Arm88 Privacy Policy – Our Commitment to Protecting the Personal Data of Malaysian Members

1. Introduction – arm88 and Our Privacy Commitment

Arm88 is an online betting platform serving gaming and sports enthusiasts in Malaysia. Since we first launched, one of our core principles has remained constant: our commitment to protecting the personal data of every member. Your trust is the foundation of our relationship, and we do not take lightly the responsibility that comes with it.

This Privacy Policy is written in English and has been drafted in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection standards. We are committed to ensuring that every arm88 member has a clear understanding of what data we collect, why we need it, how it is protected, and what rights you have over that data.

Arm88 acts as the data controller for all personal information collected through our platform. This means we are fully responsible for how your data is processed and protected at every stage of our operations.

2. Personal Information We Collect

Arm88 collects several categories of information from our members. Each category is collected for a specific purpose and does not exceed the minimum data required for that purpose.

Personal Identification Information:

• Full name as per official identity document (MyKad or passport)
• Identity card number (MyKad) or passport number for KYC verification
• Date of birth — to verify the minimum age eligibility of 18 years
• Gender (optional)
• Photos or scans of identity documents submitted during KYC

Contact Information:

• An active Malaysian phone number — used for OTP verification and important communications
• Email address — for account notifications, promotions (if you have opted in), and official communications
• Residential address (may be required for certain KYC processes)

Financial & Transaction Information:

• A record of all deposits and withdrawals on the arm88 platform — including payment method (Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX) and amount in RM
• Limited payment account information — such as the last four digits of your eWallet phone number or bank name, not the full number
• Full transaction history within the arm88 platform

Platform Activity Information:

• Betting and gaming history — game types, wager amounts, outcomes, times, and dates
• Account login and logout activity — including time, date, and IP address
• Your chosen account settings — including betting limits, deposit limits, and self-exclusion preferences

Technical Information:

• The IP address of the device used to access the arm88 platform
• Web browser type and operating system
• Mobile device information — device model and operating system (not IMEI or other personal identifiers)
• Platform usage data — pages visited, time spent on page, navigation patterns
• Cookie data — as described in Section 9

3. How We Collect Your Personal Data

Arm88 collects personal data through several channels, depending on the type of information and the context in which it is used:

• Directly from you: When you register an arm88 account, you provide your personal identification and contact details directly. When you go through the KYC process, you voluntarily submit your identity documents. When you contact customer support, the information you share during that session is stored as a service record.
• Automatically via technology: The arm88 platform automatically collects technical information when you access and use the platform — including your IP address, device type, session information, and cookie data.
• From payment service providers: When you make a deposit or withdrawal via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, or FPX, those service providers may share limited transaction information with arm88 for verification and fraud prevention purposes. arm88 does not receive sensitive information such as your eWallet account password or bank card PIN.
• From third-party sources for verification: In certain cases, arm88 may engage suitable third-party services to assist with member identity verification as part of the KYC process, in accordance with applicable legal requirements.

4. How We Use Your Personal Data

Arm88 uses the data you provide for legitimate and specific purposes only. We do not use your data for any purpose beyond those stated below without first obtaining your consent.

5. Sharing Data with Third Parties

Arm88 does not sell, rent, or trade our members' personal data to any party for marketing or commercial purposes. This is a non-negotiable principle. However, in the course of operating our platform, there are situations where we may need to share data with certain parties within a limited and controlled scope:

• Payment Service Providers: The minimum required transaction information is shared with providers such as Touch 'n Go, GrabPay, DuitNow, and FPX banks to process deposits and withdrawals. This sharing is limited strictly to what is necessary to complete those transactions.
• Technical Service Providers: arm88 engages third-party technical service providers — such as hosting providers, security solution providers, and streaming service providers — who may have limited access to certain data in the course of carrying out their technical duties. All such providers are bound by strict data protection agreements and are not permitted to use that data for any other purpose.
• Legal & Regulatory Requirements: arm88 may be legally required to disclose certain information to the relevant authorities — such as law enforcement agencies or financial regulatory bodies — where a valid court order or legal compliance obligation exists. In such cases, arm88 will notify the member if permitted by law.
• Fraud Prevention & AML: In cases involving suspected money laundering, serious fraud, or security threats, arm88 may share the necessary information with the relevant authorities in accordance with our legal obligations.

