RSM3 Privacy Policy – Personal Data Protection for Malaysian Members

1. Introduction – RSM3's Commitment to Your Privacy

RSM3 (rsm3.click) is an online sports betting and casino platform operating for players in Malaysia. We understand that your trust in us depends not only on the quality of our services and payout speed, but also on how responsibly and transparently we handle your personal information.

This Privacy Policy has been prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and sets out in detail the privacy practices of RSM3. It covers every aspect of your personal data lifecycle — from the moment you complete the registration form to when that data is deleted from our systems. We believe full transparency is the best way to build lasting trust with our members.

This Privacy Policy applies to all registered RSM3 members, visitors to rsm3.click, and any individual who interacts with the RSM3 platform, support services, or marketing communications. By using the RSM3 platform, you agree to the terms of this Privacy Policy.

2. Types of Personal Data We Collect

RSM3 only collects personal data necessary for its stated purposes and does not collect data beyond what is required for the platform's operations. The following are the categories of data we collect:

3. Purpose of Data Collection and Processing

Rsm3 collects and processes your personal data for legitimate and specific purposes only. We do not use your data for any purpose beyond those stated below without first obtaining your consent:

• Account Management: Creates, verifies, and maintains your RSM3 account, including secure login and password recovery processes.
• Identity and Age Verification: Ensures all RSM3 members meet the minimum age requirement of 18 and verifies each member's true identity as required under Malaysian law.
• Financial Transaction Processing: Processing deposits via DuitNow, FPX (Maybank2u and CIMB Clicks), Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, as well as managing withdrawal of winnings to members' bank accounts or digital wallets.
• Legal Compliance: Meeting reporting requirements under anti-money laundering (AML) laws, PDPA data protection legislation, and directives from relevant regulatory bodies.
• Fraud Prevention and Security: Identifying and preventing fraudulent activity, multi-account usage, money laundering, and other security threats to the RSM3 platform and its members.
• Service Improvement: We analyze aggregated usage patterns (without identifying any individual) to improve the platform interface, enhance speed and reliability, and develop new features that are relevant to Malaysian players.
• Customer Support: Providing effective member support via live chat, email, and WhatsApp in Bahasa Melayu.
• Marketing Communications: Sending information about RSM3 promotions, bonuses, and new offers — but only to members who have given consent to receive such communications.
• Responsible Betting: Monitors betting patterns to identify members who may need responsible gambling support and provides appropriate self-management tools.

4. Legal Basis for Data Processing

Under Malaysia's Personal Data Protection Act 2010 (PDPA), RSM3 processes your personal data on valid legal grounds. Depending on the purpose of processing, the applicable basis is:

• Consent: When you register an RSM3 account and agree to this Privacy Policy, you give consent for the processing of your data for the general purposes stated. You may withdraw consent for marketing communications at any time without affecting your right to continue using the platform.
• Contract Performance: Data processing required to fulfil rsm3's contractual obligations to you — such as processing deposits, settling bets, and paying out winnings — is carried out on the basis of contractual necessity.
• Legitimate Interests: RSM3 processes certain technical data (such as IP address logs and platform activity) on the basis of legitimate interests for security and fraud prevention purposes, which serve the legitimate interests of both RSM3 and its members.
• Legal Obligation: Data processing for AML compliance purposes, mandatory identity verification, and reporting to authorities is based on legal obligations that cannot be opted out of.

5. Data Sharing with Third Parties

RSM3 does not sell, rent, or trade members' personal data to any third party for marketing or commercial purposes. This is an absolute commitment by RSM3 that will not be compromised.

However, under limited and specific circumstances, rsm3 may share personal data with the following parties:

• Payment Service Providers: DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay providers receive the information required to process your financial transactions. This processing is limited strictly to the data necessary for each specific transaction.
• Technical Service Providers: rsm3 uses technical infrastructure services from trusted third-party providers — such as secure cloud hosting services. All such providers are bound by strict data protection agreements and are not permitted to use your data for their own purposes.
• Legal Authorities: RSM3 will disclose personal data to the police, courts, financial regulatory bodies, or other Malaysian government agencies when required by law or a valid court order. RSM3 will not make such disclosures voluntarily beyond what is legally required.
• Identity Verification Providers: To meet KYC (Know Your Customer) and AML requirements, RSM3 may engage licensed third-party identity verification services. These services receive only the data necessary for verification and are bound by strict confidentiality agreements.

All data transfers to third parties are carried out with appropriate technical and contractual controls to ensure your data is protected in accordance with the standards set out in Malaysia's PDPA. rsm3 conducts regular reviews of all third-party vendors to ensure ongoing compliance with data protection requirements.

6. Security Measures and Data Protection

RSM3 implements comprehensive technical and organisational security standards to protect members' personal data from unauthorised access, disclosure, alteration, or destruction. Key measures we have in place include:

• 256-bit SSL Encryption: All communications between your browser and RSM3's servers are protected by Transport Layer Security (TLS) encryption using 256-bit keys — the same standard used by Malaysia's leading banking institutions such as Maybank and CIMB.
• Network Segregation: Member personal data is stored in a database environment that is isolated from public infrastructure, protected by firewalls and layered access controls.
• Internal Access Controls: Only RSM3 staff who require data access to perform their duties are permitted to access members' personal data, and only to the extent necessary for those duties. All internal access is logged and monitored.
• Two-Factor Authentication: RSM3 accounts are secured with two-factor authentication (2FA) via SMS OTP to prevent unauthorised access even if a password is compromised.
• 24/7 Monitoring: rsm3's security team continuously monitors platform activity to swiftly identify and respond to any security threats or breaches.
• Regular Security Audits: RSM3 conducts regular penetration testing and security audits by independent third parties to identify and address vulnerabilities before they can be exploited.
• Secure Data Backup: Member data is regularly backed up to a separate secure location to ensure service continuity and data protection in the event of an unexpected system disruption.

While RSM3 implements comprehensive security measures, no system is entirely immune to cyber threats. You also play an important role in protecting your account — keep your password confidential, avoid reusing it across other accounts, and contact support@rsm3.click immediately if you suspect any unauthorised access to your account.

7. Use of Cookies and Tracking Technologies

Rsm3 uses cookies and similar tracking technologies to enhance the user experience, maintain login session security, and analyse platform usage patterns. The following are the types of cookies we use:

• Essential Cookies: These cookies are required for core RSM3 platform functions such as login authentication, session management, and security. Without them, the RSM3 platform cannot operate properly. Essential cookies do not require your consent and cannot be disabled.
• Performance Cookies: We use analytics cookies to understand how members use the RSM3 platform — which pages are visited most frequently, average session duration, and where users encounter difficulties. All data is collected in aggregate and without identifying any individual. These cookies help RSM3 improve the platform based on real usage data.
• Functional Cookies: These cookies store your preferences — such as display language, odds display settings, and your favourite sports market preferences — so you do not have to reconfigure them each time you log in.
• Security Cookies: RSM3 uses dedicated security cookies to detect unusual login activity, identify access attempts from new locations, and support our anti-fraud verification systems.

You can manage or disable cookies through your web browser settings. Please note that disabling essential cookies will affect the functionality of the RSM3 platform and may prevent you from logging in or completing transactions. RSM3 does not use third-party cookies for advertising or marketing purposes without your explicit consent.

8. Data Retention and Deletion

RSM3 does not retain personal data longer than is necessary for the stated purpose or as required under Malaysian law. RSM3's data retention policy is as follows:

• Active Account Data: Personal data of members with active accounts is retained for the duration of the active account and for a reasonable period following account closure.
• Financial Transaction Records: Under Malaysia's AML legal requirements, financial transaction records must be retained for a minimum of 7 years after the transaction date. This is a legal obligation that cannot be waived even upon account closure.
• KYC and Identity Verification Data: Identity verification documents (such as copies of MyKad) are retained for a minimum of 5 years as required under Malaysia's AML regulations.
• Support Communication Data: Customer support conversation records are retained for 2 years for quality control purposes and to resolve any disputes that may arise.
• Technical Data and Logs: System logs and technical data are retained for 90 days for security and troubleshooting purposes, after which they are automatically deleted or anonymised.

Once the retention period has expired and there is no legal requirement to continue storing the data, RSM3 will securely delete or anonymise your personal data using methods that ensure it cannot be recovered. If you would like to know how long specific data about you is retained, please contact us at support@rsm3.click.

9. Your Rights as an RSM3 Member Under PDPA

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding personal data held by RSM3:

To exercise any of the rights above, send an email to support@rsm3.click with the subject line "Privacy Rights Request" and state the type of request, your full name, and your registered phone number. RSM3 may require additional identity verification before processing your request in order to protect your data security.

10. Children's Data Protection

RSM3 strictly prohibits the use of its platform by individuals under the age of 18. The RSM3 platform is not designed for children, and we do not knowingly collect personal data from minors.

RSM3 conducts an age verification process at registration to ensure that only individuals aged 18 and above can create an account. If RSM3 discovers that a child's personal data has been collected without our knowledge — for example, as a result of age misrepresentation during registration — we will immediately take the following steps:

• Suspending the associated account immediately.
• Delete all such children's personal data from our systems as promptly as possible.
• Cancels all related bets and winnings.
• Reporting the incident to the relevant authorities where appropriate.

If you know or suspect that a minor has registered an rsm3 account, please contact us immediately at support@rsm3.click so that prompt action can be taken.

11. Amendments to the Privacy Policy

Rsm3 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or technological developments. When material amendments are made, rsm3 will:

• Updating the "Last Updated" date at the top of this Privacy Policy page.
• Displaying a clear notice on the RSM3 platform homepage regarding changes taking effect.
• For significant amendments that materially affect members' privacy rights, RSM3 will send a notification via email or SMS to affected members before the changes come into effect.

It is your responsibility to review this Privacy Policy periodically. Continued use of the RSM3 platform following any amendments will be deemed acceptance of the latest version of this Privacy Policy. If you do not agree with the changes made, please discontinue use of the platform and contact us to request account closure.

12. How to Contact Us on Privacy Matters

If you have any questions, concerns, or complaints regarding this Privacy Policy or how rsm3 handles your personal data, please reach out to us through the following channels:

• Email: support@rsm3.click (with the email subject: "Privacy Policy Enquiry")
• Live Chat: Available 24 hours a day, 7 days a week through the RSM3 platform in Bahasa Melayu
• WhatsApp: Via the official RSM3 support number listed on the platform

RSM3 is committed to responding to all privacy-related enquiries within 5 business days. For more complex cases that require in-depth investigation, we will keep you updated on progress within the stipulated timeframe. The RSM3 data protection team is always on hand to help you understand your rights and how we safeguard your privacy as a valued member.