Privacy Policy — Arena39 Malaysia

This Privacy Policy ("Policy") is issued by Arena39 ("Arena39", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at arena39.cam (the "Platform"). This Policy sets out how Arena39 collects, uses, stores, shares, and protects personal data provided by or generated through the use of the Platform by registered players and visitors ("you", "your", "Player", "User").

Arena39 is committed to maintaining the highest standards of data protection and user privacy. We collect only the personal data necessary for the legitimate operation of our Platform, and we do not engage in the sale, rental, or unlicensed disclosure of your personal information to third parties.

By registering an Account on Arena39 or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data in the manner described herein. This Policy should be read in conjunction with Arena39's Terms & Conditions, which are incorporated by reference.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or any combination thereof.
• "Data Controller" means Arena39, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party engaged by Arena39 to process Personal Data on Arena39's behalf under a binding data processing agreement.
• "Sensitive Data" means a subset of Personal Data that is treated with heightened protection, including financial account details, government-issued identification numbers, and KYC verification documents.
• "Cookies" means small text files placed on a User's device by the Platform for the purpose of enabling session management, preference retention, and anonymised analytics.
• "KYC" means Know Your Customer — the identity and payment verification process required by Arena39 prior to authorising withdrawal transactions.
• "Account" means a registered user account on the Arena39 Platform.

Arena39 collects the following categories of Personal Data in connection with the provision of its services:

• Full legal name as it appears on a government-issued identity document
• Date of birth (used to verify compliance with the 21+ age restriction)
• Gender (optional, for personalisation purposes)
• Nationality and country of residence
• Malaysian MyKad number, passport number, or equivalent identification number

• Email address (primary means of account notification)
• Malaysian mobile telephone number
• Residential address, including postcode, city (e.g., Kuala Lumpur, Penang, Johor Bahru), and state

• Payment method type (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, Hong Leong, BTC, ETH, USDT)
• Partial payment account identifiers (e.g., masked wallet ID or last four digits of bank account) sufficient to verify ownership
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment channel used
• Currency denomination (MYR or cryptocurrency equivalent)

• Wagering history, game session data, win and loss records
• Promotion and bonus claims history
• VIP tier status and loyalty programme activity
• Responsible gambling preferences (deposit limits, session limits, self-exclusion status)

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Session timestamps and duration
• Cookie identifiers and session tokens
• Referring URL and navigation paths within the Platform

• Content of Live Chat, email, and WhatsApp support communications
• Support ticket history and resolution records
• Language preference for support interactions (English, Bahasa Melayu, or Chinese)

Arena39 does not collect full payment card numbers, CVV codes, or bank login credentials at any point. Payment transactions are processed through regulated third-party payment gateways that maintain their own PCI-DSS compliant data security frameworks.

Arena39 collects Personal Data through the following channels and mechanisms:

• Direct provision by the Player: Data submitted during Account registration, KYC verification, deposit and withdrawal requests, support enquiries, and promotional form submissions.
• Automated technical collection: Data collected automatically during Platform use, including session data, device identifiers, IP addresses, and cookie data as described in Section 10.
• Third-party payment processors: Transaction confirmation data received from Arena39's licensed payment service providers following deposit or withdrawal processing.
• KYC verification partners: Identity verification data returned by Arena39's contracted identity verification service providers upon document submission.
• Fraud prevention systems: Risk signals and device fingerprinting data generated by Arena39's fraud detection infrastructure to protect both Arena39 and its players.

Arena39 processes Personal Data solely for the purposes set out in the table below. We do not process Personal Data for any purpose that is incompatible with those originally specified at the time of collection.

Arena39 processes Personal Data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing is required to perform Arena39's obligations under the Account agreement with the Player, including service delivery, payment processing, and customer support.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, KYC mandates, age verification requirements, and lawful orders from competent authorities.
• Legitimate Interest: Processing is necessary for Arena39's legitimate business interests, including fraud prevention, platform security, and anonymised performance analytics, provided such interests do not override the Player's fundamental privacy rights.
• Consent: Processing is based on the Player's freely given, specific, informed, and revocable consent, applied where Arena39 sends optional promotional communications or processes non-essential behavioural data for personalisation. Consent may be withdrawn at any time via Account settings or by contacting Arena39 support.

Arena39 does not sell, lease, or otherwise commercially transfer Personal Data to any third party for marketing, advertising, or commercial profiling purposes. Personal Data may be shared in the following limited and controlled circumstances:

Transaction and identity data is shared with Arena39's regulated payment processing partners — including providers facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, Hong Leong, and cryptocurrency gateway transactions — strictly to the extent necessary to process deposits and withdrawals on your behalf.

Where required for identity verification, documents and identification data may be transmitted to Arena39's contracted KYC verification service providers operating under data processing agreements that bind them to confidentiality and data security obligations equivalent to those of Arena39.

Technical data including IP addresses, device identifiers, and behavioural patterns may be processed by Arena39's fraud prevention and risk management systems. This processing serves to protect both Arena39 and its players from fraudulent activity.

