Super Ace Privacy Policy – Data Protection for Malaysian Players

Super Ace Entertainment Ltd ("Super Ace", "we") respects the privacy of every user on our platform at superace-play.com. This Privacy Policy explains in detail how we handle your personal information — from the moment you visit our website through the entire duration of your active membership with Super Ace.

This policy applies to all services provided by Super Ace, including the website, mobile apps (Android and iOS), email, SMS and Live Chat communications. It also applies to all players who register using a Malaysian phone number (+60) and access the platform from any location.

Super Ace is committed to protecting your privacy in line with responsible data protection principles. We recognise that your trust is our most valuable asset — and we take our responsibility to safeguard the information you entrust to us very seriously.

Super ace collects various types of information depending on how you interact with our platform. The table below outlines the main categories of data we collect:

We do not collect sensitive personal information such as biometric data, medical records or ethnic background unless specifically required for legal compliance purposes.

Super Ace collects data through several key channels:

Information You Provide Directly

• Account registration form — name, phone number, email address and password.
• Identity verification process (KYC) — documents such as MyKad or passport.
• Payment method details provided when registering a bank account or eWallet (DuitNow, Touch 'n Go, GrabPay, Boost, ShopeePay).
• Feedback, complaints or requests you submit to the support team.
• Participation in Super Ace surveys, promotional programmes or contests.

Automatically Collected Information

• Server log data: IP address, access time, pages visited and actions performed.
• Device data: phone model, operating system version, unique device identifier.
• Game data: every wager, win, loss, session duration, and game played is automatically recorded for compliance and security purposes.
• Cookies and similar tracking technologies used to enhance the user experience.

Information from Third Parties

• Payment verification providers such as FPX, Maybank2u, or CIMB Clicks may share transaction verification information with us.
• Third-party KYC service providers who assist us in verifying player identities.
• Analytics partners who help us understand platform usage patterns in an aggregated and anonymised form.

Super ace uses the data collected for clearly defined and legitimate purposes. We do not use your data for any purpose not stated in this policy without first obtaining your consent.

• Account Management: To create, verify and manage your player account — including login, account security and profile updates.
• Transaction Processing: To process deposits via DuitNow, Touch 'n Go eWallet, GrabPay, Boost and ShopeePay, as well as withdrawals to your bank account, securely and accurately.
• Legal Compliance (KYC/AML): To fulfil the identity verification and anti-money laundering (AML) requirements mandated by our platform's operating licence.
• Security & Fraud Prevention: To detect and prevent fraudulent activity, multi-account usage, bonus abuse and other security threats.
• Service Improvement: To analyse usage patterns, identify technical issues and improve the overall user experience.
• Service Communications: To send important account-related notifications, transaction confirmations, security updates and policy changes via SMS or email.
• Responsible Gaming: To monitor gameplay patterns and identify players who may benefit from responsible gaming programme support.
• Marketing (with consent): To send relevant promotional information, bonuses and personalised offers — only if you have consented to receive marketing communications.

Super Ace does not sell or rent your personal data to any third party for marketing purposes. However, we may share your data with the following parties in limited and controlled circumstances:

• Technology Service Providers: Game providers such as Pragmatic Play, PG Soft, and Evolution Gaming receive only the minimum data necessary to operate the games (such as player ID and bet value). They are bound by strict confidentiality agreements.
• Payment Processors: FPX providers, partner banks and eWallet vendors receive the transaction information necessary to process your deposits and withdrawals securely.
• KYC Providers: Third-party identity verification providers that assist us in authenticating your identification documents.
• Legal Authorities: We will disclose information where required by law, court order, or direction from a competent authority — including for financial crime investigations or anti-money laundering purposes.
• Professional Advisors: Lawyers, accountants, and auditors bound by strict professional confidentiality obligations, where required for business operations.

Protecting your data is a core technical and organisational priority at Super Ace. We continually invest in our security infrastructure to ensure your information remains safe at all times.

• Data Encryption in Transit: All communications between your browser or app and Super Ace servers are protected by TLS 1.3 with 256-bit SSL encryption — the same standard used by Malaysia's leading banks.
• Stored Data Encryption: Sensitive data such as financial information and KYC documents is stored in encrypted format on secure servers. Passwords are stored using a one-way hashing function that cannot be reversed.
• Layered Access Controls: Only Super Ace staff with a legitimate business need who have passed background checks are permitted to access players' personal data. All access is logged and regularly audited.
• 24/7 Security Monitoring: Our cybersecurity team continuously monitors systems to detect suspicious activity, intrusion attempts and other security threats.
• Regular Security Audits: Penetration testing and security audits are conducted by independent third parties on a regular basis to identify and address any system vulnerabilities.
• Incident Response Plan: super ace has a defined data security incident response procedure in place. In the event of a significant data breach, we will notify affected players within 72 hours.

As a super ace player, you have the following rights regarding your personal data. To exercise any of these rights, contact us at support@superace-play.com.

Super ace uses cookies and similar tracking technologies to enhance your experience on our platform. Below are the types of cookies we use and how you can manage them:

You may manage or disable non-essential cookies through your web browser settings. However, disabling essential cookies may affect platform functionality such as login and session security.

The super ace platform is intended solely for individuals aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we discover that we have collected data from an individual under the age of 18, we will immediately take the following steps:

• Promptly closing the account in question.
• Delete all associated personal data from our systems.
• Returning any funds that may remain in the account through a secure process.

In operating the super ace platform, certain player data may be processed or stored outside Malaysia — for example, at data centres located in Singapore or Hong Kong for redundancy and service continuity purposes.

All international data transfers are carried out with adequate safeguards in place:

• Data is only transferred to jurisdictions or recipients that provide a level of data protection equivalent to the standards we uphold.
• Legally binding data processing agreements are signed with all third-party processors that receive Malaysian players' data.
• Data encryption is maintained throughout the transfer process using industry-recognised security protocols.

Super Ace retains your personal data only for as long as necessary to fulfil the purposes stated in this policy, or as required by law. The following are our data retention guidelines:

• Active Account Data: For as long as your account remains active and you continue using the Super Ace platform.
• Financial Transaction Data: A minimum of 7 years from the transaction date, in line with AML compliance requirements and financial regulations.
• KYC Records: A minimum of 5 years after account closure or the date of the last transaction, whichever is later.
• Communication Logs: Customer support conversation records are retained for 2 years for quality control and compliance purposes.
• Anonymised Analytics Data: Anonymised data may be retained for longer periods for business analytics purposes with no fixed time limit.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised in accordance with industry-standard procedures.

If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal data, please reach out to us through the following channels:

• Privacy Email: support@superace-play.com — send an email with the subject "Privacy Inquiry" for a faster response.
• 24/7 Live Chat: Via the Live Chat icon in your Super Ace account. Our team is available to assist in both Bahasa Malaysia and English.
• FAQ: Review FAQ page us for prompt answers to the most frequently asked questions.

Super Ace is committed to responding to all privacy-related enquiries within 5 business days. For formal data rights requests, the response period is up to 30 calendar days as stated in Section 07.

This Privacy Policy is subject to periodic review and amendment. Any material changes will be communicated to you via in-account notifications and/or your registered email before taking effect. The "Last Updated" date at the top of this page reflects the current applicable version.