Privacy Policy

This Privacy Policy (hereinafter "this Policy" or "the Policy") is published by grab89 ("we", "us", "our", "the Platform", "the Operator"), the operator of the online gaming and sports betting platform accessible at https://grab89.lat and its associated interfaces. It governs how we collect, use, store, share, and otherwise process the personal information of individuals who access or use the grab89 Platform ("you", "your", "the User", "the Player").

grab89 is committed to handling personal data responsibly and in compliance with applicable data protection legislation and industry best practices. We recognise that the trust you place in us when you share your personal information is significant, and we take that responsibility seriously.

By registering an account, accessing the Platform, or otherwise using any grab89 service, you confirm that you have read, understood, and consented to the data practices described in this Policy. If you do not agree to this Policy, you should discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

grab89 collects Personal Data through several distinct channels in the course of providing the Platform and its associated services. We apply a principle of data minimisation — collecting only what is genuinely necessary for the stated purpose.

3.1 Registration Data

When you create a grab89 account, we collect the following information:

• Full legal name — as it appears on your government-issued identification document.
• Date of birth — to verify compliance with the21+ minimum age requirement.
• Email address — for account communication, security alerts, and transactional notifications.
• Phone number — for two-factor authentication and, if opted into, account activity notifications.
• Residential address — including city, state, and postcode, for identity verification and regulatory compliance.
• Username and encrypted password — for secure account access.

3.2 KYC and Verification Data

As part of our Know Your Customer (KYC) process — which is mandatory before certain transactions, including withdrawals above defined thresholds — we may additionally collect:

• Copies of government-issued photo identification (e.g., MyKad, passport or driving licence).
• Proof of address documents (e.g., a recent utility bill, bank statement, or municipal rate notice).
• Source of funds documentation where required by AML procedures.
• Proof of payment method ownership (e.g., a screenshot or partial statement from your Maybank2u, CIMB Clicks, Touch 'n Go eWallet, or other registered payment account).

3.3 Transaction and Financial Data

In connection with deposits, withdrawals, and gaming activity, we record:

• Deposit and withdrawal amounts, dates, and payment method references.
• Game session data including wager amounts, outcomes, and session duration.
• Bonus claims, wagering progress, and cashback calculations.
• Tokenised payment method identifiers (we do not store raw bank account or card numbers).

3.4 Technical and Device Data

When you access the Platform, our systems automatically collect certain technical information, including:

• IP address and geolocation (at country and region level).
• Device type, operating system, and browser type and version.
• Pages visited, navigation paths, time on page, and interaction events.
• Session identifiers and authentication tokens.
• Referring URL and exit URL.

3.5 Communications Data

If you contact our support team via live chat, email, or WhatsApp, we record the content of that communication and any associated metadata (date, time, resolution outcome) for quality assurance, training, and dispute resolution purposes.

grab89 uses the Personal Data collected for the following clearly defined purposes. We do not use your data for any purpose not described in this Policy without first seeking your consent or establishing an alternative lawful basis.

grab89 relies on the following lawful bases for processing your Personal Data, in accordance with applicable data protection law:

• Contractual Necessity — Processing that is necessary to fulfil the contract between you and grab89, including account management, payment processing, and service delivery.
• Legal Obligation — Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) reporting, responsible gambling obligations, and KYC requirements imposed by our operating licence.
• Legitimate Interest — Processing necessary for grab89's legitimate operational interests, including fraud prevention, platform security, abuse detection, and service improvement — provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent — Processing based on your freely given, specific, and informed consent — for example, receiving marketing communications. You may withdraw consent at any time without affecting other processing grounds.

grab89 does not sell, rent, or otherwise trade your Personal Data to third parties for commercial gain. We disclose Personal Data only in the following limited circumstances, and only to the extent strictly necessary for the stated purpose:

6.1 Service Providers and Data Processors

We engage third-party service providers to support Platform operations in areas including payment processing, identity verification, cloud hosting, cybersecurity, and customer support tooling. These providers process Personal Data solely on our instructions, under binding data processing agreements that prohibit them from using data for their own purposes.

Payment-related processing in Malaysia is conducted via established channels including but not limited to the FPX network, DuitNow infrastructure, and licensed e-wallet operators such as Touch 'n Go eWallet, Boost, and GrabPay. These entities are subject to Bank Negara Malaysia (BNM) oversight and their own published privacy policies.

6.2 Regulatory and Legal Disclosures

grab89 may be required to disclose Personal Data to competent regulatory authorities, law enforcement agencies, or judicial bodies where required by applicable law, court order, or regulatory direction. In such cases, we will disclose only the minimum data necessary to satisfy the legal obligation and, where permitted, will notify you of such disclosure.

6.3 Business Transfers

In the event that grab89 undergoes a merger, acquisition, asset sale, or restructuring, Personal Data held by grab89 may be transferred to the acquiring entity as part of that transaction. We will notify affected Users prior to any such transfer and will ensure that the receiving entity commits to data protection standards no less protective than those in this Policy.

6.4 Aggregated and Anonymised Data

grab89 may share aggregated, statistical, or anonymised data — from which individual Users cannot be identified — with partners, research organisations, or regulators for industry analysis, product development, or public reporting purposes. This does not constitute sharing of Personal Data.

grab89 uses cookies and similar tracking technologies on the Platform to ensure proper functionality, maintain session security, and gather analytics data. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies do not contain executable code and cannot access data from your device beyond what is placed by the grab89 Platform.

