Privacy Policy — Syarikat88

Syarikat88 ("we", "us", "our", "the Company") operates the online casino and sports betting platform accessible at syarikat88.cam (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who interact with our Platform, including registered Members, prospective users, and visitors.

This Privacy Policy ("Policy") sets out, in accordance with applicable data protection and privacy obligations, the types of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, and the rights available to you in respect of your personal data. It applies to all data processing activities carried out by or on behalf of the Company in connection with the Platform.

By registering an account, accessing the Platform, or otherwise providing your personal data to us, you acknowledge that you have read and understood this Policy. This Policy forms part of our Terms & Conditions, which are available at syarikat88.cam/terms-conditions.

In this Policy, the following terms carry the meanings assigned below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, contact details, or any factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. In respect of this Platform, the Data Controller is Syarikat88.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller pursuant to documented instructions.
• "Member" — a natural person who has successfully completed the account registration process on the Platform.
• "Cookies" — small text files placed on a user's device by a website server for the purposes of session management, preference storage, or analytics.

Syarikat88 acts as the Data Controller in respect of all personal data collected from Members and visitors in connection with the operation of the Platform. As Data Controller, the Company is responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection obligations.

Where the Company engages third-party service providers to process personal data on its behalf — such as payment processors, fraud prevention services, and customer support technology providers — those providers act as Data Processors and are contractually bound to process personal data only in accordance with the Company's documented instructions and this Policy.

The Company collects the following categories of personal data in connection with the operation of the Platform. We collect only what is necessary for the purposes described in this Policy.

We collect personal data through the following means:

Direct Collection

Data you provide directly when you register an Account, complete KYC documentation, submit a deposit or withdrawal request, contact our support team, or update your account preferences. This includes all information entered into forms and fields on the Platform.

Automated Collection

Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, server log files, and similar tracking technologies embedded in the Platform. This data is collected on each visit regardless of whether you are logged into an Account.

Third-Party Sources

Identity and fraud-screening data received from third-party KYC and anti-money laundering service providers engaged by the Company as part of the account verification process. Payment-related data received from our integrated payment processors, including DuitNow, FPX, and banking partners such as Maybank, CIMB, Public Bank, and Hong Leong.

The Company processes personal data for the following specific purposes:

• Account Management: To create, maintain, and administer your Member Account, process login requests, and manage account security including password resets and two-factor authentication.
• Transaction Processing: To process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and other integrated payment channels, and to maintain accurate transaction records denominated in Malaysian Ringgit (MYR/RM).
• Identity Verification (KYC): To verify your identity and confirm eligibility to use the Platform, including age verification (21+ requirement), in compliance with applicable anti-money laundering obligations.
• Platform Delivery: To provide and improve the sports betting, live casino, slots, and other gaming products offered on the Platform, including personalising the gaming experience where applicable.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, account compromise, and other security incidents, including through automated monitoring of betting patterns and account activity.
• Customer Support: To respond to your queries, complaints, and requests submitted through live chat or email, and to maintain records of communications for quality and dispute resolution purposes.
• Responsible Gambling: To administer and enforce responsible gambling tools elected by Members, including deposit limits, loss limits, self-exclusion orders, and session time reminders.
• Legal and Regulatory Compliance: To meet the Company's obligations under applicable law, including responding to lawful requests from regulatory or law enforcement authorities.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates by email or in-platform notification, where you have provided consent or where permitted by applicable law. You may opt out at any time.
• Analytics and Platform Improvement: To analyse aggregated usage data for the purpose of improving Platform performance, game offerings, and the user experience.

We process your personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing required for the performance of the Member agreement between you and the Company — including account registration, transaction processing, and the delivery of gaming services.
• Legitimate Interests: Processing carried out in pursuit of the Company's legitimate business interests, including fraud prevention, platform security, and analytics, where those interests are not overridden by your rights and interests.
• Legal Obligation: Processing required to comply with applicable law, including KYC and anti-money laundering obligations, and responses to lawful regulatory requests.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — primarily in respect of direct marketing communications. Where consent is the basis for processing, you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

Syarikat88 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may disclose personal data to the following categories of recipients, strictly as necessary for the purposes described in this Policy:

• Payment Processors: Third-party payment service providers (including DuitNow operators, FPX, Touch 'n Go, Boost, GrabPay, and the relevant banking institutions) for the purpose of processing deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and anti-money laundering screening services engaged to verify Member identity and conduct sanctions screening.
• Technology and Infrastructure Providers: Cloud hosting providers, cybersecurity services, and platform software vendors who process personal data solely as Data Processors under contractual data processing agreements.
• Customer Support Technology: Live chat and support ticketing platform providers engaged to facilitate Member support communications.
• Legal and Regulatory Authorities: Government agencies, law enforcement authorities, and regulators where disclosure is required by applicable law, court order, or regulatory direction.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged by the Company in the course of professional advisory services, subject to applicable professional confidentiality obligations.

