nft88 Privacy Policy

1.Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• "nft88" / "we" / "us" / "our" — the legal entity operating nft88.win under international gaming authority licensing.
• "Player" / "User" / "you" / "your" — any individual who accesses, registers with, or uses the nft88 platform.
• "Personal Data" — any information that identifies or could reasonably identify you as an individual, including name, email, identification documents, financial details, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "PDPA" — Malaysia's Personal Data Protection Act 2010.
• "KYC" — Know Your Customer procedures conducted to verify player identity in accordance with anti-money laundering obligations.

2.Who We Are (Data Controller)

nft88.win is operated by the legal entity holding the applicable international gaming authority licence under which the platform functions. nft88 acts as the data controller in respect of personal data collected from players using the platform.

As data controller, nft88 determines the purposes and means by which your personal data is processed. All data processing described in this policy is carried out by nft88 or by processors acting under our direct instruction and under contractual data processing agreements.

For all privacy-related enquiries, players may contact nft88 via 24/7 Live Chat on nft88.win or by email at [email protected].

3.Personal Data We Collect

nft88 collects the following categories of personal data from players:

3.1 Identity Data

• Full legal name as it appears on your government-issued identification
• Date of birth (required to verify 21+ age eligibility)
• Gender (where provided voluntarily)
• Copies of identity documents (NRIC, passport, or equivalent) submitted during KYC verification

3.2 Contact Data

• Email address (required for account registration and communications)
• Mobile phone number (where provided for 2FA or account recovery)
• City and country of residence (e.g., Kuala Lumpur, Penang, Johor Bahru)

3.3 Financial Data

• Payment method details (Touch n Go eWallet, Boost, FPX bank selection, card last-four digits)
• Transaction history — deposits, withdrawals, bets placed, and winnings
• Bank account or e-wallet identifiers associated with deposits and withdrawals

3.4 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session logs including login timestamps, game activity, and session duration
• Cookies and similar tracking technologies as described in Section 10

3.5 Communications Data

• Records of communications with nft88 support via live chat or email
• Promotional email engagement data (opens, clicks) where applicable

4.How We Collect Your Data

nft88 collects personal data through the following channels:

• Account Registration: Data you provide when creating your nft88 account, including name, date of birth, email, and chosen username.
• KYC Verification: Identity and address documents submitted during the mandatory verification process required under AML compliance obligations.
• Deposits & Withdrawals: Payment information captured during financial transactions via Touch n Go eWallet, Boost, FPX, or card processors.
• Platform Usage: Automatically collected technical data including IP addresses, device identifiers, and session activity generated by your use of nft88.
• Customer Support: Information you provide when contacting nft88 via live chat or email.
• Cookies: Data collected via cookies and similar technologies as described in Section 10 of this policy.

5.Legal Basis for Processing

nft88 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our agreement with you — account creation, payment processing, game access, and withdrawal handling.
• Legal Obligation: Processing required to comply with applicable law — including KYC/AML obligations under the gaming licence, financial record-keeping requirements, and regulatory reporting.
• Legitimate Interests: Processing conducted for fraud prevention, platform security, responsible gaming enforcement, and analytical purposes, where these interests are not overridden by your privacy rights.
• Consent: Where nft88 sends promotional communications (such as bonus offers or newsletters), this is done on the basis of your consent, which you may withdraw at any time by contacting support or using the unsubscribe mechanism in communications.

6.How We Use Your Personal Data

nft88 uses the personal data it collects for the following purposes:

• Creating and managing your nft88 player account
• Verifying your identity and age (21+) in compliance with licensing and AML requirements
• Processing deposits and withdrawals in Malaysian Ringgit (MYR)
• Providing access to all nft88 products — sportsbook, live casino, slots, poker, and esports betting
• Detecting and preventing fraud, money laundering, and prohibited conduct as described in the nft88 Terms & Conditions
• Enforcing responsible gaming tools including deposit limits, self-exclusion, and cooling-off restrictions
• Responding to player support queries and complaints
• Sending transactional communications — account notifications, security alerts, and withdrawal confirmations
• Sending promotional communications where you have provided consent
• Complying with regulatory reporting obligations under the applicable gaming licence
• Improving and optimising the nft88 platform based on aggregated, anonymised usage analytics

7.Data Sharing & Disclosure

7.1  nft88 does not sell your personal data to any third party. Data sharing is limited to the following categories of recipients, each engaged under contractual data processing agreements:

• Payment Processors: Touch n Go eWallet, Boost, FPX gateway operators, card scheme processors (Visa/Mastercard) — receiving only the transaction data necessary to process your payment.
• Identity Verification Providers: Third-party KYC service providers engaged to verify identity documents as part of mandatory AML compliance. These providers are contractually prohibited from using your data for any purpose beyond identity verification for nft88.
• Game Content Providers: Licensed game providers (such as Evolution, PG Soft, Pragmatic Play) may receive pseudonymised session data as technically necessary to deliver their games via the nft88 platform. These providers do not receive your name, payment details, or identity documents.
• Regulatory Authorities: nft88 will disclose personal data to the licensing authority, financial intelligence units, or law enforcement agencies where legally required to do so.
• IT Infrastructure & Security Providers: Cloud hosting providers and cybersecurity services engaged to maintain platform operations, under strict data processing agreements.

