b88 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how b88 ("b88", "we", "us", "our") collects, processes, stores, and discloses personal data relating to individuals ("Member", "User", "you") who access or use the b88 platform available at https://b88.casa and all associated sub-domains, mobile interfaces, and related services (collectively, the "Platform").

b88 is committed to protecting the privacy and personal data of all its members, including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. This Policy is intended to provide full transparency regarding our data handling practices in accordance with applicable data protection standards.

By registering for an account, making a deposit, or otherwise using the b88 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, location data, financial data, or any online identifiers that could reasonably be used to identify that person.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In the context of this Policy, the Data Controller is b88.
• "Data Processor" — a third party that processes personal data on behalf of b88 under a contractual arrangement and in accordance with b88's instructions.
• "KYC Data" — identity and verification documentation submitted by a Member as part of the Know Your Customer (KYC) verification process.
• "Cookie" — a small text file placed on a user's device by a website to store preferences, session information, and analytical data.
• "Sensitive Personal Data" — categories of personal data that warrant heightened protection, including but not limited to identity document numbers, financial account details, and biometric data where applicable.

Data Controller

b88 acts as the Data Controller in respect of personal data collected through the Platform. As Data Controller, b88 is responsible for determining the purpose and manner in which personal data is processed and for ensuring that processing activities comply with applicable data protection obligations.

For all privacy-related enquiries, requests to exercise your data rights, or complaints regarding b88's handling of your personal data, please refer to the contact details set out in Section 17 of this Policy.

Data We Collect

b88 collects personal data in the following categories. The specific data elements collected in each category depend on the services you use and the stage of your relationship with the Platform.

How We Collect Your Data

b88 collects personal data through the following means:

5.1 Directly From You

• At account registration (name, contact details, date of birth);
• During KYC verification (identity documents, address proof);
• When you make a deposit or withdrawal (payment method details);
• When you contact customer support via live chat or email;
• When you respond to surveys, promotions, or marketing communications.

5.2 Automatically Through Platform Use

• Technical data (IP address, device identifiers, session data) collected automatically when you access the Platform;
• Cookies and similar tracking technologies placed on your device — see Section 10 for full details;
• Gaming activity logs generated as you use the casino, sportsbook, or other Platform features.

5.3 From Third Parties

• Identity verification providers used to cross-check KYC documents against official records;
• Payment processors (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX) who confirm transaction status and account ownership;
• Fraud detection and anti-money laundering screening services;
• Responsible gambling databases where a Member has self-excluded through an industry-wide programme.

Legal Basis for Processing

b88 processes personal data only where a lawful basis exists for doing so. The applicable legal bases are as follows:

• Contractual Necessity: Processing required to perform the contract between b88 and the Member — including account operation, payment processing, and delivery of gaming services;
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML), counter-terrorism financing (CTF), and age verification obligations;
• Legitimate Interest: Processing carried out for b88's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and business analytics — provided such interests are not overridden by your rights and interests;
• Consent: Processing based on your freely given, specific, and informed consent — primarily for the purpose of sending marketing and promotional communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

How We Use Your Data

b88 uses the personal data it collects for the following purposes:

• Creating, managing, and maintaining your Member account;
• Processing deposits and withdrawals through your chosen payment method (e-wallet, FPX, DuitNow, bank wire, or cryptocurrency);
• Conducting KYC identity verification and ongoing AML/CTF compliance checks;
• Investigating and resolving disputes, including bet disputes, payment discrepancies, and account queries;
• Detecting and preventing fraud, multi-accounting, bonus abuse, and other prohibited conduct under the Terms & Conditions;
• Monitoring gaming activity to identify signs of problem gambling and to enforce responsible gambling obligations;
• Sending service communications — including account confirmations, security alerts, and transaction notifications — to your registered email address;
• Where you have opted in, sending promotional communications including bonus offers, event notifications, and personalised recommendations;
• Improving the Platform through analytics, user behaviour research, and technical performance monitoring;
• Complying with all applicable laws, regulatory requirements, and orders from competent authorities.

Data Sharing & Disclosure

b88 does not sell, rent, or trade your personal data. We disclose personal data to third parties only in the following circumstances:

8.1 Service Providers

We share data with contracted service providers who assist in operating the Platform, including payment processors, KYC/identity verification providers, fraud detection systems, IT infrastructure providers, and customer support platforms. All such providers are contractually bound to process data only as instructed by b88 and to maintain appropriate security standards.

