Privacy Policy – ap8 Platform

1. Introduction

ap8 ("ap8", "we", "our", "us") is the operator of the online gaming platform accessible at ap8.one. We take the privacy and security of your personal data seriously. This Privacy Policy describes the types of personal information we collect from users of the ap8 platform, the purposes for which we use it, the circumstances under which we may share it, and the rights available to you in relation to your data.

This Policy applies to all personal data processed in connection with your registration, use of any ap8 product (slots, live casino, sportsbook, jackpot games), participation in promotions, and any communications you have with ap8 support. It supplements but does not replace our Terms & Conditions, which also contain provisions relevant to your personal data.

ap8 is committed to handling your personal data in a manner consistent with applicable data protection principles, including purpose limitation, data minimisation, storage limitation, accuracy, integrity, and confidentiality. We process your data only to the extent necessary to provide our services and meet our legal obligations.

2. Data Controller

For the purposes of applicable data protection law, ap8 is the data controller in respect of personal data collected through the ap8.one platform. As data controller, ap8 determines the purposes and means of processing your personal information. Our data protection contact details are provided in Section 16 of this Policy.

Where ap8 engages third-party service providers to process personal data on our behalf (for example, payment processors, KYC verification providers, or customer support software vendors), those providers act as data processors under written data processing agreements that bind them to process your data only in accordance with our documented instructions and applicable data protection law.

3. Personal Data We Collect

ap8 collects the following categories of personal data in connection with your use of the platform:

ap8 does not intentionally collect special category personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where strictly necessary for regulatory compliance, such as processing a responsible gaming self-exclusion request that references a medical basis.

4. How We Collect Your Data

4.1 Directly from You

The majority of personal data ap8 holds about you is provided directly by you when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or respond to a promotion. You are not obligated to provide data beyond what is strictly required for the service, but failure to provide mandatory data (for example, identity verification documents) may prevent us from providing certain features such as withdrawal processing.

4.2 Automatically

When you access and use the ap8 platform, we automatically collect certain technical and behavioural data through cookies, server logs, and similar technologies. This includes your IP address, device characteristics, pages visited, game sessions initiated, and actions taken within the platform. This data is used primarily for platform security, fraud prevention, and service improvement purposes.

4.3 From Third Parties

ap8 may receive personal data about you from third-party sources in limited circumstances, including: identity verification and anti-fraud service providers during KYC processing; payment processors confirming transaction completion; and licensing authority databases where required for regulatory compliance checks.

5. Legal Basis for Processing

ap8 processes your personal data on the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to perform our contract with you — for example, verifying your identity to enable withdrawals, processing deposits, settling wagers, and administering your account.
• Legal obligation: Processing required to comply with applicable laws and our gaming licence obligations — including anti-money laundering checks, KYC verification, and regulatory reporting.
• Legitimate interests: Processing necessary for ap8's legitimate business interests, provided those interests are not overridden by your rights — for example, fraud detection, platform security monitoring, and service improvement analytics.
• Consent: Where you have given explicit consent — for example, to receive promotional communications by email or SMS. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. How We Use Your Personal Data

ap8 uses the personal data we collect for the following purposes:

• Creating, verifying, and managing your ap8 account, including identity verification in accordance with KYC requirements.
• Processing deposits and withdrawals through your selected payment methods (Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, GrabPay, USDT, and others).
• Providing and personalising access to ap8 gaming products including slots, live casino, sportsbook, and jackpot games.
• Administering bonuses, promotions, and loyalty programmes in accordance with their specific terms.
• Detecting and preventing fraudulent activity, money laundering, collusion, multi-accounting, and other prohibited conduct.
• Complying with anti-money laundering, responsible gaming, and other regulatory obligations applicable under our gaming licence.
• Providing customer support and responding to enquiries, disputes, and complaints.
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts).
• Sending promotional communications where you have opted in — you may unsubscribe at any time.
• Monitoring and improving the performance, security, and user experience of the ap8 platform.
• Enforcing our Terms & Conditions and responsible gaming obligations.

7. Data Sharing & Disclosure

ap8 does not sell your personal data to third parties. We may share your data with the following categories of recipients in the circumstances described:

• Game providers and content suppliers: Limited data (such as player session tokens) is shared with certified game providers to enable game launch and session management. Providers do not receive your full personal profile.
• Payment processors: Financial transaction data is shared with payment service providers (including e-wallet operators such as Touch n Go and Boost, and bank FPX gateways) solely for the purpose of processing your transactions.
• KYC and fraud prevention providers: Identity and document data is shared with licensed identity verification and anti-fraud service providers for the purpose of account verification and fraud screening.
• Regulatory authorities and law enforcement: ap8 will disclose personal data to regulators, law enforcement agencies, courts, or other competent authorities where required to do so by law, court order, regulatory directive, or our gaming licence obligations.
• Professional advisers: Legal, audit, and compliance advisers may have access to personal data where strictly necessary to provide professional services to ap8, subject to confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of ap8's business, personal data may be transferred to the acquirer as part of that transaction, subject to equivalent data protection commitments.