7.2  nft88 will never share your personal data with marketing agencies, data brokers, or any entity for purposes unrelated to the delivery of nft88's services or compliance with legal obligations.

8.International Data Transfers

8.1  Due to the international nature of online gaming operations and the global infrastructure of nft88's technology partners, your personal data may be transferred to and processed in countries outside Malaysia. Such transfers may include countries within Asia, Europe, or other regions where nft88's service providers maintain infrastructure.

8.2  Where personal data is transferred internationally, nft88 ensures that appropriate safeguards are in place — including contractual data transfer agreements, standard contractual clauses, or transfers to jurisdictions recognised as providing adequate data protection under applicable frameworks.

8.3  By using nft88 and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data as described above.

9.Data Retention

9.1  nft88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your nft88 account and for a period of at least 5 years following permanent account closure, in accordance with AML record-keeping requirements.
• Transaction Records: Retained for a minimum of 7 years following the date of each transaction, as required under financial record-keeping obligations.
• KYC Documents: Retained for the period specified under the applicable gaming licence's AML framework, typically 5 years from the end of the business relationship.
• Support Communications: Retained for 3 years from the date of the interaction, unless required for longer in connection with a dispute or regulatory matter.
• Technical Log Data: Retained for up to 12 months for security and fraud prevention purposes, after which it is anonymised or deleted.

9.2  Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents recovery.

10.Cookies & Tracking Technologies

10.1  nft88 uses the following categories of cookies on the platform:

• Essential Cookies: Required for basic platform functionality — maintaining your login session, processing transactions, and enforcing security measures. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings or preferred lobby view. These improve your experience but are not strictly essential.
• Analytical Cookies: Used to collect aggregated, anonymised data about how players navigate and use the nft88 platform, helping us improve page performance and product design. This data does not identify individual players.

10.2  nft88 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts that transmit your browsing behaviour to external advertising networks.

10.3  You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent access to logged-in features of the nft88 platform.

11.Security Measures

11.1  nft88 implements technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and nft88 servers
• Encrypted storage of passwords using industry-standard cryptographic hashing algorithms
• Segregated storage of player funds and personal data on access-controlled infrastructure
• Multi-factor authentication for administrative access to systems holding player data
• Regular penetration testing and security audits conducted by independent third parties
• Staff training on data protection obligations and information security practices

11.2  Despite these measures, no digital platform can guarantee absolute security. In the event of a data breach that poses material risk to affected players, nft88 will notify affected individuals and, where required, the relevant regulatory authority, within the timeframes prescribed by applicable law.

12.Your Data Rights

12.1  Subject to applicable law, you have the following rights in respect of your personal data held by nft88:

• Right of Access: You may request a copy of the personal data nft88 holds about you.
• Right of Correction: You may request correction of inaccurate or incomplete personal data held in your nft88 account. Minor corrections can be made directly via account settings; significant changes (e.g., legal name) require identity verification.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., promotional communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Restrict Processing: In certain circumstances, you may request that nft88 restricts the processing of your data — for example, while a correction request is under review.
• Right to Object: You may object to processing based on legitimate interests, subject to nft88's overriding legal obligations under gaming licensing and AML law.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to nft88's mandatory retention obligations under applicable law.

12.2  To exercise any of the above rights, contact nft88 via 24/7 Live Chat or at [email protected]. nft88 will respond within 30 days of receiving a valid request.

12.3  nft88 may require identity verification before fulfilling any data rights request to ensure requests are made by the account holder.

13.Children & Minors

13.1  nft88 is strictly an adult platform for persons aged 21 years and above. nft88 does not knowingly collect personal data from anyone under the age of 21.

13.2  If nft88 discovers or is notified that personal data has been collected from a person under 21, the account will be immediately suspended, funds may be withheld pending investigation, and the data will be securely deleted to the extent permissible under applicable legal obligations.

13.3  If you have reason to believe a minor is using nft88, please contact support immediately at [email protected].

14.Changes to This Privacy Policy

14.1  nft88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. Material changes will be communicated to registered players via email or prominent in-platform notification at least 7 days before the revised policy takes effect.

14.2  The "Last updated" date at the top of this policy reflects when it was most recently revised. We encourage players to review this policy periodically to stay informed of how nft88 handles their personal data.

14.3  Continued use of nft88 following the effective date of any revised Privacy Policy constitutes acceptance of the updated terms.

15.Contact & Complaints

15.1  For any privacy-related questions, requests, or concerns, please contact nft88's support team:

15.2  If you are not satisfied with how nft88 has handled your personal data or a data rights request, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction, or with the supervisory authority of the jurisdiction under which nft88's gaming licence is issued.

15.3  nft88 takes all privacy complaints seriously. Formal complaints will be acknowledged within 5 business days and investigated thoroughly, with a substantive response provided within 30 days of receipt.