Privacy Policy fl888 – Comprehensive Personal Data Protection for Malaysian Players

This Privacy Policy ("Policy") describes how fl888 ("we", "platform") collects, uses, stores, protects, and discloses your personal data when you use the fl888 online betting platform via the fl888.xyz website or the official fl888 mobile app.

Fl888 operates as an online betting platform serving Malaysian players. In this capacity, we are a "Data Processor" responsible under Malaysia's Personal Data Protection Act 2010 (PDPA). We take this responsibility seriously and are committed to ensuring your personal data is handled securely, transparently, and only to the extent necessary.

This policy applies to all fl888 platform users, including:

• Visitors to the fl888 website who have not yet registered an account.
• Individuals who are in the process of registering a new fl888 account.
• Registered members who actively use fl888's services.
• Former members who have closed their accounts (within the applicable data retention period).

Fl888 collects two main categories of data — information you provide to us directly, and data collected automatically while you use the platform.

Data you provide directly:

• Registration information: Full name, date of birth, Malaysian MyKad or passport number, active phone number, email address.
• Identity verification (KYC) information: Copy of identity document, bank or digital wallet statement, verification selfie if required.
• Financial information: Payment method details you have registered — including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow accounts, or your FPX or bank account number for withdrawal purposes.
• Communications: The content of messages you send to fl888 customer support via Live Chat, WhatsApp, or email.
• Profile information: Username, profile photo (if uploaded), language settings, and other personal account preferences.

Automatically collected data:

• IP address and state-level geolocation information.
• Device type, operating system, phone or computer model, screen resolution.
• Web browser type and version used.
• Login session records including date, time, and duration.
• Betting activity records including game type, wager amounts, and outcomes.
• Cookie data and similar tracking technologies (detailed in Section 6).

Fl888 uses collected personal data for legitimate and necessary purposes only. Below is a complete list of data use purposes, along with the legal or operational basis that justifies each:

• Account management: Creating, maintaining, and securing your fl888 account, including identity verification, password recovery, and login session management.
• Transaction processing: Processing deposits via TNG, GrabPay, DuitNow, FPX, Boost or ShopeePay, and withdrawals to your bank account or digital wallet in MYR.
• KYC and legal compliance: Verifying age (minimum 18 years), preventing identity fraud, and meeting legal requirements including anti-money laundering (AML) obligations.
• Fraud detection and prevention: Analysing account activity patterns to detect bots, collusion, multiple accounts, and other suspicious behaviour.
• Gaming service provision: Operating poker, roulette, Sports Betting, E-Sports, lottery, Live Casino, and all other games available on fl888 in a fair and transparent manner.
• VIP programme and promotions: Managing VIP tiers, calculating weekly cashback, issuing reward points, and delivering relevant promotions based on your gameplay patterns.
• Customer support: Resolving enquiries, complaints, and technical issues by accessing relevant account and transaction records.
• Platform improvements: Aggregated and anonymised usage data is analysed to understand how players interact with the platform, in order to drive improvements.
• Important communications: Sending transaction notifications, security updates, changes to terms, and other important information relating to your account.

fl888 does not sell your personal data to anyone. However, in the course of operating the platform, we may need to share data with certain parties within strictly limited and controlled boundaries:

• Payment service providers: Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX network operators, and the banks involved in processing your financial transactions. Data shared is limited strictly to what is necessary to process the relevant transaction.
• Technology service providers: Companies providing the server infrastructure, cloud services, cybersecurity, and analytics used by fl888 — all bound by strict confidentiality agreements.
• Regulatory bodies and law enforcement authorities: Where required by Malaysian law or a valid court order, fl888 will disclose the necessary data to the relevant authorities. fl888 will not disclose data beyond what is required by such an order.
• Identity verification services: Third-party KYC service providers used to assist in verifying identity documents for legal compliance purposes.

In all of the data sharing cases above, fl888 ensures that the receiving party has adequate data protection measures in place and uses the data solely for the stated purposes.

