Privacy Policy

This Privacy Policy ("Policy") issued by waja32 ("we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://waja32.cam and any associated mobile applications or sub-domains (collectively, the "Platform"). This Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data submitted by or generated from individuals who register accounts, interact with, or visit the Platform ("you", "the User", "the Player").

By accessing or using the waja32 Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

This Policy should be read in conjunction with our Terms & Conditions, which govern the overall contractual relationship between you and waja32. In the event of any conflict between this Policy and the Terms & Conditions on a data-related matter, this Policy shall prevail.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

Waja32 collects personal data across several categories depending on the stage of the player journey and the services being used. The categories and specific data points collected are described in the table below:

Waja32 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide voluntarily during account registration, KYC document upload, support contact, promotional opt-in, or responsible gambling tool configuration.
• Automated Platform Systems: Technical and usage data generated automatically by our platform systems during each login session, game round, and transaction — including server logs, game engine records, and session analytics.
• Payment Processors: Transaction confirmation data returned by payment service providers such as Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB Bank, DuitNow, and FPX following deposit or withdrawal instructions. Payment processors do not share full card or account numbers with waja32.
• Identity Verification Providers: During KYC verification, an authorised third-party identity checking service may process your submitted documents and return a verification outcome to waja32. The full document content is not retained by the verification service beyond the verification transaction.
• Cookies and Tracking Technologies: As described in Section 9 of this Policy, cookies and similar technologies are used to collect technical and behavioural data during your use of the Platform.
• Publicly Available Sources: In limited circumstances, and strictly where required for fraud prevention or AML compliance, waja32 may consult publicly available data sources to verify information provided by a player.

Waja32 processes personal data only where a recognised lawful basis exists. The primary lawful bases and corresponding processing purposes are described below:

Processing your identity, contact, financial, and gaming activity data is necessary to perform the contract between you and waja32 — specifically: to create and maintain your account; to process deposits and withdrawals in MYR via your chosen payment method; to calculate and credit winings; to operate the games, betting markets, and promotional features you access; and to provide account support.

Waja32 is subject to anti-money laundering (AML), counter-terrorist financing (CTF), and responsible gambling obligations under the terms of its international gaming licence. Processing of identity, financial, and responsible gambling data is required to fulfil these obligations, including mandatory KYC verification, suspicious transaction reporting, and age enforcement.

Waja32 processes technical and behavioural data on the basis of legitimate business interests, including: fraud detection and prevention; platform security monitoring; responsible gambling risk assessment; game integrity assurance; and platform performance optimisation. These interests are balanced against your privacy rights and do not override your fundamental data protection interests.

Where processing is not required for contractual, legal, or legitimate interest purposes — for example, the sending of optional promotional communications or participation in surveys — we will seek your explicit consent before processing commences. You may withdraw consent at any time by updating your communication preferences in account settings or by contacting our support team.

Waja32 does not sell, rent, or trade your personal data with third parties for commercial or marketing purposes. We share personal data only in the following circumstances:

• Service Providers (Data Processors): We engage carefully selected third-party processors to support platform operations — including payment processors (e.g., DuitNow, FPX, Touch 'n Go eWallet gateway providers), KYC verification services, cloud infrastructure providers, fraud detection tools, and customer support platforms. All processors are contractually bound to process data only on waja32's instructions and to maintain appropriate security standards.
• Regulatory and Licensing Authorities: Waja32 may be required to disclose player data to its licensing authority or relevant regulatory bodies in connection with compliance audits, AML investigations, or licensing condition requirements.
• Law Enforcement: Where required by a valid legal order, court judgment, or statutory obligation, waja32 will disclose relevant data to law enforcement agencies or government bodies. Waja32 will, where legally permissible, notify the affected player of such a disclosure.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of business assets, player data may be transferred to a successor entity, provided that equivalent data protection standards continue to apply. Players will be notified of any such transfer.
• With Your Consent: In any other circumstance not described above, waja32 will seek your explicit consent before disclosing your personal data to any third party.

Waja32 operates globally and may transfer your personal data to countries outside of Malaysia where our servers, service providers, or licensing authority are located. Some of these countries may not have data protection laws that are equivalent in scope to those you may be accustomed to.

