Privacy Policy — spa19

spa19 ("we", "us", "our", the "Company") operates the online casino and sports betting platform accessible at https://spa19.cam (the "Platform"). We are committed to protecting the personal data of all individuals who interact with our Platform, including registered players, prospective users, and visitors.

This Privacy Policy ("Policy") sets out, in clear and structured terms, what personal data spa19 collects from you, why we collect it, how we use and protect it, with whom we may share it, and what rights you hold in relation to it. This Policy applies to all personal data processed through the spa19 Platform, regardless of whether you access it from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other location.

This Policy forms part of our broader framework of legal documents, which includes the Terms & Conditions. By creating an Account, making a deposit, or otherwise using the spa19 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to our processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

spa19 collects personal data in several categories, depending on the nature of your interaction with the Platform. The following table outlines each category, specific data points, and the primary reason for collection.

spa19 collects your personal data through the following channels and mechanisms:

You provide data directly when you register an Account, complete the KYC verification process, make a deposit or withdrawal request, contact customer support, participate in a promotional campaign, or adjust your responsible gambling settings. This is the primary source of the personal data we hold about you.

When you access the Platform, our servers and analytics infrastructure automatically collect certain technical data, including your IP address, device identifiers, browser type, and session activity. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 11.

In limited circumstances, spa19 may receive personal data about you from third-party sources, including:

• KYC verification providers: Licensed identity verification services that cross-reference the documents you submit against official identity databases.
• Payment processors: Malaysian payment intermediaries (including FPX operators and e-wallet providers) that process and confirm your deposit and withdrawal transactions.
• Fraud and AML screening services: Third-party compliance platforms that screen player details against sanctions lists and politically exposed persons (PEP) databases.
• Referral sources: If you registered via a referral link, the referring party's identifier may be associated with your account registration record.

spa19 processes your personal data for the following specific and legitimate purposes:

• Account creation and management: To register, maintain, and administer your spa19 Account, including authentication and account recovery.
• Identity and age verification (KYC): To confirm that you are a real person, that you are at least 21 years of age, and that your identity matches the payment methods associated with your Account.
• Payment processing: To process deposits and withdrawals through your chosen payment method (e.g., Touch 'n Go eWallet, Maybank, DuitNow, CIMB, FPX, BTC), and to maintain accurate financial records.
• Gaming service delivery: To provide access to casino games, live dealer tables, sports betting markets, and associated Platform features.
• Fraud prevention and security: To detect and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other conduct prohibited by our Terms & Conditions.
• Legal and regulatory compliance: To meet our obligations under applicable anti-money laundering (AML) legislation, international gaming licensing requirements, and other regulatory frameworks.
• Customer support: To respond to enquiries, resolve disputes, process account requests, and facilitate self-exclusion or limit-setting under our responsible gambling program.
• Responsible gambling monitoring: To monitor player behaviour for indicators of problem gambling, implement player-requested limits, and fulfil our duty of care obligations.
• Platform improvement and analytics: To understand how players interact with the Platform, identify technical issues, test new features, and improve overall user experience.
• Marketing communications (with consent): To send promotional communications, bonus notifications, and Platform updates to players who have opted in to receive such communications. You may withdraw consent at any time.

spa19 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil the contract represented by these Terms, including account management, payment processing, and game delivery.
• Legal obligation: Processing necessary to comply with applicable AML regulations, KYC requirements, and international gaming licensing conditions.
• Legitimate interests: Processing carried out for spa19's legitimate business interests — including fraud prevention, platform security, and service improvement — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given consent, in particular for direct marketing communications and non-essential cookie placement. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Vital interests: In exceptional circumstances, processing that is necessary to protect an individual's life or safety, including responsible gambling interventions.

spa19 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with third parties only in the following defined circumstances:

We engage carefully selected third-party service providers who process data on our behalf and under our instruction, bound by confidentiality and data processing agreements. These include:

• KYC and identity verification providers
• Payment processors and Malaysian banking partners (including FPX network operators and e-wallet service providers)
• Cloud infrastructure and hosting providers
• Fraud detection and AML screening platforms
• Customer support software providers
• Game content providers and live dealer studio operators (limited session and wager data only)

spa19 may disclose personal data to licensing authorities, law enforcement agencies, financial intelligence units, or courts where required to do so by law, court order, or regulatory direction. Such disclosure is made only to the extent strictly necessary.

