Royal24 Privacy Policy – Malaysian Player Data Protection

This Privacy Policy ("Policy") is published by Royal24, the operator of an online entertainment platform accessible via royal24.online. This document explains in detail how Royal24 collects, processes, stores, protects, and discloses your personal data as a user of our platform.

Royal24 operates in full compliance with the requirements of Malaysia's Personal Data Protection Act (PDPA) 2010. We take these legal obligations seriously and invest in systems, procedures, and staff training to ensure ongoing compliance with all applicable data protection requirements.

This Policy applies to all individuals who interact with Royal24, including website visitors, registered players, customer support applicants, and any party that provides personal data to us through any official Royal24 communication channel. By using the Royal24 platform, you acknowledge that you have read and understood how we handle your personal data as described in this Policy.

Royal24 collects various categories of personal data depending on the nature of your interactions with our platform. Below is a comprehensive summary of the data we collect and its sources:

We do not collect sensitive data such as health information, political views, or religious beliefs unless specifically required for responsible gambling purposes and with your explicit consent.

Royal24 uses the personal data it collects for lawful and transparent purposes. Every use of your data is directly related to the provision of services you have requested or to Royal24's compliance with applicable legal obligations. The following are the primary purposes for which your personal data is used:

• Account management: To create, verify, maintain, and secure your Royal24 account. This includes registration processing, login verification, password resets, and account security notifications.
• Financial transaction processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks, and FPX, as well as to handle your withdrawal of winnings accurately and securely.
• Gaming service provision: To give you access to all Royal24 games, save your game progress and history, calculate and credit winnings, and manage your account balance.
• VIP Rewards Programme: To calculate your VIP level, credit cashback, manage exclusive benefits, and ensure you receive the correct rewards based on your playing activity at Royal24.
• Customer support: To help you resolve technical issues, account enquiries, complaints, and other support requests more effectively by providing access to your relevant account history.
• Responsible gambling: To monitor play patterns, identify signs of problem gambling and ensure the self-exclusion tools you have set are properly enforced.
• Fraud detection and prevention: To identify suspicious activity, fraud attempts, money laundering, or use of the platform that violates Royal24's terms.
• Legal compliance: To meet anti-money laundering (AML) legal requirements, PDPA compliance obligations, and any other legal duties applicable to Royal24 in Malaysia.
• Marketing communications (with consent): To send information about Royal24 promotions, bonuses, and special offers to players who have consented to receive marketing communications. You may withdraw this consent at any time.
• Platform improvements: To analyse usage patterns in aggregate (not at the individual level) in order to improve the performance, interface and overall user experience of the Royal24 platform.

Royal24 will not use your personal data for any purpose beyond those stated above without first obtaining your renewed consent.

In accordance with Malaysia's PDPA 2010, Royal24 processes your personal data only on the following valid legal bases:

• Your consent: For optional marketing communications, VIP loyalty programmes and any data processing beyond basic operational requirements, Royal24 obtains your explicit consent. You may withdraw this consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.
• Contract performance: The majority of data processing is necessary to fulfil our obligations to you as a Royal24 player — including managing your account, processing financial transactions, and providing access to games.
• Legitimate interests: Royal24 processes certain data on the basis of our legitimate interests in detecting fraud, maintaining platform security, and protecting all users from harmful activity, provided those interests do not override your fundamental privacy rights.
• Legal obligation: Some data processing is mandatory to comply with applicable Malaysian laws, including AML requirements, tax reporting obligations, and lawful directives from competent authorities.

Royal24 does not sell, rent or trade players' personal data to any third party for their own marketing purposes. This is an absolute commitment on our part. However, in the course of legitimate platform operations, we may share data with the following parties in limited and controlled circumstances:

• Payment service providers: To process deposit and withdrawal transactions, Royal24 shares the necessary transaction information with payment service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and the FPX network. These providers have their own privacy policies and are subject to strict data protection agreements with Royal24.
• Gaming software providers: Third-party game providers that supply game titles to the Royal24 platform may receive session data required to run those games. This sharing is limited strictly to data necessary for game functionality.
• Cloud and infrastructure service providers: Data is stored and processed on servers managed by leading cloud infrastructure providers that meet industry-standard security benchmarks and are bound by strict confidentiality agreements with Royal24.
• Regulatory authorities and law enforcement: Royal24 will disclose data to the relevant Malaysian authorities when required to do so by law or court order. We have no discretion to refuse such lawful requests.
• Legal and accounting professionals: In the context of legally required legal advice or financial audits, relevant data may be shared with professionals bound by strict obligations of professional confidentiality.

In all data sharing scenarios described above, Royal24 ensures that recipients of your data are bound by data protection agreements requiring them to handle your data to a standard equivalent to our own.

The security of players' personal data is a technical priority in which we invest significant resources. Royal24 implements multiple layers of security controls to protect your data from unauthorised access, disclosure, alteration, or unintended destruction:

• Encryption of data in transit: All communications between your device and Royal24's servers are protected with TLS 1.3 / SSL 256-bit encryption, ensuring no data can be intercepted in transit across the internet.
• Encryption of data at rest: Sensitive data stored in Royal24's databases — including financial information and identity documents — is encrypted using industry-standard AES-256 encryption.
• Internal access controls: Access to player data within Royal24's internal systems is restricted to staff who require it to perform their duties. Role-based access control (RBAC) is applied to ensure each staff member can only access the data necessary for their specific job functions.
• 24/7 security monitoring: Our systems are continuously monitored to detect any suspicious activity, intrusion attempts, or anomalies that may indicate a security threat.
• Two-factor authentication: Two-factor authentication is available and strongly encouraged for all Royal24 player accounts as an additional layer of protection against unauthorised access.
• Regular security audits: Royal24 conducts regular security audits and penetration testing by independent security experts to identify and remediate any vulnerabilities before they can be exploited.

