digi888 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, location data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, digi888.
• "Data Processor" means any entity that processes Personal Data on behalf of digi888 under a written data processing agreement.
• "Account" means a registered player account on the digi888.win platform.
• "KYC" means Know Your Customer identity verification, a regulatory compliance process required before withdrawal processing.

2. Data Controller Information

The Data Controller responsible for Personal Data collected through the digi888 platform is the operator of digi888.win. For all privacy-related queries, data subject rights requests, and complaints, players may contact the digi888 data protection contact point via the support channels listed in Section 14 of this Policy.

3. Personal Data We Collect

digi888 collects Personal Data in the following categories:

4. How We Collect Your Data

digi888 collects Personal Data through the following means:

• Direct submission: Information provided by you during Account registration, KYC document submission, payment processing, and customer support interactions.
• Automated technical collection: Technical and Usage Data collected automatically when you access or use the digi888 platform, including through server logs, session tracking, and cookie technologies (see Section 9).
• Third-party verification services: Identity and address verification data returned to digi888 by third-party KYC and AML service providers as part of the verification process.
• Payment processors: Transaction confirmation and payment status data received from payment gateways including Touch n Go, Boost, FPX, and Malaysian banking partners.
• Fraud detection providers: Risk scores, device fingerprint data, and behavioural indicators provided by fraud prevention service partners.

5. Purposes and Legal Basis for Processing

digi888 processes Personal Data for the following purposes, each underpinned by a lawful processing basis:

digi888 does not use Personal Data for automated decision-making that produces significant legal effects without a human review stage.

6. Data Sharing and Third-Party Disclosures

6.1 Service Providers. digi888 shares Personal Data with third-party service providers that support platform operations under binding data processing agreements. These providers are permitted to use Personal Data only for the specific services they are contracted to deliver and may not use it for their own commercial purposes. Categories of service providers include: payment gateway operators, identity verification and KYC technology providers, fraud detection and AML screening services, cloud infrastructure and hosting providers, and customer support software vendors.

6.2 Regulatory Authorities. digi888 may be required to disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, valid legal process, or as necessary to comply with digi888's international gaming licence obligations. digi888 will, where legally permitted, notify the affected Player of any such disclosure requirement.

6.3 No Commercial Data Sales. digi888 does not sell, rent, license, or commercially transfer Personal Data to any third party for that party's own marketing or commercial purposes. This restriction applies without exception.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of digi888's assets, Personal Data held by digi888 may be transferred to the acquiring entity as part of the transaction. Players would be notified of any such transfer and of any consequent changes to this Privacy Policy before the transfer takes effect.

7. International Data Transfers

digi888 may transfer Personal Data to service providers or infrastructure located outside Malaysia. Where such transfers occur, digi888 ensures that appropriate safeguards are in place to maintain an equivalent level of data protection, including through the use of contractual data transfer mechanisms, processor agreements incorporating standard data protection clauses, and due diligence assessments of the data protection practices of recipient entities.

8. Data Retention

8.1 Active Accounts. Personal Data associated with active digi888 Accounts is retained for the duration of the Account relationship and for a period thereafter as required by applicable legal, regulatory, and contractual obligations.

8.2 Post-Closure Retention. Following Account closure, digi888 retains the following categories of data for the stated minimum periods in compliance with its international gaming licence requirements and applicable anti-money laundering regulations:

• Identity and KYC verification data: minimum 5 years post-Account closure
• Transaction and financial records: minimum 5 years post-transaction date
• Customer support and communications records: minimum 3 years
• Technical and Usage Data: up to 24 months in identifiable form; may be retained in anonymised, aggregated form indefinitely

8.3 Deletion. Personal Data no longer required for legal, regulatory, or operational purposes is deleted or anonymised in accordance with digi888's data lifecycle management procedures.

9. Cookies and Tracking Technologies

9.1 What We Use. digi888 uses cookies and similar tracking technologies (including local storage and session identifiers) to maintain authenticated sessions, record platform preferences, gather anonymised usage analytics, and support fraud detection.

9.2 Cookie Categories:

• Strictly Necessary: Required for the platform to function. These cannot be disabled without affecting core functionality, including maintaining your logged-in session.
• Analytical / Performance: Used to understand how players interact with the platform, identify usage patterns, and improve platform performance. Data is collected in anonymised or pseudonymised form.
• Functional: Store preferences such as language settings and responsible gaming limit configurations.
• Security / Fraud Prevention: Device fingerprinting and session integrity tokens used by digi888's fraud detection systems.

9.3 Cookie Control. Non-essential cookies may be managed through your browser settings. Disabling analytical or functional cookies may affect certain features of the digi888 platform but will not prevent access to core gaming and account functions.

10. Security Measures

digi888 implements a layered technical and organisational security programme to protect Personal Data against unauthorised access, disclosure, loss, or alteration. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and digi888's servers
• Encryption at rest for sensitive Personal Data and financial records held in digi888's data stores
• Role-based access controls limiting Personal Data access to authorised personnel with a demonstrated operational need
• Multi-factor authentication for internal system access by digi888 staff
• Regular penetration testing and vulnerability assessments of platform infrastructure
• Incident response procedures for the detection, containment, and notification of Personal Data breaches

Notwithstanding these measures, no online platform can guarantee absolute security. Players are encouraged to maintain strong, unique passwords for their digi888 Accounts and to enable two-factor authentication where available.

11. Your Data Subject Rights

Registered digi888 players have the following rights in relation to their Personal Data, subject to applicable legal limitations and verification requirements:

• Right of Access: Request a copy of the Personal Data digi888 holds about you.
• Right to Rectification: Request correction of inaccurate or incomplete Personal Data.
• Right to Erasure: Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may preclude full deletion (see Section 8).
• Right to Restriction: Request that digi888 restricts processing of your Personal Data in certain circumstances, such as where the accuracy of the data is contested.
• Right to Portability: Request a copy of your Personal Data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to Object: Object to processing of your Personal Data for legitimate interests purposes, including profiling for responsible gaming risk monitoring.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact digi888's support team via live chat or email at [email protected]. Requests will be acknowledged within 5 business days and resolved within 30 days, subject to verification of your identity and the complexity of the request.

12. Children and Minors

The digi888 platform is strictly restricted to persons aged 21 and above. digi888 does not knowingly collect Personal Data from individuals under the age of 21. Where digi888 becomes aware that Personal Data has been collected from a person under 21, that Account will be suspended, the data will be deleted in accordance with applicable obligations, and any associated funds will be handled in accordance with regulatory requirements. Parents or guardians who believe a minor has registered on digi888 should contact [email protected] immediately.

13. Changes to This Policy

digi888 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, or platform features. Material changes will be communicated to registered players via the registered email address at least 14 days before the revised Policy takes effect. The current version of this Privacy Policy is always accessible at digi888.win/privacy-policy. Continued use of the digi888 platform after the effective date of an updated Policy constitutes acceptance of the revised terms.

14. Contact and Data Subject Requests

For all privacy-related queries, data subject rights requests, or concerns about how digi888 handles your Personal Data, please contact us through the following channels:

• Live Chat: Available 24/7 via digi888.win — for urgent data concerns, live chat is the fastest channel
• Email: [email protected] — please include "Privacy Request" in the subject line for prioritised routing

digi888 will acknowledge all privacy-related contacts within 2 business days and will respond substantively within 30 days of receiving a complete request. Identity verification may be required before Personal Data is disclosed or modified in response to a data subject request.