Privacy Policy

This Privacy Policy ("Policy") is published by Muslot ("we", "us", "the Company", "Muslot"), the operator of the online casino and sports betting platform accessible at https://muslot.cam and all associated sub-domains and services (collectively, "the Platform" or "the Service"). This Policy governs the collection, processing, storage, disclosure, and deletion of personal data belonging to all registered users, visitors, and prospective players ("you", "the User", "the Data Subject").

Muslot is committed to handling your personal data responsibly and in accordance with applicable data protection legislation. We recognise that privacy is a fundamental right and we have designed our data practices to be proportionate, transparent, and respectful of that right.

By registering an account on the Muslot platform, depositing funds, or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any aspect of this Policy, please do not use the Platform and contact us to close your account.

The following terms carry the meanings set out below throughout this Privacy Policy:

• "Personal Data" — Any information that identifies or could reasonably identify a natural person, either directly (e.g., name, email address) or indirectly (e.g., account ID combined with transaction history).
• "Processing" — Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Muslot, in its capacity as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — A third-party service provider that processes personal data on behalf of Muslot under a contractual data processing agreement.
• "Sensitive Personal Data" — A subset of personal data attracting heightened protection, including national identity numbers (MyKad), financial account details, and KYC documents.
• "Consent" — A freely given, specific, informed, and unambiguous indication of a Data Subject's agreement to the processing of their personal data.
• "Cookie" — A small text file placed on a user's device by a website to store session or preference information.

Muslot collects personal data through several channels, including account registration, identity verification (KYC), financial transactions, platform usage, and direct communications with our support team. The categories of personal data we collect are as follows:

3.1 Registration Data

• Full legal name and date of birth
• Email address and mobile telephone number
• Username and encrypted account password
• Country and city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Preferred currency (MYR — Malaysian Ringgit)

3.2 Identity Verification (KYC) Data

• Government-issued photo identification — Malaysian MyKad, Passport, or Driver's Licence (front and back)
• Proof of residential address — utility bill or bank statement dated within 3 months
• Selfie photograph holding the identification document
• Source of funds documentation (required for higher-volume accounts)

3.3 Financial Data

• Deposit and withdrawal transaction records (amounts, dates, methods)
• Payment method identifiers — e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay), bank account references (Maybank, CIMB, Public Bank, RHB, Hong Leong), card BIN data
• Cryptocurrency wallet addresses (where applicable)

3.4 Technical & Usage Data

• IP address and geolocation data (country and city level)
• Device type, operating system, browser type and version
• Session duration, pages visited, game history, and bet records
• Login timestamps and platform activity logs
• Cookie and tracking pixel data (see Section 7)

3.5 Communications Data

• Support chat transcripts and email correspondence
• Feedback, complaints, and survey responses
• Marketing preference settings and communication opt-in or opt-out records

The following table summarises the principal purposes for which Muslot processes personal data, together with the associated legal basis for each processing activity:

Muslot does not use personal data for automated decision-making that produces significant legal or similarly significant effects on Data Subjects, without providing a mechanism for human review upon request.

Muslot relies on the following legal bases for processing personal data, as applicable to each processing activity:

• Contract Performance: Processing necessary for the performance of a contract to which you are a party, including account registration, deposit and withdrawal processing, and access to platform services.
• Legal Obligation: Processing required for compliance with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and regulatory reporting.
• Legitimate Interests: Processing necessary for the legitimate interests of Muslot or third parties, including fraud prevention, platform security, responsible gambling monitoring, and analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent, principally for direct marketing communications. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting our support team.

Muslot does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We may share personal data with the following categories of recipients, strictly limited to what is necessary for the stated purpose:

• Payment Service Providers: Financial data is shared with payment processors (including e-wallet operators such as Touch 'n Go, Boost, and GrabPay; bank payment processors via DuitNow and FPX; and card networks) solely for transaction processing purposes.
• Identity Verification (KYC) Providers: KYC documents may be processed by contracted third-party identity verification platforms operating under data processing agreements with Muslot.
• Game Providers: Technical session data (game type, stakes, outcomes) is shared with third-party game studios to facilitate gameplay. No additional identifying personal data is shared unless strictly required.
• Fraud Prevention Services: Technical and transaction data may be shared with contracted fraud detection and anti-money laundering compliance service providers.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to relevant authorities when required to do so by applicable law, court order, or regulatory direction. We will notify you of such disclosure where legally permitted to do so.
• Professional Advisers: Legal counsel, accountants, and auditors may access personal data under strict confidentiality obligations in the course of providing professional services to Muslot.

The Muslot platform uses cookies and similar tracking technologies to provide core platform functionality, improve user experience, and analyse platform performance. A cookie is a small data file stored on your device by your web browser when you access a website.