7.1 Types of Cookies Used

7.2 Managing Cookies

Most web browsers allow you to control cookie settings through your browser preferences. You may choose to reject non-essential cookies; however, disabling strictly necessary cookies will impair your ability to log in to and use the grab89 Platform. Instructions for managing cookies are available in your browser's help documentation.

grab89 retains Personal Data only for as long as is necessary for the purposes for which it was collected or as required by applicable law. The following retention periods apply as general guide:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes.

grab89 implements a multi-layered security framework designed to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Transport layer security (TLS 1.3) — All data transmitted between your browser or device and the grab89 Platform is encrypted via TLS 1.3 or higher.
• Data-at-rest encryption — Personal Data stored on grab89 servers is encrypted using AES-256 symmetric encryption.
• Tokenisation — Payment method details are tokenised by licensed payment processors; raw financial instrument data is never stored on grab89 infrastructure.
• Access controls — Internal access to Personal Data is restricted on a role-based, need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Penetration testing — grab89 commissions regular independent security assessments to identify and remediate vulnerabilities.
• Incident response — grab89 maintains a formal data breach response plan. In the event of a personal data breach affecting Users, we will notify affected individuals and relevant authorities in accordance with applicable law.

Whilst grab89 takes all reasonable measures to protect your data, no system is completely impervious to risk. You are responsible for maintaining the security of your own account credentials and for promptly notifying us if you suspect any unauthorised access.

Subject to applicable data protection law, you have the following rights in relation to the Personal Data we hold about you. To exercise any of these rights, please contact our support team at the details provided in Section 15. We will respond to valid requests within 30 calendar days.

grab89 strictly enforces aminimum age requirement of 21 years for all registered Players. The Platform is not directed at, and must not be used by, any person under the age of 21. We do not knowingly collect Personal Data from persons under the age of 21.

Age verification is conducted as part of the KYC process. Upon registration, Players must confirm that they are 21 years of age or older. grab89 reserves the right to request documentary proof of age — such as a MyKad, passport, or driving licence — at any point during the account lifecycle. Where we discover or have reasonable grounds to believe that a registered User is under 21, we will:

• Immediately suspend the Account.
• Securely delete all Personal Data collected in relation to that Account as soon as legally permissible.
• Process any refund of real-money deposits in accordance with applicable law.
• Report the matter to relevant authorities where required by law.

If you become aware that a minor has registered an account on grab89, please contact our support team immediately so that we can take appropriate action.

As an online platform serving users across Malaysia and other jurisdictions, grab89 may transfer Personal Data to service providers whose infrastructure is located in countries other than your country of residence. Such transfers may include data hosted on cloud servers in Singapore, Hong Kong, or other data centre locations across the Asia-Pacific region.

Where Personal Data is transferred internationally, grab89 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under applicable data protection law. These safeguards may include:

• Standard contractual data protection clauses in agreements with receiving entities.
• Binding corporate rules where data is transferred within a corporate group.
• Adequacy determinations by relevant regulatory bodies where applicable.
• Specific technical and organisational security measures required of all data processors.

You may request further information about the specific safeguards applicable to any particular transfer by contacting our support team.

The grab89 Platform integrates with several categories of third-party services to deliver its full functionality. Each third-party service provider operates under its own privacy policy and terms of service. grab89 is not responsible for the data practices of third-party services beyond the scope of our data processing agreements with those providers.

13.1 Payment Processors

Deposit and withdrawal transactions processed via Malaysian payment channels — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect — are handled by regulated payment service providers operating under Bank Negara Malaysia oversight. Your payment data shared with these processors is subject to their own privacy policies and applicable financial regulation.

13.2 Identity Verification Providers

KYC verification may be performed in whole or in part by specialist identity verification providers engaged by grab89. These providers process identity document images and biometric data solely for the purpose of verifying your identity in accordance with AML obligations, and are contractually prohibited from using that data for any other purpose.

13.3 Cloud and Hosting Providers

grab89 uses enterprise-grade cloud infrastructure providers for hosting and data storage. These providers are engaged under data processing agreements that include technical security requirements, data isolation standards, and confidentiality obligations consistent with the requirements of this Policy.

13.4 No External Links

The grab89 Platform does not contain links to external third-party websites. All navigation within the Platform remains within the grab89 domain. This Policy applies only to data collected and processed by or on behalf of grab89.

grab89 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The revised Policy will be published on this page with an updated "Last Updated" date at the top of the document.

Where amendments are material — meaning they substantively change how we collect, use, or share your Personal Data — we will provide notice via the Platform or by email to registered Users at least 14 days before the changes take effect, except where a shorter notice period is required by law or regulation.

Your continued use of the grab89 Platform after any amendment takes effect constitutes your acceptance of the revised Policy. If you do not agree to any revised terms, you should cease using the Platform and contact our support team to request Account closure in accordance with our Terms and Conditions.

We recommend revisiting this page periodically to stay informed of how grab89 handles your Personal Data. The version of the Policy in force at the time of any data processing event shall be the version that applies to that event.

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or wish to raise a concern about how your Personal Data has been handled, please contact the grab89 data support team using the details below. All privacy enquiries are handled in English, Bahasa Melayu, and Mandarin.

15.1 Response Timeframe

grab89 will acknowledge receipt of your privacy request within 3 business days and will provide a substantive response within 30 calendar days of receipt. Where the complexity or volume of requests requires additional time, we will notify you of the extended timeframe and the reason for the delay.

15.2 Escalation and Regulatory Complaints

If you are not satisfied with our response to a privacy request or complaint, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction. For players based in Malaysia, the relevant body is the Department of Personal Data Protection (JPDP) under the Ministry of Digital. Details of how to lodge a complaint with JPDP are publicly available on their official government website.

For information about our betting and gaming terms, please visit our Terms & Conditions page. For responsible gambling tools and support resources, please visit our Responsible Gambling page.