Cas3 Privacy Policy – Personal Data Protection for Malaysia Players

Personal Data We Collect

Cas3 collects your personal data through several means — directly when you provide it to us, automatically as you use the platform, and in some cases from legitimate third-party sources. The categories of data we collect are as follows:

How and Why We Use Your Data

Every piece of data cas3 collects has a clear and legitimate purpose. We use your personal data for the following:

• Account Management — to register, verify, and manage your account at cas3, including the KYC process required under anti-money laundering laws.
• Transaction Processing — processing deposits and withdrawals via your chosen Malaysian payment method, including Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX.
• Service Provision — to give you access to all games and features on the cas3 platform, including live baccarat, blackjack, roulette, poker, slots, and Sports Betting.
• Platform Security — to identify and prevent fraud, money laundering, account abuse, and other security threats that could harm the platform or other members.
• Responsible Gaming — monitoring gameplay patterns to identify signs of problem gambling, enabling us to take proactive steps to protect our members' well-being.
• Service Communications — sending you important notifications relating to your account, transactions, security updates, and policy changes.
• Marketing Communications — sending you information about cas3 promotions, bonuses, and offers that may be of interest to you. You may withdraw consent for marketing communications at any time through your account settings.
• Analytics & Improvement — to analyse platform usage, understand member needs, and continually improve the user experience on cas3.
• Legal Compliance — to fulfil applicable legal and regulatory obligations, including retaining transaction records as required by the relevant authorities.

Cas3 will not use your personal data for any purpose not stated above without first obtaining your consent.

Sharing Data with Third Parties

Cas3 takes a very cautious approach to sharing your personal data. We never sells your data. Data sharing only occurs in the limited circumstances set out below:

• Payment Service Providers — when you make a deposit or withdrawal, the necessary transaction details are shared with your chosen payment service provider (Touch 'n Go, GrabPay, DuitNow, FPX banks, etc.) strictly to the extent required to complete the transaction.
• Game Software Providers — limited technical data is shared with cas3's gaming software provider partners solely for the purpose of ensuring the platform operates correctly and securely.
• Identity Verification Service (KYC) — your identity verification documents may be shared with accredited third-party KYC service providers for verification purposes only.
• Legal Authorities — cas3 will disclose information to the relevant authorities, such as the police, courts, or regulators, when required by law or a valid court order.
• Fraud Prevention Service — limited information may be shared with third-party fraud prevention services to protect our platform and members from fraudulent activity.

All third parties that receive data from cas3 are bound by strict data protection agreements and are not permitted to use your data for any purpose other than what has been agreed upon with cas3.

The Security of Your Personal Data

Cas3 continually invests in security infrastructure to ensure your personal data remains protected at all times. The security measures we have in place include:

• 256-bit SSL Encryption for all communications between your browser and cas3's servers — the same standard used by Malaysia's leading financial institutions.
• Encrypted data storage — all sensitive personal data is stored in encrypted form on our servers, meaning that even in the unlikely event of a breach, your data cannot be read without the encryption key.
• Strict access controls — only cas3 staff who require access to your personal data to carry out their authorised duties are permitted to do so, and all access is logged and monitored.
• Two-factor authentication (2FA) available to all member accounts and strongly recommended for added security.
• 24/7 system monitoring to detect and respond to any security threats or suspicious activity in real time.
• Regular penetration testing conducted by independent security experts to identify and address any vulnerabilities before they can be exploited.
• Staff security training conducted on a regular basis to ensure all cas3 staff understand their responsibilities in protecting members' personal data.

While cas3 takes all reasonable measures to protect your data, no system can guarantee absolute 100% security. We therefore encourage you to take your own protective steps as well, such as using a strong password, enabling 2FA, and never sharing your login credentials with anyone.

Data Retention Period

Cas3 retains your personal data only for as long as it is needed for the purposes set out in this policy or as required by applicable law. The general data retention guidelines are as follows:

• Active account data — retained for the duration that your cas3 account remains active.
• Financial transaction records — retained for a minimum of 7 years after a transaction occurs, in compliance with Malaysia's anti-money laundering laws and tax reporting requirements.
• KYC Documents — retained for a minimum of 5 years after the business relationship between you and cas3 has ended.
• Customer support communication records — retained for 3 years after the issue has been resolved.
• Log and technical data — retained for a maximum of 12 months for security and troubleshooting purposes.
• Marketing data (if you have given your consent) — retained until you withdraw your consent or close your account.

Once the relevant retention period has expired, your data will be securely deleted or anonymised in a way that can no longer be linked back to you personally.