7.1 Categories of Cookies Used

• Strictly Necessary Cookies: Essential for core platform functions including session management, account authentication, and security. These cookies cannot be disabled without affecting core functionality.
• Functional Cookies: Remember your preferences, language settings, and account configuration to provide a personalised experience on return visits.
• Analytics Cookies: Collect anonymised or aggregated data about how users navigate and interact with the platform, used to identify and resolve usability issues and improve overall performance.
• Session Timeout Cookies: Used by our responsible gambling tools to track active session duration and trigger session time alerts where configured by the user.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair core platform functionality including login and payment processing. Muslot does not use third-party advertising cookies or cross-site tracking cookies.

Muslot retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies:

• Account and Registration Data: Retained for the duration of the active account relationship, plus a minimum of 5 years following account closure, in compliance with anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of account closure or the date of the last transaction, whichever is later.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction.
• Customer Support Communications: Retained for 3 years from the date of the final communication, or longer where the communication relates to a formal complaint or dispute.
• Technical and Usage Logs: Retained for up to 12 months for operational and security purposes, after which they are deleted or anonymised.
• Marketing Consent Records: Retained for the duration of the consent period, plus 3 years following withdrawal of consent, for compliance audit purposes.

Upon expiry of the applicable retention period, personal data is either securely deleted from active systems or irreversibly anonymised so that it can no longer be attributed to an identified or identifiable individual.

Muslot implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, or destruction. Our security framework includes:

• Encryption: All data in transit is protected using TLS 1.2 or higher. Sensitive data at rest (including KYC documents and financial records) is encrypted using AES-256.
• Access Controls: Access to personal data systems is restricted to authorised Muslot personnel on a need-to-know basis, governed by role-based access controls and multi-factor authentication.
• Infrastructure Security: Muslot's platform infrastructure is hosted on hardened servers within access-controlled data centre environments with physical and logical security perimeters.
• Regular Security Audits: Penetration testing and vulnerability assessments are conducted periodically by qualified third-party security professionals.
• Incident Response: Muslot maintains a documented data breach response procedure. In the event of a personal data breach affecting your rights and freedoms, you will be notified without undue delay.

As a Data Subject, you hold the following rights in relation to your personal data held by Muslot. To exercise any of these rights, please contact our support team using the details in Section 15. We will respond to all verified requests within 30 calendar days.

Please note that some rights are subject to limitations — for example, we may be unable to delete certain data where retention is required by AML legislation or other legal obligations. In such cases, we will explain clearly which data cannot be deleted and the applicable reason.

The Muslot platform is strictly intended for individuals aged 21 years and above. Muslot does not knowingly collect, process, or retain personal data belonging to individuals below this age threshold. If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete all associated data and close the account.

If you have reason to believe that a minor has registered an account on the Muslot platform, please contact our support team immediately at [email protected]. We take the protection of minors from gambling-related harms extremely seriously and will act on all such notifications without delay.

Muslot's primary data storage and processing infrastructure is located in secure data centre facilities serving the Asia-Pacific region. In certain circumstances, personal data may be transferred to or accessed by third-party service providers operating in other jurisdictions, including KYC verification providers, fraud detection services, and game studios.

Any international transfer of personal data is conducted only where adequate safeguards are in place, including contractual data processing agreements that impose obligations on the receiving party equivalent to those applicable to Muslot. We take reasonable steps to ensure that recipients of transferred data maintain appropriate security standards.

The Muslot platform integrates with a number of third-party services to provide core functionality, including payment gateways (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank), game content providers, and identity verification platforms. These third parties operate under their own privacy policies, and Muslot is not responsible for the data practices of third-party providers operating outside of our direct contractual control.

Where third parties process personal data on our behalf as Data Processors, they are required under contract to: process data only on Muslot's documented instructions; implement appropriate technical and organisational security measures; not engage sub-processors without prior written authorisation; and assist Muslot in fulfilling Data Subject rights requests.

Muslot does not embed third-party social media tracking pixels, third-party advertising networks, or affiliate tracking on any page that processes personal data or financial transactions.

Muslot reserves the right to update or modify this Privacy Policy at any time. Material changes that significantly affect your rights or the way we process your personal data will be communicated to you via in-platform notification and/or by email to your registered address at least 14 days prior to the updated Policy taking effect.

Non-material updates — such as corrections of typographical errors, clarifications to existing practices, or updates to contact details — may be made without prior notice. The effective date shown at the top of this document will be updated to reflect the date of any revision.

Your continued use of the Muslot platform following the effective date of any updated Privacy Policy constitutes your acknowledgment and acceptance of the revised terms. It is your responsibility to review this Policy periodically to remain informed of our current data practices.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the Muslot privacy team using the details below. We aim to acknowledge all privacy-related enquiries within 3 business days and resolve them within 30 calendar days.

When submitting a data rights request, please provide your registered email address, account username, and a description of your request to allow us to locate your account and process your request efficiently.