All third-party Data Processors engaged by the Company are required, by contract, to implement appropriate technical and organisational security measures, process personal data only as instructed, and not retain personal data beyond the period necessary for the relevant processing purpose.

The Company retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active Member Account is retained for the duration of the Account's existence and for a defined period following Account closure, as required by applicable anti-money laundering and gaming regulatory obligations.
• Transaction Records: Financial transaction records, including deposit and withdrawal histories, are retained for a minimum period as required by applicable financial record-keeping obligations, typically not less than five (5) years from the date of the relevant transaction.
• KYC Documentation: Identity verification documents are retained for the period required by applicable anti-money laundering regulations from the date of the last transaction or Account closure, whichever is later.
• Support Communications: Records of customer support interactions are retained for a period of two (2) years from the date of the communication, unless they are relevant to an ongoing dispute or regulatory investigation.
• Marketing Data: Email marketing preferences and consent records are retained until you withdraw consent or opt out, plus a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with the Company's data destruction procedures.

The Company implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive personal data and financial data at rest within the Company's data storage infrastructure;
• Role-based access controls limiting access to personal data to authorised personnel with a documented legitimate business need;
• Two-factor authentication (2FA) options for Member Accounts to protect against unauthorised account access;
• Continuous automated monitoring of Platform systems for security anomalies, intrusion attempts, and suspicious activity;
• Regular security testing, vulnerability assessments, and independent penetration testing of Platform infrastructure;
• Staff training programmes covering data protection obligations and security awareness.

In the event of a personal data breach that poses a risk to your rights and freedoms, the Company will notify the relevant affected individuals and regulatory authorities in accordance with applicable legal obligations and without undue delay.

The Platform uses cookies and similar tracking technologies to support the delivery of core Platform functions, improve user experience, and assist with analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the functioning of the Platform. These cookies enable core functions such as session management, login authentication, and security features. The Platform cannot function correctly without them. No consent is required for strictly necessary cookies.
• Functional Cookies: Used to remember your preferences and settings — such as preferred language, responsible gambling tool elections, and display preferences — to provide a more personalised experience on subsequent visits.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use the Platform, including which pages are visited most frequently and the paths taken through the Platform. This data informs Platform improvement decisions and does not identify individual users.
• Session Cookies: Temporary cookies that expire when you close your browser session, used to maintain your login state and session security during an active visit to the Platform.

You may configure your browser to refuse some or all cookies, or to notify you when a cookie is being placed. Please note that disabling strictly necessary cookies may prevent some or all Platform functions from operating correctly.

Subject to applicable law and the conditions set out in this Policy, you hold the following rights in respect of your personal data held by Syarikat88. To exercise any of these rights, please contact us via the live chat support channel or email address set out in Section 15.

We will respond to all verified data rights requests within a reasonable period, and in any event no later than thirty (30) days from receipt of your request. Where we require additional time or information to process your request, we will notify you promptly.

The Platform is strictly restricted to individuals aged 21 years and above. The Company does not knowingly collect, process, or retain personal data relating to individuals under the age of 21.

Age verification is a mandatory step in the account registration process. The Company reserves the right to request proof of age documentation — including a copy of a Malaysian identity card (MyKad) or passport — at any stage of the Member relationship.

If the Company becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, it will take prompt steps to delete such data and close the associated Account. If you believe that a minor has registered an Account on the Platform, please notify us immediately via live chat or email.

The Company reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or the Company's data processing practices. The current effective version of this Policy will at all times be accessible at syarikat88.cam/privacy-policy, and the effective date displayed at the top of this page will be updated accordingly.

Where changes to this Policy are material — meaning they affect the nature, scope, or purpose of the processing of your personal data in a significant way — we will notify registered Members by displaying a prominent notice on the Platform upon next login, or by sending a notification to the email address registered on your Account.

Your continued use of the Platform following notification of any change constitutes your acknowledgement of the revised Policy. If you do not agree to any revision, you should cease using the Platform and may request Account closure in accordance with our Terms & Conditions.

If you wish to exercise any of your data rights, raise a concern about how your personal data is being handled, or make a general enquiry about this Privacy Policy, please contact the Syarikat88 data support team through the following channels:

• Live Chat: Available 24/7 via the on-site live chat function. This is the fastest route for data rights requests and account-related privacy queries. Please identify your request as a "data privacy matter" to ensure it is routed to the appropriate team member.
• Email (plain text — not a clickable link):
  [email protected]

All data rights requests must be submitted by the registered Member whose data is the subject of the request, or by a person with documented authority to act on that Member's behalf. We may request identity verification before processing a request.

We aim to acknowledge all requests within five (5) business days and to provide a substantive response within thirty (30) days of receipt of a complete and verified request.