promo888 Privacy Policy

1.1 promo888 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who interact with the promo888 platform at promo888.co ("Platform"), including registered Players, prospective registrants, and visitors.

1.2 This Privacy Policy ("Policy") describes our practices regarding the collection, use, storage, disclosure, and protection of personal data. It applies to all data processing activities carried out by promo888 in connection with the operation of the Platform and the provision of online casino, sportsbook, and related gaming services to players across Malaysia and other eligible jurisdictions.

1.3 By registering an Account, making a deposit, or using any feature of the promo888 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must discontinue use of the Platform and contact our support team to request account closure.

1.4 This Policy should be read together with our Terms and Conditions, available at promo888.co/terms-conditions, and our Responsible Gaming Policy, available at promo888.co/responsible-gaming.

2.1 promo888, as the operator of promo888.co, acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, promo888 determines the purposes for which and the means by which personal data is processed.

2.2 For all data protection enquiries, rights requests, or complaints, you may contact our Data Protection team via the support channels listed in Section 16 of this Policy.

3.1 Registration Data: When you create a promo888 Account, we collect your full legal name, date of birth, residential address, email address, and Malaysian mobile telephone number.

3.2 KYC Identity Documents: To comply with international gaming authority Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, we collect copies of government-issued identity documents. For Malaysian players, this typically means your MyKad (front and back) or passport bio-data page, and a recent proof of address document such as a utility bill, bank statement, or government correspondence.

3.3 Financial Data: We collect information about deposits and withdrawals, including transaction amounts, timestamps, and payment method identifiers (e.g., masked bank account numbers, e-wallet account references for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX). Full payment card numbers, if applicable, are processed by PCI-DSS-compliant payment processors — promo888 does not store raw card data.

3.4 Gaming Activity Data: We collect records of your gameplay on the promo888 Platform, including game sessions, wagering amounts, game outcomes, bonus usage, sportsbook bets, and session durations. This data is used for account management, responsible gaming monitoring, and regulatory reporting.

3.5 Technical and Device Data: We automatically collect technical information when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and session timestamps. This data is collected via server logs and similar technologies.

3.6 Communication Records: We retain records of communications between you and the promo888 support team, including live chat transcripts and email correspondence, for quality assurance, dispute resolution, and regulatory compliance purposes.

promo888 collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, contact support, or update your Account profile;
• Automatically — through server logs, session tracking technologies, and cookies when you browse or interact with the Platform;
• From payment processors — confirmation data returned by FPX, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect following transaction processing;
• From identity verification services — responses from KYC verification providers used to cross-reference identity documents;
• From fraud and AML screening services — risk assessment data returned by third-party compliance screening tools.

5.1 Account Administration: To create, maintain, and manage your promo888 Account, including processing deposits, withdrawals, and bonus allocations.

5.2 Identity Verification and Compliance: To verify your identity and age (21+), conduct KYC and AML checks, satisfy regulatory reporting obligations, and comply with applicable gaming authority requirements.

5.3 Platform Security: To detect and prevent fraud, unauthorised account access, multiple-account creation, bonus abuse, and other prohibited activities as defined in our Terms and Conditions.

5.4 Customer Support: To respond to your enquiries, process complaints, and resolve disputes in a timely manner. Support interactions are logged for quality assurance and training purposes.

5.5 Responsible Gaming: To monitor gaming patterns for indicators of problem gambling, apply player protection measures where appropriate, and communicate responsible gaming resources to at-risk players.

5.6 Service Improvement: To analyse aggregated, anonymised usage data to improve Platform performance, game selection, user experience, and promotional effectiveness. This analysis does not involve decisions based solely on automated processing that produce legal or similarly significant effects on individual players.

5.7 Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications. You may withdraw marketing consent at any time by contacting our support team.

promo888 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform the agreement between you and promo888, including account operation and payment processing;
• Legal Obligation: Processing necessary to comply with KYC, AML, age verification, and other regulatory obligations imposed by applicable gaming authority requirements;
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement purposes, where such interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications, where you have given explicit, freely withdrawn consent.

7.1 promo888 does not sell or rent your personal data to third parties. We share personal data only in the following limited circumstances:

• Payment Processors: Transaction data is shared with FPX, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and connected Malaysian banking partners solely to process deposits and withdrawals;
• KYC and AML Compliance Providers: Identity document data is shared with licensed identity verification and AML screening providers engaged to assist promo888 in meeting its regulatory obligations;
• Game Providers: Gameplay session data may be shared with the relevant third-party game studio or provider for the purpose of operating the game, resolving game-related disputes, and audit purposes;
• Regulatory and Law Enforcement Authorities: Where required by law, court order, or regulatory direction, promo888 may disclose personal data to the relevant authority;
• IT Infrastructure and Hosting Providers: Servers and cloud infrastructure providers engaged by promo888 are bound by data processing agreements that restrict use of player data to service delivery purposes only.

