Privacy Policy

This Privacy Policy is issued by NFT88 ("the Platform", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at nft88.cam. It applies to all individuals who access the NFT88 platform, including registered account holders ("Players") and unregistered visitors who browse the site.

NFT88 is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection legislation. This policy sets out in plain terms what data we collect, why we collect it, how we use it, with whom we share it, and for how long we retain it.

By registering an account on NFT88 or by continuing to access and use the platform after having been presented with this policy, you acknowledge that you have read and understood its contents and consent to the data processing activities described herein where consent is identified as the applicable legal basis.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial data, location data, or any combination of data points that could identify an individual.
• "Data Controller" means NFT88 — the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of NFT88 pursuant to a data processing agreement — for example, KYC verification providers, payment processors, and analytics service providers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transfer, or erasure.
• "Cookies" means small text files placed on your device by the NFT88 platform for the purpose of session management, authentication, analytics, and user experience personalisation.
• "KYC" means Know Your Customer — the identity and address verification process required for regulatory compliance purposes.
• "Platform" refers to the NFT88 website at nft88.cam and any associated mobile-optimised pages.

NFT88 collects personal data across several categories, depending on how you interact with the platform. The principal categories of data we collect are set out in the table below:

NFT88 does not collect sensitive special-category personal data (such as racial origin, health records, or religious beliefs) unless such data is incidentally contained in documents submitted for KYC verification purposes, in which case it is not actively processed or stored beyond what is necessary for identity confirmation.

4.1 Data You Provide Directly

The majority of personal data NFT88 holds about you is data that you provide to us directly through your interactions with the platform. This includes data submitted at registration, during the KYC verification process, when making deposits or withdrawals, and when contacting customer support via live chat or email.

4.2 Data Collected Automatically

When you access and use the NFT88 platform, certain technical and usage data is collected automatically through server logs, cookies, and similar tracking technologies. This data includes your IP address, browser type, operating system, device identifiers, pages visited, session start and end times, and the referring URL from which you arrived at the platform.

4.3 Data from Third Parties

NFT88 may receive personal data about you from third-party sources in the following circumstances: from KYC verification service providers who perform identity checks on our behalf; from payment processors who confirm the status and ownership of payment methods; from fraud detection and anti-money-laundering (AML) service providers; and, where applicable, from referral partners or affiliates who referred your account registration.

NFT88 processes your personal data for the following identified purposes:

• Account Creation and Management: To establish and maintain your player account, including authentication, account security, and communication of account-related updates.
• Identity Verification (KYC): To verify your identity and age (21+ requirement) as required by applicable regulatory obligations and our own platform policies.
• Payment Processing: To process deposits via supported Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank) and to execute withdrawal requests to verified accounts.
• Fraud Prevention and AML Compliance: To detect, investigate, and prevent fraudulent activity, money laundering, and other financial crimes through transaction monitoring and behavioural analysis.
• Responsible Gambling Monitoring: To monitor player activity for indicators of problematic gambling behaviour and to administer player-requested responsible gambling tools such as deposit limits, session restrictions, and self-exclusion.
• Platform Improvement and Analytics: To analyse aggregate usage patterns to improve platform performance, user experience, game library curation, and the responsiveness of the mobile platform.
• Customer Support: To respond to support enquiries, investigate account disputes, process complaints, and communicate resolutions.
• Marketing Communications: To send promotional emails and notifications to players who have provided consent to receive such communications, including bonus offers, tournament announcements, and platform updates. You may withdraw consent at any time.
• Legal and Regulatory Compliance: To meet obligations imposed by applicable laws, including record-keeping requirements, responses to regulatory enquiries, and cooperation with lawful requests from competent authorities.