Cookies and Tracking Technologies

The cas3 platform uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions properly. The types of cookies we use are:

• Essential Cookies — required for core platform functions such as login, session security, and retaining your language preferences. These cookies cannot be disabled, as the platform will not function correctly without them.
• Performance Cookies — to collect data on how you use our platform (for example, which pages are visited most frequently and how long you spend on each) to help us improve the user experience. This data is collected in aggregate form and does not identify you personally.
• Functional Cookies — to allow the platform to remember your preferences, such as display settings, favourite games, and responsible gaming limits you have set.
• Security Cookies — used to detect suspicious activity, prevent fraud, and protect your account from unauthorised access.

You can manage your cookie settings through your web browser at any time. Please note, however, that disabling essential cookies may affect your ability to use certain features of the cas3 platform. For more information on how to manage cookies, please refer to your web browser's help documentation.

Your Personal Data Rights

As a cas3 member and data subject under Malaysia's PDPA, you have the following rights in relation to your personal data:

• Right of Access — you have the right to request a copy of the personal data we hold about you. Such requests will be processed within 14 working days.
• Right to Rectification — if any of your personal data is inaccurate or out of date, you have the right to request a correction. Certain details such as your name and date of birth can be updated directly through your account settings.
• Right to Erasure — under certain circumstances, you have the right to request the deletion of your personal data. Please note that cas3 may be unable to erase all data if it is required to fulfil legal obligations.
• Right to Restriction of Processing — you have the right to request that cas3 restrict the processing of your data under certain circumstances, such as when you are disputing the accuracy of that data.
• Right to Object — you have the right to object to the use of your data for direct marketing purposes at any time.
• Right to Data Portability — you have the right to receive the personal data you have provided to us in a machine-readable format and to transfer it to another service provider.
• Right to Withdraw Consent — where the processing of your data is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us by email at support@cas3.best or via the in-platform live chat. We will respond within 14 business days of receiving your request.

Children's Data Protection

The cas3 platform is intended exclusively for individuals aged 18 and above. We do not knowingly collect personal data from minors. Should we discover that personal data of a minor has been collected without proper parental or guardian consent verification, we will take immediate steps to delete that data and close the account in question.

Parents or guardians who suspect that their minor child has registered for or is using the cas3 platform are urged to contact our support team immediately at support@cas3.best so that appropriate action can be taken without delay.

Cas3 also employs age verification technology during the registration and KYC processes to ensure our platform is not accessed by minors. This includes identity document checks and cross-verification of the data provided.

Cross-Border Data Transfers

In the course of its operations, cas3 may need to transfer your personal data to servers or service providers that may operate outside Malaysia. This includes cloud service providers, data backup systems, and international gaming software providers.

Where such data transfers occur, cas3 ensures that:

• The recipient country or territory has data protection laws that are equivalent to or stricter than those in Malaysia.
• Appropriate data transfer agreements have been put in place between cas3 and data recipients to ensure your data is protected to the same standard as it is in Malaysia.
• Data recipients have adequate technical and organisational security measures in place to protect your data.

If you would like to learn more about the safeguards we use for international data transfers, please contact us at support@cas3.best.

Amendments to This Privacy Policy

Cas3 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in laws, technology, or our business practices. When a material amendment is made:

• We will notify you via the email address registered to your account at least 14 days prior amendments take effect.
• Notifications of any amendments will also be prominently displayed when you log in to the cas3 platform.
• The "Last Updated" date at the top of this document will be revised to reflect the date of the most recent amendment.

Your continued use of the cas3 platform after any amendments to the Privacy Policy take effect will be considered your acceptance of the revised policy. If you do not agree with any changes made, you have the right to close your account and discontinue use of the cas3 platform before those amendments come into effect.

We encourage you to review this Privacy Policy page periodically to ensure you are always up to date on how cas3 protects your personal data.

Contact cas3's Privacy Officer

Cas3 has appointed a Data Protection Officer responsible for ensuring our platform's compliance with applicable data protection laws and for handling all privacy-related enquiries and complaints.

For any enquiries, concerns, or requests regarding your personal data, please contact us at:

• Email: support@cas3.best (please state "Privacy Enquiry" in the email subject line)
• Live Chat: available 24/7 via the chat button within the cas3 platform
• Response Time: we are committed to responding within 14 business days of receiving your enquiry

If you are not satisfied with cas3's response to your privacy enquiry or complaint, you have the right to lodge a complaint with the relevant data protection authority in Malaysia — the Department of Personal Data Protection (JPDP) under the Ministry of Digital.