Privacy Policy — cowboy38

cowboy38 ("we", "us", "our", "the Company", "the Platform") operates the online casino and sports betting service accessible at https://cowboy38.cam. We are committed to protecting the privacy and personal data of all registered players, prospective users, and visitors to our platform, including those based across Malaysia in cities such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam.

This Privacy Policy ("Policy") describes how cowboy38 collects, uses, discloses, and safeguards personal information in connection with the operation of our platform. It applies to all personal data processed by us in relation to account registration, KYC verification, financial transactions, customer support interactions, and platform usage analytics.

By registering an account on cowboy38 or continuing to use our platform after this Policy has been made available to you, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the platform immediately.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, storage, use, disclosure, transfer, and erasure.
• "Data Subject" means the individual to whom Personal Data relates — in the context of cowboy38, this refers to registered players, applicants, and visitors to the platform.
• "Data Controller" means cowboy38, which determines the purposes and means of processing Personal Data.
• "Third Party" means any person or entity other than the Data Subject and cowboy38, including technology service providers, payment processors, and regulatory authorities.
• "KYC" means Know Your Customer — the identity verification process required by regulatory and anti-money laundering compliance obligations.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their Personal Data.

cowboy38 collects personal data from you directly (when you register, deposit, contact support, or use the platform) and indirectly (through automated technical means during your use of the platform). The categories of personal data we collect include the following:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for age verification — cowboy38 is a 21+ platform).
• Email address and contact telephone number.
• Username and hashed account password.
• Residential address including city, state, and postcode.

3.2 KYC & Verification Data

• Copies of government-issued identity documents (e.g., MyKad, passport).
• Proof of address documentation (e.g., utility bill, bank statement).
• Selfie or liveness verification image where required for enhanced due diligence.
• Source of funds documentation in cases where AML compliance requires it.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers.
• Payment method details as required for transaction processing (e.g., Maybank, CIMB, Public Bank, Hong Leong Bank account reference numbers; Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX identifiers; cryptocurrency wallet addresses for BTC and USDT transactions).
• Wagering history, game session records, and bonus transaction logs.

3.4 Technical & Usage Data

• IP address, device type, operating system, and browser version.
• Platform access timestamps and session duration data.
• Pages visited, features accessed, and interaction logs for platform analytics and security monitoring.
• Cookie and tracking data as described in Section 7 of this Policy.

3.5 Communications Data

• Correspondence records from live chat, email support, and any other direct communication with cowboy38 staff.
• Feedback, complaints, and dispute records.

cowboy38 processes personal data for the following purposes. Where a legal basis applies to each purpose, this is identified in Section 5 of this Policy.

cowboy38 processes personal data under the following legal bases, applied on a purpose-by-purpose basis:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you have accepted, including account registration, transaction processing, and platform access.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations, licensing conditions, and financial record-keeping requirements.
• Legitimate Interests: Processing carried out to pursue the legitimate interests of cowboy38, including fraud prevention, platform security, analytics, and business improvement, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

cowboy38 does not sell, rent, or trade personal data to third parties for commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Service Providers: Banks and e-wallet operators (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency processors) require transaction data to process your deposits and withdrawals securely.
• KYC & Identity Verification Partners: Third-party identity verification services may process copies of your identification documents to confirm your identity and age.
• Technology & Infrastructure Providers: Cloud hosting, platform software, and security providers who process data on our behalf under contractual data processing agreements.
• Regulatory & Law Enforcement Authorities: Where required by law, court order, or the direction of a competent authority, cowboy38 will disclose personal data to the relevant body. We will notify you of such disclosures where legally permissible.
• Fraud Prevention & Security Services: Shared risk data with fraud detection platforms to protect players and the platform from financial crime.
• Professional Advisers: Legal, financial, and compliance advisers bound by professional confidentiality obligations, where necessary for the operation and protection of our business.

All third-party recipients of personal data are required to process such data only in accordance with cowboy38's instructions and applicable data protection requirements.

cowboy38 uses cookies and similar tracking technologies to operate the platform efficiently, improve user experience, and support security functions. A cookie is a small text file placed on your device by our platform when you visit.

