k888 Privacy Policy

Who We Are

k888 is an online gaming platform operated at k888.lat and all associated subdomains ("the Platform"). For the purposes of this Privacy Policy, k888 acts as the data controller in respect of personal data collected from Players and visitors to the Platform.

This Privacy Policy applies to all personal data processed by k888 in connection with: registration and maintenance of Player Accounts; deposits and withdrawals; gameplay and betting activity; customer support interactions; and marketing communications (where consented to). This Policy is incorporated by reference into the k888 Terms & Conditions.

If you have questions about how k888 handles your personal data, please contact our data team at [email protected] before submitting a formal complaint.

Personal Data We Collect

k888 collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include:

• Identity data: Full legal name, date of birth, nationality, and copies of identity documents provided during know-your-customer (KYC) verification.
• Contact data: Email address, Malaysian mobile telephone number, and residential address.
• Financial data: Bank account details, e-wallet account identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, etc.), transaction histories, deposit and withdrawal records.
• Account data: Username, encrypted password hash, account preferences, responsible gaming limit settings, and communication preferences.
• Technical data: IP address, device identifiers, browser type and version, operating system, screen resolution, and session timestamps.
• Usage data: Pages visited on the Platform, games played, bets placed, session duration, click-path data, and feature interactions.
• Communications data: Records of live chat transcripts, support emails, and any correspondence between you and k888.
• Verification documents: Government-issued identification documents (e.g. MyKad, passport) and supporting documents submitted for identity or payment verification purposes.

How We Collect Personal Data

k888 collects personal data through the following means:

• Direct provision: Information you provide when registering an Account, completing KYC verification, making a deposit, submitting a withdrawal request, or contacting customer support.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, log files, and analytics scripts operated by k888 directly.
• Third-party providers: Identity verification data from licensed KYC service providers; payment confirmation data from payment processors (e.g. FPX, Touch 'n Go, DuitNow operators); fraud detection signals from security service providers.
• Publicly available sources: Publicly available sanctions lists and politically exposed person (PEP) databases accessed as part of k888's anti-money laundering compliance obligations.

Purposes of Processing

k888 processes your personal data for the following purposes:

• Account management: Creating, maintaining, verifying, and securing your k888 Account.
• Service delivery: Enabling gameplay, processing bets and wagers, crediting winnings, and operating the Platform's features.
• Payment processing: Executing deposit and withdrawal transactions and preventing payment fraud.
• KYC and AML compliance: Verifying your identity and age (21+ requirement) in compliance with our international gaming authority licence and applicable anti-money laundering obligations.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviours and administering self-exclusion, deposit limit, and cool-off requests.
• Customer support: Responding to queries, resolving disputes, and managing complaints.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent, abusive, or unlawful activity on the Platform.
• Marketing (with consent): Sending promotional communications, personalised offers, and bonus notifications where you have opted in to receive such communications.
• Platform improvement: Analysing usage data in aggregate to improve the performance, design, and content of the k888 Platform.
• Legal compliance: Meeting our obligations under applicable law, regulatory requirements, and orders from competent authorities.

Legal Basis for Processing

k888 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between k888 and you as a registered Player — including Account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC, AML, age verification, and licence conditions imposed by our gaming authority.
• Legitimate interests: Processing undertaken in pursuit of k888's legitimate interests in operating a secure, fair, and commercially viable platform — including fraud prevention, security monitoring, and platform analytics — provided those interests are not overridden by your privacy interests or fundamental rights.
• Consent: Processing based on your freely given, specific, and informed consent — principally in relation to marketing communications. You may withdraw consent at any time by contacting k888 support or updating your Account communication preferences.

Sharing of Personal Data

k888 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. k888 shares personal data only in the following limited circumstances:

• Service providers: Third-party processors engaged by k888 to provide KYC verification, payment processing, fraud detection, cloud hosting, and customer support technology. Such providers are contractually bound to process your data only on k888's instructions and in accordance with this Policy.
• Gaming authority: Our international gaming authority licence requires k888 to provide certain player data and audit records to the licensing authority upon request.
• Law enforcement and regulators: k888 will disclose personal data to competent governmental, regulatory, or law enforcement authorities where required to do so by law, court order, or regulatory direction.
• Group entities: Where k888 operates through affiliated entities, personal data may be shared within the group solely for the purposes described in this Policy and subject to equivalent data protection safeguards.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of k888's assets, Player data may be transferred to the successor entity, subject to equivalent privacy protections and prior notice to affected Players.

