Privacy Policy My Lucky888 – We Protect Your Data the Way We Look After Our Members

My lucky888 collects your personal information through various channels throughout your interactions with our platform. We are committed to collecting only the data necessary for legitimate purposes, in line with the data minimisation principle under Malaysia's Personal Data Protection Act (PDPA) 2010.

A) Information You Provide Directly

When you register a my lucky888 account, you will be asked to provide the following: your full name as it appears on your identification document, a valid email address, an active Malaysian phone number, your date of birth, and a password. During the identity verification (KYC) process, you may be asked to upload a copy of your MyKad or passport to confirm your identity. This is a standard industry procedure designed to prevent fraud, money laundering, and access by underage individuals.

B) Automatically Collected Information

When you use the my lucky888 platform, our systems automatically collect certain technical data, including your device's IP address, browser type and operating system, pages visited within the platform, session time and duration, and game performance information. This data is used solely to ensure platform security, detect fraudulent activity, and improve the overall user experience.

C) Financial Information

For deposit and withdrawal purposes, my lucky888 retains financial transaction records including the payment method used (e.g. Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, or FPX via Maybank2u and CIMB Clicks), transaction amounts, dates, and processing status. We does not store your credit card number or e-wallet account password directly — all such sensitive information is processed by authorised third-party payment operators.

The data we collect is used solely for specific, legitimate purposes. My lucky888 does not use your data for unrelated purposes or for anything you have not consented to.

For purposes that require your consent (such as marketing and analytics), you may withdraw that consent at any time through your account settings or by contacting the my lucky888 support team.

My lucky888 does not sell, rent, or trade your personal data to any third party for commercial gain. However, in the course of legitimate business operations, we may share your data with the following categories of third parties — all of whom are subject to strict confidentiality agreements:

• Payment Processors: Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX-participating banks (including Maybank2u and CIMB Clicks) to process your financial transactions
• Game Providers: Companies such as Pragmatic Play, NetEnt, and PG Soft receive only the minimum information required to verify player identity and process game outcomes
• Technology Service Providers: Companies providing cloud infrastructure, analytics, and cybersecurity services to my lucky888
• Legal Authorities: We are required to disclose your data when mandated by Malaysian law, a court order, or a competent enforcement authority.

My lucky888 continually invests in the security of our digital infrastructure to ensure your data is protected against unauthorised access, theft, or destruction. The technical security measures we implement include:

• End-to-end encryption using TLS 1.3 and 256-bit SSL protocols for all data in transit
• Encryption of stored sensitive data using AES-256 algorithm
• Intrusion detection system (IDS) and 24/7 network monitoring
• Role-based access control (RBAC) ensuring that only authorised personnel can access sensitive data
• Regular security audits conducted by independent cybersecurity firms
• A comprehensive incident response plan to address any data breaches

In the event of a data breach affecting your personal information, my lucky888 is committed to notifying you via your registered email address within 72 hours of becoming aware of the incident, in line with Malaysia's PDPA requirements.

My lucky888 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform runs smoothly. The following are the types of cookies we use:

• Essential Cookies: Required for the platform to function — including login session management and language preferences. These cookies cannot be disabled.
• Performance Cookies: Collects data on how you use the platform to help us identify and resolve technical issues.
• Functional Cookies: Saves your preferences such as favourite games, display settings, and in-platform search history.
• Analytics Cookies: Helps us understand aggregate platform usage patterns for improvement purposes.

You can manage non-essential cookies through the cookie settings in your my lucky888 account or via your browser settings. Please note that disabling certain cookies may affect the functionality of some platform features.

Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have several important rights regarding your personal data, all of which my lucky888 fully respects:

My lucky888 does not retain your personal data for longer than is necessary for the original purpose of collection, or as required by Malaysian law. The following is a guide to our retention periods:

• Active account data: Retained for the duration of account activity plus 5 years after account closure (financial audit requirements)
• Financial transaction records: Retained for 7 years in accordance with Malaysian legal requirements
• Customer support communication logs: Retained for 3 years from the date of last interaction
• Analytics cookie data: Deleted 13 months after the date of collection
• KYC verification data: Retained for 7 years from the date of last verification

Once the relevant retention period has elapsed, your data will be securely deleted using irreversible deletion methods, or converted into anonymised data that cannot be linked back to your identity.

My lucky888 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform service improvements. We are committed to transparency in all changes made.

When we make material changes to this policy, we will notify you via:

• An email notification to your registered email address
• In-platform pop-up notification on your next login to my lucky888
• Update the "Last Updated" date at the top of this document

Your continued use of the my lucky888 platform after any changes take effect will be considered your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account before the effective date of those changes.

My lucky888 has appointed a Data Protection Officer (DPO) responsible for ensuring PDPA compliance and handling all privacy-related enquiries. If you have any questions, concerns, or complaints regarding how we handle your personal data, please contact us through the following channels: