Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") sets out how Mustang303 (the "Company", "We", "Us", or "Our"), operator of the online gaming platform accessible at mustang303.cam, collects, processes, stores, and protects the personal data of individuals (the "Player", "User", or "You") who interact with the platform, whether by visiting the website, registering a player account, making a deposit, placing a wager, or contacting our customer support team.

Mustang303 serves players located primarily in Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities and states throughout the country. We are committed to handling all personal data in a manner that is lawful, fair, and transparent, and to implementing appropriate technical and organisational measures to protect that data against unauthorised access, loss, or misuse.

By accessing or using the Mustang303 platform, you acknowledge that you have read and understood this Policy and you consent to the processing of your personal data as described herein. If you do not agree to the terms of this Policy, you must not use the platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated herein by reference.

In this Policy, the following terms carry the meanings set out below:

Mustang303 collects personal data in the categories set out below. We collect only the data that is necessary for a specified, legitimate purpose. We do not collect sensitive categories of personal data (such as racial or ethnic origin, political opinions, or health data) unless specifically required to do so by applicable law.

We collect personal data through the following channels and mechanisms:

• Direct provision: Data you actively provide during account registration, KYC submission, deposit or withdrawal requests, contact form submissions, or live chat conversations with our support team.
• Automated collection: Technical and usage data collected automatically when you access or interact with the platform, via server logs, cookies, and similar tracking technologies described in Section 8.
• Payment processors: Transaction confirmation data shared with us by your payment provider (e.g., DuitNow, FPX, Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank) in connection with a deposit or withdrawal.
• Identity verification providers: Confirmed identity data returned by third-party KYC verification services where we engage such services to validate your identity documents.
• Anti-fraud and compliance services: Risk signals and fraud indicators shared with us by third-party anti-fraud monitoring services in connection with our obligations to prevent money laundering and protect the platform's integrity.

Mustang303 processes your personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to perform our obligations under the player account agreement — including account management, payment processing, game delivery, and withdrawal fulfillment.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC verification requirements, and data retention obligations imposed by applicable financial and gambling regulations.
• Legitimate interests: Processing for the purposes of fraud prevention, platform security, responsible gambling monitoring, and the improvement of our services, where such interests are not overridden by your fundamental rights and interests.
• Consent: Processing for marketing communications (e.g., promotional email notifications, SMS alerts about bonuses) where you have given explicit, freely-given consent. You may withdraw consent at any time by contacting support or using the unsubscribe mechanism in any marketing communication.

Mustang303 uses the personal data we collect for the following purposes, each of which is grounded in a lawful basis as described in Section 5:

• To create, verify, and manage your player account, including processing registration information and verifying your identity and age (21+ requirement strictly enforced).
• To process deposits made via Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and USDT TRC20; and to process withdrawal requests to your verified account.
• To provide customer support services in English, Bahasa Melayu, and Mandarin, and to maintain records of support interactions for dispute resolution purposes.
• To monitor platform usage for responsible gambling purposes, including detecting patterns of play that may indicate problem gambling behaviour, and to facilitate player-requested deposit limits, reality checks, and self-exclusion.
• To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, money laundering, and other prohibited conduct as described in our Terms & Conditions.
• To send transactional communications relating to your account — including deposit confirmations, withdrawal notifications, KYC status updates, and security alerts.
• To send marketing communications about Mustang303 promotions, bonuses, and new game launches, where you have consented to receive such communications.
• To comply with applicable legal and regulatory obligations, including the retention of transaction records for the periods required by law.
• To analyse platform usage data in aggregate, anonymised form to improve the performance, reliability, and user experience of the platform.

Mustang303 does not sell, rent, or trade your personal data to any third party. We share your data only in the limited circumstances described below, and only to the extent necessary for each specified purpose:

• Payment service providers: We share financial transaction data with the payment processors required to complete your deposit or withdrawal (e.g., DuitNow network operators, FPX-participating banks, Touch 'n Go eWallet, Boost, GrabPay). Each provider handles data under their own privacy policy and applicable financial regulations.
• KYC and identity verification providers: We may engage third-party KYC service providers to assist in verifying the identity documents you submit. These providers act as data processors under contractual obligation and are not permitted to use your data for any purpose other than identity verification on our behalf.
• Anti-fraud and AML compliance services: We may share transaction data and device signals with third-party fraud detection and anti-money-laundering monitoring services to protect the platform and comply with financial crime prevention obligations.
• IT and infrastructure providers: We engage cloud hosting, database, and cybersecurity service providers to operate the platform. These providers process data only under contract and are bound by strict data security obligations.
• Legal and regulatory authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law, a valid court order, or a binding regulatory request. Where permitted by law, we will notify you of such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of Mustang303's assets, player data may be transferred to the acquiring entity, subject to the same privacy protections as described in this Policy.

