Privacy Policy Lisboa33 – Full Data Protection for Malaysian Users

1. Introduction & Scope of Lisboa33's Privacy Policy

This Privacy Policy ("Policy") describes how Lisboa33 Group ("Lisboa33", "we", "us") collects, uses, stores, discloses, and protects your personal information when you use our website, mobile app, and all services provided by Lisboa33 to users in Malaysia.

This policy applies to all individuals who register as Lisboa33 members, visit our website, use the Lisboa33 app, or interact with any of our digital services. It should be read together with Lisboa33's Terms & Conditions, which form part of the full agreement between you and Lisboa33.

Lisboa33 is fully compliant with the Personal Data Protection Act 2010 (PDPA) and all related regulations enforced by the Department of Personal Data Protection (JPDP) under Malaysia's Ministry of Communications and Digital.

2. Types of Personal Data We Collect

Lisboa33 only collects personal data necessary to provide you with quality services. In general, the data we collect falls into several categories:

Lisboa33 does not collect sensitive data such as health information, religious beliefs, political views, or biometric data unless required by applicable law or for purposes to which you have given explicit consent.

3. How Lisboa33 Collects Your Data

Lisboa33 collects your personal information through various means, depending on how you interact with our platform:

• Account Registration: You provide information directly when completing the Lisboa33 registration form, including your name, email, phone number, and date of birth.
• Identity Verification (KYC): We collect copies of identity documents (MyKad or passport) to meet anti-money laundering (AML) compliance requirements.
• Financial Transactions: When you make a deposit via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, or FPX, transaction details are automatically recorded in the Lisboa33 system.
• Platform Usage: Every action taken on the Lisboa33 platform — from navigation clicks to bets placed — may be recorded for service improvement and security purposes.
• Cookies & Tracking Technologies: The Lisboa33 website uses cookies and similar technologies to remember your preferences and improve your experience.
• Third Parties: In certain cases, Lisboa33 may receive data from approved identity verification providers, payment processors, or marketing service providers.

4. How Lisboa33 Uses Your Data

Every piece of data we collect has a clear and legitimate purpose. Lisboa33 processes your personal data for the following reasons:

1. Service Provision: To process registration, manage accounts, handle deposits and withdrawals, and provide access to all games and betting on the Lisboa33 platform.
2. Identity Verification: To comply with KYC requirements and anti-money laundering (AML) procedures as mandated under Malaysian law.
3. Platform Security: To detect and prevent fraudulent activity, bot usage, collusion, multiple account ownership, and other security threats to the Lisboa33 platform.
4. Service Communications: To send you important notifications regarding your account, transactions, eligible bonuses, and Lisboa33 policy updates.
5. Product Improvement: To analyse aggregated (anonymised) usage patterns for the purpose of improving the Lisboa33 platform's interface, performance, and overall user experience.
6. Marketing (with consent): To send you promotions, bonus offers, and the latest Lisboa33 updates, if you have opted in to receive marketing communications.
7. Legal Compliance: To comply with any legal requirements, regulations, court orders, or requests from legitimate authorities.

5. Legal Basis for Data Processing

In accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), Lisboa33 ensures that every processing of personal data rests on a solid legal basis:

• Contract Performance: Processing necessary to provide the Lisboa33 services you requested upon registration, including account management, payment processing, and bet settlement.
• Legal Obligation: Processing to fulfil requirements under the PDPA, the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001, and any other applicable regulatory obligations.
• Legitimate Interests: Processing to prevent fraud, maintain network security, and protect the legitimate interests of Lisboa33 and its members.
• Consent: For optional processing such as marketing communications and non-essential cookies, Lisboa33 requires your explicit consent, which may be withdrawn at any time.

6. Data Sharing with Third Parties

Lisboa33 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. However, we may share your data in the following limited circumstances:

• Service Providers: Companies that assist Lisboa33 in its operations, such as payment processors (Touch 'n Go, GrabPay, DuitNow, etc.), identity verification providers, and cloud infrastructure providers. All such parties are bound by strict data protection agreements with Lisboa33.
• Game Providers: Casino game, slots, and table game providers partnered with Lisboa33 may receive data necessary for game operation. This data is limited to the minimum technical information required.
• Authority: Lisboa33 will disclose data to Malaysian authorities such as the police, courts, or regulatory bodies where required by law or where there is an urgent public safety need.
• Corporate Transactions: In the event of a merger, acquisition, or sale of Lisboa33's assets, personal data may be transferred to the new entity. You will be notified in advance and given the option to opt out.

7. Lisboa33 Data Security Measures

Lisboa33 continuously invests in cybersecurity infrastructure to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures we employ include:

• 256-bit SSL Encryption: All communications between your device and Lisboa33 servers are encrypted to the highest industry standards.
• Two-Factor Authentication (2FA): Available and strongly recommended for all Lisboa33 accounts to prevent unauthorised access even in the event of a compromised password.
• Separate Trust Account: Member funds are held in a trust account that is fully segregated from Lisboa33's operational funds.
• 24/7 Security Monitoring: Lisboa33's cybersecurity team continuously monitors systems to detect any suspicious activity.
• Regular Security Audits: Lisboa33 conducts regular independent penetration testing and security audits.
• Internal Access Controls: Only Lisboa33 staff who require access to your data for their specific job functions are permitted to do so, with all access fully logged.

That said, no security system can be guaranteed 100% secure. Lisboa33 is committed to notifying you promptly should any data breach occur that affects your personal information, in accordance with the requirements of PDPA 2010.

8. Data Retention Period

Lisboa33 retains your personal data only for as long as necessary to fulfil the purposes outlined in this policy or as required by applicable law. General retention periods are as follows:

• Active Account Data: Retained for the duration your Lisboa33 account is active, plus 7 years after account closure (for financial compliance and AML purposes).
• Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's Anti-Money Laundering Act requirements.
• Support Communication Records: Retained for 3 years from the date of last interaction.
• Security Log Data: Retained for 12 months for digital forensics purposes where required.
• Marketing Data (with consent): Retained until you withdraw consent or close your account.

When data is no longer needed and there is no legal requirement to retain it, Lisboa33 will securely delete or anonymise it using industry-recognised procedures.

10. Lisboa33 Cookie Policy

The Lisboa33 website and app use cookies and similar tracking technologies to enhance your experience. The following are the types of cookies we use:

You can manage or disable optional cookies through the privacy settings in your Lisboa33 account or via your web browser settings. Disabling certain cookies may affect some Lisboa33 platform features.

11. Protection of Children's Data

Lisboa33 services are not intended for individuals under the age of 18. Lisboa33 does not knowingly collect personal data from minors. If you believe your child under 18 has provided personal data to Lisboa33 without your knowledge, please contact us immediately at privacy@lisboa33.biz.

Upon receiving such a report and verifying its validity, Lisboa33 will take the following steps:

• Immediately closing the account in question.
• Permanently deleting all related personal data from our systems.
• Returning any funds remaining in the account to the rightful guardian through the appropriate verification process.

12. Changes to Lisboa33's Privacy Policy

Lisboa33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or service improvements. When material changes are made, Lisboa33 will:

• Updating the "Last Updated" date at the top of this document.
• Sending notice to all active members via their registered email address at least 7 days before the changes take effect.
• Displaying a clear notice on the Lisboa33 homepage for a minimum of 14 days.

Continued use of the Lisboa33 platform after the effective date of any changes constitutes acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

13. Contact Lisboa33's Privacy Officer

For any questions, concerns, or requests relating to this Privacy Policy or how Lisboa33 handles your personal data, please contact our Data Protection Officer:

• Privacy Email: privacy@lisboa33.biz
• General Support Email: support@lisboa33.biz
• 24/7 Live Chat: Available on the Lisboa33 platform

We are committed to responding to all privacy-related enquiries within 5 business days. For formal data subject rights requests, the response period is up to 30 business days in accordance with Malaysia's PDPA 2010.