Privacy Policy
scrplay3 Platform

This Privacy Policy ("Policy") describes how scrplay3 ("scrplay3", "we", "us", "our"), operator of the online gaming platform accessible at scrplay3.cam, processes the personal data of its registered players and website visitors ("you", "your", "Data Subject").

scrplay3 is committed to handling personal data responsibly and in accordance with internationally recognised data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability. This Policy applies to all personal data collected through the scrplay3 website, mobile platform, support channels, and any associated applications or services.

By registering an account with scrplay3, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not register an account or continue using the Platform.

• "Personal Data" means any information that identifies or could reasonably identify a living individual, including names, email addresses, payment details, IP addresses, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means scrplay3, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of scrplay3 under a written data processing agreement.
• "KYC" (Know Your Customer) refers to mandatory identity and eligibility verification procedures performed prior to or during account activation.
• "Cookies" means small text files placed on your device by the scrplay3 Platform to support functionality, analytics, and session management.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

scrplay3 may collect and hold the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Identity and Contact Data

• Full legal name, date of birth, and nationality
• Email address and, where provided, a secondary contact number
• Residential address (city, postcode, country — e.g., Kuala Lumpur, Petaling Jaya, Johor Bahru, Penang, Shah Alam)
• Government-issued identification document number (for KYC purposes)

3.2 Financial and Payment Data

• Bank account details, eWallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow), and FPX references associated with deposit and withdrawal transactions
• Transaction histories, deposit amounts in MYR, withdrawal records, and bonus redemption activity
• Source-of-funds documentation provided during enhanced due-diligence reviews

3.3 Technical and Usage Data

• IP address, browser type and version, operating system, device type, and screen resolution
• Session timestamps, pages visited, game titles accessed, and wager histories
• Referring URL and onward navigation paths within the Platform

3.4 Communications Data

• Content of live-chat transcripts, email exchanges, and support tickets submitted to scrplay3
• Preferences and opt-in status for promotional communications

3.5 Responsible Gambling Data

• Self-imposed deposit limits, session timer settings, cooling-off periods, and self-exclusion status
• Any disclosures made voluntarily to scrplay3 regarding gambling behaviour or vulnerability

scrplay3 collects personal data through the following channels:

• Direct submission: Information you provide when completing the registration form, undergoing KYC verification, making a deposit or withdrawal request, or contacting support.
• Automated technical collection: Data gathered automatically via cookies, server logs, analytics tools, and fraud-detection systems when you access the Platform.
• Third-party payment processors: Transaction confirmation data and payment verification outcomes transmitted by payment service providers including Malaysian bank gateways and eWallet operators.
• Identity verification services: Results of identity and document checks performed by third-party KYC and AML compliance providers retained by scrplay3.
• Public and regulatory sources: Sanctions screening databases, politically exposed persons (PEP) lists, and publicly available adverse-media sources accessed as part of our compliance obligations.

All personal data collected by scrplay3 is processed within secure, access-controlled environments. Access to personal data is restricted to authorised personnel who require it to fulfil their job functions. All staff with access to personal data are subject to contractual confidentiality obligations.

6.1 Automated Decision-Making

scrplay3 employs automated systems to assist with fraud detection, transaction monitoring, and responsible gambling risk assessments. Where an automated process results in a decision that materially affects your account — such as a temporary withdrawal hold or an account access restriction — you have the right to request human review of that decision by contacting [email protected] (plain text, not a clickable link).

6.2 Profiling

Aggregated and anonymised usage data may be used to improve the Platform, personalise game recommendations, and tailor promotional offers to player preferences. This profiling is based on your Platform activity and does not involve the sale or onward transfer of identifiable profiles to third parties.

scrplay3 uses cookies and similar tracking technologies to maintain session integrity, detect fraud, analyse Platform usage, and deliver a personalised experience. The following categories of cookies may be set when you visit or use scrplay3:

• Strictly Necessary Cookies: Essential to the operation of the Platform — e.g., session tokens, authentication cookies, and security identifiers. These cannot be disabled without affecting core functionality.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate the Platform, which pages they visit, and how long they spend on each section. Used to improve Platform performance and content relevance.
• Functional Cookies: Remember your preferences such as language selection, notification settings, and responsible gambling tool configurations.
• Marketing Cookies: Only set where you have provided explicit consent. Used to measure the effectiveness of promotional campaigns and, where applicable, to deliver relevant offers.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the scrplay3 Platform and may prevent account login.

scrplay3 does not sell personal data. We may share your information with third parties only in the following defined circumstances, and only to the minimum extent necessary for the stated purpose:

