Open88 Privacy Policy – Personal Data Protection for Malaysian Players

This Privacy Policy is published by open88 ("we", "the Platform" or "open88") and applies to all individuals who register, browse, or use the services of our online entertainment platform, accessible via the open88-khelo.com website along with all associated subdomains and mobile applications.

Open88 operates for users in Malaysia and is fully committed to protecting the privacy of every one of our members. We understand that your trust in open88 depends largely on your confidence that your personal information is handled responsibly, transparently, and securely.

By registering an account or continuing to use the open88 platform following any changes to this Privacy Policy, you agree to be bound by the terms set out in this document. If you do not agree with any part of this Privacy Policy, you are advised not to use open88's services.

Open88 collects your personal data through several channels — directly from you at registration, through your use of the platform, and automatically via standard tracking technologies. The following are the categories of data we collect:

Personal Identification Data (collected during registration):

• Full name as stated on your official Malaysian identity document (MyKad or passport)
• An active Malaysian phone number registered in your name
• A valid and active email address
• Date of birth (for age verification — members must be 18 years of age or older)
• Identity verification documents (KYC), including a copy of your MyKad where required for account verification or large withdrawal processing

Financial & Transaction Data:

• Deposit and withdrawal history, including amounts, dates, times, and payment methods used (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX via Maybank2u or CIMB Clicks)
• EWallet or bank account number used for withdrawal processing
• Records of bonuses and VIP rewards received

Platform Usage Data:

• Gaming records including the types of games played (slots, Live Casino, sports betting on EPL, Malaysia Super League, badminton, e-sports), total wagers, wins, and losses
• Time and duration of gaming sessions
• Current VIP tier and tier progression history

Technical Data (collected automatically):

• The IP address of your device at the time of accessing the open88 platform
• Type and version of web browser or mobile application used
• Device type (Android, iOS, laptop) and operating system
• Cookie data and session identifiers to maintain your login experience
• Pages visited and actions taken within the open88 platform

Every piece of data collected by open88 has a specific and legitimate purpose. We use your personal data for the following:

• Account Management: Creating, managing, and maintaining your open88 account, including the registration process, identity verification, password management, and account-related communications.
• Payment Processing: Processing your deposits via Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, or FPX, and securely and accurately managing withdrawals of winnings to your chosen payment method.
• Gaming Services Provision: Enables you to access and play all games and services available on the open88 platform, including slots, Live Casino, and Sports Betting.
• VIP Rewards Programme: Calculating and managing your VIP tier, processing automatic weekly cashback, activating VIP benefits, and connecting you with a personal account manager at eligible tiers.
• Fraud Prevention & Security: Detecting and preventing fraudulent activity, multiple account creation, money laundering, and any misuse of the open88 platform that may harm other members.
• Responsible Gaming: Monitoring gameplay patterns to identify players who may need support, and ensuring that self-control tools such as deposit limits and self-exclusion are functioning correctly.
• Service Communications: Sending you important notifications about your account, changes to our terms, promotions you have opted into, and responses related to customer support.
• Platform Improvements: Analysing usage data in aggregated, anonymised form to understand how members use the open88 platform and to make relevant improvements.

Open88 will not use your personal data for any purpose not stated above without first obtaining your additional consent.

Open88 processes your personal data on valid legal bases in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). The legal basis we rely on depends on the purpose of processing:

• Contract Performance: Data processing required to deliver the services you have requested — including managing your account, processing payments, and providing access to games — is necessary for the performance of the agreement between you and open88.
• Legitimate Interests: open88 has a legitimate interest in processing data for fraud prevention, platform security, and service improvement purposes, provided this does not override your fundamental privacy rights.
• Legal Obligation: Certain data processing — such as the retention of KYC records and financial transactions — is required to fulfil applicable legal and regulatory compliance obligations.
• Consent: For optional marketing communications such as the latest promotions and exclusive open88 offers, we rely on your explicit consent. You may withdraw this consent at any time.

Open88 does not sell member personal data to any party. However, in the course of operating our business, there are situations where data must be shared with certain parties to enable our services to function:

• Payment Service Providers: Required transaction information is shared with eWallet providers (Touch 'n Go, GrabPay, Boost, ShopeePay) and internet banking platforms (DuitNow, FPX via Maybank2u, CIMB Clicks) solely for the purpose of processing your deposits and withdrawals. These providers maintain their own privacy policies and are subject to Malaysian financial regulations.
• Game Software Providers: Minimal technical data required to operate games — such as session identifiers and active bets — may be processed by the game software providers used by open88. All such providers are bound by strict confidentiality agreements.
• Legal Authorities: open88 will disclose personal data to Malaysian authorities where required by a court order, valid legal process, or to assist in legitimate criminal investigations such as fraud or money laundering.
• IT & Security Service Providers: Selected server infrastructure providers, anti-fraud services, and cybersecurity partners may have limited access to data strictly for technical operational purposes.

