Privacy Policy of
Fortuna33

1 Introduction

This Privacy Policy ("Policy") is issued by Fortuna33 ("the Platform", "we", "us", or "our"), the operator of the online gaming platform accessible at fortuna33.cam. This Policy describes how we collect, use, process, disclose, and protect personal data relating to individuals ("Members", "Users", or "you") who register for an account or otherwise interact with the Fortuna33 platform.

Fortuna33 is an internationally licensed online gaming operator. We are committed to handling personal data in accordance with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) frameworks and the Malaysian Personal Data Protection Act 2010 (PDPA) where applicable to our Malaysian user base.

This Policy should be read together with our Terms & Conditions and our Responsible Gambling Policy. By creating an account or using any feature of this platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

2 Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, IP address, and financial information.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" means Fortuna33, the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party engaged by Fortuna33 to process personal data on our behalf under a binding data processing agreement.
• "KYC Data" means identity and verification documents collected as part of the Know Your Customer process, including government-issued identification, proof of address, and payment method verification.
• "Cookies" means small text files placed on a user's device by a website for purposes including session management, analytics, and personalisation.
• "PDPA" means the Malaysian Personal Data Protection Act 2010 and all subsidiary regulations issued thereunder.

3 Categories of Personal Data We Collect

Fortuna33 collects the following categories of personal data, depending on how you interact with the platform:

4 How We Collect Personal Data

We collect personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or update your account profile.
• Automatically — when you access the platform, our systems automatically record technical and usage data including IP address, device fingerprint, session activity, and cookie data through standard server logs and analytics tools.
• From third parties — we may receive information from our payment processors (including FPX, Maybank, CIMB, Public Bank, Hong Leong, and e-wallet providers) to confirm payment status; from identity verification service providers during KYC; and from fraud prevention databases to support our anti-money-laundering obligations.
• From publicly available sources — in certain circumstances, we may supplement your profile data with information from public registers or sanction screening databases as required by our compliance obligations.

5 Purposes of Data Processing

Fortuna33 processes your personal data for the following specific purposes:

1. Account management: Creating and maintaining your Member account, authenticating your identity on login, and enabling access to all platform features.
2. Transaction processing: Processing deposits and withdrawals in MYR via your chosen payment method, maintaining accurate transaction records, and resolving payment disputes.
3. KYC and compliance: Verifying your identity and age (21+ requirement), complying with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations, and screening against sanctions lists.
4. Responsible gambling: Monitoring betting patterns to identify potential problem gambling behaviour, applying deposit limits and self-exclusion restrictions, and supporting Members who request intervention tools.
5. Customer support: Responding to your enquiries, resolving complaints, and maintaining records of communications for quality assurance and dispute resolution.
6. Platform security and fraud prevention: Detecting and preventing unauthorised access, multi-accounting, bonus abuse, collusion, and other fraudulent or prohibited activities.
7. Service improvement: Analysing aggregated usage data to improve game offerings, platform performance, user experience, and product development.
8. Marketing communications: Sending you personalised promotional offers, bonus notifications, and platform updates via email or in-platform messaging — subject to your communication preferences and applicable opt-out rights.
9. Legal obligations: Retaining records to satisfy regulatory requirements, responding to lawful requests from competent authorities, and enforcing our Terms & Conditions.

6 Legal Basis for Processing

Where data protection law requires a legal basis for processing personal data, Fortuna33 relies on the following grounds:

• Contractual necessity: Processing required to perform the contract between you and Fortuna33 — including account creation, transaction processing, and providing access to games and services.
• Legal obligation: Processing required to comply with applicable law — including KYC verification, AML/CTF screening, record-keeping obligations, and responses to regulatory requests.
• Legitimate interests: Processing carried out for our legitimate business interests that do not override your fundamental rights — including fraud prevention, platform security, and service analytics.
• Consent: Where we rely on your consent — for example, for direct marketing communications and non-essential cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

7 Data Sharing & Disclosure

Fortuna33 does not sell or rent your personal data. We may share your data with third parties only in the following limited circumstances:

• Payment service providers: We share transaction data with payment processors including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank solely to process your financial transactions.
• Identity verification providers: We engage certified third-party KYC and identity verification services to validate documents and conduct AML/CTF screening. These processors are bound by data processing agreements and are prohibited from using your data for any purpose other than verification.
• Technology and hosting providers: We use cloud infrastructure and technology service providers to host and operate the platform. All such providers are contractually bound to process personal data only on our documented instructions.
• Game software providers: Certain usage data (such as anonymised betting activity) may be shared with our certified RNG game software partners for quality assurance and technical auditing purposes.
• Regulatory and law enforcement authorities: We will disclose personal data to competent legal, regulatory, or law enforcement authorities where required by law or in response to a valid legal request, including court orders, regulatory investigations, and AML reporting obligations.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, personal data may be transferred to the acquiring entity subject to equivalent data protection obligations.

