Privacy Policy RM88 — Data Protection & Information Security

1 Policy Introduction & Scope

This Privacy Policy is published by rm88 ("we", "Platform", or "company") and applies to all users who register, browse, or use any services provided through the rm88 platform, including the official rm88 website and rm88 mobile app on Android and iOS.

As a responsible online casino and sports betting platform, rm88 takes the security and privacy of users' personal information very seriously. We operate in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and leading international data protection principles.

By using the rm88 platform, you confirm that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform and contact us to delete your account.

2 Information We Collect

Rm88 collects several categories of personal information depending on how you interact with our platform. Below is a summary of the types of data collected and their sources:

Rm88 does not collect sensitive data such as health information, biometric data, or religious information unless specifically required by law in relation to identity verification. We only collect data that is genuinely necessary for the stated purposes — this data minimization principle is central to our approach.

3 How We Use Your Information

All information collected by rm88 is used for clear and lawful purposes. We do not use your data for purposes unrelated to the provision of platform services. The following are the primary purposes for data use:

• Identity Verification (KYC): Identity information is used to verify that you meet the minimum age requirement (18 years) and to ensure the account is registered under the correct name to prevent fraud.
• Financial Transaction Processing: Financial information is used solely to process deposits via FPX, Touch 'n Go, Boost, and GrabPay, as well as withdrawals to your bank account.
• Anti-Money Laundering (AML) Compliance: rm88 is legally required to monitor and report any suspicious transactions to the relevant authorities.
• Account-Related Communications: We use your email address and phone number to send important account notices, transaction confirmations, and security alerts.
• Customer Support: Account information is used by our support team to identify and assist you in resolving any issues quickly and accurately.
• Platform Improvements: Anonymised usage data is analysed to understand user patterns and help us improve the design, performance, and content of the rm88 platform.
• Fraud Prevention & Security: Technical data such as IP addresses and device information is used to detect and prevent unauthorised access, duplicate accounts, and other fraudulent activity.
• Marketing Communications (with opt-out option): If you opt in to receive promotional communications, we will send you information about the latest bonuses and promotions. You may unsubscribe at any time.

4 Data Sharing & Disclosure

Rm88 does not sell, rent, or disclose your personal information to third parties for commercial purposes. However, there are specific situations where we may need to share your data with the following parties:

• Payment Service Providers: Financial information required to process transactions is shared with approved payment providers such as banks, FPX, Touch 'n Go, Boost, and GrabPay. These providers are bound by strict confidentiality agreements.
• Game Service Providers: Third-party game software providers that supply games on the rm88 platform may receive the minimum data required to operate those games. No sensitive financial information is shared with game providers.
• Legal Authority: rm88 will disclose information when required by law, court order, or legitimate request from Malaysian law enforcement authorities. This includes compliance with AML/CTF reporting requirements.
• Auditors & Regulatory Bodies: Information required for audit and regulatory compliance purposes may be shared with independent auditors or relevant regulatory bodies.
• Business Transfer: In the event of a merger, acquisition, or asset sale, user data may be transferred as part of that business process. You will be notified in advance should this occur.

5 Security & Data Encryption

Rm88 continuously invests in the latest security infrastructure to ensure your personal data remains protected at all times. The technical and organizational security measures we implement include:

• 256-bit SSL/TLS Encryption: All data communications between your browser or app and rm88's servers are encrypted using TLS 1.3 protocol with a 256-bit key length — the highest standard in the industry.
• Data-at-Rest Encryption: Sensitive data stored in the rm88 database is encrypted using the AES-256 algorithm to ensure security even in the event of unauthorised physical access to servers.
• Two-Factor Authentication (2FA): All accounts can enable 2FA. rm88 internal staff with access to user data are required to use 2FA without exception.
• Role-Based Access Control: Access to user data among rm88 staff is restricted on a need-to-know basis. Only staff who genuinely require access to specific data to perform their duties are permitted to do so.
• 24/7 Security Monitoring: An intrusion detection system (IDS) and automated threat prevention system continuously monitor rm88's infrastructure to detect and block any cyber threats.
• Regular Penetration Testing: rm88 conducts regular penetration testing by independent security experts to identify and close any vulnerabilities before they can be exploited.

While rm88 takes all reasonable measures to protect your data, no system is completely immune to cyber threats. You also play a role in keeping your account secure — use a strong password, enable 2FA, and never share your login credentials with anyone.

6 Cookies & Tracking Technologies

Rm88 uses cookies and similar tracking technologies to enhance user experience, analyze platform performance, and maintain session security. The following are the types of cookies used:

• Essential Cookies: These cookies are required for core platform functions such as maintaining login sessions, saving language preferences, and ensuring security. They cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies: We use analytics tools to understand how users interact with the platform — most visited pages, time spent, and buttons clicked. This data is collected anonymously and used solely for platform improvements.
• Functional Cookies: These cookies allow the platform to remember your preferences, such as display settings, preferred language, and betting limits you have set in your account settings.
• Security Cookies: Used to detect suspicious activity, prevent CSRF (Cross-Site Request Forgery) attacks, and ensure that every session is valid and secure.

You can manage your cookie settings through your web browser settings. However, disabling essential cookies may affect the functionality and security of the rm88 platform. For more information on managing cookies in popular browsers, please refer to your browser's help documentation.

7 Your Rights as a User

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection principles, you have the following rights regarding the personal information held by rm88:

• Right of Access: You have the right to request a copy of the personal information we hold about you. Data access requests will be processed within 14 business days.
• Right to Rectification: If any of your personal information is inaccurate or out of date, you have the right to request that we correct it. Most basic information can be updated directly through your account profile settings.
• Right to Erasure: Under certain circumstances, you have the right to request that we delete your personal information. Please note that we may need to retain certain data for a period prescribed by law (see Section 8).
• Right to Restriction of Processing: You may request that we restrict how we use your data under certain circumstances, such as when you dispute the accuracy of the data or while a claim is being investigated.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format (such as CSV or JSON) for transfer to another party if required.
• Right to Object to Marketing: You may object to the processing of your data for direct marketing purposes at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of processing that took place prior to the withdrawal.

8 Data Retention Period

Rm88 does not retain your personal data longer than necessary for the purposes it was collected or as required by law. The following are our data retention period guidelines:

• Active Account Data: While your account is active, we retain all information necessary to operate your account safely and effectively.
• Financial Transaction Records: Deposit and withdrawal transaction records are retained for a minimum of 7 years from the transaction date, in accordance with Malaysia's financial and AML legal requirements.
• KYC Verification Documents: Identity documents and proof of address collected for KYC verification are retained for 5 years after account closure in accordance with compliance requirements.
• Log & Security Data: System logs and security data are retained for 12 months for fraud detection and security investigation purposes.
• Support Communication Data: Customer support conversation records are retained for 3 years for reference and service quality improvement.
• After Account Closure: Upon account closure, we will delete or anonymise personal data that is no longer required within 30 days, except for data that must be retained under legal requirements.

9 Privacy Policy Updates

Rm88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or improvements to our services. The "Updated" date at the top of this document indicates when these terms were last reviewed.

When material changes are made to this Privacy Policy, rm88 will notify you through the following means:

• Notice prominently displayed on the rm88 platform homepage
• Email notification to the email address registered to your account
• Notice displayed during your next login session to your account

Continued use of the rm88 platform after receiving notice of changes is considered acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request deletion of your data.

10 Contact Our Privacy Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or how rm88 handles your personal data, please contact our Data Protection Officer through the following channels:

• Privacy Email: [email protected] — dedicated to privacy and data protection inquiries
• General Support Email: [email protected] — for general account inquiries
• Live Chat: Available 24/7 via the chat icon on the rm88 platform — for issues requiring immediate attention
• FAQ: Visit the page rm88 FAQs for answers to the most frequently asked questions

All privacy inquiries will be handled with confidentiality and professionalism. We aim to respond within 3 business days for general inquiries, and within 24 hours for urgent security issues. If you are not satisfied with our response, you have the right to file a complaint with Malaysia's Department of Personal Data Protection (JPDP) in accordance with the provisions of PDPA 2010.