Privacy Policy — VIP288

Introduction

This Privacy Policy ("Policy") is published by VIP288 ("the Company", "we", "us", "our") and applies to all personal data collected from individuals ("you", "your", "the Player") who access or use the VIP288 online gaming and sports betting platform, available at https://vip288.casa and any associated mobile interface (collectively, "the Platform").

VIP288 operates as an international online gaming platform serving players across Malaysia, including those located in Kuala Lumpur, Selangor, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions. We recognise that our Malaysian players entrust us with sensitive personal and financial information, and we treat that trust with the highest degree of seriousness.

This Policy explains: what categories of personal data we collect; the purposes for which we process that data; our lawful basis for processing; with whom we share data; how long we retain data; and the rights available to you regarding your personal information.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

Data We Collect

VIP288 collects personal data from you through several points of interaction with the Platform. The categories of personal data we collect, and the specific data points within each category, are set out below.

3.1 Registration & Account Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (for age verification purposes — players must be 21 or above)
• Residential address, including postcode and state of residence
• Email address (used as primary communication channel)
• Username selected at registration
• Account creation date and VIP tier status

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (Malaysian MyKad, passport, or equivalent)
• Proof of residential address (utility bill, bank statement, or official government correspondence)
• Proof of payment method ownership (e-wallet account confirmation, bank statement header)

3.3 Financial & Transaction Data

• Deposit amounts, dates, and payment method references (e.g., Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, BTC/USDT)
• Withdrawal requests, amounts, processing times, and destination account identifiers (masked)
• Account balance history and bonus credit records
• Wagering history, game session records, and bet settlement data

3.4 Technical & Device Data

• IP address at time of login and transaction
• Device type, operating system, and browser version
• Session duration, pages visited, and interaction patterns on the Platform
• Geolocation data (city and country level, derived from IP address)

3.5 Communication Data

• Records of live chat conversations with our support team
• Email correspondence sent to and from [email protected]
• Feedback, complaints, and dispute submissions

How We Collect Data

VIP288 collects personal data through the following channels and methods:

• Direct submission by you: Data you provide voluntarily when registering an Account, completing KYC verification, submitting a deposit or withdrawal request, contacting our support team, or completing any form or interaction on the Platform.
• Automated collection: Technical data such as IP addresses, session logs, and device fingerprints collected automatically when you access the Platform, via server logs and analytics tools.
• Cookies and tracking technologies: Session cookies, persistent cookies, and similar tracking technologies placed on your device when you browse the Platform. Full details are provided in Section 10 of this Policy.
• Third-party sources: Data received from payment processors (transaction confirmation and status), KYC verification service providers (identity verification outcomes), and fraud prevention services (risk scoring data), where necessary to operate the Platform securely.

Lawful Basis for Processing

VIP288 processes personal data only where a valid lawful basis exists. The lawful bases we rely upon, and the processing activities associated with each, are as follows:

How We Use Your Data

VIP288 uses personal data collected from players for the following specific purposes:

6.1 Account & Service Delivery

To create and maintain your Account; to authenticate your identity on login; to process deposits and withdrawals via your selected Malaysian payment channels (including Touch 'n Go eWallet, DuitNow, FPX, and local bank transfer); to manage bonus credits and wagering requirements; and to administer your VIP tier benefits.

6.2 Identity Verification & Compliance

To verify that you meet the minimum age requirement of 21 years; to conduct mandatory KYC checks before processing withdrawal requests; to perform anti-money laundering (AML) transaction monitoring; and to comply with applicable legal obligations including reporting to relevant authorities where required by law.

6.3 Security & Fraud Prevention

To detect, investigate, and prevent fraudulent activity, prohibited conduct, and unauthorised Account access; to identify and block duplicate Accounts; to monitor wagering patterns for signs of bonus abuse or collusion; and to safeguard the integrity of our gaming and sportsbook operations.

6.4 Platform Improvement

To analyse Platform usage patterns and identify areas for improvement; to test new game categories and features; to optimise payment flow and withdrawal processing efficiency; and to improve the overall experience for Malaysian players.

6.5 Customer Support

To respond to your enquiries, support tickets, and complaints via live chat or email; to maintain records of previous interactions for continuity of support; and to escalate and resolve formal disputes.

6.6 Marketing (Consent-Based Only)

To send promotional emails, bonus notifications, VIP programme updates, and new game announcements to players who have expressly consented to receive marketing communications. We do not send unsolicited marketing.

