These providers receive only the minimum data required to process the relevant transaction.
- Identity verification agencies: Third-party KYC service providers engaged to verify the identity and age of registered users in compliance with licensing requirements.
- Game content providers: Software studios whose casino and live dealer games are hosted on the Platform receive session data necessary to operate the game and record outcomes.
- Fraud prevention and risk management services: Specialist providers that analyse transaction patterns to detect and prevent fraudulent activity.
- Legal and regulatory authorities: Where required by law, court order or a lawful request from a competent authority, including anti-money laundering bodies and licensing regulators.
- IT infrastructure and hosting providers: Contracted providers who host Platform data under strict data processing agreements that prohibit unauthorised use or disclosure.
All third-party Data Processors engaged by raja328 are contractually required to process Personal Data only for the specified purpose, to maintain appropriate security standards and to comply with applicable data protection obligations.
Data Retention
raja328 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and licensing obligations. The following general retention principles apply:
- Active account data is retained for the duration of the account relationship and for a period of no less than five (5) years following account closure, in order to satisfy anti-money laundering record-keeping requirements.
- KYC verification records are retained for a minimum of five (5) years following the completion of the verification process or the closure of the associated account, whichever is later.
- Transaction records including deposit and withdrawal history in MYR are retained for a minimum of five (5) years for financial compliance purposes.
- Customer support records are retained for a period of three (3) years following the resolution of the relevant interaction, unless they form part of an ongoing dispute or legal matter.
- Marketing preference data is retained until consent is withdrawn, after which records of the withdrawal of consent are kept for a reasonable compliance period.
Upon expiry of the applicable retention period, Personal Data is deleted or irreversibly anonymised in accordance with the Platform's data disposal procedures.
Cookies & Tracking Technologies
raja328 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns and support fraud prevention. A cookie is a small text file placed on your device by the Platform's server. You can control cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.
You may withdraw consent for non-essential cookies at any time through your browser settings or account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
Data Security
raja328 implements a range of technical and organisational security measures to protect Personal Data against unauthorised access, loss, destruction or disclosure. These measures include but are not limited to:
- Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform.
- Encryption at rest for sensitive account and financial data stored on Platform servers.
- Access controls limiting employee and contractor access to Personal Data on a strictly need-to-know basis.
- Regular internal security reviews and vulnerability assessments.
- Multi-factor authentication options for account access.
- Incident response procedures to identify, contain and notify users of any data breach that poses a material risk to their privacy rights, within a reasonable timeframe.
While raja328 applies industry-standard security practices, no digital system is entirely immune to risk. You play an important part in protecting your own account by using a strong, unique password, not sharing your login credentials with third parties, and signing out of the Platform when using a shared device.
Account security reminder: raja328 will never ask for your password via email or live chat. If you receive any such request, treat it as suspicious and contact support immediately.
User Rights
Subject to applicable law and the Platform's legal obligations, registered users of raja328 may exercise the following rights in relation to their Personal Data. Requests should be submitted in writing to the contact details provided in Section 15.
Right of Access
You may request a copy of the Personal Data held about you, along with information about how it is being processed.
Right to Rectification
You may request correction of any inaccurate or incomplete Personal Data held in your account records.
Right to Erasure
You may request deletion of Personal Data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.
Right to Restriction
You may request that processing of your data be restricted while a dispute or accuracy query is being resolved.
Right to Portability
Where processing is based on consent or contract and carried out by automated means, you may request a structured copy of your data in a machine-readable format.
Right to Object
You may object to processing based on legitimate interests, including direct marketing, at any time through your account marketing preferences.
raja328 will respond to all valid data rights requests within thirty (30) calendar days. In cases of complexity or high volume, this period may be extended by a further sixty (60) days with prior written notice.
Minors & Age Verification
The raja328 platform is strictly for persons aged 21 and above. raja328 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step before any real-money activity is permitted on the Platform.
If raja328 becomes aware that Personal Data has been collected from a person under the age of 21 without appropriate parental or guardian consent, or in breach of the Platform's eligibility requirements, that data will be promptly deleted and the associated account closed. If you believe a minor has accessed the Platform, please notify the support team at the contact address in Section 15.
International Data Transfers
raja328 operates under an international licensing framework and may engage service providers located outside Malaysia for hosting, payment processing, identity verification and other operational purposes. As a result, your Personal Data may be transferred to, and processed in, countries outside Malaysia.
Where such transfers occur, raja328 ensures that appropriate safeguards are in place to protect the data, including contractual data processing agreements that impose obligations on recipient parties equivalent to those set out in this Privacy Policy. raja328 does not transfer Personal Data to jurisdictions where adequate data protection safeguards cannot be established.
Amendments to This Policy
raja328 reserves the right to update this Privacy Policy from time to time to reflect changes in data processing practices, legal obligations or Platform functionality. Material changes will be communicated to registered users via the email address associated with their account or through a prominent notice displayed on the Platform prior to the effective date of the change.
The "Last reviewed" date at the top of this Policy indicates when it was most recently revised. Continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you should cease using the Platform and contact support to initiate account closure.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights or need to report a privacy concern, please contact the raja328 data team in writing. All correspondence should be submitted in English for efficient processing.
Email: [email protected]
Please include your registered email address and a brief description of your query or request. raja328 aims to acknowledge all privacy-related enquiries within five (5) business days and to provide a substantive response within the timeframes stated in Section 11.
The email address above is displayed as plain text only and is not a clickable link. For answers to common platform questions, please visit the FAQ section.