While we implement comprehensive security measures, no system can be guaranteed 100% secure against all increasingly sophisticated cyber threats. In the event of a security incident affecting your personal data, Royal24 is committed to notifying you within the timeframe required by the PDPA and taking immediate remedial action.

The Royal24 platform uses cookies and similar tracking technologies to enhance the user experience, ensure proper platform functionality, and analyse how players interact with our services. The following are the types of cookies we use:

• Essential cookies (required): Required for core platform functions such as login sessions, security and language settings. These cookies cannot be disabled as doing so will affect your ability to use the Royal24 platform properly.
• Performance & analytics cookies: We use analytics cookies to understand how players use the Royal24 platform in aggregate – most visited pages, average session duration, and navigation patterns. This data helps us improve the overall user experience.
• Functionality cookies: Saving your preferences such as language, display settings, and game configurations so you do not have to reset them each time you log in to Royal24.
• Fraud detection cookies: Helping us identify suspicious patterns and protecting your account from unauthorised access by comparing your current device and location against your usual login behaviour.

You can manage your cookie settings through your web browser settings. Disabling all cookies may affect certain functions of the Royal24 platform; however, third-party marketing cookies can be disabled without materially impacting your gaming experience.

Royal24 defines clear and specific data retention periods for each data category. We do not retain data longer than necessary for its stated purpose or as required by Malaysian law:

• Active account data: Retained for as long as your Royal24 account remains active, and for an additional 5 years following account closure to meet legal compliance requirements.
• Financial transaction history: Retained for 7 years in accordance with Malaysian accounting and anti-money laundering legal requirements. This includes records of all deposits and withdrawals made via Touch 'n Go, GrabPay, DuitNow, FPX, and other methods.
• Customer support communication records: Retained for 3 years from the date of last communication for reference and resolution of any disputes that may arise at a later stage.
• Technical log data (IP address, access logs): Retained for 12 months for security purposes, fraud detection, and technical incident investigation.
• Marketing data (for players who have given consent): Retained until you withdraw your consent to receive marketing communications, after which your data will be moved to a suppression list within 30 days.
• Identity verification documents (KYC): Retained for the period required under Malaysia's AML compliance obligations, typically 5 years from the date of the last verification.

Once the relevant retention period has expired, data is securely disposed of using methods that ensure it cannot be recovered or accessed again. For digital data, this involves secure deletion in accordance with established standards.

As a Royal24 player and data subject under Malaysia's PDPA 2010, you have legal and enforceable rights over the handling of your personal data. Royal24 fully respects these rights and provides straightforward mechanisms for you to exercise them:

To exercise any of the above rights, submit a written request to Royal24's privacy officer at support@royal24.online clearly stating the right you wish to exercise and providing sufficient information for us to verify your identity. We will process your request within 21 business days of receiving a complete request.

In the course of operating an online platform, your personal data may be stored or processed on servers located outside Malaysia. This may occur when Royal24 uses international cloud infrastructure services or game software providers that operate globally.

When cross-border data transfers occur, Royal24 ensures adequate protections are in place through:

• Only transferring data to countries or jurisdictions with a level of data protection equivalent to or greater than that of Malaysia.
• Implementing standard contractual clauses that require recipients of data outside Malaysia to uphold data protection standards equivalent to the PDPA.
• Ensuring that any international service providers who receive Royal24 player data are certified under internationally recognised data protection frameworks.

If you would like to learn more about the specific protection mechanisms we use for international data transfers involving your data, please contact us at support@royal24.online.

Royal24 takes child protection very seriously. Our platform is strictly intended for individuals aged 18 years and above only, and we implement proactive measures to prevent access by children and minors.

From a data protection standpoint, Royal24 does not knowingly collect any personal data from individuals under the age of 18. If we discover that personal data belonging to a child or minor has been collected in our systems without our knowledge, we will:

• Closing the relevant account promptly upon age verification.
• Deleting all relevant personal data from our systems as promptly as possible.
• Returning any outstanding balance to the original payment method, subject to any necessary investigation.
• Taking additional steps to strengthen our age verification systems to prevent recurrence.

If you suspect that a minor is using the Royal24 platform, please notify us immediately at support@royal24.online. We take every such report seriously and will respond promptly.

Royal24 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, new legal requirements, or improvements to the services we offer. We are committed to notifying you of any material changes in a clear and timely manner.

When significant changes are made to this Privacy Policy, Royal24 will:

• Updating the "Last updated" date at the top of this document.
• Sending a notification to your registered email address at least 14 days before changes take effect for material amendments.
• Displaying a prominent notice on the Royal24 platform the first time you log in after a policy change.
• Maintaining an archive of previous versions of this policy, which players may request if needed.

Your continued use of the Royal24 platform after any policy changes take effect constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you have the right to close your account before those changes come into effect.

Royal24 has appointed a dedicated privacy officer responsible for all matters relating to player personal data protection. We encourage you to reach out to us directly if you have any questions, concerns, or wish to exercise your PDPA rights:

Complaints to Regulatory Authorities: If you believe that Royal24 has processed your personal data in a manner that violates Malaysia's PDPA 2010 and you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under the Ministry of Communications and Digital.

Effective Date: This Royal24 Privacy Policy takes effect on 1 July 2026 and supersedes all previously published versions.