• Payment service providers: Malaysian bank gateways (Maybank, CIMB, Public Bank, Hong Leong), FPX, DuitNow, and eWallet operators (Touch 'n Go eWallet, Boost, GrabPay) as required to process deposits and withdrawals.
• KYC and AML compliance providers: Third-party identity verification and sanctions-screening services engaged to fulfil our compliance obligations.
• Technology and hosting providers: Cloud infrastructure, database, and security service providers operating under binding data-processing agreements with scrplay3.
• Legal and regulatory authorities: Where required by applicable law, a valid court order, regulatory direction, or investigation by a competent authority.
• Professional advisers: Lawyers, auditors, and insurers operating under professional confidentiality obligations, where necessary for corporate governance or legal defence.

scrplay3 operates within an international regulatory framework and may transfer personal data to data processors located outside of Malaysia. Where such transfers occur, scrplay3 ensures that appropriate safeguards are in place, including contractual data-processing agreements that impose equivalent data-protection standards to those applied within the Platform's primary jurisdiction.

If you are a Malaysian national or resident, you acknowledge that your personal data may be processed in jurisdictions that do not provide data-protection laws identical to those in Malaysia. In all cases, scrplay3 applies the principles set out in this Policy to protect your data regardless of where it is processed.

scrplay3 retains personal data only for as long as it is required to fulfil the purposes described in this Policy, comply with legal and regulatory obligations, and resolve disputes or enforce agreements. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five years following permanent account closure, to satisfy AML and regulatory record-keeping obligations.
• Transaction records: Retained for a minimum of five years from the date of each transaction, in compliance with applicable financial record-keeping requirements.
• Support communications: Retained for up to three years from the date of the last interaction, or longer where required in connection with an open dispute or legal matter.
• Analytics and usage data: Retained in aggregated or anonymised form indefinitely for Platform improvement purposes; identifiable usage data is retained for up to 24 months from collection.
• Self-exclusion records: Retained for the full duration of the exclusion period and for a minimum of five years thereafter to prevent re-registration.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised unless a longer retention period is required by a specific legal obligation.

Subject to applicable law and certain exceptions (such as where processing is required to comply with a legal obligation), you have the following rights with respect to your personal data:

1. Right of Access: You may request confirmation of whether scrplay3 holds personal data about you and obtain a copy of that data.
2. Right to Rectification: You may request correction of inaccurate or incomplete personal data held about you.
3. Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and no overriding legal retention obligation applies.
4. Right to Restriction: You may request that processing of your personal data be restricted in certain circumstances — for example, while the accuracy of the data is being contested.
5. Right to Data Portability: Where processing is based on your consent or contract performance, you may request that your personal data be provided to you in a structured, machine-readable format.
6. Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes. Where you object to marketing processing, we will cease that processing immediately.
7. Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the rights listed above, submit a written request to [email protected] (plain text address — not a clickable link). scrplay3 will acknowledge your request within five business days and aim to fulfil it within 30 calendar days. We may request verification of your identity before processing your request.

scrplay3 applies a layered security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your device and our servers
• Encryption at rest for stored personal data and financial records
• Role-based access controls limiting data access to authorised personnel only
• Two-factor authentication (2FA) options for player accounts
• Continuous system monitoring, intrusion detection, and automated alerting
• Regular penetration testing and independent security audits
• Formal data breach response procedures with defined notification timelines

scrplay3 is strictly an adults-only platform. Registration and gameplay are prohibited for any person under the age of 21 years. scrplay3 does not knowingly collect personal data from individuals under 21 years of age.

If scrplay3 becomes aware that personal data has been collected from a person under the age of 21, that account will be suspended immediately and all associated personal data will be permanently deleted. Any deposited funds will be returned via the original payment method following verification of the account holder's identity.

If you believe that a minor has registered an account with scrplay3, please notify us immediately at [email protected] (plain text — not a clickable link).

scrplay3 reserves the right to amend this Privacy Policy at any time to reflect changes in our data-processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via a prominent notice on the Platform or by email to the registered address no fewer than seven calendar days before the revised Policy takes effect, except where an immediate update is required by law.

The effective date at the top of this Policy will be updated with each revision. Continued use of the scrplay3 Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the changes, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

For any questions, requests, or complaints relating to this Privacy Policy or the processing of your personal data, please contact the scrplay3 data team through the following channels. All details below are presented as plain text — no clickable email links are provided:

• Data Enquiries Email: [email protected]
• Live Chat: Available 24/7 via the scrplay3 Platform — average response 3–5 minutes
• Support Languages: English, Bahasa Melayu, and Mandarin
• Response Timeline: Acknowledgement within 5 business days; full response within 30 calendar days for subject access requests