8. International Data Transfers

As an internationally operated gaming platform, ap8 may transfer your personal data to countries outside Malaysia in connection with the services described in this Policy — for example, to data centres hosting the platform infrastructure, or to certified game providers with servers in other jurisdictions. Where such transfers occur, ap8 ensures that appropriate safeguards are in place to protect your data, including contractual data transfer mechanisms that impose equivalent data protection standards on the recipient.

If you require further information about the safeguards ap8 applies to international data transfers, please contact us using the details in Section 16.

9. Data Retention

ap8 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or our gaming licence conditions. The following retention principles apply:

• Account and identity data is retained for the duration of your account's active period and for a minimum of five (5) years after account closure, as required for anti-money laundering regulatory compliance.
• Financial transaction records are retained for a minimum of seven (7) years in accordance with applicable financial record-keeping obligations.
• Gaming activity data (session history, bet records) is retained for a minimum of five (5) years after the session or bet in question.
• Customer support communications are retained for three (3) years after the case is closed.
• Marketing preference data is retained until you withdraw consent, plus a reasonable period to process the withdrawal.

Where data is no longer required for any legitimate purpose and no legal retention obligation applies, ap8 will securely delete or anonymise it.

10. Cookies & Tracking Technologies

ap8 uses cookies and similar tracking technologies (including local storage and session tokens) on the ap8.one platform. Cookies are small text files placed on your device that enable platform functionality and provide usage analytics.

10.1 Strictly Necessary Cookies

These cookies are essential for the ap8 platform to function. They maintain your authenticated session, store your language and currency preferences, and enable security features such as CSRF protection. These cookies cannot be disabled without breaking core platform functionality.

10.2 Analytics Cookies

ap8 uses privacy-respecting analytics tools to understand how players use the platform — which features are used most, where errors occur, and how performance can be improved. Analytics data is aggregated and does not identify individual players.

10.3 Managing Cookies

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the ap8 platform, including the ability to stay logged in between sessions.

11. Your Data Rights

Subject to applicable law and the conditions of our gaming licence, you have the following rights in relation to personal data ap8 holds about you:

• Right of access: You may request a copy of the personal data ap8 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: In certain circumstances, you may request deletion of your personal data. Note that erasure requests may be declined where retention is required by law (for example, AML record-keeping obligations).
• Right to restriction: You may request that ap8 restrict processing of your data while the accuracy or lawfulness of processing is disputed.
• Right to data portability: Where processing is based on your consent or contractual necessity, you may request a machine-readable copy of your personal data.
• Right to object: You may object to processing based on legitimate interests. You may also object to direct marketing at any time, unconditionally.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact ap8 using the details in Section 16. ap8 will respond to valid requests within 30 days. In complex cases, this period may be extended by a further 60 days, with notice given to you.

12. Children's Privacy

If you believe a person under 21 has registered on ap8, please contact our support team immediately. ap8 uses KYC verification to confirm the age of all registered players; any account that cannot be verified as belonging to a person aged 21 or above will be suspended pending verification.

13. Security Measures

ap8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ap8 servers.
• Encryption of sensitive data fields (including passwords, which are hashed and salted) in our databases.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing of platform infrastructure.
• Two-factor authentication available to all players and required for staff accessing player data systems.
• Incident response procedures for identifying, containing, and reporting data security incidents.

While ap8 takes all reasonable steps to protect your personal data, no internet-connected system is entirely immune to security risks. You should also take steps to protect your own account, including using a strong unique password and enabling 2FA on your ap8 account.

14. Third-Party Platforms & Links

The ap8 platform may contain references to third-party game providers and payment services. ap8 is not responsible for the privacy practices of third-party entities. When you interact with a third-party service (for example, completing a payment via your Touch n Go eWallet app), that interaction is governed by the third party's own privacy policy, not this Policy.

ap8 encourages you to review the privacy policies of any third-party services you use in connection with your ap8 account.

15. Changes to This Privacy Policy

ap8 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or gaming licence requirements. Material changes will be communicated to registered players via in-platform notification or email at least fourteen (14) days before taking effect. The "Last updated" date at the top of this page indicates when the most recent revision was made.

Your continued use of the ap8 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the updated Policy, you should close your account before the changes take effect.

16. Contact & Data Enquiries

For any queries relating to this Privacy Policy, to exercise your data rights, or to raise a data protection concern, you may contact ap8's data protection team. Our support email address is displayed in the footer of this page as plain text. Please include "Privacy Enquiry" in the subject line of your email and provide your registered username so we can locate your account.

ap8 aims to acknowledge all data rights requests within 72 hours and to resolve them within 30 days. For complex requests involving large volumes of data, this period may be extended in accordance with applicable law, with notification provided to you.

If you are not satisfied with ap8's response to a data protection enquiry, you have the right to escalate your complaint to the relevant data protection supervisory authority or our gaming licensing authority.