Privacy Policy Spin 888 – Protecting Your Personal Data in Malaysia

This Privacy Policy is issued by Spin 888 ("we", "the Company") and applies to all users who access or use the spin888.io platform ("Platform"), including the website, mobile application, and any related services we provide.

This document describes our practices regarding the collection, use, disclosure, storage, and protection of your personal information. It is drafted in accordance with Malaysia Personal Data Protection Act 2010 (PDPA 2010) and international industry best practices.

By registering an account or using any part of the Spin 888 Platform, you consent to the collection and use of your personal data as described in this policy. If you do not agree, please refrain from using our platform and contact us for further discussion.

Spin 888 collects various types of information depending on your level of interaction with our platform. Below is a full breakdown of the data categories we process:

2.1 Registration & Identity Information

• Full name as stated on your MyKad or other valid Malaysian identity document
• Identity card number (MyKad) — required for the KYC process
• Date of birth for verification of the 21-year age requirement
• Active email address
• Malaysian mobile number
• Current residential address in Malaysia

2.2 Financial & Transaction Information

This information is required solely to process deposits and withdrawals in Malaysian Ringgit (MYR). We not store your full account number, card number, or e-wallet password:

2.3 Usage & Technical Data

• IP address and geolocation data (Malaysian states only)
• Device type, operating system, and web browser
• Login session history (date, time, and device)
• Records of betting and gaming activity on the platform
• Interaction logs with the customer support team

Spin 888 uses your personal data solely for legitimate, stated purposes. We will not use your data beyond the scope described below:

• Account Management: Create, maintain, and secure your Spin 888 account
• Identity Verification (KYC): Verifying that you meet the age requirement and membership eligibility criteria
• Payment Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks, and FPX; as well as withdrawal of winnings in MYR
• Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and unauthorised access
• Customer Support: Assist you with enquiries, complaints, or technical issues
• Legal Compliance: Fulfilling applicable legal and regulatory obligations in Malaysia
• Platform Improvements: Analysing usage patterns anonymously to improve the user experience
• Important Communications: Sending account-related notifications, security alerts, and terms update notices

Spin 888 does not sell, rent, or commercialise your personal data to any third party. However, in the following limited circumstances, we may share necessary data:

4.1 Payment Service Providers

To process transactions in MYR via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and FPX (Maybank2u, CIMB Clicks), we are required to share the minimum necessary transaction information with the relevant payment gateway providers. All such providers are bound by strict data protection agreements with us.

4.2 Legal Requirements

We may be required by Malaysian law or court order to disclose certain information to the relevant authorities. In such cases, we will only disclose the minimum data necessary and will notify you if permitted to do so.

4.3 Trusted Technology Providers

A limited portion of non-identifying (anonymised) usage data may be shared with platform technology providers who assist us in operating Spin 888. All such providers are bound by confidentiality agreements and are prohibited from repurposing the data.

Spin 888 implements multiple layers of technical and organisational security to protect your personal data from unauthorised access, alteration, or destruction:

• Encryption in Transit: SSL/TLS 256-bit encryption for all communications between the platform and users
• Storage Encryption: Sensitive data is encrypted in the database using AES-256
• Access Controls: Only authorised personnel with a legitimate business need may access personal data
• Two-Factor Authentication (2FA): Available to all member accounts as an additional layer of security
• 24/7 Monitoring: Intrusion detection system (IDS) operating around the clock
• Penetration Testing: Regular security audits by independent parties to identify vulnerabilities
• Data Backup: Regular backups to separate locations for data recovery in the event of an incident

The Spin 888 platform uses cookies and similar tracking technologies to enhance your experience. Here is an overview of the types of cookies we use:

6.1 Essential Cookies (Required)

These cookies are required for the platform's core functions — including login authentication, session security, and language preferences. They cannot be disabled, as the platform will not function without them.

6.2 Analytics Cookies (Optional)

These cookies help us understand how users interact with the platform — which pages are visited most frequently, time spent on site, and where users drop off. All analytics data is anonymised and aggregated.

6.3 Preference Cookies (Optional)

These cookies store your preferences such as your chosen language, display layout, and game settings. They ensure you don't have to reconfigure the same settings every time you log in.

You can manage or delete cookies through your web browser settings at any time. Please note that disabling essential cookies may affect platform functionality.

Under the Malaysia Personal Data Protection Act 2010 (PDPA 2010), you have the following rights in relation to the personal data we hold about you:

Spin 888 retains your personal data only for as long as necessary for the stated purposes or as required by law:

• Active account data: Retained for as long as your account remains active or an ongoing service need exists
• Financial transaction records: Retained for 7 years after the transaction date, in accordance with Malaysian financial regulations
• KYC & identity verification records: Retained for 5 years after account closure
• Customer support logs: Retained for 3 years for reference and dispute resolution
• Analytical cookie data: Deleted after 13 months
• Account data closed due to fraud: Retained for the period required by the relevant legislation

Once the retention period expires, your data will be securely deleted or fully anonymised within 30 days.

The Spin 888 Platform is intended exclusively for individuals aged 21 years of age and above only. We do not knowingly collect or process personal data of individuals under the age of 21.

If you believe that a minor has registered an account using false information, please contact us immediately at support@spin888.io. We will investigate and close the account in question, and permanently delete all associated data within 48 hours of confirmation.

Spin 888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or new platform features.

Material changes will be communicated to you via your registered email and/or a prominent in-platform notification at least 7 days before the changes take effect. Continued use of the platform after the effective date of any changes constitutes your acceptance of the updated policy.

For minor changes that do not affect your fundamental rights, we may update this document without a specific notification. The "Last updated" date at the top of this page always reflects the most current version.

If you have any questions, concerns, or complaints about how Spin 888 handles your personal data, we encourage you to reach out to us directly:

• Privacy Email: privacy@spin888.io
• General Support Email: support@spin888.io
• Live Chat: Available 24/7 within the Spin 888 platform
• Response Time: We are committed to responding to all privacy enquiries within 3 working days

If you are not satisfied with our response, you have the right to lodge a complaint with Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital Malaysia.