rm888 Privacy Policy

1. Introduction

rm888 operates as a licensed online gaming platform serving players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and beyond. In the course of providing our gaming services — which include live casino, sportsbook, slots, and jackpot games — rm888 necessarily collects and processes certain personal data relating to registered users and website visitors.

rm888 is committed to handling all personal data responsibly, lawfully, and in a manner that respects the rights and reasonable expectations of our players. This Policy is written in plain language to ensure you understand exactly what data we hold about you, why we hold it, and what your rights are in relation to it.

This Policy should be read in conjunction with rm888's Terms & Conditions, which govern the overall contractual relationship between rm888 and its registered players.

2. Data Controller

For the purposes of applicable data protection legislation, rm888 is the data controller in respect of all personal data collected from Users of the rm888 platform. rm888 determines the purposes for which and the manner in which any personal data is processed.

If you have any questions about how rm888 processes your data, or wish to exercise any of your rights described in Section 10 below, please contact our data protection point of contact via the details in Section 16.

3. Data We Collect

3.1 Data You Provide Directly

When you register an account with rm888 or interact with our services, you provide us with the following categories of personal data:

• Identity Data: Full legal name, date of birth, nationality, and identity document details (MyKad number or passport number for Malaysian and international players respectively).
• Contact Data: Email address, Malaysian mobile phone number, and residential address.
• Financial Data: Payment method details (eWallet accounts, bank account numbers for FPX transactions, or cryptocurrency wallet addresses for USDT TRC20). rm888 does not store full payment card numbers on its servers.
• Account Credentials: Username and encrypted password hash. rm888 never stores passwords in plain text.
• Communications: Records of correspondence between you and rm888's customer support team, including live chat transcripts and email exchanges.
• Responsible Gaming Data: Self-imposed limits, self-exclusion requests, and any information provided in connection with responsible gaming tools.

3.2 Data Collected Automatically

When you access the rm888 platform, we automatically collect certain technical data, including:

• Usage Data: Pages visited, features used, games played, betting history, session duration, and navigation patterns within the platform.
• Device Data: IP address, device type and model, operating system version, browser type and version, and screen resolution.
• Location Data: Approximate geographic location derived from IP address (used for regulatory compliance and fraud prevention — not precise GPS location).
• Cookie Data: Data collected via cookies and similar tracking technologies as described in Section 9.

3.3 Data from Third Parties

rm888 may receive personal data about you from third parties in specific circumstances, including: identity verification services used to conduct KYC checks; payment processors confirming the status of transactions; and fraud detection services used to protect the integrity of the platform.

4. How We Use Your Data

rm888 uses the personal data it collects for the following purposes:

5. Legal Basis for Processing

rm888 processes personal data on the following legal bases:

• Contract Performance: Processing necessary to fulfil rm888's contractual obligations to you under the Terms & Conditions, including operating your account and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable laws and our gaming licence obligations, including KYC identity verification, anti-money laundering reporting, and responsible gaming mandates.
• Legitimate Interests: Processing carried out in pursuit of rm888's legitimate business interests, including fraud prevention, platform security, and service improvement, where these interests are not overridden by your fundamental rights.
• Consent: Where rm888 relies on your consent to process data (primarily for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Disclosure

rm888 does not sell, rent, or trade your personal data to third parties for marketing purposes. We may share your personal data with third parties only in the following limited circumstances:

• Service Providers: Third-party providers who process data on rm888's behalf, including KYC verification services, payment processors (including Touch 'n Go, Boost, GrabPay, DuitNow, and FPX providers), cloud infrastructure providers, and fraud detection services. All such providers are contractually bound to process data only on rm888's instructions and to maintain equivalent security standards.
• Gaming Regulators: rm888's gaming licence authorities may require access to player data as part of their regulatory oversight functions. rm888 will cooperate with such requests as required by law.
• Law Enforcement: rm888 may disclose personal data to law enforcement agencies, government bodies, or courts where required by a valid legal order, warrant, or regulatory requirement.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of rm888's assets, personal data held by rm888 may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

rm888 will not share your personal data in any manner not described above without your explicit prior consent.

7. International Data Transfers

rm888's platform infrastructure and some of our third-party service providers may be located outside Malaysia. Where personal data is transferred outside Malaysia, rm888 will ensure that appropriate safeguards are in place to protect that data, including contractual clauses requiring the recipient to maintain data protection standards equivalent to those applied by rm888.

