Privacy Policy

This Privacy Policy (the "Policy") is issued by cash88 (referred to herein as "cash88", "we", "our", or "the Operator") and applies to all personal data collected, processed, stored, and transferred in connection with your use of the cash88 online gaming platform accessible at https://cash88.lat (the "Platform").

cash88 is committed to protecting the privacy and personal data of all users, with particular regard to our players in Malaysia. We process personal data in accordance with the applicable data protection laws of our licensing jurisdiction and, where relevant, the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This Policy should be read together with our Terms & Conditions and our Responsible Gambling Policy, which together form the complete framework governing your relationship with cash88.

In this Policy, the following terms shall have the meanings ascribed below:

• "Personal Data" means any information that identifies or could reasonably identify a natural person, either directly or indirectly, including but not limited to name, identification number, contact details, location data, or online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, modification, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means cash88 in its capacity as the entity that determines the purposes and means of processing personal data.
• "Data Processor" means any third party engaged by cash88 to process personal data on its behalf, in accordance with cash88's instructions.
• "Data Subject" means the individual to whom the personal data relates — in the context of this Platform, the registered Player.
• "KYC" means Know Your Customer, the identity and age verification process required for all cash88 Players.
• "MYR" means Malaysian Ringgit, the primary currency of the Platform.
• "Third Party" means any entity other than the Data Subject and cash88 that is involved in the processing of personal data.

cash88 collects personal data in connection with the operation of your Account and the delivery of our services. The categories of personal data we collect include:

3.1 Identity Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (for the purposes of age verification — players must be 21 or older);
• Nationality and country of residence;
• A copy of your identification document (e.g., Malaysian MyKad, passport, or driver's licence); and
• A selfie or facial image where required for enhanced KYC verification.

3.2 Contact Data

• Email address (primary communication channel for Account notifications);
• Malaysian mobile phone number; and
• Residential address, including city (Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or other Malaysian localities) and postcode.

3.3 Financial Data

• Payment method identifiers, including e-wallet IDs (Touch 'n Go eWallet, Boost, GrabPay), bank account numbers (Maybank, CIMB, Public Bank, Hong Leong Bank), and DuitNow / FPX transaction references;
• Cryptocurrency wallet addresses where applicable; and
• Transaction history, including deposit amounts in MYR, withdrawal requests, and bonus redemptions.

3.4 Technical Data

• IP address and approximate geolocation;
• Device type, operating system, browser type, and version;
• Session logs, login timestamps, and access records; and
• Platform usage data, including pages visited, games played, and betting history.

3.5 Communications Data

• Records of live chat conversations and support ticket correspondence;
• Responses to surveys or feedback requests where you choose to participate; and
• Any other communications you voluntarily send to cash88.

cash88 collects personal data through the following channels:

• Direct interactions: Data you provide when registering an Account, completing KYC verification, making a deposit, requesting a withdrawal, or contacting our support team.
• Automated technical collection: Data collected automatically when you access the Platform, including through cookies, server logs, and analytics tools. See Section 8 for full details of our cookie practices.
• Third-party sources: Data received from payment processing partners (e.g., FPX gateway operators, e-wallet providers) for transaction verification purposes, and from identity verification service providers engaged for KYC compliance.
• Publicly available sources: In limited circumstances, publicly available information may be used to supplement KYC or fraud prevention checks.

cash88 processes personal data only where we have a lawful basis for doing so. The purposes for which we process your data and the corresponding legal basis are set out in the table below:

cash88 does not sell your personal data. We may share your personal data with third parties only in the following circumstances:

6.1 Service Providers

We engage third-party service providers who process personal data on our behalf as Data Processors. These include: payment gateway operators (including those facilitating DuitNow, FPX, and e-wallet transactions); identity verification and KYC service providers; IT infrastructure and cloud hosting providers; and fraud detection and cybersecurity service providers. All such providers are bound by data processing agreements that restrict their use of personal data to the specific services they provide to cash88.

6.2 Legal and Regulatory Disclosure

cash88 may disclose personal data to competent governmental, regulatory, or law enforcement authorities where we are legally required to do so, including in connection with our licensing obligations, anti-money laundering (AML) reporting, or responses to lawful court orders.

6.3 Corporate Transactions

In the event of a merger, acquisition, or sale of all or part of cash88's business assets, personal data may be transferred to the acquiring entity as part of that transaction. Players will be notified of any such transfer that materially affects the processing of their personal data.

Your personal data may be processed in countries outside Malaysia where cash88's infrastructure or third-party service providers are located. When personal data is transferred outside Malaysia, cash88 ensures that appropriate safeguards are in place, which may include contractual clauses, data processing agreements, or other mechanisms that ensure an equivalent level of data protection to that required under applicable Malaysian law.

By using the cash88 Platform, you acknowledge and consent to the potential transfer of your personal data to jurisdictions outside of Malaysia for the purposes described in this Policy.

cash88 uses cookies and similar tracking technologies on the Platform to provide essential functionality, improve performance, and ensure security. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Performance Cookies: Used to collect anonymised data about how players use the Platform, including pages visited and time spent on each page. This data is used to improve Platform performance and user experience.
• Functional Cookies: Store your preferences, such as language settings and display preferences, so that you do not need to re-enter them on each visit.

cash88 does not use advertising cookies or cross-site tracking pixels. You may configure your browser settings to block or delete cookies; however, doing so may impair the functionality of the Platform, including your ability to log in and maintain a session.

cash88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and licensing obligations, and to resolve disputes or enforce our agreements. Specific retention periods include:

• Account and Identity Data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in compliance with anti-money laundering recordkeeping requirements.
• Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial recordkeeping obligations.
• Support Communications: Retained for three (3) years from the date of the last communication, or longer where required for ongoing dispute resolution.
• Technical Logs: Retained for twelve (12) months, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

cash88 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest, including identity documents and financial records;
• Role-based access controls restricting access to personal data to authorised personnel only;
• Two-factor authentication (2FA) for Platform access, available to all Players;
• Regular penetration testing and security audits conducted by independent cybersecurity professionals;
• Incident response procedures for detecting, reporting, and managing personal data breaches; and
• Staff training on data protection and information security practices.

As a Data Subject, you have the following rights in respect of your personal data held by cash88. To exercise any of these rights, please contact us using the details in Section 14.

cash88 will respond to all rights requests within thirty (30) calendar days of receipt. We may need to verify your identity before processing your request to ensure that personal data is not disclosed to an unauthorised person.

The cash88 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect or process personal data from any individual under the age of 21. If we become aware that personal data has been submitted by or on behalf of a minor, we will immediately suspend the relevant Account, delete the associated personal data, and report the matter to the appropriate authorities where required by law.

cash88 reserves the right to amend or update this Privacy Policy at any time. Any material changes to this Policy will be communicated to registered Players via a notice on the Platform or by email to the address registered on your Account. The date of the most recent revision is indicated at the top of this page.

Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment to this Policy, you should discontinue use of the Platform and close your Account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the cash88 Data Privacy team through any of the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available directly on the Platform, 24 hours a day, 7 days a week
• Subject Line: Please reference "Privacy Request" in all email communications relating to data rights
• Response Time: We aim to acknowledge all privacy-related inquiries within 48 hours and provide a substantive response within 30 calendar days

For responsible gambling concerns or self-exclusion requests, please refer to our Responsible Gambling page, which sets out the tools and support resources available to cash88 players in Malaysia.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previous versions of the cash88 Privacy Policy. The most current version of this Policy will always be accessible at https://cash88.lat/privacy-policy.