ACB8 Privacy Policy – Malaysia Personal Data Protection

1Introduction & Scope of This Policy

This Privacy Policy is issued by ACB8 ("we", "Platform", "Company") and applies to all individuals who register, browse or use any services offered through the ACB8 platform — including our official website, iOS and Android mobile apps, and any other official channels we operate.

We understand that your trust is our most valuable asset. That is why we have written this Privacy Policy in plain, easy-to-understand language — so you know exactly what happens with your data, not just vague legal provisions. We believe you have the right to know all of this, and we have nothing to hide.

This Policy covers:

• The types of personal information we collect from you.
• The purpose for which we collect and use that information.
• How we store and protect your data.
• Which parties may receive your data and under what circumstances.
• Your rights concerning your personal data and how to exercise them.

If you have any questions regarding this Privacy Policy or how we manage your data, please contact our data protection team via the details stated in Section 11.

2Personal Information We Collect

ACB8 collects your personal information through various means — directly from you during registration, automatically while you use the platform, or from trusted third parties in certain circumstances. Below is a full list of the categories of information we collect:

3Purpose of Data Collection & Use

Every piece of information we collect has a clear and lawful purpose. acb8 uses your personal data for the following purposes:

• Account Management: Creating, verifying and maintaining your member account on the acb8 platform, including secure login processes and two-factor authentication.
• Transaction Processing: Processing deposits, withdrawals and all other financial transactions accurately and securely using local payment methods such as DuitNow, FPX and digital wallets.
• Identity Verification (KYC): Meeting legal compliance requirements related to user identity verification and anti-money laundering.
• Customer Service: Providing effective customer support, including resolving complaints, answering inquiries and managing your requests.
• Platform Security: Detecting and preventing fraud, account abuse, hacking activity and any other security threats to our platform and users.
• Experience Personalisation: Personalising the content, promotions and game recommendations offered to you based on your preferences and usage habits on the platform.
• Marketing Communications: Sending information about promotions, bonuses and the latest offers — only to members who have given consent to receive such communications.
• Legal Compliance: Fulfilling legal obligations, regulations and directives from relevant authorities.

We will not use your data for any purpose not stated here without obtaining your consent first. If you wish to withdraw consent for marketing purposes, you may do so at any time by contacting our support team.

4Legal Basis for Data Processing

ACB8 processes your personal data on valid legal grounds under Malaysia's Personal Data Protection Act 2010 (PDPA). Depending on the purpose of processing, we rely on the following bases:

• Consent: For direct marketing activities and promotional communications, we process your data based on the explicit consent you provided during registration. You may withdraw this consent at any time.
• Contract Performance: To process transactions, manage your account, and provide the services you request — this is necessary to fulfil our agreement with you.
• Legal Obligation: For KYC compliance, anti-money laundering prevention, and statutory reporting requirements — we are legally obligated to process this data.
• Legitimate Interest: For platform security purposes, fraud detection, and service improvement — we have a legitimate interest that does not override your privacy rights.

5Data Sharing with Third Parties

ACB8 takes a highly cautious and limited approach to sharing your personal data. We do not sell your data. Below is a list of parties who may receive your data and under what circumstances:

• Payment Service Providers: Banks, credit card companies and local digital wallet providers that process your financial transactions. They receive only the minimum information required to process the relevant transaction.
• Game Providers: Game software providers such as live casino companies and slot providers that need to verify your account status to enable access to their games.
• Identity Verification Companies: Third-party KYC and document verification services we use to verify new members' identities in order to meet compliance requirements.
• Authorities and Regulatory Bodies: Where required by law, court order, or direction from a legitimate authority, we are obligated to disclose the necessary information.
• Cloud & Infrastructure Services: Cloud service providers hosting our platform infrastructure, provided they are bound by strict confidentiality and data protection agreements.

6Data Retention Period

ACB8 retains your personal data for as long as necessary to fulfil the original purpose of collection, or as required by applicable law — whichever is longer. Below is a guide to our retention periods:

• Active Account Data: For as long as your account remains active and in good standing, we retain all your profile information and account history.
• Post-Account Closure Data: After your account is closed, we retain your basic information for 7 years to meet Anti-Money Laundering legal requirements and applicable tax reporting obligations in Malaysia.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysia's financial legal requirements.
• Security & Technical Logs: Retained for 2 years for fraud detection and security investigation purposes.
• Marketing Data: Deleted within 90 days after you withdraw consent for marketing communications.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised so that it can no longer be linked back to your identity.

7Data Security Measures

ACB8 invests seriously in data security infrastructure to ensure your personal information is always protected. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS Encryption for all data communications between your device and our servers.
• Data encryption at rest using AES-256 for all sensitive data stored in our databases.
• Two-Factor Authentication (2FA) available for all member accounts as an additional layer of security during login.
• 24/7 security monitoring using sophisticated intrusion and anomaly detection systems to identify threats in real time.
• Regular security audits by an independent third party to assess and verify the effectiveness of our security controls.
• Strict internal access controls — only authorised personnel may access members' personal data, and every access is logged for audit purposes.
• Security awareness training mandatory for all acb8 staff who handle personal data.

8Your Rights Regarding Personal Data

Under the Personal Data Protection Act 2010 and our own policies, you have the following rights regarding your personal data held by ACB8:

To exercise any of the above rights, contact our data protection team by email at [email protected]. We will process your request within 14 working days after your identity has been verified.

9Cookies & Tracking Technologies

The acb8 platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and analyse platform usage. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as they are critical to platform operation.
• Performance Cookies: Helps us understand how users interact with our platform — which pages are visited most, where users encounter issues, and more. This information is used to improve the platform.
• Functional Cookies: Saving your preferences such as preferred language, display theme and other settings so you do not need to reconfigure them every time you log in.
• Analytics Cookies: Helps us analyse usage patterns in aggregate and anonymised form to improve our services. Analytics data is not linked to your personal identity.

You can manage your cookie settings through your web browser settings. However, disabling essential cookies may affect the functionality of the ACB8 platform. For more information on managing cookies, please refer to your web browser's help section.

10Amendments to This Privacy Policy

ACB8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements in how we protect your data.

When we make material changes to this Policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on our platform's home page for at least 14 days.
• Sending notifications via your registered email for significant changes.

Continued use of the acb8 platform after any changes to the Privacy Policy take effect will be deemed as your acceptance of the amended Policy. If you disagree with the changes made, you have the right to close your account by contacting our support team.

11Contact Our Data Protection Officer

If you have any questions, concerns or complaints regarding this Privacy Policy or how acb8 handles your personal data, please contact us through the following channels:

• Privacy Email: [email protected] — dedicated to privacy and data protection enquiries.
• General Support: [email protected] — for general enquiries regarding your account and services.
• Live Chat: Available 24/7 on the acb8 mobile app and website for immediate responses.
• Help Centre: Visit our FAQ page for answers to frequently asked questions about privacy and data security.

We are committed to responding to all privacy-related inquiries within 3 working days, and to fulfil your data rights request within 14 working days after identity verification. If you believe we have not handled your complaint satisfactorily, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.