Privacy Policy kaya 88 — Your Data Protection

Kaya 88 ("we", "platform", "kaya88.wine") is committed to protecting the privacy of every member and user on our platform. This Privacy Policy has been drafted to comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and to ensure you fully understand your rights with respect to your personal data.

This Privacy Policy covers all aspects of data collection and processing that take place through the Kaya 88 platform, including kaya88.wine, our mobile application (where applicable), and all your interactions with our customer support team. We are committed to ensuring that every decision involving your data is made with full transparency.

By registering a Kaya 88 account or using any part of our platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform immediately and contact us to close your account.

Kaya 88 collects various types of personal data depending on how you interact with our platform. Below is detailed information on the types of data we collect and their sources:

Kaya 88 uses collected personal data solely for legitimate purposes that have been made known to you. We will not use your data for any other purpose without first obtaining your consent.

• Account Management: To securely create, verify, and maintain your member account on the kaya 88 platform.
• Identity Verification (KYC): To verify that you meet the minimum age requirement of 18 years and all other membership eligibility criteria before granting access to the platform.
• Transaction Processing: Managing your deposits and withdrawals via supported Malaysian local payment methods.
• Customer Support: Helping you resolve technical issues, account enquiries, and game-related concerns quickly and efficiently.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may need support related to responsible gaming.
• Promotional Communications: Sending relevant promotional information, bonuses, and special offers (with your consent) to Malaysia members.
• Platform Improvements: To analyse aggregated, anonymised usage data in order to improve the kaya 88 user experience.

Kaya 88 does not sell, rent, or trade members' personal data to third parties for marketing purposes. However, in certain limited circumstances, we may need to share your data with the following parties:

• Payment Provider: Relevant information is shared with payment processors such as DuitNow, FPX, Touch 'n Go, GrabPay, and Boost solely for the purpose of processing your financial transactions.
• Technology Service Provider: Companies providing the technical infrastructure, hosting, and cloud services used by kaya 88 are bound by strict confidentiality agreements.
• Regulatory Bodies & Law Enforcement: kaya 88 will disclose information when required by Malaysian law or a valid court order.
• Group Companies: Related entities within the Kaya 88 group of companies that require data access for internal operational purposes only.

Kaya 88 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or accidental disclosure.

• 256-bit SSL/TLS encryption for all data transmitted between your device and Kaya 88's servers.
• Passwords are stored in hashed form that cannot be decrypted, using the bcrypt algorithm.
• Two-factor authentication (2FA) is available and encouraged for all member accounts.
• Role-based access control (RBAC) — only authorised personnel may access member data.
• Regular security audits and penetration testing conducted by independent experts.
• 24/7 system monitoring to detect any suspicious activity or unauthorised access attempts.
• A comprehensive incident response plan to address any data breaches promptly.

Kaya 88 retains your personal data only for as long as necessary to fulfil the original purpose of collection or as required by applicable Malaysian law.

• Active Account: Data is retained for as long as your account remains active on the kaya 88 platform.
• Upon Account Closure: Financial transaction data and KYC records are retained for 7 years to comply with Malaysian financial legal requirements.
• Communication Logs: Customer support conversation records are retained for 2 years for quality assurance purposes.
• Technical Logs: Server log data and IP addresses are retained for a maximum of 90 days before being automatically deleted.

Upon expiry of the retention period, your data will be permanently deleted or anonymised so that it can no longer be linked to your identity. The deletion process is automatic and requires no action on your part.

Kaya 88 uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how members use our platform. The following are the types of cookies we use:

• Essential Cookies: Required for core platform operations such as login, game sessions, and account security. These cookies cannot be disabled.
• Performance Cookies: Collecting anonymised data on how you use the platform to help us improve our services.
• Functional Cookies: Storing your preferences such as language, display settings, and favourite game selections.
• Analytics Cookies: Helps us understand aggregated usage patterns to make better-informed platform improvement decisions.

You can manage your cookie settings through your web browser at any time. However, disabling certain cookies may affect the functionality of some parts of the Kaya 88 platform.

Under Malaysia's PDPA 2010, you have the following rights regarding the personal data held by Kaya 88. Click on each right to learn more:

In some cases, your personal data may be processed or stored on servers located outside Malaysia, including in the Asia Pacific region. Any cross-border data transfers carried out by kaya 88 are subject to adequate safeguards to ensure your data remains protected.

• Data transfers are only carried out to countries or regions with a level of data protection equivalent to Malaysia's PDPA.
• Binding data processing agreements are signed with all data recipients outside Malaysia.
• Sensitive financial data is never transferred outside the Asia-Pacific region without your explicit consent.

Kaya 88 is a platform exclusively for individuals aged 18 years of age and above. We do not knowingly collect or process personal data of individuals under the age of 18.

The Kaya 88 platform may occasionally contain links to external websites, including payment provider portals such as Maybank2u or CIMB Clicks during the FPX deposit process. Kaya 88 is not responsible for the privacy practices of any such third-party websites.

We encourage you to review the Privacy Policy of any external websites you visit. Kaya 88's Privacy Policy applies solely to the kaya88.wine platform and does not cover any third-party websites or services you may access through links on our platform.

Kaya 88 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, updated legal requirements, or service improvements. Any amendments will be accompanied by a clear update date displayed at the top of this page.

For material amendments — significant changes that affect how we handle your data — we will provide notice via email or in-platform notification at least 14 days before the changes take effect. Your continued use of the kaya 88 platform after the effective date of any amendment will be deemed acceptance of the updated policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how Kaya 88 handles your personal data, please contact our Data Protection Officer (DPO) through the following channels:

• DPO Email:  support@kaya88.wine — please use the subject line "Privacy Policy Enquiry" to help us respond faster.
• Live Chat:  Click the live chat icon at the bottom corner of the Kaya 88 platform — response within 2 minutes, 24/7.
• Frequently Asked Questions:  Visit FAQ page us for answers to the privacy questions most frequently asked by Malaysia members.

We are committed to responding to all privacy-related enquiries within 5 business days. For formal complaints requiring a thorough investigation, the full resolution process will be completed within 21 business days. If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.