Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by play8 (hereinafter "play8", "we", "us", or "our") and applies to all personal data collected, processed, stored, or transmitted in connection with your registration for, and use of, the play8 online casino and sports betting platform accessible at https://play8.cam and all associated interfaces and services (collectively, "the Platform").

play8 is committed to protecting the privacy and personal data of all individuals who interact with our Platform, with particular regard to the privacy expectations of Malaysian players in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applicable international data protection standards.

By creating an account, accessing the Platform, or submitting any personal information to play8, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which are incorporated by reference.

In this Policy, the following terms carry the meanings assigned to them below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means play8, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party engaged by play8 to process personal data on play8's behalf and in accordance with play8's instructions.
• "KYC Data" means identity and verification documentation submitted as part of the Know Your Customer process, including identity documents, proof of address, and selfie photographs.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "PDPA" means the Personal Data Protection Act 2010 (Malaysia), which governs the processing of personal data in commercial transactions in Malaysia.

play8 collects personal data across the following categories:

• Full legal name as it appears on your government-issued identity document;
• Date of birth (for the purpose of age verification — players must be 21 or above);
• Residential address, including city and postcode;
• Email address and mobile phone number; and
• Preferred currency (Malaysian Ringgit — MYR — by default for Malaysian players).

• Copies of government-issued identity documents (Malaysian MyKad, Passport, or Driver's License);
• Proof of residential address (utility bill, bank statement, or official correspondence — dated within three months);
• Selfie photograph taken while holding the identity document; and
• Payment method verification documentation where required.

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• Payment method identifiers — e.g., masked e-wallet account numbers for Touch 'n Go eWallet, Boost, GrabPay; masked bank account references for Maybank, CIMB, Public Bank, Hong Leong, FPX, DuitNow; and cryptocurrency wallet addresses for BTC, ETH, USDT; and
• Bonus and promotion redemption records.

• IP address and approximate geolocation;
• Browser type, version, and operating system;
• Device type and screen resolution;
• Session timestamps, page navigation sequences, and login history; and
• Game play logs, wagering activity records, and sportsbook betting history.

• Live chat transcripts and email correspondence with play8's support team; and
• Records of responsible gambling requests (e.g., deposit limit adjustments, self-exclusion requests, cool-off periods).

play8 collects your personal data through the following channels and mechanisms:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or submit a responsible gambling request;
• Automatically — through cookies, server logs, and analytics tools when you access or browse the Platform;
• From payment processors — transaction confirmation data transmitted by your bank, e-wallet provider (Touch 'n Go, Boost, GrabPay), or FPX/DuitNow network; and
• From identity verification services — where play8 uses third-party KYC service providers to assist with document authentication and fraud detection, subject to the terms in Section 7.

play8 processes your personal data for the following purposes:

play8 processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contractual Necessity: Processing required to fulfil our obligations under the account agreement — including account maintenance, game access, and payment processing;
• Legal Obligation: Processing required by applicable law — including KYC obligations under anti-money laundering regulations and age verification requirements under gambling licensing conditions;
• Legitimate Interests: Processing for purposes that serve play8's legitimate business interests and do not override your fundamental rights — including fraud prevention, platform security, and responsible gambling monitoring; and
• Consent: Processing where you have given your explicit, informed consent — primarily for optional marketing communications and the use of non-essential cookies. Consent may be withdrawn at any time.

play8 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purposes:

play8 shares transaction data with your chosen payment provider — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, and cryptocurrency processing services — strictly for the purpose of executing deposit and withdrawal transactions.

play8 may engage authorised third-party identity verification services to assist with document authentication and automated fraud scoring. These partners act as Data Processors and are contractually bound to process data only on play8's instructions and to maintain appropriate security standards.

play8 will disclose personal data to relevant regulatory bodies, law enforcement agencies, or financial intelligence units where required to do so by applicable law, court order, or regulatory direction — including Malaysia's Bank Negara Malaysia (BNM) and international AML/CFT authorities where applicable.