Arena39 may disclose Personal Data to competent regulatory, judicial, law enforcement, or governmental authorities where required to do so by applicable law, court order, or legitimate legal process. Arena39 will, where legally permissible, notify the affected Player of such disclosure.

In the event of a merger, acquisition, asset sale, or corporate restructuring involving Arena39, Personal Data held by Arena39 may be transferred to the relevant successor entity, subject to the successor's commitment to maintain data protection standards consistent with this Policy.

Arena39 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of the Account's active status plus a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction to satisfy financial compliance and audit obligations.
• KYC Verification Documents: Retained for a minimum of five (5) years following Account closure or the completion of the relevant transaction, whichever is later.
• Support Communications: Retained for three (3) years from the date of the last support interaction, unless a longer retention period is required due to an ongoing dispute or legal matter.
• Technical & Log Data: Retained for a maximum of twelve (12) months from the date of collection, unless required for ongoing fraud investigations.
• Marketing Consent Records: Retained for the period of consent plus three (3) years to demonstrate compliance with consent-based processing obligations.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with Arena39's data disposal procedures, such that it can no longer be attributed to an identifiable individual.

Arena39 implements a comprehensive suite of technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. Key measures in place include:

• Transport Layer Security (TLS 1.3): All data transmitted between the Player's device and the Arena39 Platform is encrypted using 256-bit SSL/TLS encryption, rendering data unreadable to any intercepting third party.
• Access Controls: Access to Personal Data within Arena39's internal systems is restricted on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all administrative accounts.
• Data Minimisation: Arena39 collects only the minimum Personal Data necessary for each specified purpose and avoids retention of data beyond applicable retention periods.
• Security Audits: Arena39 conducts periodic internal security reviews and engages third-party security assessors to evaluate the integrity of its data protection infrastructure.
• Incident Response: Arena39 maintains a documented data breach response procedure. In the event of a confirmed data breach affecting Player Personal Data, Arena39 will notify affected Players without undue delay to the extent required by applicable law.
• Employee Training: All Arena39 personnel with access to Personal Data receive regular training on data protection obligations and information security best practices.

Arena39 uses cookies and similar tracking technologies on the Platform for the following limited purposes:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These enable session management, login state persistence, and security token validation. They cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language selection (English, Bahasa Melayu, or Chinese), display settings, and responsible gambling tool configurations.
• Analytical Cookies: Collect anonymised, aggregated data about how Players navigate and interact with the Platform. This data is used to improve Platform performance and user experience. No individually identifiable data is extracted from analytical cookies.

Arena39 does not use third-party advertising tracking cookies, cross-site behavioural profiling technologies, or social media pixel trackers on the Platform. We do not share cookie-derived data with advertising networks.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies may impair your ability to use the Platform. Blocking functional or analytical cookies will not prevent Platform access but may reduce the quality of your experience.

As a Player on the Arena39 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact Arena39's support team via Live Chat or email at [email protected]. Arena39 will respond to verified data rights requests within 30 calendar days of receipt.

Please note that certain rights are subject to limitations where Arena39 is required to retain data for legal compliance, fraud prevention, or dispute resolution purposes. Where a request cannot be fulfilled in full, Arena39 will provide a written explanation of the applicable limitation.

Arena39 is strictly prohibited for use by individuals under the age of 21. The Platform does not knowingly collect, process, or retain Personal Data from any person under the age of 21. If Arena39 becomes aware that Personal Data has been collected from a person who has not attained the minimum age of 21, such data will be promptly deleted and the associated Account will be permanently closed.

The Arena39 Platform may contain references or links to third-party websites, payment provider portals, or external services. Arena39 has no control over the privacy practices or content of such third-party platforms, and this Privacy Policy does not apply to data processing conducted by third parties.

Arena39 strongly recommends that you review the privacy policy of any third-party service you access via a link from the Platform before submitting any Personal Data to that service. Arena39 accepts no responsibility or liability for the data handling practices of third-party websites or services.

Arena39 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Platform features, or data processing practices. Where material changes are made, Arena39 will notify registered Players via the email address associated with their Account or by prominent notice on the Platform prior to the updated Policy taking effect.

The version date displayed at the top of this page reflects the date of the most recent revision. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. It is your responsibility to check this page periodically for updates.

For any enquiries relating to this Privacy Policy, or to exercise any of the data rights described in Section 11, please contact Arena39 through the following channels:

• Live Chat: Available 24/7 directly on the Platform. Average response time: 3–5 minutes. Support available in English, Bahasa Melayu, and Chinese.
• Email: [email protected] — for formal data rights requests and written enquiries. Response within 1–2 business days for general enquiries; within 30 calendar days for formal data rights requests.
• Registered office address: Available to verified Players upon KYC-authenticated request submitted via support.

Where a data rights request is submitted via email, Arena39 may require you to verify your identity before processing the request, in order to ensure that Personal Data is not disclosed to or actioned upon by unauthorised parties.