Privacy Policy — efek88

This Privacy Policy (hereinafter referred to as "the Policy" or "this Policy") sets out the data protection practices of the online gaming platform operating under the brand name efek88, accessible at efek88.cam (hereinafter referred to as "the Platform", "the Website", "efek88", "we", "us", or "our"). This Policy applies to all personal data collected, processed, stored, and transmitted by efek88 in connection with your use of the Platform and related services.

efek88 respects your right to privacy and is committed to handling your personal information responsibly, transparently, and in accordance with internationally recognised data protection standards. This Policy explains what personal data we collect from players across Malaysia — including users from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — why we collect it, how we use it, and the rights available to you in relation to your data.

This Policy should be read together with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated herein by reference. By registering an account, making a deposit, or otherwise using the efek88 Platform, you confirm that you have read and understood this Privacy Policy and consent to the data practices described herein.

In this Policy, unless the context otherwise requires, the following terms have the meanings assigned to them below:

The Data Controller responsible for your Personal Data collected through the efek88 Platform is the entity that owns and operates the efek88 brand under its applicable international online gaming licence. As a platform primarily serving Malaysian players, efek88 recognises the relevance of the Malaysia Personal Data Protection Act 2010 (PDPA) to the reasonable expectations of its Malaysian user base, and endeavours to uphold equivalent standards of data stewardship even where the PDPA may not strictly apply by jurisdiction.

Queries regarding data controller identity, data protection obligations, or specific compliance questions may be directed to our support team via the contact details provided in Section 17 of this Policy.

efek88 collects the following categories of Personal Data from Users of the Platform:

• Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identity documents (e.g., Malaysian MyKad, passport) submitted during KYC verification.
• Contact Data: Email address, mobile phone number, and residential address as provided during account registration or subsequently updated by the User.
• Financial Data: Bank account numbers, e-wallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay registered phone numbers), cryptocurrency wallet addresses, deposit and withdrawal transaction records, and account balance history.
• Technical Data: IP address, device type, browser type and version, operating system, screen resolution, referring URLs, session duration, and login timestamps.
• Behavioural & Usage Data: Game history, bet records, sports markets accessed (including Liga Super Malaysia, EPL, and other covered markets), bonus participation history, session frequency, and in-platform navigation patterns.
• Communications Data: Records of your interactions with efek88 customer support, including live chat transcripts, email correspondence, and support ticket content.
• Compliance Data: Self-exclusion status, responsible gambling tool activations, AML screening results, and KYC verification outcomes.

Where you provide Personal Data about third parties (for example, a referred friend's name or contact details in connection with a referral programme), you represent and warrant that you have obtained all necessary consents from those third parties for efek88 to process their data as described in this Policy.

efek88 collects Personal Data through the following means:

• Direct submission: When you create an Account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, or participate in any promotional offer.
• Automated technical collection: Via cookies, web beacons, server logs, and similar tracking technologies as you navigate the Platform. See Section 8 for full details on our cookie practices.
• Third-party sources: From identity verification agencies, payment processors (including DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong banking systems), fraud prevention services, and publicly available sanctions or watch-list databases used for AML screening.
• Referral programmes: Where a third-party User provides your contact information in connection with efek88's Refer a Friend programme, subject to your subsequent independent registration and consent.

efek88 processes Personal Data only where a lawful basis for such processing exists. The following table summarises the primary purposes for which we process Personal Data and the corresponding legal bases:

Where processing is based on your consent, you may withdraw that consent at any time by contacting our support team or adjusting your Account preferences. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.

The following section provides further detail on specific data processing activities of particular relevance to efek88 Users:

Payment Processing: Financial data submitted in connection with deposits and withdrawals via Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency networks is transmitted to and processed by the relevant licensed payment service provider. efek88 does not store full bank account credentials or e-wallet PINs on its own servers. Payment data is tokenised wherever technically feasible.

KYC and AML Screening: Identity document images submitted during KYC verification are transmitted to third-party identity verification service providers under data processing agreements. These providers process your documents solely for the purpose of identity confirmation and sanctions screening. Results and associated data are retained as required under applicable licensing and AML obligations.

