01 Introduction
This Privacy Policy ("Policy") describes how Rush33 ("Rush33", "we", "us", "our") collects, processes, stores, shares, and protects personal data provided by users ("User", "you", "your") in connection with access to and use of the rush33 platform at https://rush33.cam (the "Platform").
Rush33 operates an English-language online casino and sports betting service primarily serving Malaysian players. As part of delivering that service, we necessarily collect and process certain personal information. This Policy sets out, in clear and formal terms, exactly what that involves and what your rights are in relation to your personal data.
This Policy forms part of our broader Terms and Conditions and should be read alongside them. By registering an Account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
Effective Date: This Privacy Policy was last updated on 1 January 2026. Rush33 will notify registered Users of any material changes via email or in-Platform notification prior to the changes taking effect.
02 Definitions
The following terms carry the meanings set out below wherever they appear in this Privacy Policy:
03 Data We Collect
Rush33 collects the categories of personal data described in the table below. We collect only the data that is necessary for the specific purpose indicated, in accordance with the data minimisation principle.
Sensitive Data: Rush33 does not intentionally collect special categories of sensitive personal data (such as racial origin, health data, or religious beliefs) unless specifically required by law or for responsible gambling assessment purposes, in which case explicit consent will be sought.
04 How We Collect Your Data
Rush33 collects personal data through the following means:
The majority of your personal data is collected directly from you when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your Account preferences. You have control over what information you provide, subject to the minimum requirements for Account registration and KYC compliance.
Rush33's servers and analytics tools automatically record certain technical data when you access the Platform, including your IP address, device identifiers, browser session data, and interaction logs. This data is collected through standard web server logs, cookies, and session tracking technologies.
Rush33 may receive personal data from third-party service providers engaged to support Platform operations, including KYC identity verification providers, payment processors (such as e-wallet operators and banks), fraud detection services, and analytics platforms. Data received from third parties is handled in accordance with this Policy.
05 Purposes of Data Processing
Rush33 processes your personal data only for specific, legitimate purposes. The principal purposes for which we process personal data are set out below:
- Account Management: To create, verify, and maintain your Account; to authenticate your identity at login; and to administer your Account preferences and settings.
- Service Delivery: To provide access to the Platform's games, sports betting markets, and financial services, including processing deposits and withdrawals in MYR and supported cryptocurrencies.
- KYC and AML Compliance: To verify your identity and age (21+) in compliance with applicable Know Your Customer and Anti-Money Laundering obligations before processing withdrawals or at any time we are required to do so by law or regulation.
- Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, account takeover, and other prohibited conduct on the Platform.
- Responsible Gambling: To identify potentially problematic gambling patterns, administer self-exclusion requests and deposit limits, and support Users who request responsible gambling interventions.
- Customer Support: To respond to your queries, resolve disputes, and provide technical and account assistance via live chat and email.
- Marketing and Promotions: To send you promotional offers, loyalty programme updates, and platform news, subject to your marketing opt-in preferences. You may opt out at any time via your Account settings or by contacting support.
- Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the Platform's features, design, and performance.
- Legal Compliance: To comply with applicable laws, respond to lawful requests from competent authorities, and enforce our Terms and Conditions.
06 Legal Bases for Processing
Rush33 processes your personal data on the following legal bases, consistent with applicable data protection principles including those reflected in the Malaysian Personal Data Protection Act 2010:
- Contractual Necessity: Processing required to perform the contract between you and Rush33 — including Account registration, payment processing, and service delivery — is carried out on the basis that such processing is necessary for the performance of that contract.
- Legal Obligation: Certain processing, including KYC identity verification, AML record-keeping, and responses to law enforcement requests, is carried out because Rush33 is legally required to do so under applicable law.
- Legitimate Interests: Rush33 processes certain data on the basis of our legitimate interests in operating a secure, fraud-free platform and improving our services, provided those interests are not overridden by your data protection rights.
- Consent: Where processing is not required by contract or law, Rush33 will seek your explicit consent — for example, for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
07 Data Sharing & Disclosure
Rush33 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data only in the limited circumstances described below:
Rush33 engages third-party service providers who process personal data on our behalf to support Platform operations. These include payment processors (e-wallet operators, FPX/DuitNow intermediaries, cryptocurrency exchange gateways), KYC verification providers, fraud detection and AML screening services, cloud infrastructure providers, and customer support tooling. All processors are bound by data processing agreements requiring them to handle your data in accordance with applicable data protection standards.
Rush33 may disclose personal data to competent governmental or regulatory authorities where required to do so by law, court order, or lawful regulatory request. We will, where permitted by law, notify affected Users of such disclosures.
In the event of a merger, acquisition, or sale of all or part of Rush33's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms before any change takes effect.
We will never sell your data: Rush33 does not, and will not, sell your personal data to advertising networks, data brokers, or any third party for their own commercial use. Your data is used exclusively to operate and improve the Platform and fulfil our legal obligations.
08 Data Retention
Rush33 retains personal data for as long as is necessary for the purpose for which it was collected and to meet our legal and regulatory obligations. The following retention guidelines apply:
- Account Data: Retained for the duration of your active Account plus a minimum of 5 years following Account closure, in accordance with AML record-keeping requirements.
- KYC and Identity Documents: Retained for a minimum of 5 years from the date of submission or from the date of Account closure, whichever is later, as required by applicable financial crime prevention regulations.
- Transaction Records: All financial transaction records (deposits, withdrawals, wager history) are retained for a minimum of 5 years for AML compliance and dispute resolution purposes.
- Support Communications: Customer support transcripts and email records are retained for 2 years from the date of the interaction, unless linked to an ongoing dispute or legal proceeding.
- Marketing Data: Marketing preference records and campaign interaction data are retained while you hold an active Account and for 12 months following Account closure or opt-out, whichever is earlier.
- Technical / Log Data: Server logs and session data are retained for up to 12 months for security and fraud investigation purposes.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any identifiable individual.
09 Data Security
Rush33 implements and maintains a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
- 256-bit SSL/TLS encryption applied to all data transmitted between your device and the Platform.
- Encryption at rest for sensitive data categories including KYC documents and financial records stored on our infrastructure.
- Access controls and role-based permissions ensuring that only authorised Rush33 personnel and contracted service providers can access personal data, limited to what is necessary for their specific function.
- Regular security audits, penetration testing, and vulnerability assessments of the Platform infrastructure.
- Two-factor authentication (2FA) available to all Users for Account login security.
- Incident response procedures for the timely identification, containment, and notification of any personal data breach.
While Rush33 applies industry-standard security practices, no online platform can guarantee absolute security against all possible threats. You also play a role in keeping your Account secure — we strongly encourage you to use a strong, unique password and enable 2FA on your Account.
Suspected breach? If you believe your Account has been accessed without your authorisation, contact Rush33 support immediately at [email protected] (plain text — not a link). We will investigate all such reports within 24 hours.
10 Cookies & Tracking Technologies
Rush33 uses cookies and similar tracking technologies to operate the Platform and improve User experience. Cookies are small text files stored on your device when you visit the Platform. They do not contain executable code and cannot access other data on your device.
- Strictly Necessary Cookies: Required for the Platform to function correctly. These include session cookies that maintain your authenticated login state and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without breaking Platform functionality.
- Analytics Cookies: Used to collect anonymised data about how Users interact with the Platform — such as which pages are visited most frequently and where Users encounter errors — helping Rush33 improve the Platform. These cookies do not identify you personally.
- Functional Cookies: Used to remember your preferences, such as language settings and last-used game categories, to personalise your experience on return visits.
- Marketing Cookies: Used, subject to your consent, to deliver promotional content relevant to your interests. You may opt out of marketing cookies through your browser settings or our cookie management tool.
You may configure your browser to refuse or delete cookies. Note that disabling strictly necessary cookies will impair or prevent access to the Platform. For other cookie categories, your preferences are respected and will not affect core Platform functionality. Consult your browser's help documentation for instructions on managing cookie settings.
11 Your Data Rights
As a User of Rush33, you have the following rights in relation to the personal data we hold about you. These rights are consistent with the principles of the Malaysian Personal Data Protection Act 2010 and internationally recognised data protection standards.
Request a copy of the personal data Rush33 holds about you and information about how it is used.
Request correction of inaccurate or incomplete personal data held your Account or our records.
Request deletion of your personal data, subject to our legal retention obligations (e.g., AML record-keeping requirements).
Request that we restrict processing of your data in certain circumstances, such as while dispute is under review.
Request a copy of certain personal data in a structured, machine-readable format for transfer to another service provider.
Object to processing of your data for direct marketing purposes at any time. You may also object to processing based on legitimate interests.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.
You have the right to lodge a complaint with the relevant data protection authority if you believe your rights have been infringed.
To exercise any of the above rights, please contact our support team at the details set out in Section 15. Rush33 will respond to all valid rights requests within 30 calendar days of receipt. We may require proof of identity before processing your request.
12 Children & Minors
Rush33 is strictly an adults-only platform. We do not permit any person under the age of 21 to register an Account or use our services. We do not knowingly collect personal data from individuals under 21 years of age.
If Rush33 becomes aware that personal data has been collected from a minor (a person under the age of 21), we will immediately suspend the associated Account, delete the personal data, and take appropriate action in accordance with our Terms and Conditions and applicable law.
Parent or guardian concern? If you believe a minor has registered on rush33 or used your account, please contact us immediately at [email protected] (plain text — not a link). We will investigate and act promptly to remove any underage accounts and associated data.
13 Third-Party Links & Services
The rush33 Platform may contain references to or integrations with third-party services, such as payment gateways (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB) and game content providers. When you interact with those third-party services, you are subject to their own privacy policies and terms, which are separate from this Policy.
Rush33 is not responsible for the privacy practices of third-party services and does not endorse or assume liability for the data practices of any external party. We encourage you to review the privacy policies of any third-party services you engage with in connection with your use of the Platform.
14 Amendments to This Policy
Rush33 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform features. Where changes are material — meaning they affect your rights or how your data is used — Rush33 will provide advance notice via email to your registered address and/or a prominent in-Platform notification, with a minimum of 7 days' notice where practicable.
The "Effective Date" at the top of this Policy reflects when the current version came into force. We recommend reviewing this Policy periodically. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.
15 Contact Us — Data & Privacy Enquiries
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Rush33, please contact us using the details below. All privacy and data-related correspondence should be submitted in English.