nft88 Privacy Policy

1 Introduction

nft88 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access and use the nft88 platform at nft88.app (the "Platform"). This Privacy Policy describes in detail how nft88 handles personal data in connection with the operation of its online gaming and sports betting services.

This Privacy Policy applies to all personal data collected through the Platform, including data provided during account registration, identity verification (KYC), financial transactions, customer support interactions, and general platform use. It should be read together with the nft88 Terms and Conditions.

By registering an account or using the Platform, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not accept this Privacy Policy, you must not use the Platform.

2 Data Controller

For the purposes of applicable data protection law, nft88 acts as the Data Controller in respect of personal data collected from Players using the Platform. nft88 determines the purposes for which personal data is processed and the means by which such processing is carried out.

Where nft88 engages third-party service providers to process personal data on its behalf (for example, payment processors and game providers), such third parties act as Data Processors and are bound by written data processing agreements that restrict their use of personal data to the purposes specified by nft88.

3 Categories of Personal Data We Collect

nft88 collects the following categories of personal data, depending on how you interact with the Platform:

Identity Data: Full legal name, date of birth, nationality, and government-issued identification document details (Malaysian MyKad number or passport number and expiry date). This data is collected as part of mandatory KYC verification.

Contact Data: Email address, mobile telephone number, and, where provided, residential address. Malaysian players typically provide a Kuala Lumpur, Penang, Johor Bahru, or other Malaysian address for identity verification purposes.

Financial Data: Details of your registered payment methods including Touch n Go eWallet account identifiers, Boost account identifiers, bank account names associated with FPX transactions, and DuitNow QR registration details. nft88 does not store full bank account numbers or payment card numbers directly — these are handled by PCI-compliant payment processors.

Transaction Data: Records of all deposits, withdrawals, wagers, game rounds, and bonus claims made on the Platform, including amounts in MYR, timestamps, and outcomes.

Technical Data: IP address, device type and operating system, browser type and version, session duration, pages visited on the Platform, and geolocation data derived from IP address.

Communications Data: Records of live chat conversations, email correspondence, and support tickets between you and nft88 Customer Support.

Responsible Gaming Data: Records of any deposit limits, session limits, or self-exclusion arrangements you have activated on your nft88 account.

4 How We Collect Personal Data

nft88 collects personal data through the following channels:

• Direct provision: Data you provide when completing the account registration form, KYC verification submissions, payment method registration, and customer support requests;
• Automated technical collection: Data collected automatically as you use the Platform, including via cookies, web beacons, server logs, and session tracking technologies;
• Third-party sources: Identity verification data obtained from KYC service providers; fraud screening data from anti-fraud service providers; and payment confirmation data from payment processors including eWallet operators and FPX banking partners;
• Publicly available sources: Where nft88 supplements identity data using publicly available records for fraud prevention purposes.

5 Purposes for Which We Process Personal Data

nft88 processes personal data for the following purposes:

• To create, maintain, and manage your nft88 account, including verifying your identity and eligibility to use the Platform;
• To process MYR deposits and withdrawals, including verification of payment method ownership and execution of FPX and eWallet transactions;
• To operate the gaming and sportsbook services available on the Platform, including recording wager outcomes and crediting winnings;
• To administer bonus and promotional programmes and to verify compliance with applicable wagering requirements;
• To comply with KYC, anti-money laundering (AML), and counter-terrorism financing (CTF) obligations under applicable law;
• To detect and prevent fraud, cheating, collusion, and other forms of prohibited conduct on the Platform;
• To provide customer support and to respond to complaints and disputes;
• To operate responsible gaming tools including deposit limits, session timers, and self-exclusion arrangements;
• To send transactional communications, including account verification emails, deposit confirmations, and withdrawal notifications;
• To send marketing communications about nft88 promotions, where you have provided explicit consent to receive such communications. You may withdraw this consent at any time;
• To comply with nft88's legal and regulatory obligations, including record-keeping requirements imposed by applicable international gaming authority regulations.

6 Legal Basis for Processing

nft88 processes personal data on the following legal bases:

• Performance of contract: Processing necessary to operate your nft88 account, process payments, and deliver gaming services in accordance with the Terms and Conditions;
• Legal obligation: Processing necessary for nft88 to comply with KYC, AML, and CTF requirements, and to maintain records required by applicable gaming regulations;
• Legitimate interests: Processing for fraud prevention, platform security, and the improvement of nft88 services, where such interests are not overridden by your privacy rights;
• Consent: Processing of data for optional purposes such as marketing communications, where you have given explicit prior consent.

