arena39 Privacy Policy

1. Who We Are

arena39 operates the online gaming and sports betting platform accessible at https://arena39.lat (the "Platform"). References to "arena39", "we", "us", or "our" throughout this Privacy Policy refer to the company operating this Platform under its internationally recognised gaming licence.

We are committed to protecting the personal data of all users registered with arena39, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Bangsar, and beyond.

2. Data We Collect

When you create an account, use our services, or interact with arena39, we may collect the following categories of personal data:

• Identity Data: Full name, date of birth, national identification number (MyKad or passport number), and a copy of your identity document where required for KYC (Know Your Customer) verification.
• Contact Data: Email address, Malaysian mobile phone number, and residential address (including postcode and state).
• Financial Data: Bank account details, e-wallet identifiers (such as your Touch 'n Go eWallet or Boost account reference), transaction histories, deposit records, and withdrawal records processed via FPX, DuitNow, or other supported payment methods.
• Account Data: Username, password (stored in hashed form), account preferences, bonus eligibility status, and communication preferences.
• Technical Data: IP address, browser type and version, device type and operating system, referring URLs, session duration, and pages visited on the Platform.
• Behavioural Data: Game history, betting patterns, wagering amounts, and platform interaction logs. This data is also used to support responsible gaming monitoring.
• Communications Data: Records of any correspondence you have with our customer support team, including live chat transcripts and email exchanges.

We collect this data directly from you when you register or use our services, automatically through technical tracking tools, and in some cases from third-party identity verification or payment service providers.

3. How We Use Your Data

arena39 uses your personal data for the following purposes:

• Account Management: To create, maintain, and administer your arena39 account, and to verify your identity as required under applicable gaming regulations.
• Transaction Processing: To process deposits and withdrawals via FPX, DuitNow, Maybank2u, CIMB Clicks, Public Bank, Touch 'n Go eWallet, Boost, and GrabPay.
• Regulatory Compliance: To fulfil our obligations under anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) requirements imposed by our gaming licence conditions.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance in English, Bahasa Melayu, and Chinese.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and other illegal or prohibited conduct.
• Responsible Gaming: To monitor gaming behaviour and identify users who may be showing signs of problem gambling, and to enforce self-exclusion or deposit limit arrangements where applicable.
• Platform Improvement: To analyse usage patterns and technical performance data so that we can improve the arena39 platform, fix bugs, and develop new features.
• Marketing Communications: With your explicit consent, to send you information about promotions, bonuses, and new features available on arena39. You may withdraw this consent at any time via your account settings.
• Legal Proceedings: To establish, exercise, or defend legal claims where necessary.

4. Legal Basis for Processing

Where data protection law requires us to identify a legal basis for processing your personal data, we rely on the following grounds:

• Contractual Necessity: Processing required to perform our contract with you — for example, operating your account and processing financial transactions.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/CTF obligations and gaming licence requirements.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and freedoms.
• Consent: Where you have given us clear, explicit consent to process your data for a specific purpose (such as receiving marketing emails), we rely on that consent. You can withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

arena39 does not sell or rent your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Service Providers: Banks and payment processors (including FPX gateway operators, DuitNow, and licensed e-wallet providers) as necessary to complete financial transactions.
• Identity Verification Services: Third-party KYC and AML screening providers used to verify your identity and comply with our regulatory obligations.
• Technology & Hosting Partners: Cloud infrastructure and software service providers who host and support the arena39 platform. These parties process data on our behalf under strict data processing agreements.
• Regulatory Authorities: Gaming regulators, financial intelligence units, law enforcement agencies, and courts where we are legally required to disclose information.
• Professional Advisers: Lawyers, auditors, and other professional advisers where necessary to obtain legal or financial advice in connection with our business operations.

6. Cookies & Tracking Technologies

arena39 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help us recognise you, maintain your session, and understand how you use our services.

We use the following types of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. They enable core features such as user authentication, session management, and security checks. These cannot be disabled.
• Functional Cookies: Used to remember your preferences (such as preferred language or currency display) and personalise your experience on arena39.
• Analytics Cookies: Help us understand how users navigate the Platform — which pages are most visited, where users drop off, and how performance can be improved. This data is aggregated and does not identify you individually.
• Security Cookies: Used to detect and prevent fraudulent activity and to support our responsible gaming monitoring systems.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. arena39 does not use third-party advertising or behavioural tracking cookies.

7. Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy, or as required by applicable law. In practice, this means:

• Account and identity data is retained for a minimum of five (5) years after account closure, in accordance with AML/CTF record-keeping requirements under our gaming licence.
• Transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications are retained for two (2) years from the date of the interaction.
• Technical and analytical data (such as log files) is retained for up to twelve (12) months.
• Marketing consent records are retained until you withdraw consent, plus an additional period as required to demonstrate our compliance with consent obligations.

When your data is no longer required, we will securely delete or anonymise it in accordance with our internal data destruction procedures.

8. Your Rights

Subject to applicable law, you have the following rights in relation to the personal data arena39 holds about you:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct inaccurate or incomplete personal data.
• Right to Erasure: You may request that we delete your personal data in certain circumstances, subject to our legal obligations to retain records.
• Right to Restriction: You may ask us to restrict processing of your data in certain circumstances — for example, while a dispute about accuracy is resolved.
• Right to Data Portability: Where technically feasible and legally applicable, you may request a machine-readable copy of the personal data you have provided to us.
• Right to Object: You may object to processing based on our legitimate interests, and you may withdraw consent for marketing communications at any time.
• Rights Related to Automated Decision-Making: If any significant decisions about your account are made solely by automated means, you have the right to request human review of that decision.

To exercise any of these rights, please contact our support team via live chat on the Platform or by email at [email protected]. We aim to respond to all valid requests within 30 days. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for it.

9. Security Measures

arena39 implements a range of technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers
• Encryption of sensitive data at rest, including financial details and identity documents
• Strict role-based access controls limiting staff access to personal data on a need-to-know basis
• Regular penetration testing and security audits of our Platform infrastructure
• Multi-factor authentication requirements for administrative system access
• Continuous monitoring for suspicious activity and automated alerting systems
• Staff training on data protection obligations and information security best practices

While we take every reasonable precaution, no online platform can guarantee absolute security. We encourage you to use a strong, unique password for your arena39 account and to enable any two-factor authentication options available in your account settings.

10. International Data Transfers

arena39 operates under an internationally recognised gaming licence and may use cloud infrastructure and service providers located outside Malaysia. Where your personal data is transferred to a country that does not provide the same level of data protection as your home jurisdiction, we ensure appropriate safeguards are in place — such as standard contractual clauses or equivalent mechanisms — to protect your information during and after the transfer.

By using the arena39 Platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia. We remain committed to ensuring that any such transfers are carried out lawfully and with adequate protections in place.

11. Minors & Age Verification

The arena39 Platform is strictly for adults. You must be 21 years of age or older to register an account and access any gaming services. We take this obligation seriously and implement the following safeguards:

• All users must confirm their age during the registration process.
• We conduct identity verification (KYC) checks that include date-of-birth confirmation against a government-issued identity document.
• Accounts found to belong to persons under 21 will be immediately suspended, all funds returned (net of any bonuses claimed), and the matter reported to the relevant authorities where required by law.
• If you become aware that a minor has registered on arena39, please contact us immediately at [email protected].

We do not knowingly collect or process personal data belonging to persons under the age of 21.

12. Changes to This Privacy Policy

arena39 reserves the right to update or amend this Privacy Policy from time to time, for example to reflect changes in applicable law, our business practices, or the services we offer. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Display a notice on the Platform alerting registered users to the update
• Where required by law, seek fresh consent from you before the new terms take effect

We encourage you to review this Privacy Policy periodically. Your continued use of the arena39 Platform after any changes are published constitutes your acceptance of the updated terms, to the extent permitted by applicable law.

13. Contact Us

If you have any questions, concerns, or complaints about how arena39 handles your personal data, or if you wish to exercise any of your data protection rights, please get in touch with our Privacy & Compliance team:

• Email: [email protected]
• Live Chat: Available 24/7 directly on the arena39 Platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and provide a full response within 30 days.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection or gaming regulatory authority in the jurisdiction applicable to your circumstances.