Privacy Policy my888 – Malaysia Member Personal Data Protection

This Privacy Policy ("Policy") is published by my888 ("Platform", "we", "us") and represents our written commitment to every Malaysian member using my888.run's services. This Policy explains exactly what types of personal data we collect, the purposes for collection, how we store and protect it, and the rights you hold as the data owner.

My888 acts as a data processor under Malaysia's PDPA 2010 framework. This means we have clear legal responsibilities to ensure your personal data is processed fairly, lawfully, and transparently. We take this responsibility seriously and fulfil it through strict internal policies, ongoing staff training, and regular security audits.

This policy is updated from time to time to reflect changes in our data processing practices or in applicable law. The most recent update date is always shown at the top of this page. my888 recommends that you check this page periodically.

My888 collects your personal data through several means – directly from you during registration and platform use, and automatically through standard tracking technologies. The following are the types of data we collect:

For identity verification purposes on withdrawals exceeding certain limits, my888 may request a copy of an identity document such as a MyKad or passport. Such documents will be stored securely and deleted once the verification process is complete, unless a longer retention period is required by law.

My888 uses the personal data we collect solely for the following purposes. We will not use your data for any other purpose without first obtaining your consent:

• Account management: To register and manage your my888 account, process logins, ensure account security and grant access to platform services.
• Service delivery: To process bets and gaming transactions, and manage deposits and withdrawals in Malaysian Ringgit (RM) via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, Boost and ShopeePay.
• Identity verification: To verify members' age and identity in order to meet legal requirements, particularly to ensure all members are 18 years of age or older.
• Customer support: To handle enquiries, complaints, and support requests submitted to the my888 support team via live chat or email.
• Service communications: Sending important account notifications such as deposit confirmations, withdrawal confirmations, and security alerts. Promotional notifications are only sent if you have given your consent.
• Platform improvements: Analysing usage patterns in aggregate (without identifying individuals) to understand how members use the platform and to make relevant improvements.
• Fraud prevention: Detecting and preventing fraudulent activity, money laundering, multi-account usage, and other abuses that could compromise the integrity of the platform.
• Legal compliance: Complying with applicable legal and regulatory requirements, including retaining transaction records for the periods mandated under Malaysian law.

My888 does not sell, rent, or disclose members' personal data to third parties for marketing purposes. However, in certain limited situations, my888 may need to share your personal data with the following parties:

• Payment service providers: Payment gateways that process your deposit and withdrawal transactions (such as Touch 'n Go, GrabPay, DuitNow and FPX providers) receive only the minimum transaction data necessary to process payments. All such providers are bound by confidentiality agreements and adhere to strict data security standards.
• Game software providers: Live casino and sports game providers that partner with my888 may receive minimal technical data (such as game session IDs) necessary for game delivery. They do not receive your personal identifying information.
• Competent authorities: my888 may be required to disclose members' personal data to law enforcement agencies, courts, or Malaysian government authorities if compelled by a valid court order or applicable law. We will not disclose more than what is legally required.
• Auditors & professional consultants: In the context of internal or external audits, appointed auditors may have access to transaction records in their professional capacity. All such parties are bound by professional confidentiality agreements.

My888 retains your personal data only for as long as necessary to fulfil the original purpose of collection, or as required by Malaysian law. The following is a general guide to our data retention periods:

• Active account data: For as long as your my888 account remains active, basic personal data such as your name, phone number, and email address will be retained for ongoing account management purposes.
• Financial transaction records: Deposit, withdrawal, and gaming transaction records are retained for a minimum of 7 years from the transaction date, in line with Malaysia's accounting and anti-money laundering legal requirements.
• Support communication logs: Customer support conversation records are retained for 2 years from the date of last communication, for reference and dispute resolution purposes.
• Data after account closure: Once your account is closed, my888 will delete or anonymise your personal data that is no longer needed within 90 days, except for data that must be retained to comply with legal requirements.
• Identity verification documents: MyKad or passport copies submitted for withdrawal verification purposes will be deleted within 30 days of successful verification, unless a longer retention period is required by law.

My888 uses cookies and similar tracking technologies to enhance the user experience, analyse platform traffic, and maintain login session security. Cookies are small text files stored in your web browser when you visit the my888 website.

My888 uses three types of cookies:

• Essential cookies: Required for core platform functions such as login verification, session management, and security. These cookies cannot be disabled as they are essential for the platform to operate. They do not store any personally identifiable information.
• Functional cookies: Stores your preferences such as language, display settings, and gaming session information, allowing my888 to deliver a more personalised experience. You may disable these cookies, though some platform features may be affected.
• Analytics cookies: Used to understand, in aggregate, how members use the my888 platform — which pages are visited most often, average session duration, and navigation patterns. This data is used to improve the platform and does not contain any personally identifiable information.