We require all third-party data processors to implement appropriate technical and organisational security measures and to process personal data only as instructed by Mustang303 and in accordance with applicable data protection law.

Mustang303 uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device when you visit a website. Cookies are widely used to make websites function correctly, remember your preferences, and provide analytical information to site operators.

We use the following categories of cookies:

Mustang303 does not use third-party advertising cookies or behavioural tracking cookies to profile you across other websites. Most browser settings allow you to manage or delete cookies; however, disabling strictly necessary cookies may impair the functionality of the platform.

Mustang303 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. The following general retention periods apply:

• Account data and KYC documents: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements.
• Transaction records (deposits, withdrawals, wager history): Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the interaction, or longer if the communication relates to an ongoing dispute, legal claim, or regulatory investigation.
• Marketing consent records: Retained for as long as the consent remains active, plus three (3) years after withdrawal of consent, as evidence of the consent status.
• Technical and device data (logs, IP addresses): Typically retained for up to ninety (90) days for security and fraud investigation purposes, unless a longer period is required in connection with a specific investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be attributed to an identifiable individual.

Mustang303 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security programme includes the following measures:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption. We enforce HTTPS across all platform pages.
• Encryption at rest: Sensitive personal and financial data stored in our databases is encrypted at rest using industry-standard encryption protocols.
• Access controls: Access to personal data within our systems is restricted on a strict need-to-know basis. Staff with access to player data are subject to confidentiality obligations and receive regular data protection training.
• Two-factor authentication: Two-factor authentication (2FA) is available to all players and is enforced for privileged administrative access to our internal systems.
• Penetration testing and vulnerability management: We conduct regular security assessments of our platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Incident response: We maintain a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players as required by applicable law.

While we take every reasonable precaution to protect your data, no method of transmission over the internet or electronic storage is entirely risk-free. You play an important role in keeping your account secure — please use a strong unique password, enable two-factor authentication, and never share your login credentials with any third party.

As a data subject, you have the following rights in relation to your personal data held by Mustang303. These rights may be subject to certain legal limitations and exemptions where applicable (for example, we cannot delete data that we are legally required to retain for AML compliance purposes):

To exercise any of your data rights, please submit a written request to [email protected], including your full name, registered email address, and a clear description of the right you wish to exercise. We will acknowledge your request within 5 business days and respond substantively within 14 calendar days. Where a request is complex or we have received a high volume of requests, we may extend this period by a further 14 calendar days, in which case we will notify you.

Mustang303 is an online gambling platform strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. The platform is not designed for, marketed to, or intended to be used by minors.

Age verification is a mandatory step in our account registration and KYC process. Where we have reasonable grounds to believe that a player's account has been created by or is being used by a person under the age of 21, we will immediately suspend the account, initiate a formal age verification process, and — if the suspicion is confirmed — close the account and return any deposited real-money funds to the verified source.

If you are a parent or guardian and believe that your child has created a Mustang303 account or submitted personal data to us, please contact our support team immediately at [email protected]. We will promptly investigate and take appropriate action to remove any such data.

Mustang303 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal or regulatory requirements, or the services we offer. All revisions will be published on this page with an updated "Last updated" date displayed at the top of the document.

Where we make material changes that significantly affect how we collect or use your personal data, we will take reasonable steps to notify you directly — for example, by displaying a prominent notice on the platform or by sending an email notification to your registered address, where practically feasible.

We encourage you to review this Policy periodically to stay informed of how we are handling your data. Your continued use of the Mustang303 platform following the publication of an updated Policy constitutes your acknowledgment of the revised terms.

If you have any questions, concerns, or requests relating to this Privacy Policy or our personal data practices, please do not hesitate to reach out to our support team. All data-related enquiries are handled with strict confidentiality and in accordance with this Policy.

When submitting a data rights request or a privacy-related enquiry, please include your full name, your registered email address, and a clear description of your request to help us respond efficiently. For identity verification purposes, we may ask you to provide a copy of your MyKad or passport before disclosing any account-specific personal data.

You may also review our related policies for more information on how your data and account activity are governed: Terms & Conditions | Responsible Gambling Policy.