Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by Granat88 ("we", "us", "our"), the operator of the online gaming platform accessible at https://granat88.cam ("the Platform"). This Policy governs our collection, use, storage, disclosure, and protection of personal data relating to all users ("you", "your") who access or register on the Platform, with particular reference to users located in Malaysia.

Granat88 is committed to handling your personal information in a transparent, lawful, and fair manner. We take our obligations under applicable data protection regulations seriously and have designed our data practices to reflect international best standards.

By accessing or using the Platform — including browsing the site, creating an account, making a deposit, or placing a wager — you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.

2 Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identity document number, email address, phone number, IP address, and financial information.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" — Granat88, being the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — any third party that processes Personal Data on behalf of Granat88 in accordance with our instructions (e.g., payment processors, KYC verification services).
• "Cookies" — small text files placed on your device by the Platform that store information about your browsing session and preferences.
• "KYC" — Know Your Customer: the mandatory identity and address verification process required of all registered users prior to withdrawal.
• "Sensitive Personal Data" — categories of data that warrant higher levels of protection, including identity document details, financial information, and transaction records.

3 Data We Collect

3.1 Data You Provide Directly

When you register, complete KYC verification, deposit funds, or contact our support team, you provide us with personal data that we collect and process. This includes:

3.2 Data We Collect Automatically

When you access the Platform, we automatically collect certain technical and behavioural data through server logs, cookies, and analytics tools:

• Internet Protocol (IP) address and approximate geolocation (country/city level)
• Browser type, version, and operating system
• Device type (desktop, mobile, tablet) and screen resolution
• Pages visited, features used, game sessions initiated, and time spent on Platform
• Referral source (how you arrived at the Platform)
• Session duration, click paths, and interaction data

3.3 Data From Third Parties

We may receive supplementary personal data from trusted third-party service providers, including identity verification agencies (for KYC purposes), payment processors (to confirm transaction completion via services such as Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Boost, and GrabPay), and fraud detection partners.

4 Legal Basis for Processing

Granat88 processes personal data only where a valid legal basis exists. The primary legal bases on which we rely are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and Granat88 — including account creation, transaction processing, and withdrawal handling.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC obligations, anti-money laundering (AML) requirements, and financial crime prevention duties.
• Legitimate Interests: Processing carried out in pursuit of Granat88's legitimate business interests, including fraud prevention, network security, service improvement, and responsible gambling monitoring — where such interests are not overridden by your fundamental rights.
• Consent: Where required, we will seek your explicit consent before processing your data — for example, prior to sending direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

5 How We Use Your Data

Granat88 processes your personal data for the following specific purposes:

• Account Management: Creating, maintaining, and administering your registered account on the Platform.
• Payment Processing: Facilitating deposits in MYR via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, and cryptocurrency channels; processing withdrawal requests to verified payment methods.
• KYC & Identity Verification: Confirming your identity, age (minimum 21 years), and address in compliance with regulatory requirements.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, money laundering, and other unlawful activity on the Platform.
• Responsible Gambling: Monitoring gaming patterns to identify potential problem gambling behaviour; enabling and enforcing self-imposed deposit limits, session limits, and self-exclusion requests.
• Customer Support: Responding to queries, resolving disputes, and improving the quality of our support services.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve Platform features, performance, and user experience.
• Legal Compliance: Meeting our obligations under applicable law, regulatory requirements, and court orders.
• Marketing Communications: Sending promotional offers and platform updates to registered users who have opted in to receive such communications. You may opt out at any time.

6 Data Sharing & Disclosure

6.1 Third-Party Service Providers

Granat88 engages trusted third-party Data Processors to deliver certain services on our behalf. These processors are contractually bound to use your personal data only for the purpose for which it was shared and in accordance with our instructions. Categories of third-party processors include:

• Payment processors and e-wallet providers (Touch 'n Go eWallet, DuitNow, FPX operators, Boost, GrabPay, and banking partners including Maybank, CIMB, Public Bank, Hong Leong Bank)
• Identity verification and KYC service providers
• Fraud detection and anti-money laundering screening services
• Cloud hosting and data storage infrastructure providers
• Customer support platform providers
• Analytics and performance monitoring services (using anonymised or aggregated data only)

6.2 Regulatory & Legal Disclosure

We may disclose your personal data to regulatory authorities, law enforcement agencies, or other competent government bodies where we are legally required or permitted to do so — including for the purposes of complying with AML obligations, responding to lawful requests, or cooperating with investigations into financial crime.