6. Data Security – How We Protect Your Information

Arm88 continuously invests in robust security infrastructure to ensure your personal and financial data is fully protected. Our security systems are built on a "defence in depth" principle — meaning multiple layers of protection are in place, not just one.

arm88 Technical Security Measures:

• 256-bit SSL Encryption: All data transmitted between your device and arm88's servers is protected by 256-bit SSL (Secure Sockets Layer) encryption — the same standard used by leading banking and financial institutions in Malaysia. This ensures that no one can read or alter your data while it is in transit.
• Sensitive Data Encryption in Database: Sensitive information such as passwords (stored in hashed form, not plain text) and KYC data is stored in an encrypted state on arm88's servers. Even if someone were to gain access to the database, this data cannot be read without the corresponding encryption key.
• Two-Factor Authentication (2FA): arm88 supports and encourages the use of two-factor authentication for member accounts. All logins are monitored for suspicious activity, and our system will automatically lock an account if repeated login attempts are detected from an unrecognised location or device.
• Independent Security Audits: arm88 undergoes periodic independent security audits conducted by accredited cybersecurity firms. Any vulnerabilities identified during these audits are addressed promptly in order of risk priority.
• 24/7 Monitoring: arm88's automated monitoring system operates around the clock to detect suspicious activity, intrusion attempts, and other concerning indicators in real time. Our security team is on standby to respond immediately whenever an anomaly is identified.

While arm88 takes all reasonable measures to protect your data, it is important to note that no system is 100% breach-proof. We encourage you to play your part in securing your account — use a strong password, never share it with anyone, and notify us immediately if you suspect any unauthorised access to your account.

7. Data Retention Period

Arm88 retains your personal data for as long as it is needed for the purpose it was collected, or for as long as your account remains active. For closed or inactive accounts, retention periods vary by data type and applicable legal requirements:

• Financial Transaction Records: Retained for a minimum of 7 years after the transaction takes place, in line with Malaysia's financial and tax regulatory requirements.
• KYC Records (Identity Documents): Retained for a minimum of 5 years after account closure, in line with applicable AML compliance requirements.
• Platform Activity Logs & Betting Records: Retained for 3 years for dispute resolution, audit, and platform analytics purposes.
• Customer Support Communication Records: Retained for 3 years for quality control purposes and historical dispute reference.
• Technical Data (Access Logs, IP): Retained for 12 months for security and fraud detection purposes.

Once the applicable retention period has expired and there is no further legal or operational need to keep the data, arm88 will securely delete or anonymise your data.

8. Your Rights as an arm88 Member

As an arm88 member, you have the following rights regarding your personal data, which you may exercise at any time by contacting us through the channels stated in Section 12:

To exercise any of the rights above, contact the arm88 data protection team by email at support@arm88.com stating your request type and account details. We will respond within 14 business days.

9. Cookies & Tracking Technologies

The arm88 platform uses cookies and similar tracking technologies to ensure the platform operates correctly, enhance the user experience, and understand how users interact with our platform. Cookies are small text files stored on your device when you visit the arm88 platform.

You can manage cookie usage through your web browser settings. Please note that disabling essential cookies may affect the functionality of the arm88 platform. For optional cookies (analytics and preferences), you may opt out without impacting the platform's core functions.

10. Children's Privacy

The arm88 platform is strictly for individuals aged 18 and above. arm88 does not intentionally collect personal data from anyone under the age of 18.

If we find that we have inadvertently collected personal data from an underage individual, we will take immediate steps to delete that data and close the account in question. Parents or guardians who discover that a child under their care has registered an arm88 account should contact us immediately at support@arm88.com so that we can respond promptly.

11. Amendments to This Privacy Policy

Arm88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or changes in platform operations. The "Updated" date at the top of this document will reflect the date of the most recent amendment.

When material amendments are made to this Privacy Policy — meaning changes that significantly affect how we collect, use, or protect your data — arm88 will notify members via in-platform notifications or their registered email address, at least 14 days before the changes take effect.

Continued use of the arm88 platform after any amendments to this Privacy Policy take effect constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the platform and close your account before the amendments come into effect.

12. Contact Us – Privacy & Data Protection Enquiries

If you have any questions or concerns, or wish to exercise any of your privacy rights as set out in this Privacy Policy, please contact the arm88 data protection team through the following channels: