Privacy Policy

This Privacy Policy ("Policy") describes how Spade96 ("the Platform", "we", "us", "our"), operating the website at https://spade96.cam, collects, uses, stores, shares, and protects the personal data of individuals who access, register, or otherwise interact with the Spade96 platform ("you", "Player", "User").

Spade96 operates as an internationally licensed online casino and sports betting platform serving Malaysian players and other eligible users. As part of our licensing obligations and our commitment to player trust, we apply internationally recognised data protection standards, including principles aligned with the General Data Protection Regulation (GDPR) and comparable frameworks, in our handling of all personal data.

By creating an account with Spade96 or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. Where your consent is the legal basis for processing, you have the right to withdraw that consent at any time, subject to any overriding legal or contractual obligations.

Spade96 collects personal data across several categories, depending on the nature of your interaction with the Platform. The following sets out the categories of data collected and typical examples within each category:

• Full legal name as it appears on government-issued identification.
• Date of birth (for age verification — minimum 21 years required).
• Residential address, including Malaysian city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).
• Email address and mobile phone number used for account registration and communication.
• Username and hashed account password.

• Copies of valid government-issued Malaysian identification, including MyKad, Driver's Licence, or Passport.
• Proof of residential address documents, such as utility bills or bank statements dated within three months.
• Selfie photographs taken alongside your identification document for liveness verification.
• Source-of-funds documentation where requested for compliance with anti-money laundering obligations.

• Deposit and withdrawal transaction records, including amounts in Malaysian Ringgit (MYR/RM) or USDT equivalent.
• Payment method identifiers associated with your account (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, USDT TRC20 wallet address).
• Account balance history and bonus fund activity logs.

• Game session records including games played, bet amounts, outcomes, and session duration.
• Sports betting slip history including markets, selections, odds accepted, and settlement results.
• Bonus and promotion participation records.

• IP address and geolocation data at time of access.
• Device identifiers, browser type, operating system, and screen resolution.
• Session timestamps and login history.
• Cookie identifiers and similar tracking technology data where applicable.

• Records of communications between you and the Spade96 support team, including live chat transcripts and email correspondence.
• Formal complaint submissions and dispute correspondence.

Spade96 collects personal data through the following channels:

• Directly from you: when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or voluntarily provide information through your account settings.
• Automatically: when you access and interact with the Platform, through server logs, cookies, session tracking technology, and device fingerprinting used for fraud prevention and security purposes.
• From third-party service providers: including identity verification services, payment processors (for transaction confirmation and fraud screening), and KYC verification platforms operating on Spade96's behalf.
• From publicly available sources: where required for anti-money laundering or fraud prevention checks, Spade96 may cross-reference your information against publicly available databases or sanctions lists.

Spade96 processes your personal data for the following specific purposes:

Spade96 processes personal data on one or more of the following legal bases, as appropriate to the specific processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the Spade96 Terms and Conditions, including account management and payment processing.
• Legal Obligation: Processing required to comply with applicable laws and our international gaming licensing requirements, including KYC, AML monitoring, and regulatory reporting.
• Legitimate Interests: Processing necessary for Spade96's legitimate business interests, including fraud prevention, platform security, and responsible gambling monitoring, where these interests are not overridden by your fundamental rights.
• Consent: Where processing is based on your consent — for example, where we send you marketing communications about promotions — you have the right to withdraw that consent at any time by contacting support or updating your notification preferences.

Spade96 does not sell your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

We engage third-party service providers who process personal data on our behalf and under our documented instructions. These include payment processors (facilitating transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners including Maybank, CIMB, Public Bank, and Hong Leong Bank), identity verification and KYC platform providers, fraud detection services, IT infrastructure providers, and customer support software operators.

All data processors engaged by Spade96 are subject to contractual data processing agreements that prohibit use of your data for any purpose outside the scope of services provided to Spade96.

Where required by our international gaming licence or applicable law, Spade96 may disclose player data to licensing and regulatory authorities, including for audit purposes or in response to formal information requests.

Spade96 may disclose personal data to law enforcement agencies, courts, or other government bodies where required by law, court order, or legally enforceable governmental request, or where disclosure is necessary to protect the rights, safety, or property of Spade96, its employees, or other players.

Spade96 operates as an internationally licensed platform, and personal data processed by us and our service providers may be transferred to and stored in countries outside Malaysia. These countries may have different data protection laws than those applicable in your country of residence.

Where personal data is transferred outside of jurisdictions with equivalent data protection standards, Spade96 implements appropriate safeguards, including contractual clauses with data processors that require the maintenance of data protection standards comparable to those applied by Spade96 itself.

By using the Spade96 platform, you acknowledge and consent to the transfer of your personal data to servers and service providers located outside Malaysia, subject to the protections described in this Policy.

Spade96 retains personal data only for as long as is necessary to fulfil the purposes set out in this Policy and to comply with applicable legal, regulatory, and licensing retention requirements. In practice, the following retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, as required under international gaming licensing obligations and anti-money laundering regulations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, in line with AML record-keeping requirements.
• Customer support communications: Retained for three (3) years following resolution of the relevant enquiry, unless a longer period is required for ongoing dispute resolution or legal proceedings.
• Technical and device data (logs): Typically retained for 12 months from the date of collection, unless required for longer periods for security investigations.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any individual player. You may request earlier deletion of your data where no overriding legal basis exists for continued retention — see Section 11 (User Rights).

Spade96 uses cookies and similar technologies (including local storage and session tokens) on the Platform. Cookies are small data files placed on your device by your browser when you access the site.

You can manage or disable non-essential cookies through your browser settings. Please note that disabling essential cookies will prevent the Platform from functioning correctly and may make it impossible to log in or access your account. Spade96 does not use third-party advertising or social media tracking cookies.

Subject to applicable law and any overriding legal obligations (including our licensing retention requirements), you have the following rights in relation to your personal data held by Spade96:

The Spade96 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of our KYC process, and any account found to belong to an individual below the minimum age will be immediately closed.

If you have reason to believe that a person under the age of 21 has registered an account with Spade96 or provided personal data to the Platform, please contact us immediately at [email protected] so that appropriate action can be taken, including deletion of the relevant data.

Spade96 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or device and the Spade96 servers is encrypted using 256-bit SSL/TLS, preventing interception in transit.
• Encrypted data storage: Sensitive data, including KYC documents and financial records, is stored in encrypted databases with access restricted to authorised personnel only.
• Access controls: Spade96 staff access to personal data is governed by role-based access controls, with access limited to what is strictly necessary for job functions. All staff access is logged and audited.
• Password security: Account passwords are stored as cryptographically hashed values. Spade96 does not have access to your plaintext password at any time.
• Fraud detection: Automated systems monitor transactions and login activity in real time for signs of fraud, unauthorised access, and suspicious patterns.
• Regular security assessments: Platform infrastructure is subject to regular security testing and vulnerability assessments as part of our licensing compliance programme.

While Spade96 takes all reasonable steps to protect your personal data, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for notifying Spade96 promptly if you suspect unauthorised account activity.

The Spade96 Platform may contain references to third-party services, including payment providers such as Touch 'n Go eWallet, Boost (Axiata), and GrabPay, for informational purposes. This Privacy Policy applies solely to data processed by Spade96 and does not cover the data practices of any third-party service provider, payment platform, or external website.

When you use a third-party payment service to make a deposit, that service operates under its own separate privacy policy. Spade96 receives only the transaction confirmation data necessary to credit your account and does not have access to your full payment account details beyond what is required for payment processing and fraud prevention.

Spade96 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or licensing requirements. Material changes will be communicated to registered players via email notification to the registered account address or through a prominent notice on the Platform prior to the changes taking effect.

The "Effective Date" displayed at the top of this Policy indicates when the current version came into force. Your continued use of the Spade96 Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. The most current version of this Policy is always available at https://spade96.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Spade96 handles your personal data, please contact our support team using the details below. We take all privacy enquiries seriously and aim to respond within 30 days of receipt.

When submitting a data subject rights request, please include your full registered name, account username or email address, the specific right you are exercising, and sufficient identification to verify your identity. Requests that cannot be verified within a reasonable timeframe may not be able to be processed.