In the event of a merger, acquisition, corporate restructure, or sale of spa19's assets, personal data held about players may be transferred to the acquiring entity, subject to that entity providing equivalent privacy protections. Players will be notified of any such change that materially affects the use of their personal data.

spa19 will not share your personal data with any other third party without obtaining your prior explicit consent for that specific disclosure.

As an internationally licensed online gaming platform, spa19 operates infrastructure and engages service providers located in various countries. As a result, your personal data may be transferred to and processed in countries outside Malaysia, including jurisdictions in Southeast Asia, Europe, and elsewhere.

When we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect the data to a standard equivalent to that described in this Policy. These safeguards may include contractual clauses, data processing agreements, and assurances regarding the recipient's compliance with recognised data protection frameworks.

spa19 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, to meet our legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data management procedures.

spa19 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Key security controls include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our Platform.
• Encryption at rest for sensitive personal and financial data stored on our servers.
• Two-factor authentication (2FA) available on all player accounts.
• Access controls and role-based permissions ensuring that internal staff access to personal data is limited to those with a legitimate operational need.
• Regular security audits and penetration testing conducted by independent cybersecurity professionals.
• Automated fraud detection systems monitoring for suspicious access patterns, login anomalies, and unusual transaction behaviour.
• Incident response procedures designed to identify, contain, and report data security incidents in a timely manner.

While spa19 takes all reasonable precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account login credentials. If you suspect that your Account has been compromised, contact our support team immediately via live chat or at [email protected].

spa19 uses cookies and similar technologies (such as web beacons and local storage) to operate and improve the Platform. Cookies are small data files stored on your device that allow us to recognise you across sessions and deliver a consistent, personalised experience.

You may manage cookie preferences through your browser settings. Please note that disabling essential or security cookies may prevent access to certain Platform features. spa19 does not use third-party advertising cookies or behavioural targeting cookies for cross-site advertising.

spa19 respects your rights in relation to your personal data. Subject to applicable legal limitations and regulatory obligations, you hold the following rights:

To exercise any of the above rights, please contact our Data Protection team via live chat or in writing at [email protected] with "Data Rights Request" in the subject line. We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days, subject to identity verification.

The spa19 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Our KYC process is designed specifically to verify that all account holders meet this minimum age requirement before any real-money activity is permitted.

If spa19 becomes aware, at any point, that an individual under the age of 21 has registered an Account or provided personal data to our Platform, we will:

• Immediately suspend the Account pending investigation.
• Delete all personal data associated with the underage individual, subject to any legal obligation to retain evidence of the incident.
• Void all transactions and forfeit all balances associated with the Account.
• Report the incident to relevant authorities where required by law.

If you believe a minor has accessed the spa19 Platform or provided their data to us, please contact us immediately at [email protected]. We take reports of underage access with the utmost seriousness.

spa19 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or business operations. Material changes — those that meaningfully alter your rights or how we use your data — will be communicated to registered players via in-platform notification or email to the address registered on your Account, with a minimum of 7 days' notice before the change takes effect.

The "Last Updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this Policy periodically to stay informed about how we protect your information.

Your continued use of the spa19 Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy. If you do not agree with any material change, you should request Account closure before the change takes effect.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact the spa19 Data Protection team through the channels listed below. Email addresses are displayed as plain text only and are not clickable links.

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week — including all Malaysian public holidays. Average response time under 90 seconds.
• Subject Line for Data Requests: Please include "Privacy Request" or "Data Rights Request" to ensure your message reaches the correct team.
• Languages: English, Bahasa Melayu, Mandarin, Cantonese