Fl888 continually invests in security infrastructure to ensure your personal data is protected to the highest standard. Below are the key security measures we have in place:

• 256-bit SSL/TLS Encryption: All communications between your device and fl888's servers are fully encrypted, making them unreadable to any unauthorised party.
• Data encryption at rest: Sensitive data such as financial information and identity documents is stored in encrypted format within fl888's databases.
• Role-based access control: fl888 employees may only access data that is necessary for carrying out their duties. Access to sensitive data is logged and monitored.
• Continuous 24/7 threat monitoring: An automated security monitoring system tracks all network and account activity in real time to detect potential breaches.
• Regular security audits: fl888 conducts regular internal and external security audits to identify and address potential vulnerabilities before they can be exploited.
• Incident response procedures: fl888 has clear procedures in place for handling data security incidents, including user notification procedures where required by law.

Fl888 uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device by your web browser. The following are the types of cookies fl888 uses:

You can manage your cookie preferences through your web browser settings. Disabling essential cookies may affect core functionality of the fl888 platform, including your ability to log in to your account.

Fl888 retains your personal data only for as long as necessary to fulfil the purposes stated in this Policy, or as required by Malaysian law. fl888's general data retention guidelines are as follows:

• Active account data: For as long as your account remains active on fl888 — identity data, transaction records, and gaming activity records are retained for service and compliance purposes.
• Data following account closure: After an account is closed, fl888 retains basic records for 7 years to comply with legal requirements relating to anti-money laundering and financial reporting obligations.
• Financial transaction records: All deposit and withdrawal records are retained for 7 years from the transaction date, in line with Malaysia's financial regulatory requirements.
• Support communication data: Live Chat logs, emails, and WhatsApp records are retained for 2 years from the date of communication for quality control and dispute resolution purposes.
• Technical log data: Server access logs, IP records, and session data are retained for 12 months for security and fraud detection purposes.

Once the defined retention period has elapsed, data is securely deleted using procedures that ensure it cannot be recovered. Data that has been anonymised may be retained longer for statistical analytics purposes.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have clearly defined rights regarding your personal data held by fl888. We fully respect and uphold these rights:

In the course of our operations, your personal data may be processed or stored on servers located outside Malaysia — particularly when fl888 uses international cloud service providers for its technical infrastructure.

In all cases of international data transfers, fl888 ensuring that:

• The recipient country or entity provides a level of data protection that is adequate or equivalent to Malaysia's PDPA.
• Appropriate data transfer agreements, including internationally recognised standard contractual clauses, are in place with the relevant service providers.
• Data transferred is limited strictly to what is necessary for the relevant technical function, and does not include sensitive data that has no reason to be transferred.

This data transfer is a purely technical necessity to ensure the fl888 platform operates smoothly, securely, and remains accessible to Malaysian players from various locations.

The fl888 platform is intended exclusively for individuals aged 18 years of age and above. fl888 does not knowingly collect any personal data from individuals under the age of 18.

If fl888 discovers or suspects that personal data belonging to an individual under the age of 18 has been collected through the platform, we will take immediate steps to:

• Close the relevant account immediately.
• Deleting all personal data associated with that individual.
• Processing the return of any deposited funds, where applicable.

Parents or guardians who have reason to believe their minor child has registered an account at fl888 are advised to contact privacy@fl888.xyz immediately for prompt action.

Fl888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the services we offer.

When there are material changes to this Policy, fl888 will:

• Updating the "Last Updated" date at the top of this page.
• Notifying all active members via their registered email at least 14 days before the amendments take effect.
• Displaying an in-platform notice on fl888 when you log in after an amendment has been made.

Your continued use of the fl888 platform after the effective date of any amendment constitutes your acceptance of the revised policy. If you do not agree with the changes, you have the right to close your account and request the withdrawal of your net funds before the effective date.

If you have any questions, concerns, or complaints regarding how fl888 handles your personal data, or if you wish to exercise any of the rights set out in Section 8, please contact our privacy team through the following channels:

• Privacy Email: privacy@fl888.xyz — for inquiries and requests relating to personal data that require a formal written response.
• General Support Email: support@fl888.xyz — for general enquiries or if you are unsure who to contact.
• Live Chat: Available 24/7 within your fl888 account — for urgent privacy-related enquiries.

Fl888 is committed to responding to all privacy-related enquiries within 48 working hours. For more complex data rights requests, a full response will be provided within 30 days.