7.2 All third parties with whom promo888 shares personal data are contractually required to maintain appropriate technical and organisational security measures and to process data only as instructed by promo888.

8.1 In operating a global gaming platform, certain personal data may be processed on servers or by service providers located outside of Malaysia. Where such transfers occur, promo888 implements appropriate safeguards to ensure your data receives a level of protection equivalent to that provided under applicable data privacy standards.

8.2 Safeguards used for international transfers include contractual data processing agreements incorporating standard data protection clauses, and engagement of service providers certified under recognised data security frameworks.

9.1 promo888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to satisfy applicable regulatory retention obligations, and to resolve disputes or enforce agreements.

9.2 As a general rule, account data and transaction records are retained for a minimum period of five (5) years following account closure, in accordance with international gaming authority AML record-keeping requirements. KYC identity documents are retained for the same minimum period.

9.3 Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with any individual player.

10.1 The promo888 Platform uses cookies and similar tracking technologies to deliver and improve the Platform experience. The types of cookies used include:

• Essential Cookies: Required for the Platform to function, including session authentication, CSRF protection, and load-balancing. These cannot be disabled without disrupting Platform functionality;
• Functional Cookies: Remember your preferences such as language settings and game lobby filter state to improve your experience across sessions;
• Analytics Cookies: Collect anonymised usage data to help us understand how players navigate the Platform, which game categories are most accessed, and where performance improvements are needed.

10.2 promo888 does not use third-party advertising or tracking cookies that transmit your data to external advertising networks.

10.3 You may manage cookie preferences through your browser settings. Disabling essential cookies may impair your ability to log in or use Platform features.

11.1 promo888 implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and promo888 servers;
• Encryption of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments of the Platform infrastructure;
• Multi-factor authentication required for all internal administrative access;
• Automated monitoring and alerting for anomalous access patterns or potential security incidents;
• Regular staff training on data protection and security practices.

11.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, promo888 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

12.1 Subject to applicable law and regulatory constraints, you have the following rights in respect of your personal data held by promo888:

• Right of Access: You may request a copy of the personal data promo888 holds about you;
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data;
• Right to Erasure: In certain circumstances, you may request deletion of your personal data. Note that this right is subject to promo888's regulatory retention obligations — data required for AML, KYC, or dispute resolution purposes cannot be deleted during the applicable retention period;
• Right to Restriction of Processing: You may request that promo888 restrict processing of your data in certain circumstances, such as while the accuracy of data is being verified;
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request a copy of your data in a structured, machine-readable format;
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to Object: You may object to processing based on legitimate interests, including profiling, subject to promo888's ability to demonstrate overriding grounds.

12.2 To exercise any of the above rights, please contact our support team via live chat or at the support email address listed in Section 16. We will acknowledge rights requests within 48 hours and provide a substantive response within 30 calendar days.

13.1 The promo888 Platform is strictly intended for adults aged 21 years and above. promo888 does not knowingly collect personal data from individuals under the age of 21.

13.2 Where promo888 becomes aware that personal data has been collected from an individual under 21 years of age, such data will be deleted immediately and the relevant Account closed in accordance with our Terms and Conditions and applicable regulatory requirements.

13.3 If you have reason to believe that a person under 21 has registered a promo888 Account, please contact our support team immediately via live chat or at the support email in Section 16.

14.1 The promo888 Platform does not include links to third-party websites for commercial or advertising purposes. Game content is delivered via integrated third-party game studios; within those game environments, the game provider's own privacy terms may apply to data processed by the game engine itself.

14.2 promo888 is not responsible for the privacy practices or content of any third-party systems, including game provider interfaces, payment provider portals, or any external sites accessed independently by players outside of the promo888 Platform.

15.1 promo888 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features. The "Last Updated" date at the top of this Policy will be revised accordingly.

15.2 Where updates are material — meaning they affect the nature of data collected, the purposes for which it is used, or your rights — promo888 will notify registered Players via a login notice on the Platform and, where required, by email to the registered address on file.

15.3 Continued use of the Platform following notification of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not accept the updated Policy, please discontinue Platform use and contact us to request account closure.

For any questions, rights requests, or complaints relating to this Privacy Policy or the processing of your personal data by promo888, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the promo888 Platform — no login required to initiate a chat. For data protection matters, ask to be connected to the Data Protection team.
• Email: [email protected] (plain text — not a link; responses within 2 business hours for urgent data protection matters)
• Hours: Malaysia Standard Time (MYT, UTC+8), all days including public holidays

promo888 takes all data protection complaints seriously. Where a complaint cannot be resolved through our internal process, you may seek further recourse through the applicable regulatory or data protection authority in your jurisdiction.