7 Data Sharing with Third Parties

nft88 does not sell, rent, or trade personal data to third parties for their own marketing purposes. nft88 shares personal data only in the following circumstances:

• Payment processors: nft88 shares transaction data with eWallet operators (including Touch n Go and Boost), FPX banking partners, and other payment service providers as necessary to process deposits and withdrawals;
• KYC and identity verification providers: nft88 shares identity documents and personal details with authorised third-party KYC service providers for identity verification and age verification purposes;
• Fraud prevention and security service providers: nft88 shares Technical Data and transaction patterns with fraud detection service providers to protect the integrity of the Platform;
• Game providers: nft88 shares Player account identifiers with licensed game software providers as necessary for the operation of their games on the Platform;
• Regulatory authorities: nft88 will disclose personal data to competent regulatory authorities, law enforcement agencies, or international gaming authority oversight bodies where required to do so by applicable law or valid legal process;
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of nft88's business, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

8 International Data Transfers

nft88 may transfer personal data to servers or service providers located outside of Malaysia. Where personal data is transferred internationally, nft88 ensures that appropriate safeguards are in place to protect the data, including standard contractual clauses or equivalent transfer mechanisms recognised under applicable data protection law.

By using the Platform, you acknowledge that your personal data may be processed in jurisdictions outside of Malaysia, including jurisdictions where data protection laws may differ from those applicable in Malaysia.

9 Data Retention

nft88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for a minimum of 5 years from the date of account closure, as required by applicable AML and gaming regulatory record-keeping obligations;
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction;
• Customer support communications: Retained for 2 years from the date of the last interaction;
• Marketing consent records: Retained for the duration of the consent and for 2 years following withdrawal of consent, for compliance verification purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with nft88's data destruction procedures.

10 Cookies & Tracking Technologies

nft88 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function, including session authentication tokens that keep you logged in to your nft88 account during a browsing session;
• Performance cookies: Used to collect anonymous aggregated data about how Players navigate the Platform, helping nft88 identify and fix performance issues;
• Functional cookies: Store your preferences such as language settings and last-used game categories;
• Analytics cookies: Used to understand aggregate usage patterns across the Platform for product improvement purposes.

Strictly necessary cookies are placed without requiring your consent, as they are essential to the Platform's operation. Performance, functional, and analytics cookies are placed only with your consent, which you may provide or withdraw through the cookie preferences tool on the Platform.

Most browsers allow you to refuse or delete cookies through their settings. Disabling strictly necessary cookies may prevent you from accessing your nft88 account.

11 Your Data Protection Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by nft88:

• Right of access: You may request a copy of the personal data nft88 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data held by nft88;
• Right to erasure: You may request deletion of your personal data, subject to nft88's legal obligations to retain certain records;
• Right to restrict processing: You may request that nft88 restrict processing of your personal data in certain circumstances;
• Right to data portability: You may request a machine-readable copy of personal data you have provided to nft88, where processing is based on consent or contract;
• Right to object: You may object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, submit a written request to nft88 at [email protected]. nft88 will respond to verified requests within 30 days. nft88 may require identity verification before processing rights requests to protect against unauthorised access to Player data.

12 Security Measures

nft88 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit TLS encryption for all data transmitted between your device and nft88 servers;
• Encryption of sensitive data at rest, including identity verification documents;
• Access controls restricting internal access to personal data to authorised personnel on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure;
• Incident response procedures for the prompt identification and containment of data breaches.

13 Minors

The nft88 Platform is strictly intended for adults aged 21 years and over. nft88 does not knowingly collect personal data from individuals under the age of 21. Where nft88 becomes aware that personal data has been collected from a minor, such data will be deleted immediately and the associated account will be suspended.

If you are a parent or guardian and believe that a minor has registered an account on the Platform, please contact nft88 at [email protected] immediately.

14 Updates to This Privacy Policy

nft88 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or nft88's data processing practices. Material updates will be notified to registered Players via email or by prominent notice on the Platform, no fewer than 14 days before the revised policy takes effect.

The date at the top of this Privacy Policy indicates when it was last updated. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or nft88's handling of your personal data, please contact us through any of the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 via the nft88.app website

Please include your registered email address or username in all correspondence so that nft88 can identify your account and respond promptly to your query.