NFT88 processes your personal data only where a valid legal basis exists for doing so. The legal bases we rely upon for the processing activities described in this policy are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between NFT88 and the Player — specifically, operating your account, processing transactions, and delivering the gaming services you have registered to use.
• Legal Obligation: Processing that is required to comply with applicable legal and regulatory obligations, including KYC identity verification, AML transaction monitoring, and record-keeping requirements.
• Legitimate Interests: Processing carried out in pursuit of NFT88's legitimate business interests where those interests are not overridden by your data protection rights — including fraud prevention, platform security, and aggregate analytics for service improvement.
• Consent: Processing for which you have provided specific, informed, and freely given consent — principally the sending of direct marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

NFT88 does not sell your personal data to any third party. We may, however, share your personal data with the following categories of third party where doing so is necessary to deliver platform services, meet legal obligations, or protect against fraud:

• Payment Service Providers: Banks and e-wallet operators (including those operating FPX, DuitNow, Touch 'n Go, Boost, and GrabPay infrastructure) receive the minimum personal and financial data necessary to process deposits and withdrawals.
• KYC and Identity Verification Providers: Specialist third-party KYC providers perform identity verification checks on our behalf. These providers operate under binding data processing agreements and are prohibited from using your data for any purpose beyond the verification service.
• Game Content Providers: Where technically necessary for game delivery and fair-play auditing, limited usage and session data may be shared with licensed game providers including live dealer studio operators. No financial or identity data is shared with game providers beyond what is operationally necessary.
• Fraud and AML Service Providers: Specialist fraud detection and anti-money-laundering analytics providers may process transaction and behavioural data to flag suspicious activity. All such providers operate under data processing agreements with strict use limitations.
• Regulatory and Law Enforcement Authorities: NFT88 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or lawful regulatory direction. We will notify affected players of such disclosures where permitted to do so by law.
• Professional Advisers: Legal advisers, auditors, and insurers may access personal data on a need-to-know basis where required in connection with the conduct of their professional services for NFT88.

All third-party data processors engaged by NFT88 are subject to binding data processing agreements that require them to implement appropriate technical and organisational security measures, prohibit onward disclosure without authorisation, and process data only for the specific purposes for which it was shared.

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to remember information about your visit — such as your login session, language preferences, and usage behaviour — across pages and between sessions.

8.2 Cookies Used by NFT88

NFT88 uses the following categories of cookies on its platform:

• Strictly Necessary Cookies: Required for core platform functionality including user authentication, session management, and security. These cookies cannot be disabled without materially impairing platform performance.
• Functional Cookies: Store user preferences such as display language, session time preferences, and responsible gambling tool settings to improve your experience across sessions.
• Analytics Cookies: Collect aggregate, anonymised data about how visitors navigate and interact with the platform. This data is used to identify usability issues and guide platform improvements. Analytics cookies do not collect personally identifiable information.
• Performance Cookies: Monitor platform load times, server response performance, and the stability of specific features to support ongoing infrastructure optimisation.

8.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the NFT88 platform, including your ability to remain logged in across sessions. Instructions for managing cookies in the most commonly used browsers are available through each browser's help documentation.

NFT88 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The general retention periods applied by NFT88 are outlined below:

• Account and Identity Data: Retained for the duration of the active account relationship and for a minimum period of five (5) years following permanent account closure, in accordance with financial services record-keeping requirements.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with anti-money-laundering legislation and applicable tax record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years following the completion of the verification process or from the date of account closure, whichever is later.
• Customer Support Communications: Live chat transcripts and email correspondence are retained for a minimum of three (3) years from the date of the interaction for quality assurance, dispute resolution, and audit purposes.
• Usage and Analytics Data: Aggregate anonymised analytics data may be retained indefinitely. Personally identifiable usage logs are retained for up to twenty-four (24) months from the date of collection.
• Marketing Preferences: Records of marketing consent and opt-out history are retained for the duration of the account relationship and for a period of three (3) years thereafter.

Upon the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised using industry-standard methods.

NFT88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include but are not limited to:

• Transport Layer Encryption: All data transmitted between your browser or mobile device and the NFT88 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Data-at-Rest Encryption: Sensitive stored data — including payment details, KYC documents, and account credentials — is encrypted using AES-256 encryption.
• Access Controls: Access to personally identifiable data within NFT88's internal systems is restricted on a strict need-to-know basis. Administrative access is controlled through role-based permissions and requires multi-factor authentication.
• Security Monitoring: NFT88 employs continuous monitoring of platform infrastructure and access logs for anomalous activity, with automated alerting for potential security incidents.
• Regular Security Assessments: The platform undergoes periodic security reviews and penetration testing by qualified security personnel.