8 International Data Transfers

As an internationally licensed operator, Fortuna33 may process and store your personal data in jurisdictions outside Malaysia, including in countries where the Platform's hosting infrastructure and certain third-party processors are located. These jurisdictions may not have data protection laws equivalent in scope to the Malaysian PDPA.

Where personal data is transferred internationally, Fortuna33 ensures that appropriate safeguards are in place to protect your data, including:

• Executing Standard Contractual Clauses or equivalent data transfer agreements with receiving parties
• Engaging processors in jurisdictions recognised as providing adequate data protection
• Applying encryption and access controls to data transmitted across borders

By using the Fortuna33 platform and providing your personal data, you acknowledge and consent to the transfer of your personal data to these jurisdictions as described in this section.

9 Data Retention

We retain personal data for the minimum period necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

10 Security Measures

Fortuna33 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport encryption: All data transmissions between your device and our servers are protected by 256-bit SSL/TLS encryption.
• Data at rest encryption: Sensitive data stored on our servers, including KYC documents and financial records, is encrypted using AES-256 standards.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Employee access is governed by role-based permissions and regular access reviews.
• Two-factor authentication: Members are encouraged to enable two-factor authentication (2FA) on their accounts. Platform staff with access to personal data systems are required to use 2FA.
• Penetration testing: Our platform undergoes regular independent security assessments and penetration testing to identify and address vulnerabilities.
• Incident response: We maintain a documented data breach response plan with defined escalation procedures and notification timelines.

Notwithstanding these measures, no method of electronic transmission or storage is 100% secure. We encourage Members to choose strong, unique passwords and to contact us immediately if they suspect any unauthorised access to their account.

11 Cookies & Tracking Technologies

Fortuna33 uses cookies and similar tracking technologies (such as pixel tags and local storage) to operate and improve the platform. Cookies are small text files stored on your device when you visit our website. We use the following categories of cookies:

• Strictly necessary cookies: Required for core platform functionality, including user authentication, session management, and security. These cannot be disabled without affecting platform operation.
• Performance and analytics cookies: Used to collect aggregated, anonymised information about how Members use the platform — such as pages visited, session duration, and navigation paths — to help us improve user experience and identify technical issues.
• Functional cookies: Used to remember your preferences such as language settings, display preferences, and previously viewed content.
• Marketing and targeting cookies: Used to deliver relevant promotional content and measure the effectiveness of our campaigns. These cookies are only placed with your consent.

You may manage your cookie preferences through your browser settings or through the cookie consent tool on our platform. Please note that disabling certain cookies may affect your ability to use all features of the platform. For detailed information about the specific cookies we use, please refer to our Cookie Notice accessible within the platform settings.

12 Your Rights as a Data Subject

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by Fortuna33:

• Right of access: You may request a copy of the personal data we hold about you, along with information about how it is being processed. We will respond within 30 days of a verified request.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data we hold about you. Where data can be corrected directly through your account settings, we encourage you to do so.
• Right to erasure ("right to be forgotten"): You may request that we delete your personal data in certain circumstances, such as where the data is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal obligations, including our AML record-keeping requirements.
• Right to restrict processing: In certain circumstances, you may request that we limit how we use your data while a dispute is being resolved or a request is pending.
• Right to data portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format, where processing is based on consent or contract.
• Right to object: You have the right to object to processing of your data for direct marketing purposes at any time, without needing to provide a reason. You may also object to other processing activities where we rely on legitimate interests as the legal basis.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

To exercise any of the above rights, please contact our Data Protection team using the contact details in Clause 15. We may need to verify your identity before processing certain requests. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

13 Children's Privacy

The Fortuna33 platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. If we become aware that a person under 21 has registered an account or provided personal data to us, we will immediately suspend that account and delete the associated personal data.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on this platform, please contact us immediately at the details provided in Clause 15. We will investigate and take prompt action to remove the account and any associated data.

14 Amendments to This Policy

Fortuna33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. Where changes are material — meaning they substantially affect your rights or how your data is used — we will notify you by email to your registered address and display a prominent notice on the platform at least fourteen (14) days before the changes take effect.

Minor updates — such as clarifications of existing practices, corrections of typographical errors, or updates required to reflect new legislation without substantive change to how we process your data — may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the Fortuna33 platform following the effective date of any amendment constitutes your acknowledgement and acceptance of the revised Policy. If you do not agree with any changes, you should cease using the platform and may request account closure in accordance with the account termination provisions in our Terms & Conditions.

15 Contact Us — Data Protection Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Fortuna33, please contact our Data Protection team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available daily from 08:00 to 00:00 MYT via the on-platform chat feature
• Response time: Data subject requests acknowledged within 5 business days; resolved within 30 days
• Serving cities: Kuala Lumpur · Petaling Jaya · Shah Alam · Penang · Johor Bahru

When contacting us regarding a data subject request, please provide your full name, registered email address, and a clear description of your request. We may need to verify your identity before processing certain requests. For account-specific disputes or support issues, please refer to our FAQ page for general guidance, or contact live chat for immediate assistance.