Behavioural Analytics: Aggregated and anonymised usage data (game preferences, session patterns, bet frequency) is processed to improve the Platform's performance, personalise your experience, and identify patterns consistent with problem gambling for responsible gaming intervention purposes.

Marketing Communications: Where you have opted in to receive promotional communications, efek88 may use your email address and mobile number to send you notifications about new promotions, bonus offers, and platform updates. You may opt out of marketing communications at any time by contacting customer support or using the unsubscribe mechanism in any email communication.

efek88 uses cookies and similar tracking technologies to operate the Platform, recognise returning users, maintain session integrity, and analyse Platform usage. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential for the Platform to function. These cannot be disabled. They include session authentication cookies, security tokens, and load-balancing identifiers.
• Functional Cookies: Remember your preferences (e.g., language setting, currency display) to provide a more personalised experience. Disabling these may affect certain Platform features.
• Analytics Cookies: Used to collect aggregated data about how Users interact with the Platform — pages visited, session duration, device type, and navigation paths. This data is used solely to improve Platform performance and user experience.
• Security Cookies: Support fraud detection, bot prevention, and account integrity verification to protect registered Users and the Platform from malicious activity.

You may configure your browser to refuse all or certain categories of cookies. Please be aware that disabling strictly necessary cookies may impair your ability to log in, place bets, or access core Platform functions. efek88 does not use third-party advertising cookies or cross-site tracking cookies for commercial advertising purposes.

efek88 does not sell, rent, or trade your Personal Data to third parties for commercial purposes. Personal Data is shared only in the following limited and necessary circumstances:

• Licensed Payment Processors: Financial data is shared with payment service providers including e-wallet operators, FPX-connected banks, and cryptocurrency exchange partners solely to process your deposit and withdrawal transactions.
• Identity Verification Providers: KYC documentation and related Personal Data is shared with third-party identity verification and AML screening services operating under binding data processing agreements with efek88.
• Licensing and Regulatory Authorities: efek88 may be required to disclose Player data to its licensing authority or law enforcement agencies in response to lawful requests, court orders, or regulatory inquiries. Such disclosures are made only to the extent required by law.
• Technology and Infrastructure Partners: Hosting providers, cybersecurity vendors, and platform infrastructure partners who process data on efek88's behalf under appropriate contractual data protection commitments.
• Fraud Prevention Networks: In cases of suspected fraud, account abuse, or money laundering, anonymised or pseudonymised risk signals may be shared with industry fraud prevention networks to protect the broader player community.

As an internationally licensed platform, efek88 may transfer Personal Data to servers, service providers, or processing entities located outside of Malaysia. Such transfers occur where necessary to provide the Services — for example, where identity verification providers, payment processors, or cloud infrastructure providers operate from overseas jurisdictions.

Where Personal Data is transferred internationally, efek88 takes steps to ensure that an adequate level of protection is applied to that data, including through the use of contractual data protection clauses, data transfer agreements, or reliance on jurisdiction-specific data protection frameworks as applicable.

Malaysian Users should be aware that data protection laws in destination countries may differ from Malaysian standards under the Personal Data Protection Act 2010. efek88 endeavours to ensure your data receives equivalent protection regardless of where it is processed.

efek88 retains Personal Data only for as long as is necessary to fulfil the purposes described in this Policy or as required by applicable legal and licensing obligations. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the active Account and for a minimum of five (5) years following account closure, in accordance with AML and licensing record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) to seven (7) years from the date of each transaction, as required under standard financial compliance obligations.
• Customer support communications: Retained for up to three (3) years from the date of the most recent interaction, or longer where a complaint or dispute is unresolved.
• Technical and behavioural data (anonymised): Aggregated, anonymised usage analytics may be retained indefinitely for Platform improvement purposes, as anonymised data is no longer considered Personal Data.