By using the rm888 platform, you acknowledge that your data may be transferred to and processed in countries other than Malaysia, subject to the protections described in this section.

8. Data Retention

rm888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations.

• Active Accounts: Personal data associated with an active rm888 account is retained for the lifetime of the account plus a minimum of five (5) years following account closure, in accordance with gaming licence obligations and anti-money laundering record-keeping requirements.
• KYC Documentation: Identity documents and verification records are retained for a minimum of five (5) years following the end of the business relationship.
• Transaction Records: Financial transaction history is retained for a minimum of five (5) years.
• Communications: Customer support records are retained for a minimum of three (3) years.
• Marketing Data: Email marketing consent records are retained until consent is withdrawn, plus one (1) year thereafter.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with rm888's data disposal procedures.

9. Cookies & Tracking Technologies

The rm888 platform uses cookies and similar tracking technologies to deliver and improve our services. Cookies are small text files placed on your device when you visit the platform.

9.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences, such as language settings and game display options, to personalise your rm888 experience.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate and use the platform, enabling rm888 to identify areas for improvement.
• Security Cookies: Assist in detecting and preventing fraudulent login attempts and unusual account activity.

9.2 Managing Cookies

You can manage non-essential cookies through your browser settings. Disabling cookies may affect certain features of the rm888 platform. Note that strictly necessary cookies cannot be disabled as they are required for basic platform operation and security.

10. Your Privacy Rights

Subject to applicable law, you have the following rights in respect of your personal data held by rm888:

• Right of Access: You may request a copy of the personal data rm888 holds about you.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to rm888's legal retention obligations (particularly under gaming licence and AML requirements, which may override erasure requests for specific data categories).
• Right to Restrict Processing: In certain circumstances, you may request that rm888 temporarily suspend processing of your personal data.
• Right to Data Portability: You may request a copy of the data you have provided to rm888 in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing of your personal data carried out on the basis of legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where rm888 processes your data based on consent, you may withdraw that consent at any time.

To exercise any of these rights, please contact rm888 via the details in Section 16. rm888 will respond to verified requests within 30 days. We may need to verify your identity before processing your request.

11. Marketing Communications

rm888 may send promotional emails, SMS notifications, or platform notifications about offers, bonuses, and new games to registered players who have consented to receive such communications. Your consent to receive marketing communications is collected at registration and can be withdrawn at any time by:

• Updating your communication preferences in your rm888 account settings;
• Clicking the unsubscribe link included in any rm888 marketing email; or
• Contacting rm888 customer support to opt out.

Withdrawal of marketing consent does not affect your ability to use rm888's gaming services. Transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts) are not marketing communications and will continue regardless of marketing preferences.

12. Children's Privacy

rm888's services are strictly intended for adults aged 21 years and over. rm888 does not knowingly collect personal data from individuals under 21 years of age. If rm888 discovers or has reason to believe that an account has been registered by a person under 21, that account will be immediately suspended and all personal data associated with it will be securely deleted, subject to any applicable legal hold obligations.

If you believe a person under 21 has registered with rm888, please notify us immediately at the contact details provided in Section 16.

13. Data Security

rm888 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and rm888's servers;
• Encrypted storage of all sensitive personal and financial data at rest;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing conducted by independent third parties;
• Intrusion detection systems and real-time monitoring of platform access patterns;
• Multi-factor authentication requirements for administrative system access.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. In the unlikely event of a data breach affecting your personal data, rm888 will notify you and relevant authorities in accordance with applicable legal obligations and within required timeframes.

14. Third-Party Links

The rm888 platform does not include links to third-party websites. This Privacy Policy applies solely to personal data collected and processed by rm888 through the rm888.one platform and its associated services. rm888 accepts no responsibility for the privacy practices of any external organisations.

15. Amendments to This Policy

rm888 may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, or gaming licence requirements. Material changes will be communicated to registered Users via email to the registered address and/or by a prominent notice upon login to the rm888 platform.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. Your continued use of the rm888 platform following notification of an updated Policy constitutes your acknowledgement of the revised terms.

16. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or rm888's data processing activities, please contact us via: