Privacy Policy KM88 — Personal Data Protection for Malaysia Users

KM88 values the privacy of every user on our platform. This Privacy Policy is written in plain language — not filled with confusing legal jargon — so you truly understand what happens with your information.

When you register an account, make a deposit, play games, or simply browse the KM88 website, certain information is collected and stored. This document transparently explains what that information is, why we need it, and how it is protected.

This policy also complies with Malaysia's Personal Data Protection Act 2010 (PDPA). We believe Malaysian users deserve robust data protection, not just fine words in a document nobody reads.

KM88 only collects information that is genuinely necessary to operate the platform and provide a secure service to users. The following are the categories of information we collect:

KM88 not collect credit card numbers directly. All card transactions are processed through PCI-DSS certified third-party payment processors, which means we do not store your card number in our systems.

Every piece of data we collect has a specific purpose. km88 does not collect data for the sake of collecting data. Our primary purposes are:

• Identity verification (KYC): Verifying that users are real individuals who meet the age and eligibility requirements to use the platform.
• Financial transaction processing: Enabling deposits and withdrawals to be processed securely and accurately to the correct account holder.
• Fraud prevention and anti-money laundering: Monitoring suspicious activity to protect all users and the integrity of the platform.
• Service improvement: Understanding how users interact with the platform so we can make it better.
• Account-related communications: Sending important notifications such as transaction confirmations, security updates, and customer support responses.
• Legal compliance: Meeting the reporting and record-keeping requirements mandated by law.

The data we collect is used internally to operate the KM88 platform safely and efficiently. In more detail, here is how we use your information in daily operations:

When you register: Identity information is used to create your unique account, while your email and phone number are used to send account verification and enable password recovery when needed.

While you are playing: Game data is retained to ensure betting records and outcomes are accurate. This protects you should any dispute arise regarding game results. This data is also used for periodic RNG audits.

While you are making a transaction: Financial information is used to process deposits and withdrawals to the correct payment method. Transaction records are retained for your account purposes and to comply with financial audit requirements.

KM88 does not sell, rent, or trade personal information of users to any third party for commercial purposes. This is a principle that is fixed and non-negotiable.

There are limited circumstances in which we share certain data with trusted parties:

• Payment processors: Transaction information is shared with certified payment processors (FPX, TNG, DuitNow) solely to enable transaction processing. These processors are bound by strict confidentiality agreements.
• Game providers: Minimum technical data is shared with game providers (Pragmatic Play, PG Soft, etc.) solely to enable games to function correctly within our integrated platform.
• Legal authorities: We will disclose user information to authorities only when required by a valid court order or binding legal obligation.
• Technical service providers: Server infrastructure and cybersecurity providers may access system data (not users' personal data) to maintain platform operations.

In all of the above cases, only the minimum data necessary for the stated purpose is shared.

KM88 continually invests in security infrastructure to ensure user data remains protected. The security layers we employ include:

• 256-bit SSL/TLS encryption: All communication between your device and km88 servers is encrypted using the same 256-bit encryption standard adopted by the world's leading banks.
• Hashed password storage: User passwords are never stored in plain text — they are converted into irreversible hashes using the bcrypt algorithm.
• Two-factor authentication (2FA): Users are encouraged to enable 2FA for an additional layer of protection that prevents unauthorized access even if a password is compromised.
• Real-time threat monitoring: Our system automatically monitors suspicious activity around the clock and will immediately freeze an account if unusual access attempts are detected.
• Data segregation: Financial data is stored in an environment isolated from general profile data to reduce risk in the event of any breach.

While we take all reasonable precautions, no system can be guaranteed 100% secure. In the event of any security breach involving user data, km88 will notify affected users within the timeframe required by applicable law.

KM88 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. There are three types of cookies we use:

• Essential Cookies: Required for core platform functions such as login sessions and security. You cannot disable this type of cookie without affecting platform functionality.
• Preference Cookies: Storing user settings such as preferred language and display layout. This allows us to present the platform in the way that is most comfortable for you.
• Analytics Cookies: Collecting anonymous usage data to help us understand which parts of the platform are most used and which need improvement. This data is not linked to any individual's identity.

KM88 does not use cookies to track your activity on other websites outside our platform. We also do not allow third-party advertisers to place tracking cookies within our platform.

Under Malaysia's Personal Data Protection Act 2010 and international data protection best practices, you have the following rights regarding your personal data held by KM88:

KM88 does not retain user data indefinitely. We have a clear retention policy based on operational and legal requirements:

• Active account data: Retained for as long as the account is active and for a defined period after the account is closed.
• Financial transaction records: Retained for seven (7) years after a transaction occurs, as required by Malaysia's accounting and tax laws.
• KYC Data: Retained for the duration of the active account plus five (5) years after account closure, in line with anti-money laundering compliance requirements.
• Technical and security logs: Retained for 90 days before being automatically deleted.
• Cookie data: Expires when the session ends (session cookies) or after a set period (typically no more than 12 months).

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered.

KM88 reserves the right to update this Privacy Policy from time to time in line with changes in law, technology, or industry best practices. Users will be notified of any significant updates via:

• In-platform notifications (pop-up or information banner) upon next login.
• Email to the registered email address for changes that materially affect user rights.

The "Updated" date at the top of this page always reflects the date of the current version of this Privacy Policy. We recommend you check this page from time to time.

If you have any questions, concerns, or requests regarding this Privacy Policy or how KM88 handles your personal data, we encourage you to contact us directly:

• Live Chat: The fastest option — available 24/7 via the chat icon in the corner of the platform.
• Email: [email protected] — responses are typically within 24 hours on business days.
• Frequently Asked Questions: Many privacy-related questions have been answered on the FAQ us.

We value your trust. Every privacy-related request is handled seriously and processed by our dedicated data protection team.