SMB88 Privacy Policy

This Privacy Policy (the "Policy") is issued by SMB88 (referred to herein as "smb88", "we", "us", or "the Company") and describes how we collect, use, store, protect, share, and otherwise process the personal data of individuals who access or use the smb88 online gaming platform, including all associated websites and interfaces accessible at https://smb88.cam and any subdomains thereof (collectively, the "Platform").

smb88 is committed to handling your personal data with transparency and integrity. This Policy is designed to give you a clear and complete picture of our data processing practices so that you can make informed decisions about your use of our Platform.

This Policy should be read in conjunction with the smb88 Terms and Conditions, which together govern your overall relationship with smb88. Defined terms used in the Terms and Conditions carry the same meaning in this Policy unless otherwise specified herein.

For the purposes of this Policy, the following definitions apply:

• "Controller" means SMB88, being the entity that determines the purposes and means of processing your personal data.
• "Data Subject" means any natural person whose personal data is processed by smb88 — in the context of this Policy, primarily our Members and Platform visitors.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, IP address, device identifiers, payment details, and identity documents.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, deletion, or any combination thereof.
• "Processor" means a third-party entity that processes personal data on behalf of smb88, under a data processing agreement, for purposes specified by smb88.
• "Sensitive Personal Data" means categories of data that warrant heightened protection, including financial account information, government-issued identity document numbers, and biometric data where applicable.
• "Cookies" means small text files placed on your device by the smb88 Platform for the purposes of functionality, analytics, and session management.

smb88 collects the following categories of personal data, depending on your relationship with the Platform and the services you use:

3.1 Registration and Account Data

• Full legal name as it appears on a government-issued identity document
• Date of birth (required for mandatory age verification — 21+ minimum)
• Email address and mobile phone number
• Username and encrypted password
• Residential address (city, state, postcode — e.g., Petaling Jaya, Selangor)
• Preferred currency (Malaysian Ringgit / MYR)

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identity document (e.g., MyKad, passport)
• Proof of residential address document (e.g., utility bill, bank statement)
• Payment method ownership verification documents where required
• Selfie or live photo for facial comparison, where applicable and requested

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment channel used (e.g., Touch 'n Go eWallet, DuitNow, Maybank2u, FPX, CIMB Clicks)
• Payment method identifiers (e.g., masked bank account numbers, e-wallet registered phone number)
• Betting and gaming activity history, including stakes, outcomes, and balances

3.4 Technical and Usage Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser information
• Session timestamps, login history, and navigation patterns on the Platform
• Error logs and performance diagnostics

3.5 Communications Data

• Records of Customer Support interactions, including live chat transcripts and email correspondence
• Voluntary feedback, survey responses, or complaints submitted to smb88

smb88 collects personal data through the following channels:

• Direct provision: Data you submit during account registration, KYC verification, payment processing, or when contacting Customer Support.
• Automated collection: Technical data collected automatically as you interact with the Platform, including through cookies, server logs, and analytics tools.
• Third-party sources: Data received from identity verification service providers, payment processors, fraud prevention services, and our international licensing authority where required for compliance purposes.
• Publicly available sources: In limited circumstances and only where necessary, smb88 may supplement account information with publicly available data for the purposes of fraud prevention or due diligence.

smb88 processes your personal data for the following specific purposes:

smb88 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our obligations under the Member agreement, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable international licensing conditions, anti-money laundering regulations, and other legal obligations imposed on smb88.
• Legitimate interests: Processing necessary for fraud prevention, platform security, improving our services, and responsible gambling monitoring — provided that such interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily applicable to marketing communications and non-essential cookie usage. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

smb88 does not sell or commercially exploit your personal data. However, we share data with the following categories of third parties where necessary to deliver our services and meet our legal obligations:

7.1 Payment Processors

To facilitate deposits and withdrawals, we share relevant financial and identity data with payment service providers including but not limited to operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank online, and Hong Leong Connect. Each provider operates under its own privacy policy and is contractually bound to process data only for the purpose of completing your transaction.

7.2 Identity Verification Services

Our KYC process may involve sharing identity document data with third-party identity verification service providers who perform document authentication and facial comparison on our behalf. These Processors are contractually bound to handle data securely and to retain it only as long as required.

7.3 Regulatory and Law Enforcement Authorities

smb88 may be required to disclose personal data to its licensing authority, financial intelligence units, or law enforcement agencies in connection with legally mandated reporting obligations — for example, the reporting of suspicious transactions under applicable anti-money laundering frameworks. Such disclosures are made only where required by law or a valid legal process.

