spade54 Privacy Policy

1. Introduction

spade54 is committed to protecting the privacy and security of personal data belonging to our players. This Policy is published in accordance with our obligations under our international gaming licence and applicable data protection standards. We take a privacy-by-design approach: personal data collection is limited to what is genuinely necessary, retention is time-bounded, and security measures are applied from the point of collection through to disposal.

This Policy applies to all personal data collected through the spade54 Platform, including registration, KYC verification, transactions, gameplay, customer support interactions, and communications. It does not apply to third-party platforms, payment processors, or linked services that operate under their own privacy policies.

2. Data Controller

spade54 is the data controller responsible for personal data processed through the Platform. As data controller, spade54 determines the purposes and means of processing your personal data. Contact details for data-related enquiries are provided in Section 15 of this Policy.

3. Data We Collect

3.1 Registration Data

When you create a spade54 account, we collect your chosen username, email address, date of birth, country of residence, and chosen password (stored in hashed, non-reversible form). This data is required to establish and maintain your account.

3.2 Identity Verification (KYC) Data

Before your first withdrawal, spade54 is required by its licensing framework to verify your identity. KYC data collected may include: full legal name, residential address, government-issued identity document (e.g., MyKad, passport), and proof of address documentation. Biometric verification may be required where a third-party KYC provider conducts liveness checks. KYC documents are retained in encrypted storage for the duration required by our licensing obligations.

3.3 Financial Data

spade54 collects transaction records for all deposits and withdrawals, including payment method type, transaction reference, amount, currency, and timestamp. We do not store full card numbers or full bank account numbers — these are handled by our licensed payment processors, who operate under their own PCI-DSS and data security obligations.

3.4 Gameplay Data

We collect records of all gaming activity on your account, including game type, wager amounts, outcomes, session duration, and betting history. This data is used for account management, dispute resolution, responsible gaming monitoring, and regulatory compliance.

3.5 Technical and Device Data

When you access the spade54 Platform, we automatically collect IP address, browser type and version, operating system, device type, referral URL, pages visited, session timestamps, and click-stream data. This data is used for security monitoring, fraud detection, and platform performance optimisation.

3.6 Customer Support Data

Communications you initiate with spade54's support team via live chat or email are recorded and retained for quality assurance, dispute resolution, and training purposes.

3.7 Marketing Preferences

Where you have opted in to receive promotional communications from spade54, we retain your marketing preference settings and communication history. You may withdraw consent to marketing communications at any time by updating your account notification settings or by contacting support.

4. How We Use Your Data

spade54 uses personal data for the following purposes:

Purpose	Data Used
Account creation and management	Registration data, device data
Identity and age verification (KYC)	KYC documents, registration data
Processing deposits and withdrawals	Financial data, KYC data
Fraud prevention and security monitoring	Device data, financial data, gameplay data
Responsible gaming monitoring	Gameplay data, financial data
Customer support and dispute resolution	Support communications, gameplay data
Regulatory compliance and licensing obligations	All categories as required
Platform improvement and analytics	Technical data (aggregated and anonymised where possible)
Promotional communications (opt-in only)	Email address, marketing preferences

5. Legal Bases for Processing

spade54 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between spade54 and the Player, including account operation, payment processing, and support.
• Legal obligation: Processing required to comply with spade54's obligations under its international gaming licence, including KYC, AML compliance, and regulatory reporting.
• Legitimate interests: Processing for fraud prevention, security monitoring, and platform improvement, where those interests are not overridden by the Player's privacy rights.
• Consent: Processing for marketing communications, where you have provided explicit opt-in consent. Consent can be withdrawn at any time without affecting other processing.

6. Data Sharing

6.1 Service Providers

spade54 shares personal data with third-party service providers who process data on our behalf under data processing agreements. Categories of service providers include: payment processors, KYC verification providers, cloud hosting and infrastructure providers, fraud detection and cybersecurity services, and customer support platform providers. All service providers are contractually required to process data only as instructed by spade54 and to apply appropriate security measures.

6.2 Licensing and Regulatory Authorities

spade54 may be required to disclose player data to its licensing authority or other regulatory bodies in response to lawful requests or as part of routine regulatory reporting obligations. Such disclosures are made strictly to the extent required by applicable licensing and regulatory requirements.

6.3 Fraud Prevention and Law Enforcement

spade54 may share data with fraud prevention agencies, financial intelligence units, or law enforcement authorities where required to investigate or prevent fraud, money laundering, or other criminal activity. Disclosure to law enforcement is made only in response to lawful legal process or where spade54 believes disclosure is necessary to prevent serious harm.

6.4 No Sale of Personal Data

spade54 does not sell, rent, or trade personal data to third parties for commercial purposes. We do not share personal data with advertising networks for targeted advertising on third-party platforms.

