royal47 Privacy Policy

This Privacy Policy ("Policy") describes how royal47 ("royal47", "we", "us", "our") collects, processes, stores, and discloses personal data in connection with the operation of the royal47 online gaming platform, accessible at https://royal47.asia ("the Platform").

By registering an account, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to the terms of this Policy, you must not access or use the Platform.

This Policy should be read together with the royal47 Terms & Conditions, which form part of the agreement between you and royal47.

royal47 is the data controller in respect of personal data collected through the Platform. For the purposes of the Malaysian Personal Data Protection Act 2010 (PDPA) and the data protection requirements of our international gaming authority licence, royal47 determines the purposes and means of processing your personal data.

All privacy-related enquiries may be directed to our support team via the contact details set out in Section 14 of this Policy.

royal47 collects personal data in the following categories:

3.1 Registration Data

• Full legal name as it appears on a government-issued identification document.
• Date of birth (for age verification — Members must be 21 or above).
• Residential address, including city, state, and postcode within Malaysia or your country of residence.
• Email address and mobile phone number.
• Chosen username and hashed password (passwords are never stored in plain text).

3.2 Identity Verification (KYC) Data

• Copy of a government-issued photo identification (MyKad, passport, or equivalent).
• Proof of address document (utility bill, bank statement, or equivalent not older than three months).
• Proof of payment method ownership (e-wallet registration screenshot, bank statement, or equivalent).

3.3 Financial Data

• Deposit and withdrawal transaction records, including amounts in MYR, timestamps, and payment method identifiers.
• Payment method details (e.g., masked bank account numbers, e-wallet reference IDs for Touch n Go eWallet, Boost, Maybank, or other accepted methods). royal47 does not store full card numbers or online banking credentials.

3.4 Gameplay & Behavioural Data

• Game session history, bet records, win/loss figures, and wagering patterns.
• Sportsbook betting history, selected markets, and stake amounts.
• Responsible gambling interactions, including self-imposed limits and self-exclusion requests.

3.5 Technical & Device Data

• IP address, browser type and version, operating system, and device identifiers.
• Session timestamps, login history, and pages visited on the Platform.
• Cookie identifiers and similar tracking technologies as described in Section 7.

royal47 uses your personal data for the following purposes:

• Account Administration: To create, maintain, and manage your royal47 account, including verification of your identity and age.
• Service Delivery: To provide access to the Platform, process bets and wagers, credit winnings, and operate the live dealer lobby and sportsbook.
• Payment Processing: To process deposits and withdrawals in MYR via your chosen payment method (Touch n Go eWallet, DuitNow, Maybank, Public Bank, CIMB, and others).
• Regulatory Compliance: To comply with AML obligations, licensing requirements, and applicable Malaysian law, including PDPA obligations and reporting to regulatory authorities where required.
• Fraud Prevention & Security: To detect, investigate, and prevent fraud, unauthorised access, money laundering, and other prohibited activities.
• Responsible Gambling: To monitor gameplay for indicators of problem gambling, to enforce self-imposed limits, and to communicate proactively where we have concerns about a Member's wellbeing.
• Customer Support: To respond to enquiries, complaints, and disputes submitted through live chat or email.
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the Platform's performance, game selection, and user experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may opt out of marketing communications at any time through your account settings.

royal47 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and royal47 (i.e., to operate your account and deliver gaming services).
• Legal Obligation: Processing required to comply with AML laws, licensing authority requirements, and the Malaysian PDPA.
• Legitimate Interests: Processing for fraud prevention, platform security, and responsible gambling monitoring — where these interests are not overridden by your fundamental rights.
• Consent: Processing for direct marketing and non-essential cookies, where you have provided explicit consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

royal47 does not sell your personal data. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment Processors: Including Touch n Go eWallet, Boost, and Malaysian banking institutions, for the processing of deposits and withdrawals.
• KYC & AML Verification Providers: Identity verification and document authentication services used to fulfil our regulatory obligations.
• Fraud Prevention Services: Third-party fraud detection and risk scoring platforms that help royal47 identify and prevent prohibited conduct.
• Regulatory Authorities: Our international gaming authority licensing body and any other competent authority where disclosure is required by law or licence condition.
• Game Software Providers: Providers of casino and live dealer game software may receive session-level data necessary to operate their games. They are prohibited from using this data for any purpose other than game delivery.
• Professional Advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