Legal advisers, auditors, and professional consultants engaged by play8 may have access to relevant personal data under strict confidentiality obligations and only to the extent necessary for the provision of professional services.

play8 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following retention schedules:

• Active Account Data: Retained for the full duration of your account relationship with play8 plus a minimum of five (5) years following account closure, to comply with AML record-keeping requirements;
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in accordance with applicable AML legislation;
• Financial Transaction Records: Retained for seven (7) years to satisfy financial record-keeping obligations under applicable law;
• Communication Logs: Live chat transcripts and email correspondence retained for two (2) years unless a longer period is required for a pending dispute or investigation;
• Marketing Preferences & Consent Records: Retained for the duration of the account and for three (3) years following any withdrawal of consent, as evidence of consent management; and
• Technical & Session Logs: Typically retained for 90 days for operational purposes; longer where required for fraud or security investigations.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be attributed to an identified individual.

play8 implements a layered security architecture to protect personal data against unauthorised access, loss, destruction, or disclosure. Measures in place include:

• 256-bit SSL/TLS encryption on all data in transit between your device and play8's servers;
• AES-256 encryption at rest for sensitive fields including KYC documents, financial records, and account credentials;
• Role-based access controls ensuring that personal data is accessible only to staff members with a legitimate operational need;
• Two-factor authentication (2FA) available to all players and mandatory for administrative system access;
• Regular penetration testing and independent security audits of the Platform infrastructure; and
• Anomaly detection and monitoring systems that flag unusual access patterns or bulk data queries for immediate review.

The play8 Platform uses cookies and similar technologies (including local storage and session tokens) to enable core platform functions and to gather basic usage analytics. Cookies are small text files stored on your device by your browser.

• Strictly Necessary Cookies: Required for session authentication, login state management, and basic platform functionality. These cannot be disabled without breaking the Platform;
• Analytics Cookies: Used to collect anonymised data about how visitors navigate and use the Platform, to help play8 improve the user experience. No personally identifying information is passed to analytics services; and
• Preference Cookies: Used to remember your language preference, display settings, and other user-configurable options.

play8 does not deploy third-party advertising cookies, retargeting pixels, social media tracking scripts, or behavioural profiling technologies on the Platform. We do not participate in real-time bidding networks or cross-site audience targeting.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your play8 account.

Subject to applicable law, including the Malaysia Personal Data Protection Act 2010 (PDPA), you hold the following rights with respect to your personal data held by play8. Requests may be submitted via live chat or by emailing our support team.

• Right of Access: You may request confirmation of whether play8 holds personal data about you and, if so, a copy of that data along with information about how it is being processed;
• Right of Correction: You may request that inaccurate or incomplete personal data held about you be corrected or updated promptly;
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal;
• Right to Restrict Processing: In certain circumstances, you may request that play8 restrict the active processing of your personal data — for example, where you contest its accuracy or object to its use;
• Right to Data Portability: You may request a copy of personal data you have provided to play8 in a structured, commonly used, and machine-readable format; and
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to play8's legal obligations to retain certain records (see Section 8).

play8 will respond to all verifiable data subject requests within 30 days of receipt. For complex or multi-faceted requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

The play8 Platform is strictly intended for adults aged 21 years and above. play8 does not knowingly collect personal data from individuals below the age of 21. Age is verified as part of the KYC process prior to the processing of any withdrawal.

If play8 becomes aware, through any means, that a registered account holder is below the age of 21, the account will be immediately suspended, all deposits refunded to the original payment method where possible, and any wagering activity declared void. The personal data of the underage individual will be deleted from play8's systems as promptly as permitted by applicable law.

In connection with the operation of the play8 Platform and the engagement of third-party service providers, personal data may be transferred to, stored in, and processed in jurisdictions outside Malaysia. Where such transfers occur, play8 takes the following safeguards to ensure that your data receives an equivalent level of protection:

• Ensuring that transfers are made only to jurisdictions that provide an adequate level of data protection as assessed by relevant regulatory authorities;
• Where transfers are made to jurisdictions without a formal adequacy determination, implementing contractual safeguards (such as standard contractual clauses) with the receiving party; and
• Conducting due diligence on all international Data Processors prior to engagement to confirm their data security and compliance standards.

The play8 Platform does not host third-party advertising or links to external websites. The Platform is a self-contained environment. However, where you access the Platform via a third-party device application, browser extension, or other intermediary technology not provided or controlled by play8, those third-party services may independently collect data about your behaviour in accordance with their own privacy policies.

play8 is not responsible for the privacy practices of third-party software or services not operated by play8. We recommend reviewing the privacy documentation of any third-party tool you use to access online services.

play8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where material changes are made, play8 will notify affected players via the email address registered to their account, or via a prominent notice on the Platform, not less than 14 days before the changes take effect.

The effective date at the top of this Policy indicates when the current version was last updated. Continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy. We encourage you to review this Policy periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by play8, please contact us through the following channels. All privacy-related enquiries are handled in strict confidence.

play8 takes all data privacy enquiries seriously. If you feel that your concern has not been adequately addressed following contact with our support team, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.