Serubet Privacy Policy – Our Commitment to Protecting Your Personal Data

1 Introduction & Scope of Privacy Policy

This Privacy Policy document ("Policy") is published by Serubet and applies to all individuals who access or use the serubet.bio platform, including those who register as members, visit as guests, or interact with any of our services.

We at Serubet understands that your personal data is both sensitive and valuable. The trust you place in us when registering an account and conducting financial transactions is not something we take lightly. That is why we invest heavily in security infrastructure and ensure all our staff are trained on the importance of data protection.

This Policy is established in accordance with Personal Data Protection Act (PDPA) 2010 Malaysia and in accordance with the seven data protection principles set out in the Act: the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, and the Access Principle.

2 Types of Personal Data Collected

Serubet only collects data that is strictly necessary to provide our services. The following are the categories of data we collect:

2.1 Data You Provide Directly

• Identity Information: Full name, date of birth, identity card number (if requested for verification)
• Contact Information: Malaysian phone number, email address
• Account Information: Username, password (stored as an unreadable hash)
• Financial Information: Details of payment methods used (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX/Maybank2u, CIMB Clicks) — we do not store your full account number
• Verification Information: Copy of identity document if required for the Know Your Customer (KYC) process

2.2 Automatically Collected Data

• Technical Data: IP address, device type, operating system, web browser used
• Activity Data: Game logs, betting history, deposit and withdrawal transaction history
• Location Data: Approximate location based on IP address for security and compliance purposes
• Cookie Data: Session information, user preferences, and analytics data collected via cookies

3 Purpose of Data Collection & Use

Personal data collected by Serubet is used solely for the following purposes:

• Account Management: Creating, verifying, and managing your member account on the Serubet platform
• Transaction Processing: Processing deposits via your chosen Malaysian payment method and withdrawing your winnings in MYR
• Identity Verification (KYC): Compliance with anti-money laundering (AML) and know-your-customer (KYC) legal requirements
• Platform Security: Detecting and preventing fraud, duplicate accounts, and other unlawful activity
• Customer Support: Providing the necessary assistance when you contact the Serubet support team
• Service Communications: Sending important notifications regarding your account, transactions, and platform updates
• Marketing (with consent): Sending information about Serubet promotions, bonuses, and offers — only if you have consented to receive marketing communications
• Platform Improvements: Analysing how the platform is used to continuously improve the user experience
• Legal Compliance: Fulfilling legal obligations including PDPA 2010 and related regulations in Malaysia

Serubet is committed to not using your data for any purpose beyond those stated above without first obtaining your renewed consent.

4 Basis for Data Processing

Serubet processes your personal data on the following legal bases recognised under Malaysia's PDPA 2010:

• Consent: You have given your explicit consent by registering an account and agreeing to this Privacy Policy
• Contractual Requirement: Processing is necessary to fulfil the agreement between you and Serubet (e.g., processing deposits and withdrawals)
• Legal Obligation: Serubet is required under Malaysian law to retain transaction records and verify member identities
• Legitimate Interests: Processing for the purpose of fraud prevention and ensuring platform security constitutes Serubet's legitimate interest and does not override your fundamental rights

5 Data Sharing with Third Parties

Serubet does not sell, rent, or trade your personal data to third parties for commercial purposes. However, in certain limited circumstances, we may share your data with the following parties:

5.1 Payment Service Providers

To process your deposits and withdrawals, the necessary transaction information is shared with licensed payment service providers in Malaysia, including Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow operators, and banks supporting FPX such as Maybank and CIMB. This sharing is limited to the minimum information required to complete each transaction.

5.2 Technology Service Providers

Serubet works with trusted third-party technology service providers for platform operations, including hosting, analytics, and customer support services. All such providers are bound by strict confidentiality agreements and may only use your data for purposes specified by Serubet.

5.3 Legal Authorities

Serubet will disclose your personal data to the relevant authorities in Malaysia if required by law, court order, or a legitimate law enforcement investigation. In such circumstances, we will endeavour to inform you unless doing so is prohibited by law.

6 Data Retention Period

Serubet retains your personal data only for as long as necessary to fulfil the purposes outlined in this Policy or as required by Malaysian law. The following are general data retention guidelines:

• Active Account Data: For as long as your account remains active on the Serubet platform
• Data After Account Closure: At least 7 years after account closure to meet accounting and anti-money laundering legal requirements
• Transaction Records: 7 years as required under Malaysian tax and financial regulations
• Security Logs: 90 days for standard access logs; up to 2 years for logs related to security investigations
• Marketing Data: Until you withdraw your consent

Once the applicable retention period has ended, your data will be securely deleted using methods that ensure it cannot be recovered.

7 Data Security Measures

Serubet implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, or destruction:

7.1 Technical Security

• 256-bit SSL/TLS encryption for all data communication between your device and our servers
• Passwords are stored in hashed form using a strong cryptographic algorithm (bcrypt)
• Enterprise-grade intrusion detection system (IDS) and firewall
• Encrypted data backups performed on a regular basis
• Regular security vulnerability scanning by internal and external security teams
• Two-factor authentication (2FA) is available for all member accounts

7.2 Organisational Security

• Access to members' personal data is restricted solely to staff who require it to perform their duties
• All Serubet staff undergo comprehensive data security training
• Confidentiality agreements are signed by all staff and contractors
• Background checks are conducted on all staff with access to sensitive data

8 Cookies & Tracking Technologies

Platform Serubet uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions correctly. Cookies are small text files stored on your device by your web browser.

8.1 Types of Cookies We Use

8.2 Managing Cookies

You can manage and delete cookies through your web browser settings. Please note, however, that disabling essential cookies may affect core platform functionality. Serubet including the ability to log in to your account.

9 Your Rights under PDPA 2010

As a user in Malaysia, you have the following rights regarding your personal data held by Serubet:

9.1 How to Exercise Your Rights

To exercise any of the above rights, you may:

• Sending an email to support@serubet.bio with the subject line "Privacy Rights Request"
• Contacting the Serubet customer support team via live chat
• Submit a written request to Serubet's official address

Serubet will process your request within 21 business days. In complex cases, this period may be extended to up to 60 days, with notice provided to you.

10 Children's Data

Serubet is a platform designed exclusively for individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18.

If we discover that personal data of a minor has been collected without parental or guardian knowledge and consent, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that your child who is a minor has registered on Serubet, please contact us immediately at support@serubet.bio with the relevant account details.

11 Amendments to This Privacy Policy

Serubet reserves the right to update or amend this Privacy Policy from time to time to reflect changes in law, technology, or our business practices. When material changes are made, we will:

• Updating the "Last Updated" date at the top of this document
• Displays in-platform notifications to all active members
• Sending notification emails to the registered address for significant changes

Continued use of the platform Serubet after the effective date of any amendment indicates your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data.

We encourage you to review this page periodically to stay informed about how we protect your personal data.

12 Contact Our Data Protection Officer

Serubet has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with the PDPA 2010 and this Privacy Policy. If you have any questions, concerns, or complaints regarding your data privacy, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Personal Data Protection Department (PDPD) which is the regulatory body under the Malaysian Ministry of Communications and Digital.