Privacy Policy b888 – Data Protection Malaysian Members

B888 is an online sports betting and casino platform serving users in Malaysia. We understand that your trust in b888 starts with how we handle your most personal information. This Privacy Policy is designed to give you a clear and transparent picture of our privacy practices.

This policy applies to all personal data collected through the b888 platform — including the b888.click website, the b888 mobile app (where available), email and live chat communications, and any other interactions you have with b888 as a company. It also applies to data collected prior to formal registration, such as browsing data gathered on our website.

B888's processing of your personal data is carried out in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). We are appointed as the data controller for all personal data processed through the b888 platform.

2.1 Data You Provide Directly

B888 collects the following personal data that you provide directly when interacting with the platform:

• Identity information: Full name as shown on official identification (MyKad), date of birth and identification number for age verification and KYC purposes.
• Contact information: An active Malaysian phone number, email address and residential or mailing address.
• Account information: Username, password (stored as an unreadable hash), language preference and account settings.
• Financial information: Details of registered payment methods — including digital wallet account numbers (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) or Malaysian bank account numbers (Maybank, CIMB and others) for deposit and withdrawal purposes. b888 does not store credit or debit card numbers directly.
• Verification documents: A copy of your MyKad, a recent utility bill or bank statement as proof of identity and address for the KYC process when required.

2.2 Automatically Collected Data

When you use the b888 platform, our systems automatically record the following technical data:

• Device and access data: IP address, browser type, device operating system, screen resolution, browser language, and unique device identifier.
• Browsing data: Pages visited within the b888 platform, time spent on each visit, links clicked, navigation paths, and session duration.
• Transaction data: A complete record of all deposits, withdrawals, bets placed, games played, wins and losses, and bonus claim history.
• Location data: General location information (at the country or state level) derived from your IP address for geographic verification and legal compliance purposes.

2.3 Data from Third-Party Sources

In certain circumstances, b888 may receive your personal data from legitimate sources such as licensed third-party identity verification services, local Malaysian payment providers during transaction verification, and relevant regulatory authorities in the context of legal compliance.

B888 uses the personal data collected solely for the following purposes. We do not use your data for any other purpose without first notifying you and, where required, obtaining your consent:

• Service provision: Processing account registrations, verifying identities, handling deposits and withdrawals via local Malaysian payment methods, settling bets, and crediting winnings to your account.
• Security and compliance: Verifying age eligibility (18 and above), carrying out KYC and AML procedures as required by licensing authorities, and detecting and preventing fraud, money laundering and platform abuse.
• Service communications: Sending important notices related to your account — including registration confirmations, transaction notifications, security updates and policy changes affecting your account. These communications cannot be unsubscribed from as they form part of b888's core service.
• Customer support: Processing and resolving enquiries, complaints and requests submitted to the b888 support team via live chat or email.
• Product improvement: Analysing aggregated and anonymised usage patterns to understand how Malaysian members interact with the b888 platform and identify areas for improvement.
• Marketing communications: Sending information about b888 promotions, bonuses and new offers — but only to members who have given their consent to receive marketing communications. You may withdraw this consent at any time.
• Responsible gaming: Monitoring usage patterns to identify signs of problem gambling and reaching out to members who may need support or information about the responsible gaming tools available at b888.

Under Malaysia's PDPA 2010, b888 must have a valid legal basis for processing your personal data. Depending on the type of data and purpose of processing, b888 relies on the following bases:

• Contract performance: Processing that is necessary to deliver the services you have requested — including handling your account, deposits, bets, and withdrawals. Without this processing, b888 is unable to provide its services to you.
• Legal obligation: Processing required to fulfil b888's legal obligations under Malaysian law — including KYC and AML procedures, and reporting to the relevant authorities when required by law.
• Legitimate interests: Processing required for b888's legitimate interests — such as platform security, fraud detection and product improvement — provided those interests do not override your fundamental rights and freedoms.
• Consent: For certain processing activities not covered by the bases above — such as marketing communications — b888 will request your explicit consent. You have the right to withdraw that consent at any time without affecting any processing that took place prior to withdrawal.

5.1 Parties Who May Receive Your Data

B888 does not sell your personal data to any third party. However, in the course of operating our platform, your data may be shared with the following limited categories of third parties, only when necessary and with appropriate safeguards in place:

• Malaysian payment providers: Digital wallet and internet banking providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX participating banks receive the information necessary to process your deposit and withdrawal transactions.
• Technical service providers: Companies that assist b888 in operating the platform's technical infrastructure — including server hosting services, cybersecurity providers and analytics service providers acting as data processors under b888's direction.
• Identity verification provider: Licensed third-party services that assist b888 in verifying member identities and conducting AML checks as required by the licensing authorities.
• Relevant authority: Malaysian government agencies, law enforcement authorities, or regulatory bodies when b888 is legally required to disclose information, or where there is a legitimate and urgent need to prevent a serious security threat.

5.2 Cross-Border Data Transfers

In certain circumstances, your personal data may be transferred to and processed in countries outside Malaysia — for example, where b888's servers or parts of its technical infrastructure are located abroad. In all such cases, b888 ensures that protection equivalent to Malaysia's PDPA is applied through appropriate contractual safeguard mechanisms.