7.4 Technology and Infrastructure Providers

smb88 uses third-party cloud hosting, cybersecurity, and software services to operate the Platform. These providers act as Processors and are bound by data processing agreements that restrict their use of data to the purposes for which it was shared.

smb88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state, security tokens, and cookies that remember your preferences. These cannot be disabled without affecting Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymous aggregate information about how visitors navigate the Platform, helping us identify and resolve issues and improve the user experience. These do not identify individual users.
• Functional Cookies: Enable enhanced personalisation features, such as remembering your preferred language, game category, or deposit method selection across sessions.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. For full instructions on managing browser cookies, please consult your browser's help documentation.

smb88 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption at rest for sensitive data fields stored within our database infrastructure;
• Role-based access controls that restrict access to personal data to only those employees and contractors who require it for their specific job function;
• Multi-factor authentication for all internal systems and administrative access;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• Intrusion detection and monitoring systems that alert our security team to anomalous access patterns in real time;
• Incident response procedures that ensure prompt identification, containment, and notification in the event of a data security incident.

Notwithstanding the foregoing, no security system is infallible. smb88 cannot guarantee absolute security against all possible threats. In the event of a data breach that poses a risk to your rights or freedoms, smb88 will notify affected individuals in accordance with its obligations under applicable data protection law.

smb88 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for the duration required by applicable legal and licensing obligations. The following general retention principles apply:

• Active Account data: Retained for the full duration of your Account's active status plus any applicable post-closure retention period.
• KYC and identity verification records: Retained for a minimum of five (5) years following Account closure, as required under standard anti-money laundering compliance frameworks applicable to internationally licensed gaming operators.
• Financial transaction records: Retained for a minimum of five (5) years in accordance with financial record-keeping requirements under applicable international licensing conditions.
• Customer Support communications: Retained for a period of three (3) years following the closure of the relevant support interaction, unless a longer retention period is required for dispute resolution or legal proceedings.
• Technical and usage logs: Retained for up to twelve (12) months for platform security, fraud prevention, and performance monitoring purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Where anonymisation is used in place of deletion, the resulting data no longer constitutes personal data and is not subject to this Policy.

Subject to applicable law and any overriding legal obligations that smb88 is required to comply with, you have the following rights in respect of your personal data held by smb88:

To exercise any of the above rights, please contact our Data Protection team at [email protected]. We will respond to all verified requests within 30 days. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, in which case we will notify you of the extension.

smb88 operates under international online gaming licensing, and some of our data processing operations — including cloud infrastructure, identity verification services, and licensing compliance reporting — may involve the transfer of personal data to servers or entities located outside of Malaysia.

Where such international transfers occur, smb88 takes steps to ensure that appropriate safeguards are in place to protect your data, including:

• Entering into standard contractual clauses or equivalent data transfer agreements with recipients in third countries;
• Ensuring that third-party Processors maintain security and confidentiality standards equivalent to those required under this Policy;
• Restricting transfers to jurisdictions that provide an adequate level of data protection under applicable standards.

By using the smb88 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside of Malaysia. smb88 will not transfer your data to any third country without ensuring appropriate protections are in place.

The smb88 Platform is strictly intended for individuals who are a minimum of 21 years of age. smb88 does not knowingly collect personal data from individuals under the age of 21. Our registration process includes mandatory age verification, and KYC procedures are designed to confirm that all Members meet this minimum age requirement before withdrawal privileges are granted.

If smb88 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, we will take immediate steps to delete that data, close the associated Account, and — where required — escalate the matter in accordance with our responsible gambling obligations.

smb88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes to applicable law or licensing requirements, or improvements to our services. The effective date of the current version of this Policy is displayed at the top of this page.

Where we make material changes to this Policy — particularly changes that affect how we use your personal data or reduce your rights as a Data Subject — we will notify active Members via email and/or a prominent notice on the Platform prior to the changes taking effect. We encourage you to review this Policy periodically to stay informed of how smb88 handles your data.

Your continued use of the smb88 Platform following the effective date of an amended Policy constitutes your acknowledgement of the updated terms. If you do not agree with any change, you should cease using the Platform and contact us to arrange closure of your Account.

If you have any questions, concerns, or requests relating to this Privacy Policy or smb88's processing of your personal data, please contact us through the following channels:

• Email (Data Privacy Enquiries): [email protected] — please include "Privacy Enquiry" in your subject line to ensure your request is routed to the correct team. We aim to respond within 5 business days for general enquiries and within 30 days for formal data rights requests.
• Live Chat: Available 24 hours a day, 7 days a week, including Malaysian public holidays, accessible through the chat widget on any page of the smb88 Platform. For complex data rights requests, we recommend email contact to ensure a complete record of correspondence.

For general platform questions and support, including account issues, payment queries, and responsible gambling tools, please visit our FAQ page or contact Customer Support directly.