International Data Transfers

k888 operates under an international gaming authority licence and may process or store Player data on servers located outside Malaysia. Where personal data is transferred to jurisdictions that do not provide a level of data protection equivalent to that recognised by applicable Malaysian law, k888 will implement appropriate safeguards — including standard contractual clauses or binding corporate rules — to ensure that your personal data receives an adequate level of protection throughout its lifecycle.

By using the k888 Platform, you acknowledge that your personal data may be transferred to and processed in countries outside of Malaysia in accordance with this section.

Data Retention

k888 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods:

• Account and transaction records: Retained for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements under k888's gaming licence.
• KYC documents: Retained for a minimum of five (5) years following the completion of the last transaction or the closure of the Account, whichever is later.
• Customer support communications: Retained for three (3) years following resolution of the relevant query or dispute.
• Marketing consent records: Retained for three (3) years following the withdrawal of consent or the last interaction, whichever is later.
• Technical and usage data: Retained in identifiable form for up to twenty-four (24) months, after which it is anonymised or deleted.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised.

Cookies & Tracking Technologies

k888 uses cookies and similar tracking technologies on the Platform. The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the Platform to function, including session management, login authentication, and security. These cookies cannot be disabled without impairing core Platform functionality.
• Performance and analytics cookies: Used to collect aggregate information about how Players interact with the Platform — including which pages are most visited, session duration, and error rates — to help k888 improve the Platform experience.
• Functional cookies: Used to remember your preferences, such as language settings and responsible gaming limit configurations, across sessions.
• Marketing cookies (with consent): Used to deliver relevant promotional content and to measure the effectiveness of k888's marketing campaigns. These cookies are only activated where you have given explicit consent.

You may control cookie settings through your browser. Note that disabling certain cookies may affect the functionality of the k888 Platform.

Security Measures

k888 implements appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• 256-bit SSL encryption for all data transmissions between your device and the k888 Platform.
• Encryption of passwords using one-way hashing algorithms — k888 does not store plain-text passwords.
• Segregation of Player funds from operational accounts.
• Role-based access controls limiting staff access to personal data to those with a documented business need.
• Regular internal security audits and penetration testing.
• Incident response procedures with defined timelines for breach notification.

Notwithstanding these measures, no method of transmission over the internet or method of electronic storage is completely secure. k888 cannot guarantee absolute security of your personal data and accepts no liability for losses resulting from security breaches attributable to events beyond k888's reasonable control.

Your Privacy Rights

Subject to applicable law and any overriding obligations k888 has under its gaming licence or anti-money laundering requirements, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data k888 holds about you.
• Right to rectification: You may request correction of any personal data that is inaccurate or incomplete.
• Right to erasure: You may request deletion of your personal data, subject to k888's legal retention obligations.
• Right to restriction of processing: You may request that k888 restricts processing of your personal data in certain circumstances.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling for marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, contact k888 at [email protected]. k888 will respond to all valid requests within 30 days.

Children's Privacy

The k888 Platform is strictly restricted to individuals aged 21 years and above. k888 does not knowingly collect personal data from persons under the age of 21. If k888 becomes aware that personal data has been collected from a person under 21, that Account will be immediately suspended, all associated Funds will be forfeited, and the data will be deleted without delay.

If you believe that a person under the age of 21 has registered an Account with k888, please notify us immediately at [email protected].

Third-Party Links

The k888 Platform does not contain links to third-party websites for commercial referral purposes. To the extent that any links to third-party services appear in the context of payment processing or identity verification flows operated through embedded third-party technology, k888 is not responsible for the privacy practices of those third parties. We encourage you to review the privacy notices of any third-party services you interact with independently of the k888 Platform.

Updates to This Policy

k888 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Players via the email address associated with their Account and by a notice on the Platform for a period of not less than 30 days prior to the change taking effect.

The date of the most recent update is displayed at the top of this page. Continued use of the k888 Platform after an updated Privacy Policy has taken effect constitutes your acknowledgement of the updated Policy.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or k888's handling of your personal data, please contact the k888 data team:

• Email: [email protected] (plain text — not a clickable link)
• Response time: k888 targets an initial response to all privacy-related enquiries within 5 business days and a full response within 30 calendar days.

If you are dissatisfied with k888's handling of your personal data after raising the matter directly with us, you have the right to lodge a complaint with the relevant data protection authority or the gaming authority that issued k888's operating licence.