Upon expiry of applicable retention periods, Personal Data is securely deleted, anonymised, or archived in accordance with efek88's internal data lifecycle management policy.

efek88 implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and efek88's servers;
• Encrypted storage of sensitive data at rest, including financial records and KYC documentation;
• Two-factor authentication (2FA) available to all registered Users for enhanced account login security;
• Role-based access controls ensuring that only authorised efek88 personnel with a legitimate need can access specific categories of Personal Data;
• Regular penetration testing, vulnerability assessments, and security audits conducted by independent third-party cybersecurity specialists;
• Intrusion detection systems, anomaly monitoring, and 24/7 security operations oversight.

Despite these measures, no online platform can guarantee absolute security against all threats. In the event of a data breach that is likely to result in a high risk to Users, efek88 will notify affected Users without undue delay in accordance with its notification obligations under applicable licensing requirements.

Subject to applicable law and efek88's legitimate interests and legal obligations, you have the following rights with respect to your Personal Data held by efek88:

• Right of Access: You may request a copy of the Personal Data efek88 holds about you, together with information on how it is used and with whom it is shared.
• Right to Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. You may also update certain Account details directly through the Account settings panel.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to overriding legal obligations — efek88 cannot delete data required under AML or licensing record-keeping requirements.
• Right to Restriction of Processing: You may request that efek88 restrict processing of your Personal Data in certain circumstances, for example where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Where an objection to direct marketing is received, efek88 will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the rights above, please contact efek88 via the details provided in Section 17. We will respond to your request within 30 days of receipt, or within a shorter period where required by applicable law. Where a request is complex or numerous, we may extend the response period by a further 60 days, of which you will be notified.

The efek88 Platform is strictly intended for persons aged 21 years and above. efek88 does not knowingly collect, process, or retain Personal Data from individuals under the age of 21. Age verification is a mandatory component of the KYC process, and any Account found to be operated by or on behalf of a minor will be immediately suspended.

If efek88 becomes aware that Personal Data has been collected from an individual under the age of 21 without valid parental consent, we will take immediate steps to delete that data and close the associated Account. If you are a parent or guardian and believe that your child's data may have been submitted to efek88 without your knowledge, please contact us immediately via the details in Section 17.

As a platform primarily used by Malaysian players, efek88 acknowledges the significance of the Personal Data Protection Act 2010 (PDPA) to the reasonable privacy expectations of its Malaysian user base. While efek88 operates under international licensing and the PDPA may not apply directly by jurisdiction, efek88 voluntarily upholds the following principles consistent with the PDPA's General Principles:

• Personal Data is collected only for lawful purposes directly related to the provision of gaming services;
• Personal Data is not processed beyond what is necessary for the stated purpose;
• Users are notified of the types of data collected and the purposes at the time of collection;
• Reasonable steps are taken to ensure data accuracy and currency;
• Technical and organisational security measures are maintained to protect data integrity;
• Personal Data is retained only for as long as necessary;
• Users have the ability to access and correct their Personal Data.

Malaysian Users who have concerns about the handling of their Personal Data by efek88 are encouraged to contact our Data Protection contact via the details in Section 17.

efek88 reserves the right to amend, update, or replace this Privacy Policy at any time. Where material changes are made — particularly changes that affect how your Personal Data is processed, the categories of data we collect, or third parties with whom we share data — efek88 will notify registered Users via the email address associated with their Account and/or through a prominent notice on the Platform prior to the effective date of the change.

The date on which this Policy was most recently updated is indicated in the "Last Updated" notice at the top of this page. Continued use of the efek88 Platform following the effective date of any amendment shall constitute your acceptance of the revised Policy. We recommend reviewing this page periodically to remain informed of our current data practices.

For any queries, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data by efek88, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly through the efek88 Platform. Average response time: 3–5 minutes.
• Email: [email protected] — please include "Privacy Request" in the subject line for data protection related enquiries. Email responses are provided within 24 hours for general enquiries, and within 30 days for formal data subject rights requests.

Formal data subject rights requests (access, rectification, erasure, portability, or restriction) must be submitted in writing via email to the address above, clearly identifying yourself as an efek88 registered User and specifying the nature of your request. For security purposes, we may request proof of identity before processing any data subject rights request.

For further information on your account's data settings, deposit limits, self-exclusion options, or responsible gambling controls, please visit our Responsible Gambling page or contact our support team directly.