B888 implements a range of rigorous technical and organisational security measures to protect your personal data from unauthorised access, loss, modification or inadvertent disclosure. These measures include:

• Transmission encryption: All communications between your browser or app and b888's servers are secured by TLS 1.3 with 256-bit SSL encryption — the same industry standard used by Malaysia's major banks.
• Storage encryption: Sensitive data such as passwords (stored as one-way hashes), financial information, and identification numbers are encrypted at rest within the b888 database.
• Internal access controls: Access to members' personal data within b888 is governed by a need-to-know principle — only staff with a legitimate business need may access such data, and all access is logged for audit purposes.
• Continuous security monitoring: b888's systems are monitored around the clock to detect and respond to any suspicious activity or unauthorised access attempts.
• Regular security audits: b888 undergoes independent security audits on a regular basis to assess and strengthen the protection of our members' personal data.
• Incident response plan: b888 has a tested cybersecurity incident response procedure in place. In the event of a material data breach, b888 will notify affected members and the relevant authorities in accordance with legal requirements within the stipulated timeframe.

B888 does not retain your personal data for longer than is necessary for the purpose it was collected, or to comply with applicable legal obligations. The general principles governing data retention periods at b888 are as follows:

• Active account data: Personal and transaction data of members with active accounts is retained for as long as the account remains active and for the post-closure period stipulated by applicable legal requirements.
• Transaction and financial data: Records of all financial transactions — including deposits, withdrawals and winnings — are retained for a minimum of 7 years after the transaction occurs, in accordance with applicable financial and AML legal requirements in Malaysia.
• KYC and identity verification data: Identity verification documents collected during the KYC process are retained for as long as the account remains active and for a minimum of 5 years after account closure, in accordance with AML compliance requirements.
• Marketing data: Data used for marketing communications is retained until you withdraw your consent or request its deletion.
• Technical logs: System logs and browsing data are typically retained for 12 months for security and technical troubleshooting purposes.

Once the relevant retention period has expired, your data will be securely deleted or de-identified in accordance with b888's standard procedures.

8.1 What Are Cookies?

Cookies are small text files stored in your browser when you visit the b888 platform. They help the platform remember your preferences, maintain your login session and allow us to understand how the platform is used so we can continuously improve it.

8.2 Types of Cookies Used by b888

• Essential cookies: Cookies required for the core functionality of the b888 platform — including secure login sessions and security preferences. These cookies cannot be disabled without affecting your ability to use the platform.
• Performance cookies: Cookies that collect information on how the b888 platform is used — including the most frequently visited pages and any error messages encountered — to help us improve the user experience.
• Functional cookies: Cookies that allow the b888 platform to remember your preferences — such as interface language, region and display settings — to deliver a more personalised experience.
• Analytics cookies: Cookies that help b888 understand aggregated, anonymised usage patterns for business analytics and product improvement purposes.

8.3 Managing Your Cookie Preferences

You can manage or delete cookies through your browser settings. Please note, however, that disabling certain cookies may affect the functionality of the b888 platform — for example, you may need to log in again on every visit if session cookies are disabled.

Under Malaysia's PDPA 2010, you as a data subject have the following rights over your personal data held by b888. b888 is committed to facilitating the exercise of these rights promptly and without unnecessary obstacles:

• Right to access: You have the right to obtain a copy of the personal data b888 holds about you, along with information on how that data is being used.
• Right to rectification: You have the right to request that b888 correct any personal data we hold about you that is inaccurate, incomplete or out of date.
• Right to erasure: In certain circumstances provided for under the PDPA, you have the right to request that b888 delete your personal data. This right is not absolute and may be limited by data retention obligations prescribed by law.
• Right to object to marketing processing: You have the right to object to your personal data being used for direct marketing purposes at any time by contacting b888 or using the unsubscribe option in our marketing communications.
• Right to restrict processing: In certain circumstances, you have the right to request that b888 restrict how your personal data is processed while a dispute or complaint is being resolved.
• Right to data portability: You have the right to receive a copy of the personal data you have provided to b888 in a structured, commonly used and machine-readable format.

To exercise any of the rights above, please contact the b888 privacy team by email at support@b888.click and state your request clearly. b888 will process your request within 21 business days from the date of receipt of the completed request.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way b888 handles your personal data, we encourage you to reach out to us directly. We are committed to addressing every privacy inquiry seriously and within a reasonable timeframe.

• Support and privacy email: support@b888.click
• Live chat: Available 24 hours a day, 7 days a week directly within the b888 platform — your fastest option for immediate inquiries.
• Target response time: b888 aims to respond to privacy-related email inquiries within 2 business days and live chat inquiries within 5 minutes.

If you are not satisfied with how b888 has handled your privacy complaint, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia, the regulatory body responsible for PDPA compliance in Malaysia.

This Privacy Policy was last updated on January 2026. b888 reserves the right to update this Privacy Policy from time to time. Members will be notified of any material changes via an in-platform notice or email before the changes take effect.