Privacy Policy —
How promo888 Protects Your Data

This Privacy Policy ("Policy") is issued by promo888 ("we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://promo888.cam and all associated subdomains and services. This Policy explains how promo888 collects, uses, stores, shares, and protects the personal data of visitors, registered account holders, and any individual who interacts with our platform ("you", "User", "Player").

promo888 is designed and operated as an English-language platform serving the Malaysian market. All financial transactions are denominated in Malaysian Ringgit (MYR). Our payment processing integrates with local Malaysian payment channels including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong. Personal data processed in connection with these payment channels is subject to the protections described in this Policy.

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, IP address, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, promo888.
• "Data Processor" means any third party that processes Personal Data on behalf of promo888 under a contractual arrangement.
• "KYC Data" means identity and address verification documentation submitted by a Player in connection with the Know Your Customer process.
• "Cookie" means a small data file placed on a User's device by the platform to facilitate session management, personalisation, and analytics.
• "Third Party" means any person or entity other than the User and promo888, including payment processors, game studios, and analytics providers.

promo888 acts as the Data Controller in respect of all Personal Data collected through the platform. As Data Controller, promo888 is responsible for establishing the lawful basis for data Processing, ensuring appropriate security measures are in place, maintaining accurate records of Processing activities, and facilitating the exercise of User rights described in Section 13 of this Policy.

For all data protection enquiries, including requests to exercise your rights as a data subject, please contact our team via the channels set out in Section 17.

promo888 collects the following categories of Personal Data, to the extent necessary to operate the platform, fulfil regulatory obligations, and provide a quality service to Malaysian players:

Category	Examples	Collected at
Identity Data	Full legal name, date of birth, nationality, MyKad / passport number	Registration & KYC
Contact Data	Email address, phone number, residential address (city, postcode, state)	Registration
Financial Data	Bank account details, e-wallet ID, cryptocurrency wallet address, transaction history	Deposits & Withdrawals
KYC Documents	Copies of government ID, proof of address documents, payment instrument proof	KYC Verification
Gaming Activity Data	Bet history, wagering amounts, game sessions, wins and losses, bonus redemptions	Ongoing platform use
Technical Data	IP address, device type, browser type and version, operating system, screen resolution	Automatic — all visits
Usage Data	Pages visited, features used, session duration, clickstream data, referral source	Automatic — all visits
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, health data, or biometric data) unless expressly required by applicable law or regulatory obligation.

promo888 collects Personal Data through the following channels:

promo888 processes your Personal Data for the following specified, explicit, and legitimate purposes:

• Account creation and management: To register, verify, and maintain your Account on the platform;
• Identity and age verification (KYC): To confirm that you are at least 21 years of age and to comply with anti-money laundering obligations;
• Payment processing: To facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels;
• Platform operation and service delivery: To provide access to games, sportsbook markets, VIP features, and customer support;
• Responsible gambling compliance: To monitor account activity for signs of problem gambling, enforce deposit limits, and facilitate self-exclusion requests;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account abuse, and security breaches;
• Legal and regulatory compliance: To meet obligations under applicable law, including anti-money laundering requirements and record-keeping obligations;
• Communications: To respond to support enquiries, send transactional notifications, and — where you have opted in — to deliver promotional communications;
• Platform improvement: To analyse usage patterns, identify technical issues, and develop improvements to the player experience;
• Marketing and personalisation: To personalise content, bonus offers, and game recommendations based on your usage patterns, where you have provided consent.

promo888 processes your Personal Data only where a valid legal basis exists for doing so. The applicable legal bases are as follows:

• Contractual necessity: Processing required to perform our contractual obligations to you under the promo888 Terms & Conditions — including account management, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations and record-keeping requirements;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and internal analytics, where our legitimate interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing communications and non-essential cookies, where you have provided explicit and informed consent that you may withdraw at any time.

promo888 does not sell your Personal Data to third parties. We do not share your data with advertisers, data brokers, or unrelated commercial entities. Personal Data may be disclosed only in the following limited circumstances:

promo888 operates primarily to serve the Malaysian market, and the majority of data processing occurs within this context. Where Personal Data is transferred to or accessed by service providers located outside Malaysia (for example, cloud infrastructure or internationally hosted game studios), promo888 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Safeguards for international transfers may include contractual data protection clauses, adequacy assessments, or equivalent protective arrangements as recognised under applicable data protection frameworks.

promo888 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Retention periods are determined as follows:

