Ringgit888 Privacy Policy – Malaysian Player Personal Data Protection

Introduction & Privacy Commitment

Ringgit888 takes our responsibility to your privacy seriously. This Privacy Policy describes the data collection, use, storage, and protection practices governing personal data handled by ringgit888 ("we", "Platform") for all users and registered members.

This policy is prepared in accordance with Personal Data Protection Act 2010 (PDPA) Malaysia and adopted international data protection standards. By using the ringgit888 platform, you give us your informed consent to process your personal data in accordance with the terms set out in this document.

We believe transparency is the foundation of trust. That is why this Privacy Policy is written in plain, easy-to-understand language — not complicated legal jargon — so you truly know what is happening with your information.

Types of Personal Data We Collect

Ringgit888 collects various types of personal data depending on your interactions with the platform. This is organized into three main categories:

Identity Data — information that directly identifies you as an individual:

• Full name as shown on MyKad or passport.
• MyKad or passport number (for KYC and age verification purposes).
• Date of birth and gender.
• Current residential address.
• Registered mobile number.
• Active email address.

Financial Data — transaction and payment-related information:

• Bank account number (for withdrawal and KYC verification purposes).
• Bank name and account type.
• EWallet details (Touch 'n Go, GrabPay) linked to your account.
• Deposit and withdrawal transaction history.
• Crypto wallet address used for withdrawals (where applicable).

Platform Usage Data — information about how you interact with the platform:

• IP address and device information used.
• Login history including date, time, and approximate location.
• Game history and wagering activity.
• Account options and settings.
• Records of communications with customer support.

How We Collect Data

Your personal data is collected through several key channels, and we always ensure collection only takes place when there is a legitimate need:

• Account Registration — when you complete the registration form and submit your KYC documents.
• Platform Usage — automatically when you play, make a deposit or withdrawal, or contact support.
• Identity Verification — during the KYC process when you upload your identity documents.
• Communications — when you contact our support team via live chat or email.
• Cookies & Tracking Technologies — automatically as you browse the platform (see Section 07).

We do not purchase or obtain personal data from third-party data brokers. Every piece of data we hold is either provided directly by you or generated through your own use of the platform.

Purpose of Personal Data Use

Ringgit888 uses collected personal data solely for legitimate purposes that have been disclosed to you at the point of collection. Primary purposes include:

• Account Management — creating, maintaining, and protecting your account on the ringgit888 platform.
• Identity Verification (KYC) — verifying that you meet the age requirements, confirming your identity, and fulfilling legal compliance obligations.
• Payment Processing — processing deposits and withdrawals securely to your verified account in your name.
• Customer Support — handling enquiries and complaints, and assisting with the resolution of technical or financial issues.
• Security & Fraud Prevention — detecting and preventing fraudulent activity, money laundering, and unauthorised access.
• Legal Compliance — meeting regulatory obligations, complying with court orders, or cooperating with authority investigations.
• Platform Improvements — analysing usage patterns to improve the platform's performance, usability, and overall experience.
• Service Communications — sending important notifications related to your account, security, or changes to our terms.

For marketing communications such as promotions and special offers, we only send these to you if you have given your explicit consent, and you may unsubscribe at any time through your account settings.

Data Sharing & Disclosure to Third Parties

Ringgit888 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Your data belongs to you, and we respect this principle.

However, in the context of service operations, we may share necessary data with the following parties:

• Payment Providers — payment gateways FPX, Touch 'n Go, GrabPay, DuitNow, and crypto processors receive the information necessary to process your transactions.
• KYC Verification Providers — third-party identity verification services that assist us in verifying your KYC documents.
• Cloud Infrastructure — hosting and cloud service providers that store data to high-security standards.
• Legal Authority — when required by law, court order, or a competent law enforcement agency.
• Gaming Business Partners — game providers may receive minimal game session data required for the technical operation of games — not personal identifying information.

All third parties with whom we share data are required to uphold data protection standards no less stringent than our own, and are bound by formal data protection agreements.