Open88 continuously invests in data security to protect our members' personal information. The following technical and organisational measures are in place:

• Encryption in Transit: All communications between your device and open88's servers are protected using TLS 1.3 with 256-bit SSL encryption — the same security standard used by major banking institutions.
• Storage Encryption: Sensitive data stored in the open88 database is encrypted at rest using industry-recognised encryption algorithms.
• Internal Access Controls: Only open88 staff who require access to specific data to perform their duties are authorised to do so. A role-based access control system ensures the principle of least privilege is strictly followed.
• Two-Factor Authentication: open88 administrative accounts and access to internal systems are protected by mandatory two-factor authentication (2FA).
• Continuous Security Monitoring: open88's systems are monitored around the clock to detect suspicious activity, intrusion attempts, and any anomalies that may indicate a security threat.
• Regular Security Audits: open88 conducts regular security assessments and penetration testing to identify and address vulnerabilities before they can be exploited.

While open88 takes all reasonable steps to protect your data, no security system can be guaranteed to be 100% foolproof. You also play an important role in keeping your account safe by using a strong password and never sharing your login credentials with anyone.

Open88 retains your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable Malaysian law. The following is a guide to our retention periods:

• Active Account Data: For as long as your account remains active with open88. Data is continuously updated to maintain accuracy.
• Financial Transaction Records: Minimum 7 years from the transaction date, in accordance with applicable Malaysian financial and tax legal requirements.
• KYC Documents: Minimum 5 years from the date of verification or from the date of account closure, whichever is later, in accordance with legal compliance requirements.
• Technical Log Data: Typically 90 days for standard operational logs and up to 2 years for security-related logs or active investigations.
• Data After Account Closure: After you close your open88 account, data that does not need to be retained for legal reasons will be deleted or anonymised within 90 days.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold:

• Right of Access: You have the right to request a copy of the personal data open88 holds about you. Such requests will be processed within 21 business days.
• Right to Rectification: If any of your personal data is inaccurate or out of date, you have the right to request that open88 correct it. You can update most account information directly through your open88 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request that open88 delete your personal data. This right is subject to legal retention obligations that we are unable to override.
• Right to Restrict Processing: You may request that open88 restrict how we process your data in certain circumstances — for example, while you are disputing the accuracy of your data or objecting to a particular type of processing.
• Right to Object: You have the right to object to the processing of your data for marketing communications at any time. You may unsubscribe from promotional emails via the unsubscribe link included in any marketing email we send.

To exercise any of the above rights, please contact the open88 support team via live chat or email at support@open88-khelo.com, clearly stating your request. open88 will process your request within a reasonable timeframe and inform you of the action taken.

The open88 platform uses cookies and similar standard tracking technologies to enhance the user experience and ensure the platform functions correctly. Below are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled without significantly affecting platform functionality.
• Performance Cookies: Used to analyse how members use the open88 platform so we can identify areas for improvement. This data is collected in aggregate and anonymised form.
• Functional Cookies: Saving your preferences such as language, display settings, and login information you wish to be remembered, to make your future use of the open88 platform more convenient.

You can manage your cookie settings through your web browser. Please note that disabling certain cookies may affect your experience on the open88 platform, including potentially requiring you to log in more frequently.

The open88 platform is strictly for individuals aged 18 and above. open88 does not knowingly collect any personal data from individuals under the age of 18.

If you are a parent or guardian who believes your underage child has registered an account with open88 or provided us with their personal information, please contact our support team immediately at support@open88-khelo.com. open88 will take prompt action to verify the situation, close the account in question, and delete any data collected from the minor.

In operating its platform, open88 may need to process or store members' personal data using server infrastructure located outside Malaysia. However, open88 takes appropriate measures to ensure such data transfers are adequately protected:

• Data transfers are made only to jurisdictions with a level of data protection equivalent to or stricter than Malaysia's.
• All third parties receiving open88 member data outside Malaysia are bound by data transfer agreements that meet the required data protection standards.
• Encryption is applied to all data transferred across borders, regardless of the purpose of the transfer.

By using the open88 platform, you agree to the transfer of your personal data as described in this section, provided that all the protective measures stated herein are fully implemented by open88.

Open88 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, evolving legal requirements, or technological advancements. When we make material changes to this Privacy Policy, we will:

• Updating the "last updated" date at the top of this document.
• Sending email notifications to all registered members at least 7 days before changes take effect, for any significant amendments.
• A clear notice will be displayed on the open88 platform homepage throughout the notification period.

Your continued use of the open88 platform after any Privacy Policy changes take effect will be considered acceptance of the updated policy. If you do not agree with the changes made, you have the right to close your account and request deletion of your data before or after the changes come into effect.

If you have any questions, concerns, or requests regarding this Privacy Policy or how open88 handles your personal data, there are several ways to get in touch with us:

• Live Chat: The fastest option — accessible directly from the open88 platform, available 24/7.
• Email: Send your privacy enquiries to support@open88-khelo.com. Please include "Privacy Enquiry" in the subject line to ensure your message is routed to the right team. Our typical response time is within 24 business hours.
• VIP Manager (for Platinum members and above): Reach out to your personal account manager directly via WhatsApp for any sensitive privacy concerns.

Open88 is committed to addressing all privacy enquiries seriously and responding meaningfully within a reasonable timeframe. We value the trust you place in open88 and understand how important privacy is in the relationship between players and the platform they choose for their leisure and enjoyment.