We use the following categories of cookies:

• Essential Cookies: Strictly necessary for the platform to function, including login session management and security tokens. These cannot be disabled without affecting platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game interface configurations, and display options.
• Analytics Cookies: Collect aggregated, anonymised data about how users interact with the platform to help us improve performance and content. These do not identify you personally.
• Security Cookies: Used to detect and prevent fraudulent activity, including session hijacking and account takeover attempts.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using cowboy38, though some personalised features may not function as expected. cowboy38 does not use advertising tracking cookies or share cookie data with third-party advertising networks.

cowboy38 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and KYC Data: Retained for the duration of the active account relationship, and for a minimum of five (5) years following account closure, in accordance with AML and regulatory record-keeping obligations.
• Transaction Records: Financial transaction logs are retained for a minimum of seven (7) years from the date of transaction to comply with applicable financial regulation and audit requirements.
• Customer Support Communications: Retained for three (3) years from the date of the communication, or longer where a dispute is unresolved.
• Technical & Usage Data: Aggregated analytics data is retained for up to two (2) years. Raw session and IP logs used for security purposes are retained for up to twelve (12) months.
• Marketing Consent Records: Retained for the duration of the consent period and for one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

cowboy38 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the cowboy38 platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive personal data, including identity documents and financial records, is stored in encrypted form in access-controlled server environments.
• Access Controls: Access to personal data is restricted to authorised cowboy38 personnel who require it to perform their job functions, subject to role-based access controls and auditable access logging.
• Two-Factor Authentication: Available to all players for account login, and mandatory for administrative access to internal systems.
• Regular Security Audits: cowboy38 conducts periodic security assessments, vulnerability scans, and penetration testing to identify and remediate risks proactively.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and interests, cowboy38 will notify affected individuals in accordance with applicable data protection requirements.

While we take all reasonable precautions, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for logging out of the platform on shared devices.

As a Data Subject, you have rights in relation to the personal data that cowboy38 holds about you. These rights may be exercised by contacting our support team via live chat or by emailing us at the address listed in Section 14. We will respond to verifiable requests within 30 days.

• Right of Access: You have the right to request a copy of the personal data cowboy38 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Some corrections may require supporting documentation.
• Right to Erasure: In certain circumstances, you may request deletion of your personal data. This right is subject to exceptions where retention is required by law (e.g., AML record-keeping obligations).
• Right to Restriction: You may request that processing of your personal data be restricted in certain circumstances, such as while a dispute regarding the accuracy of your data is under review.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gambling monitoring. We will cease such processing unless there are compelling legitimate grounds that override your interests.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a structured, machine-readable copy of your personal data.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time by contacting support or using the unsubscribe function in marketing emails.

cowboy38 is strictly an adult platform intended for persons aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is conducted as part of the account registration and KYC process.

If cowboy38 becomes aware that personal data has been collected from an individual below the minimum age threshold, all such data will be deleted promptly and the associated account closed. If you are a parent or guardian and believe your child has registered an account on cowboy38, please contact our support team immediately.

cowboy38 may transfer personal data to service providers and technology partners located outside of Malaysia as part of our platform operations. Where such transfers occur, cowboy38 ensures that appropriate safeguards are in place to protect your personal data, including:

• Contractual data processing agreements incorporating data protection obligations consistent with applicable standards.
• Transfers to jurisdictions that provide an adequate level of data protection as recognised by applicable authorities.
• Implementation of technical and organisational security measures appropriate to the risk of the transfer.

By using the cowboy38 platform, you acknowledge and consent to the transfer of your personal data to the countries in which our service providers operate, subject to the safeguards described above.

cowboy38 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The date of the most recent update is indicated at the top of this page.

Where material changes are made to this Policy, we will notify registered players via email or via a prominent notice on the cowboy38 platform. Your continued use of the platform following notification of a revised Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how cowboy38 protects your personal data.

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by cowboy38, please contact our Data Support team through the following channels:

• Live Chat: Available 24/7 within the cowboy38 platform — the fastest channel for privacy-related enquiries and data rights requests.
• Email: support@cowboy38.cam — please include "Privacy Request" or "Data Rights Request" in your subject line. This address is displayed as plain text and is not a clickable link.
• Response Time: We aim to acknowledge all privacy-related communications within 3 business days and to provide a full response within 30 calendar days of receiving a verifiable request.

For questions about your account, transactions, or platform access, please visit our FAQ page or our About Us page for more information about cowboy38 and how we operate.