6.3 Business Transfers

In the event that Granat88 undergoes a merger, acquisition, restructuring, or asset sale, your personal data may be transferred to the successor entity as part of that transaction. We will notify registered users of any such change that materially affects their data rights.

7 Cookies & Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. They allow us to recognise your browser, remember your preferences, and improve the performance and personalisation of your experience.

7.2 Types of Cookies We Use

7.3 Managing Cookies

You may disable or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies may impair your ability to log in or use core Platform features. Disabling analytical cookies does not affect your ability to use the Platform but limits our ability to improve the service based on aggregate usage data.

8 Data Retention

Granat88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active Account Data: Retained for the duration of your account registration plus a minimum of five (5) years following account closure, in accordance with AML regulatory requirements.
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship, as required by anti-money laundering obligations.
• Transaction Records: Retained for a minimum of seven (7) years to satisfy financial record-keeping requirements.
• Support Communications: Retained for up to three (3) years following resolution of the relevant enquiry or dispute.
• Analytical and Technical Logs: Typically retained for up to twelve (12) months in identifiable form, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

9 Data Security

Granat88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

• Encryption at Rest: All stored personal data is protected using AES-256 encryption.
• Encryption in Transit: All data transmitted between your device and our servers is secured via TLS 1.2 or higher. The Platform operates exclusively over HTTPS.
• Access Controls: Access to personal data within Granat88's systems is restricted on a strict need-to-know basis, with role-based access permissions and multi-factor authentication required for all staff with data access.
• Security Monitoring: Our infrastructure is monitored continuously for suspicious activity, intrusion attempts, and anomalous behaviour.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

10 International Data Transfers

Granat88 operates internationally and may transfer your personal data to servers or processors located outside of Malaysia. Where such transfers occur, we take appropriate steps to ensure that your data is protected to a standard equivalent to that described in this Policy.

Safeguards employed for international transfers include contractual data processing agreements incorporating standard data protection clauses, and ensuring that recipient jurisdictions or processors provide an adequate level of data protection.

11 Your Data Rights

As a data subject, you hold the following rights in respect of your personal data processed by Granat88. Requests to exercise any of these rights should be submitted in writing to our support team at [email protected].

• Right of Access: You may request confirmation of whether we hold personal data about you and receive a copy of that data.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: Subject to legal and regulatory retention requirements, you may request deletion of your personal data. Note that KYC and transaction data must be retained for the mandatory periods outlined in Section 8.
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances — for example, while a dispute is being investigated.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to processing of your data based on legitimate interests, including profiling for direct marketing purposes.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to all verifiable data rights requests within thirty (30) calendar days. Where a request is complex or numerous, we may extend this period by a further sixty (60) days with notification to you.

12 Children & Minors

The Granat88 Platform is strictly for users aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor without verifiable parental or guardian consent, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor in your care has registered on the Platform, please contact our support team immediately at [email protected].

13 Third-Party Services & Links

The Platform may integrate with or reference third-party services such as payment gateways (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks). Each of these third-party services operates under its own privacy policy and data practices, over which Granat88 has no control.

Granat88 is not responsible for the privacy practices or content of any third-party services you access in connection with your use of our Platform. We encourage you to review the privacy policies of any third-party payment provider before submitting your payment credentials.

14 Amendments to This Policy

Granat88 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or business operations. When we make material changes to this Policy, we will update the "Last Updated" date displayed at the top of this page.

Where changes are significant, we will endeavour to notify registered users by email or via an in-platform notification. We encourage you to review this Policy periodically to stay informed of how we protect your personal data. Continued use of the Platform following the publication of a revised Policy constitutes your acceptance of the updated terms.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact the Granat88 Data Protection team:

• Email: [email protected]
• Live Chat: Available 24/7 on the Platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 3 business days and to resolve them fully within 30 calendar days.

For enquiries specifically related to responsible gambling tools, self-exclusion, or support resources available to Malaysian players, please visit our Responsible Gambling page.

For general platform terms and account conditions, please refer to our Terms & Conditions.