8.2 Regulatory & Legal Requirements

We may disclose personal data to regulatory authorities, law enforcement agencies, courts, or other public bodies where required or permitted by applicable law — including in response to AML/CTF reporting obligations, lawful court orders, or regulatory investigations. b88 will, where legally permissible, notify the relevant Member of such disclosure.

8.3 Responsible Gambling Programmes

Where required by responsible gambling obligations or where a Member has enrolled in a cross-operator self-exclusion programme, b88 may share limited data (such as membership status) with the relevant programme administrators to enforce exclusion.

8.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of b88's business assets, personal data held by b88 may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and of any material changes to data processing arrangements that result from it.

Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by b88. To exercise any of these rights, please contact our support team as described in Section 17.

b88 will respond to valid data rights requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, this period may be extended by a further sixty (60) days, with notification provided to you. b88 reserves the right to decline requests that are manifestly unfounded or excessive.

Cookies & Tracking Technologies

b88 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device that help us recognise returning users, maintain session states, and understand how the Platform is used.

10.1 Types of Cookies Used

• Essential Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, default currency display (MYR), and preferred game category.
• Analytical Cookies: Collect anonymised data on how users navigate the Platform — pages visited, session duration, click patterns — to help us improve user experience. b88 uses privacy-respecting analytics tools for this purpose.
• Security Cookies: Help detect suspicious activity, prevent fraud, and support account security functions including two-factor authentication state management.

10.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling cookies may affect the functionality of the b88 Platform — in particular, essential cookies are required for login and session management and cannot be disabled without preventing Platform use.

Data Security

b88 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit TLS encryption for all data in transit between your device and the b88 Platform;
• Encryption of sensitive data at rest, including KYC documents and financial account details;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for all administrative systems;
• Automated intrusion detection and anomaly monitoring systems;
• Regular internal and third-party security reviews and penetration testing;
• Secure document storage protocols for KYC and financial documentation.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. In the event of a data breach that is likely to result in a risk to your rights and interests, b88 will notify affected Members in accordance with applicable breach notification requirements.

Data Retention

b88 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law and regulation. The following indicative retention periods apply:

• Account and Registration Data: Retained for the duration of the Member's account plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements;
• KYC Documentation: Retained for a minimum of five (5) years from the date of collection or the date of the last transaction, whichever is later;
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction;
• Gaming Activity Logs: Retained for the duration of the account plus a minimum of three (3) years, used for dispute resolution and responsible gambling monitoring;
• Marketing Preferences: Retained until you withdraw consent or the account is closed;
• Customer Support Communications: Retained for up to three (3) years for quality assurance and dispute reference purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Children's Privacy

The b88 platform is strictly intended for adults aged 21 and above. b88 does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under this age, we will take immediate steps to close the relevant account and delete all associated data.

If you are a parent or guardian and believe that a person under 21 in your care has registered an account with b88, please contact our support team immediately using the contact details in Section 17.

Cross-Border Data Transfers

b88 may transfer personal data to, and process it in, countries outside Malaysia — for example, where our infrastructure or contracted third-party service providers operate servers in other jurisdictions.

Where such transfers occur, b88 takes steps to ensure that the transferred data receives an equivalent level of protection to that afforded under applicable Malaysian data protection standards. Such steps may include contractual data protection clauses with the receiving entity, or reliance on jurisdictions that have been assessed to provide an adequate level of data protection.

For further information about the specific safeguards applied to any cross-border transfer of your personal data, please contact our support team as described in Section 17.

Third-Party Links

The b88 Platform does not contain links to third-party websites, except as expressly required for payment processing (e.g., redirects to banking interfaces for FPX or DuitNow transactions). Where such redirects occur, you are subject to the privacy policies of the relevant third-party payment provider while on their platform.

b88 is not responsible for the privacy practices or content of any third-party website or service, including those of payment processors, and recommends that you review the privacy notices of any third-party platform you access in connection with b88 services.

Changes to This Privacy Policy

b88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered Members via their registered email address and update the "Last Updated" date at the top of this page.

We recommend that you review this Policy periodically to remain informed of how b88 is protecting your personal data. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not accept the amended Policy, you should cease using the Platform and contact support to request account closure.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or b88's handling of your personal data — including requests to exercise your data rights under Section 9 — please contact us through the following channels:

• Live Chat: Available 24/7 via the Platform — average response under 2 minutes. The fastest route for urgent data access or deletion requests.
• Email: [email protected] (plain text — not a clickable link) — responses within 4 business hours. Please mark your subject line "Privacy Request — [your registered email]".
• Support Hours: 24 hours, 7 days a week (GMT+8 — Malaysian Standard Time), including all Malaysian public holidays.