Notwithstanding these measures, no data transmission over the internet or electronic data storage system can be guaranteed to be entirely secure. NFT88 will notify affected players and relevant authorities promptly in the event of a confirmed data breach that poses a risk to individual rights, in accordance with applicable notification obligations.

In the course of providing its services, NFT88 may engage data processors whose infrastructure or personnel are located outside Malaysia. Where your personal data is transferred to, or accessed from, a jurisdiction outside Malaysia, NFT88 takes steps to ensure that appropriate safeguards are in place to protect the data in a manner consistent with applicable data protection standards.

Such safeguards may include: binding contractual clauses requiring the recipient to process data to a standard equivalent to applicable data protection legislation; engagement of processors who maintain recognised international security certifications; and restrictions on onward transfer by the recipient without NFT88's prior written authorisation.

If you have questions about specific international data transfers or wish to receive further information about the safeguards in place, please contact us using the details provided in the Contact Us section of this policy.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data that NFT88 holds about you. All rights requests should be submitted to [email protected]. NFT88 will respond to valid rights requests within a reasonable timeframe and in any event within thirty (30) days of receipt.

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is used, where it came from, and with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct or update it without undue delay.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances — such as where your data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent — you may request that we delete your personal data. This right is subject to any legal retention obligations that require us to retain certain data.
• Right to Restriction of Processing: You may request that NFT88 restrict the processing of your data in specific circumstances, such as where the accuracy of the data is contested or where you have objected to processing pending verification of our legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, and is carried out by automated means, you have the right to receive a structured, machine-readable copy of your personal data and to have it transmitted to another data controller where technically feasible.
• Right to Object: You may object to the processing of your personal data where NFT88 relies on legitimate interests as its legal basis. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

NFT88 will not charge a fee for responding to legitimate rights requests unless a request is manifestly unfounded, repetitive, or excessive. In such cases, we may charge a reasonable administrative fee or decline to act on the request, with written reasons provided.

The NFT88 platform is strictly intended for adults aged 21 years and above. NFT88 does not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. Registration by persons under 21 is expressly prohibited under the NFT88 Terms & Conditions.

Where NFT88 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will promptly close the associated account, delete all personal data connected with that account, and — where applicable — refund any deposited funds to the originating payment method.

If you are a parent or guardian and believe that your child or a person under your care has registered an account with NFT88, please contact our support team immediately at [email protected] so that we may investigate and take appropriate action without delay.

NFT88 reserves the right to update, revise, or amend this Privacy Policy from time to time in response to changes in applicable law, regulatory guidance, operational practice, or the nature of the services we provide. The "Last Updated" date displayed at the top of this page will be revised to reflect the date on which the most recent version became effective.

Where changes to this policy are material — meaning they significantly affect the way we handle your personal data or your rights in relation to it — we will notify registered Players via their registered email address and/or by displaying a prominent notice on the NFT88 platform prior to the changes taking effect.

Your continued use of the NFT88 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised policy. If you do not accept the updated terms, you should discontinue use of the platform and may request account closure in accordance with the procedures set out in the NFT88 Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data that NFT88 holds about you, please contact us through one of the following channels:

• Live Chat: Available 24/7 on the NFT88 platform. Recommended for general privacy queries and account-related questions requiring a prompt response.
• Email: [email protected] — for formal data subject rights requests, data breach notifications, consent withdrawal requests, or detailed privacy enquiries. Please include "Privacy Request" in your email subject line and provide your registered account username to assist with prompt identification and processing. Allow up to 30 days for a response.

NFT88 takes all privacy-related enquiries seriously and will acknowledge receipt of your communication promptly. We are committed to resolving data protection concerns in a timely, transparent, and fair manner.