You can manage and delete cookies through your web browser settings. Please note, however, that disabling essential cookies may affect your ability to log in and use the my888 platform fully.

My888 implements multiple layers of technical and organisational security measures to protect member personal data from unauthorised access, loss, destruction or accidental disclosure:

• Data encryption in transit: All communications between your device and my888's servers are encrypted using TLS 1.3 with 256-bit SSL encryption — the highest security standard available for web applications.
• Data encryption at rest: Sensitive member data such as passwords and financial information is encrypted in the database using strong encryption algorithms before being stored. Passwords are never stored in plain text — they are saved as irreversible hashes.
• Strict access controls: Access to member data within my888's systems is restricted based on a least-privilege principle – only staff with a legitimate operational need are granted access to specific data, and all such access is logged and continuously monitored.
• 24/7 security monitoring: my888's systems are continuously monitored to detect any suspicious activity, intrusion attempts, or security anomalies. Any security incidents will be addressed promptly by our technical security team.
• Regular security audits: my888 conducts regular internal and external security audits to identify and address system vulnerabilities before they can be exploited.
• Staff training: All my888 staff with access to member data receive comprehensive data protection training and are bound by strict confidentiality agreements.

When you make a deposit or withdrawal on my888 using Malaysian payment methods such as Touch 'n Go eWallet, GrabPay, DuitNow, FPX (Maybank2u, CIMB Clicks), Boost, or ShopeePay, my888 only collects the minimum transaction information needed to verify your payment — namely the transaction reference number, amount, and payment status.

My888 does not store your full bank account number, debit card number or e-wallet login credentials. All sensitive payment information is processed directly by authorised third-party payment gateways, not through my888's servers. This means your most sensitive financial details never reside in my888's storage.

Your winnings will only be withdrawn to the same payment method used for your deposit — this is a standard security measure to prevent money laundering and ensure funds are returned to the rightful owner. All transactions are conducted in Malaysian Ringgit (RM) with no currency conversion fees or hidden charges.

Under Malaysia's Personal Data Protection Act 2010 (PDPA 2010), you as a my888 member hold important rights regarding your personal data. my888 is committed to respecting and facilitating the exercise of these rights:

• Right to access data: You have the right to request a copy of the personal data we hold about you. my888 will process data access requests within 14 business days of receiving them.
• Right to correct data: If the personal data my888 holds about you is inaccurate, incomplete or out of date, you have the right to request a correction. Updates will be made within 7 business days.
• Right to withdraw consent: Where data processing is based on your consent (such as for promotional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to object to processing: In certain circumstances, you may object to the processing of your personal data for specific purposes, such as direct marketing. Contact the my888 support team to discuss your options.
• Right to erasure: Once your account is closed and there is no legal requirement to retain your data any further, you have the right to request the deletion of your personal data from my888's systems.

To exercise any of the rights above, please contact the my888 privacy support team by email at support@my888.run, clearly stating the right you wish to exercise along with sufficient information for us to verify your account.

The my888 platform is intended exclusively for adults aged 18 and above. my888 does not knowingly collect or process personal data from individuals under the age of 18. Should we discover that we have collected data from a minor, we will take immediate steps to delete that data and close the associated account.

Parents or guardians who discover that their minor child has registered a my888 account are advised to contact our support team immediately at support@my888.run. my888 will treat such cases with the highest priority, ensuring the account is closed and all data deleted as quickly as possible.

My888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data protection practices, applicable legislation, or the services we offer.

When material changes are made to this Privacy Policy, my888 will notify members via a prominent notice on the platform's main page and/or by email to the address registered to your account. Changes will take effect 14 days after the notice is issued, unless an earlier implementation date is required by law.

Continued use of the my888 platform after any policy changes take effect will be considered your acceptance of the updated Privacy Policy. If you do not agree with the changes, please stop using the platform and contact us to close your account.

If you have any questions, concerns or complaints about how my888 handles your personal data, our Malaysia-based support team is available to assist you at any time:

• Live Chat: Available directly on the my888 platform – responses are typically within minutes, 24 hours a day, 7 days a week.
• Email: support@my888.run – for privacy-related enquiries and data access requests, with a response time of 3 business days.

This Privacy Policy was last updated in January 2026. For any questions regarding your rights under PDPA 2010 that cannot be resolved through my888's support channels, you may contact the Department of Personal Data Protection (JPDP) Malaysia for further guidance.