Rm888 Privacy Policy – Your Personal Data Protection

Rm888 collects your personal information only when it is required for legitimate purposes related to platform operations and the provision of services to you. We do not collect excessive or irrelevant information. The types of information we collect include:

Information You Provide Directly:

• Full name as per official identification document
• Date of birth and gender
• National identification number (MyKad) or passport number
• Active email address and mobile phone number
• Current residential address
• Bank account or e-wallet details for deposit and withdrawal purposes
• Copy of identification document for KYC verification

Automatically Collected Information:

• IP address and geographic location information (country/city level)
• Device type, operating system, and web browser used
• Gaming activity history, including bets placed, games played, and session duration
• Deposit and withdrawal transaction history
• Timestamp and date log of all account activity
• Cookie data and website usage analytics data

All information collected is based on a valid legal basis — whether for fulfillment of the service contract between you and rm888, compliance with legal obligations (such as KYC and AML), or our legitimate interests in operating a safe and orderly business.

The personal data we collect is used solely for the operation of the rm888 platform and to provide you with the best, safest, and fairest gaming experience. Below is a detailed table of the purposes for which your data is used:

Rm888 does not sell, rent, or disclose your personal data to any third party for marketing or commercial purposes. However, in the course of operating a safe and legally compliant platform, we may share limited information with the following categories of third parties:

• Payment Service Providers: Recognised payment gateways for processing your deposits and withdrawals. They receive only the information necessary to complete the transaction and are bound by strict confidentiality agreements.
• Game Software Providers: Third-party game developers that supply game content to the rm888 platform. Data sharing is limited to anonymized player IDs, with no full names or personally identifiable information included.
• KYC Service Providers: An identity verification platform that helps rm888 conduct required KYC checks securely and efficiently.
• Relevant Authorities: rm888 will disclose information to government authorities, regulators, or law enforcement agencies when required by law or a valid court order.
• Platform Analytics Services: Analytics providers that help us understand platform usage patterns for continuous improvement. This data is anonymised and aggregated.

All third parties receiving your data are bound by data protection agreements requiring them to safeguard your information to the same or higher standards applied by rm888.

The security of your personal data is rm888's highest priority. We implement multiple layers of comprehensive technical and organisational protection to safeguard your information against unauthorised access, loss, misuse, or accidental disclosure:

• 256-bit SSL Encryption: All data transmitted between your browser and rm888 servers is encrypted using the latest TLS 1.3 protocol, ensuring privacy throughout data transmission.
• Data-at-Rest Encryption: Sensitive data stored in rm888's databases is encrypted using the industry-standard AES-256 encryption algorithm.
• Two-Factor Authentication (2FA): 2FA is available for all rm888 member accounts, adding an extra layer of security beyond a standard password.
• Continuous Security Monitoring: rm888's cybersecurity team monitors our systems 24/7 using advanced threat detection tools to identify and respond to any suspicious activity.
• Regular Security Audits: rm888 conducts regular penetration testing and security audits by independent third parties to identify and patch any system vulnerabilities.
• Role-Based Access Control: Access to member personal data is restricted to staff who require it for their job duties only, with all access recorded in tamper-proof audit logs.

While rm888 takes all reasonable steps to protect your data, no system in the world can guarantee absolute security. We encourage you to also take responsibility by using a strong password, not sharing your login credentials, and enabling 2FA on your rm888 account.

Rm888 uses cookies and similar tracking technologies to enhance your experience on our platform, maintain secure login sessions, and gather analytics data that helps us continuously improve our services.

Types of Cookies Used by rm888:

• Essential Cookies: Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance Cookies: Collects anonymous data about how you use the rm888 platform — the most frequently visited pages, time spent on each page, and any error messages that may appear. This data helps us improve platform performance.
• Functional Cookies: Allows the platform to remember your preferences such as language, region, and display settings to deliver a more personalised experience.
• Analytics Cookies: Used together with third-party analytics tools to understand overall platform usage patterns. This data is collected in aggregate and cannot be individually identified.

Rm888 retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required by applicable laws and regulations. Once the retention period expires, your data will be securely deleted or anonymized using industry-recognized deletion methods.

• Active Account Data: Retained for the duration your account remains active on the rm888 platform, plus any additional period required for legal and compliance purposes.
• Financial Transaction Records: Retained for a minimum of 7 years in compliance with anti-money laundering (AMLA) legal requirements and applicable financial regulations in Malaysia.
• KYC Documents: Retained for 5 years after account termination or longer if required by regulators.
• Support Communication Logs: Retained for 2 years for reference and dispute resolution purposes.
• Cookie & Analytics Data: Session data typically expires within 30 to 365 days depending on the cookie type.

When your account is closed at your own request, rm888 will initiate the data deletion process within 30 days, except for data required to be retained by law. You will be notified once the deletion process is complete.

As an rm888 member, you have the following rights regarding your personal data. rm888 is committed to respecting and facilitating the exercise of these rights within a reasonable timeframe:

• Right of Access: You have the right to know what personal data we hold about you and to obtain a copy of it. Data access requests will be processed within 14 business days.
• Right to Rectification: If you find that any personal data held by rm888 is inaccurate or outdated, you have the right to request a correction. You may also update certain information directly through your account profile settings.
• Right to Erasure: You have the right to request deletion of your personal data under certain circumstances — for example, when the data is no longer needed for its original purpose, or when you withdraw your consent. However, this right is subject to legal data retention obligations that override deletion requests.
• Right to Restriction of Processing: In certain circumstances, you may request rm888 to restrict the processing of your data while a complaint or review is pending.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format, for your own use or to transfer to another service provider.
• Right to Object: You may object to the processing of your data where it is based on rm888's legitimate interests, including processing for direct marketing purposes.

Rm888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or platform service improvements. When significant amendments are made, we will notify you via:

• In-platform notification on rm888 upon your next login
• Email to your registered email address at least 7 days before changes take effect
• A prominent notice on this Privacy Policy page with the new effective date

Continued use of the rm888 platform after the amendment's effective date constitutes acceptance of the revised Privacy Policy. If you do not agree with the amendments, you have the right to terminate your account and request deletion of your personal data in accordance with the procedures outlined in Section 07.

The latest version of this Privacy Policy is always available on this page. The effective date of the current version is 1 January 2026.