7. International Data Transfers

As an internationally licensed platform, spade54 may transfer personal data to third-party service providers located outside Malaysia. Where data is transferred internationally, spade54 takes steps to ensure that appropriate safeguards are in place, including contractual obligations on receiving parties that meet applicable data protection standards. By using the spade54 Platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia.

8. Data Retention

spade54 retains personal data for the following periods:

• Account and registration data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, in accordance with spade54's licensing retention obligations.
• KYC documentation: Retained for a minimum of five (5) years from the date of collection, or longer where required by applicable licensing regulations.
• Transaction records: Retained for five (5) years from the date of transaction.
• Gameplay records: Retained for five (5) years from the date of the relevant gaming session.
• Support communications: Retained for two (2) years from the date of the last communication in a support thread, unless the content is required for an ongoing dispute or legal matter.
• Marketing data: Retained until withdrawal of consent, then deleted within 30 days.
• Technical/device data: Retained for twelve (12) months for security and fraud monitoring purposes, then aggregated or deleted.

Where retention beyond the above periods is required by law, regulatory obligation, or ongoing legal proceedings, spade54 will retain the relevant data until the applicable obligation is discharged.

9. Security Measures

spade54 implements the following technical and organisational security measures to protect personal data:

• 256-bit SSL/TLS encryption for all data in transit between the Platform and Players;
• Encryption at rest for sensitive stored data, including KYC documents and financial records;
• Role-based access controls limiting internal access to personal data to staff with a legitimate operational need;
• Two-factor authentication for internal system access by spade54 personnel;
• Regular security audits and penetration testing conducted by third-party security specialists;
• Automated anomaly detection systems monitoring for unusual access patterns or potential data breaches;
• Incident response procedures that include notification obligations in the event of a material data breach.

No security system is completely infallible. In the event of a data breach that materially affects Player data, spade54 will notify affected Players and relevant authorities in accordance with our licensing obligations and applicable data protection requirements.

10. Cookies and Tracking Technologies

10.1 Strictly Necessary Cookies

spade54 uses cookies that are essential for the Platform to function — specifically, session cookies that maintain your logged-in state and security tokens that protect your session from cross-site request forgery attacks. These cookies cannot be disabled without preventing the Platform from functioning correctly.

10.2 Analytics Cookies

With your consent, spade54 uses analytics cookies to understand aggregate usage patterns — which pages are visited most, where users encounter friction, and how the Platform performs across different devices and browsers. Analytics data is aggregated and does not identify individual Players. You may decline analytics cookies by adjusting your browser settings or cookie preferences on the Platform.

10.3 No Third-Party Advertising Cookies

spade54 does not use third-party advertising or retargeting cookies that track your activity across other websites. Our cookie use is limited to what is necessary for Platform operation and internal analytics.

11. Your Rights

Subject to applicable law and spade54's legal retention obligations, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data spade54 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to spade54's legal retention obligations.
• Right to restriction of processing: You may request that spade54 restrict processing of your data in certain circumstances, such as where you contest the accuracy of data being processed.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact spade54 via live chat or email as detailed in Section 15. spade54 will respond to verifiable requests within 30 days. Where a request is complex or where spade54 receives multiple requests simultaneously, the response period may be extended by a further 60 days, with notice provided to the requester.

12. Children and Minors

The spade54 Platform is strictly restricted to individuals aged 21 and above. spade54 does not knowingly collect personal data from individuals under the age of 21. Where spade54 identifies or is informed that personal data has been collected from a minor, that data will be deleted immediately and the associated account will be permanently closed. If you have reason to believe that a minor has registered on the spade54 Platform, please notify us immediately via the contact details in Section 15.

13. Third-Party Links

The spade54 Platform may contain references to third-party payment providers and licensing bodies. Where any third-party service is accessed in connection with your use of spade54, that service operates under its own privacy policy. spade54 is not responsible for the privacy practices of third-party services and encourages Players to review the privacy policies of any third-party service they interact with.

14. Changes to This Policy

spade54 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform functionality. Material changes will be communicated to registered Players via email or a prominent notice on the Platform, with a minimum of 14 days' notice before the updated Policy takes effect for existing accounts. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

15. Contact and Complaints

For privacy-related enquiries, data subject requests, or complaints regarding spade54's data processing practices, please contact us via:

• Live Chat: Available 24/7 on the spade54 Platform.
• Email: [email protected] — please include "Privacy Request" in the subject line.

If you are unsatisfied with spade54's response to a privacy complaint, you may escalate the matter to the relevant supervisory authority under spade54's international gaming licence. Details of the supervisory authority are available on request from the spade54 support team.