• Account and KYC Data: Retained for the duration of the active Account plus a minimum of five (5) years following Account closure, to comply with anti-money laundering and record-keeping obligations;
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with financial record-keeping requirements;
• Gaming Activity Logs: Retained for a minimum of five (5) years for regulatory compliance and responsible gambling audit purposes;
• Support Communications: Retained for up to three (3) years after the close of the relevant support interaction;
• Cookie and Usage Data: Session cookies expire at the end of each browser session; persistent cookies are retained in accordance with the periods specified in our Cookie Notice.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification.

promo888 implements comprehensive technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption across all pages, login sessions, and transaction endpoints;
• Two-factor authentication (2FA) available to all Account holders;
• Access controls ensuring that only authorised personnel with a legitimate business need can access Personal Data;
• Regular security audits and penetration testing of platform infrastructure;
• Encrypted storage of sensitive data including KYC documents and financial records;
• Data breach response procedures with defined notification timelines in the event of a security incident affecting your data.

While promo888 employs industry-standard security practices, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your login credentials and for notifying promo888 immediately if you suspect any unauthorised access to your Account.

promo888 uses cookies and similar tracking technologies to operate the platform, improve the player experience, and analyse usage patterns. Cookies are small data files placed on your device when you access the platform.

The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to platform operation — including session authentication and security tokens. These cannot be disabled;
• Functional Cookies: Remember your preferences such as language settings, game lobby filters, and display configurations;
• Analytics Cookies: Collect aggregated data about how Players interact with the platform, used to identify performance improvements. Requires consent;
• Marketing Cookies: Used to deliver relevant promotional content based on your interests and browsing behaviour. Requires consent and may be withdrawn at any time.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair the functionality of the promo888 platform, including the ability to maintain a login session.

As a data subject whose Personal Data is processed by promo888, you hold the following rights in respect of your data. Requests to exercise these rights should be submitted to our support team via the contact methods in Section 17.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed;
• Right to Rectification: You may request that we correct inaccurate or incomplete Personal Data held in your Account;
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to Restriction: You may request that we restrict Processing of your data in certain circumstances, such as while a data accuracy dispute is under investigation;
• Right to Data Portability: You may request that we provide your Personal Data in a structured, machine-readable format for transfer to another service, where technically feasible;
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing — your objection will be honoured except where compelling legitimate grounds override it;
• Right to Withdraw Consent: Where Processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior Processing.

promo888 will acknowledge data subject requests within five (5) business days and will endeavour to fulfil or formally respond to all requests within 30 days. Where a request is complex or voluminous, we may extend this period by a further 30 days, with notification to you.

promo888 is an adult gaming platform strictly for persons aged 21 years and above. We do not knowingly collect Personal Data from any individual under the age of 21. If promo888 becomes aware that an Account has been registered by or on behalf of a person under 21, that Account will be immediately suspended, all associated data will be handled in accordance with our legal obligations, and any balance will be subject to review.

If you believe that a minor may have registered on our platform or that Personal Data of a person under 21 has been collected without appropriate consent, please contact our support team immediately so that we can investigate and take appropriate action.

The promo888 platform does not contain links to external third-party websites for commercial or advertising purposes. Our navigation and content links are limited to internal platform pages. Where references to third-party services or organisations are made within this Policy or on the platform (for example, responsible gambling support resources), these are text-only informational references and do not constitute endorsement of those organisations or their privacy practices.

promo888 accepts no responsibility for the data handling practices of any third-party organisations referenced in connection with our responsible gambling resources or regulatory obligations.

promo888 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable law. When material changes are made, we will notify registered Players by email (at the address associated with their Account) and/or by displaying a prominent notice on the platform.

The effective date at the top of this Policy will be updated to reflect the date on which any revised version takes effect. Your continued use of the promo888 platform following notification of a material amendment constitutes your acceptance of the revised Policy. We recommend reviewing this page periodically to remain informed of current practices.

For any privacy-related enquiries, data subject rights requests, or concerns regarding how promo888 handles your Personal Data, please contact our team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week — including Malaysian public holidays — via the live chat function on the promo888 platform. Fastest route for all data and account enquiries;
• Email: [email protected] — for formal written data subject requests, privacy complaints, or compliance correspondence. Please mark the subject line clearly as "Privacy Request" or "Data Subject Rights".

All privacy-related requests will be acknowledged within five (5) business days. We are committed to resolving all data protection matters promptly and transparently.