In the event of a corporate restructure, merger, or acquisition, your data may be transferred to the successor entity, subject to equivalent privacy protections.

royal47 uses cookies and similar technologies to operate and improve the Platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Required for core Platform functionality, including session authentication and security. These cannot be disabled without breaking the Platform.
• Functional Cookies: Used to remember your preferences such as language, currency display, and interface settings.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members use the Platform, which we use to improve performance and user experience.
• Marketing Cookies: Used to deliver relevant promotional content within the Platform. These are deployed only with your consent.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform, including completing the royal47 login process.

royal47 retains your personal data for as long as your account is active and for a period thereafter as required by applicable law and our licensing obligations. Specifically:

• Account and KYC data: retained for a minimum of five (5) years following account closure, in accordance with AML requirements.
• Financial transaction records: retained for a minimum of seven (7) years for tax and regulatory compliance purposes.
• Gameplay history: retained for a minimum of three (3) years from the date of each session.
• Marketing consent records: retained for the duration of your account and for two (2) years following account closure.

Where retention is no longer required by law or legitimate business purpose, personal data is securely deleted or anonymised in accordance with industry-standard data destruction practices.

royal47 implements technical and organisational security measures commensurate with the sensitivity of the personal data we process. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and royal47's servers.
• One-way cryptographic hashing of all account passwords — passwords are never stored in readable form.
• Role-based access controls — internal staff access to personal data is restricted to those with a legitimate business need.
• Regular security audits and penetration testing conducted by independent third parties.
• Two-factor authentication (2FA) available to all Members, strongly recommended to protect account access.
• Encrypted, access-controlled data storage infrastructure for all databases containing personal data.

Despite these measures, no internet-based system can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights, royal47 will notify affected Members and the relevant supervisory authority in accordance with applicable law.

Subject to applicable law and regulatory limitations, you have the following rights in respect of your personal data held by royal47:

• Right of Access: To request a copy of the personal data royal47 holds about you.
• Right of Correction: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where there is no overriding legal basis for its continued retention.
• Right to Restrict Processing: To request that we limit the processing of your data in certain circumstances.
• Right to Withdraw Consent: To withdraw consent for marketing communications or non-essential cookies at any time, without affecting the lawfulness of prior processing.
• Right to Complain: To lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been infringed.

To exercise any of the above rights, please contact the royal47 support team as described in Section 14. We will respond to verified requests within thirty (30) days.

The royal47 Platform is strictly restricted to persons aged 21 years or older. royal47 does not knowingly collect personal data from individuals under the age of 21. If we become aware that a person under the age of 21 has registered an account or provided personal data, we will immediately close the account, delete the associated data, and reverse any financial transactions.

If you have reason to believe that a minor has registered on the Platform, please contact royal47 support immediately.

royal47 operates on server infrastructure that may be located outside of Malaysia. Where your personal data is transferred to a jurisdiction outside Malaysia, royal47 ensures that appropriate safeguards are in place — including contractual data protection clauses equivalent to those required under the Malaysian PDPA — to ensure your data receives an equivalent level of protection to that afforded within Malaysia.

By using the Platform, you consent to the transfer of your personal data to jurisdictions outside Malaysia where necessary for the delivery of services, subject to the safeguards described above.

royal47 reserves the right to amend this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this page. Where changes are material, we will notify registered Members via the email address on file. Continued use of the Platform following notification of a change constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically to stay informed of how royal47 protects your personal data.

For any questions, concerns, or requests relating to this Privacy Policy or royal47's data practices, please contact our support team via live chat (available 24/7 within the Platform) or by email at [email protected]. Please include your registered username and a clear description of your privacy-related query. We aim to respond to all written privacy enquiries within five (5) business days.