Data Protection Measures

Protecting your personal data is not just our legal obligation — it is a moral duty we take seriously. ringgit888 implements multiple layers of security controls to keep your data safe at all times:

• Encryption in Transit — all data transmitted between your browser and our servers is protected by SSL/TLS 256-bit. No one can read that data even if they successfully intercept network traffic.
• Encryption at Rest — sensitive data such as passwords, bank account numbers, and KYC documents are stored in encrypted form using AES-256 encryption algorithms.
• Internal Access Control — ringgit888 staff only have access to the data genuinely required for their role. Access to sensitive data is logged and audited on a regular basis.
• Two-Factor Authentication — login to internal administration systems requires multi-factor authentication.
• Regular Vulnerability Scanning — the platform undergoes regular penetration testing and security vulnerability scans conducted by independent parties.
• Incident Response Plan — in the event of any security incident involving your data, we have clear procedures in place to detect, contain, and notify affected parties within the required timeframe.

Cookies, Local Storage & Tracking Technologies

The ringgit888 platform uses cookies and similar tracking technologies to enhance your experience and ensure the platform runs smoothly. Below are the types of cookies we use:

• Essential Cookies — required for core platform functions such as login sessions, betting slips, and security. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies — saving your preferences such as language, display settings, and preferred payment method for a smoother experience next time.
• Analytics Cookies — collecting anonymous data on how users interact with the platform to help us identify areas for improvement.
• Security Cookies — detecting suspicious activity, unauthorised login attempts, and supporting our risk control systems to function effectively.

You can manage or delete cookies through your browser settings. However, disabling essential cookies may cause some platform features to not function properly. We do not use cross-site tracking cookies for off-platform marketing purposes.

Your Rights as a Data Owner

Under Malaysia's PDPA and this Privacy Policy, you have the following rights regarding your personal data held by ringgit888:

• Right of Access — you have the right to request a copy of the personal data we hold about you. This request will be processed within 14 business days.
• Right to Rectification — if your data is inaccurate or out of date, you have the right to request a correction. Corrections will be applied once the necessary verification is completed.
• Right to Erasure — you may request the deletion of your personal data, subject to our obligations to retain certain data for legal compliance or the resolution of outstanding disputes.
• Right to Withdraw Consent — you may withdraw consent for certain data processing activities (such as marketing communications) at any time without affecting the validity of any processing that took place prior to your withdrawal.
• Right to Object — you may object to the processing of your data for specific purposes, and we will give that objection serious consideration.
• Data Portability Right — you have the right to receive a copy of your data in a machine-readable format for the purpose of transferring it to another service.

To exercise any of the above rights, contact our Data Protection Officer via live chat or the email address available on the platform. We will verify your identity before processing any data-related request.

Data Retention and Deletion Period

Ringgit888 retains your personal data only for as long as necessary for the original purpose of collection or as required by law. The following are general data retention guidelines:

• Active Account Data — retained for as long as your account is active and for an additional 5 years after account closure, to meet AML compliance obligations.
• Transaction Records — retained for 7 years after a transaction occurs, in line with accounting and audit legal requirements.
• KYC Documents — retained for 5 years after the business relationship ends, or longer if required by the relevant authorities.
• Support Communication Logs — retained for 3 years for dispute reference and service improvement purposes.
• Analytics & Access Log Data — retained for 12 months in identifiable form, then fully anonymised.

Once the retention period expires, data is securely deleted using recognized erasure methods — ensuring it cannot be recovered by any party. For anonymized data, no maximum retention period applies as it can no longer be linked to any specific individual.

Amendments to This Privacy Policy

Ringgit888 reserves the right to update this Privacy Policy from time to time to reflect changes in data processing practices, legal requirements, or platform improvements. Every update will be accompanied by a clearly marked revision date at the top of the document.

For significant amendments that affect how we process your data, we will:

• Notifying you via your registered email at least 14 days before the amendments take effect.
• Displaying a clear notice on the platform during login for a specified period.
• In certain cases, re-requesting your consent if the nature of data processing changes fundamentally.

The latest update date of this document is January 2026. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.