Where personal data is transferred internationally, waja32 implements appropriate safeguards to ensure that the data continues to be protected to an equivalent standard, including: contractual data transfer agreements with processors containing data protection obligations consistent with applicable international standards; transfer to processors located in jurisdictions assessed to provide an adequate level of data protection; and internal data governance policies applicable to all entities within the waja32 operating group.

If you would like further information about the specific safeguards in place for any international data transfer, you may submit a written request to our Data Protection Officer at [email protected].

Waja32 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable regulatory obligations. The following retention schedule applies as standard framework:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be attributed to any identifiable individual. Anonymised aggregated data may be retained for statistical and analytical purposes without time limit.

Waja32 uses cookies and similar tracking technologies on the Platform to support essential functionality, security, performance monitoring, and user experience improvements. The categories of cookies used are described below:

• Strictly Necessary Cookies: Required for the Platform to function, including session authentication, security token management, and responsible gambling tool enforcement. These cannot be disabled without impairing platform functionality.
• Performance Cookies: Used to collect anonymised data about how users interact with the Platform — page load times, navigation paths, and error events — to support ongoing platform optimisation.
• Functional Cookies: Store user preferences such as language settings, preferred game categories, and display configurations to personalise your experience across sessions.
• Security Cookies: Support fraud detection and account security monitoring by identifying unusual login patterns or device changes that may indicate unauthorised account access.

You may manage cookie preferences through your browser settings. Disabling certain categories of cookies (other than strictly necessary cookies) may affect the functionality of specific platform features but will not prevent you from accessing core gaming and account services.

As a data subject whose personal data is processed by waja32, you hold the following rights, which can be exercised by contacting us at [email protected]. We will respond to all substantiated requests within thirty (30) calendar days:

If you are not satisfied with our response to a data rights request, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction or the jurisdiction under which waja32 is licensed.

The waja32 Platform is strictly intended for adults aged 21 and above. Waja32 does not knowingly collect, store, or process personal data from individuals under the age of 21. Account registration requires a date of birth declaration, and KYC verification procedures are in place to validate age before withdrawal privileges are granted.

If waja32 becomes aware or has reason to believe that an account has been registered by or on behalf of an individual under 21 years of age, the account will be immediately suspended, any balance will be withheld pending investigation, and the matter will be handled in accordance with our age verification and responsible gambling obligations.

If you believe that a minor may have registered on our Platform using false information, please contact us immediately at [email protected]. We treat all such reports seriously and will act promptly upon receipt of a credible notification.

Waja32 employs a multi-layered security framework designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport Encryption: All data transmitted between your browser or app and the waja32 servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all pages including login, registration, deposit, and withdrawal screens.
• Encryption at Rest: Sensitive personal data fields stored in our databases — including identity documents, payment method tokens, and authentication credentials — are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff access is logged, audited, and subject to role-based access control policies. Administrative access requires multi-factor authentication.
• Security Monitoring: Continuous monitoring systems detect and alert on anomalous access patterns, potential intrusions, and unusual transaction activity in real time.
• Penetration Testing: Our platform undergoes regular third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response procedure. In the event of a confirmed breach affecting your personal data, you will be notified without undue delay in accordance with applicable obligations.

While waja32 maintains robust technical and organisational security measures, no digital system is entirely immune to risk. You are also responsible for maintaining the security of your account credentials and for enabling two-factor authentication where available.

Waja32 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or operational requirements. The date of the most recent revision is displayed at the top of this page.

Where a material change is made — particularly one that affects your rights or the way in which your data is used — we will provide reasonable advance notice by email to your registered address and/or by displaying a prominent notice on the Platform prior to the change taking effect. Where required by applicable law, we will seek renewed consent before implementing any material change to the purpose or legal basis of processing.

Continued use of the waja32 Platform following the effective date of an updated Privacy Policy constitutes acknowledgment of the revised terms. The current version of this Policy is always available at https://waja32.cam/privacy-policy.

For all privacy-related enquiries, data rights requests, or concerns about the wayaja32 handles your personal data, please contact us through one of the channels below. We aim to acknowledge all data protection enquiries within five (5) business days and resolve substantiated requests within thirty (30) calendar days.

Waja32 is committed to resolving all data protection concerns promptly and fairly. If, after contacting us, you remain dissatisfied with how your concern has been addressed, you retain the right to escalate your complaint to the appropriate supervisory authority in the jurisdiction where you reside or where the alleged infringement occurred.