Data Sharing & Disclosure

VIP288 does not sell, rent, or trade personal data to third parties for commercial purposes. We share personal data only in the following limited and necessary circumstances:

• Payment Processors: We share transaction data with our payment processing partners — including the operators of Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX integrations, and major Malaysian bank gateways — strictly to the extent required to complete deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Identity documents and verification data are shared with our contracted KYC service providers who perform automated and manual identity verification on our behalf. These providers are contractually bound to handle data confidentially and to use it only for verification purposes.
• Game Technology Providers: Limited session and account identifiers are shared with our game software providers to enable game sessions, RNG certification audits, and game-specific fairness reporting. No financial account data is shared with game providers.
• Fraud Prevention & Security Services: IP addresses, device fingerprints, and risk-scoring data may be shared with fraud prevention service providers to detect and prevent prohibited conduct.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulators, or courts where we are legally compelled to do so or where disclosure is necessary to protect VIP288's legal rights or prevent harm.
• Business Transfers: In the event of a merger, acquisition, or sale of VIP288 or substantially all of its assets, personal data held by VIP288 may be transferred to the acquirer as part of the transaction. Affected players will be notified in advance where practicable.

International Data Transfers

As an internationally operated platform serving Malaysian players, VIP288 may store and process personal data on servers located outside of Malaysia. Some of our contracted service providers — including KYC verification providers and game technology partners — are also headquartered or operate infrastructure in jurisdictions outside Malaysia.

Where personal data is transferred internationally, VIP288 takes the following safeguards to ensure your data remains protected:

• We only transfer personal data to jurisdictions that provide an adequate level of data protection, or to service providers that have contractually committed to appropriate data protection standards via Data Processing Agreements (DPAs).
• All third-party data processors operating internationally are required to implement technical and organisational security measures equivalent to or exceeding those applied by VIP288 internally.
• Cross-border data transfers are restricted to the minimum data necessary for the specific processing purpose.

Data Retention

VIP288 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any overriding legal or regulatory retention obligation. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Data that has been anonymised is no longer treated as personal data and may be retained indefinitely for aggregate analytics purposes.

Cookies & Tracking Technologies

VIP288 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your web browser when you visit a website. Cookies serve several functions on the VIP288 Platform:

Categories of Cookies We Use

You can control and manage cookies through your browser settings. Most modern browsers allow you to block or delete cookies. However, please note that disabling strictly necessary cookies will impair the Platform's core functionality, including login and session management. VIP288 does not use cookies for third-party advertising or cross-site tracking.

User Rights

Subject to applicable law and the limitations described below, you have the following rights in respect of your personal data held by VIP288. All data rights requests should be submitted to [email protected] with the subject line "Data Rights Request — [Your Account ID]".

VIP288 will respond to all verified data rights requests within thirty (30) calendar days. In complex cases requiring extended review, we will notify you of the delay and provide an expected resolution date. There is no charge for submitting a data rights request.

Marketing Communications

VIP288 sends promotional communications — including welcome bonus offers, reload promotions, VIP tier notifications, birthday bonus reminders, and new game announcements — only to players who have expressly consented to receive such communications during account registration or via their Account preferences.

We do not send unsolicited commercial email or engage in cold-contact marketing. We do not share your contact details with third-party marketers.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your Account settings
• Using the unsubscribe link included in every marketing email we send
• Contacting our support team via live chat or email at [email protected] and requesting to be removed from marketing lists

Withdrawal of marketing consent will not affect transactional communications — such as withdrawal confirmations, security alerts, KYC notifications, and account status updates — which are sent as part of the contractual service and cannot be unsubscribed from while your Account remains active.

Children's Privacy

VIP288 is strictly an adult platform. We do not knowingly collect, process, or store personal data from individuals under the age of twenty-one (21). Our registration process requires date-of-birth declaration and our KYC process requires government-issued identity verification to confirm that all registered players meet the minimum age requirement.

If VIP288 becomes aware that personal data has been collected from an individual who is under 21 years of age, that Account will be closed immediately, all associated data will be deleted or returned in accordance with applicable law, and any funds deposited will be returned to the original payment source.

If you believe that a minor has registered an Account on VIP288 using false information, please notify us immediately at [email protected]. We will investigate and take appropriate action without delay.

Security Measures

VIP288 implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes the following controls:

• Encryption in Transit: All data transmitted between your device and VIP288's servers is protected using 256-bit SSL/TLS encryption. This includes login credentials, payment data, and personal information submitted via account forms.
• Encryption at Rest: Sensitive data stored in our databases — including identity documents, payment method references, and KYC data — is encrypted at rest using AES-256 encryption.
• Access Control: Access to personal data within VIP288's internal systems is restricted on a strict need-to-know basis. Employees and contractors accessing personal data are required to operate under confidentiality obligations.
• Two-Factor Authentication: 2FA is available for Player Accounts and is mandatory for all internal staff with administrative access to player data systems.
• Regular Security Audits: VIP288 commissions independent third-party security assessments on a periodic basis to identify and remediate vulnerabilities in our infrastructure and application layer.
• Incident Response: VIP288 maintains a documented data breach response protocol. In the event of a security incident that poses a risk to player data, affected players will be notified without undue delay in accordance with applicable data breach notification requirements.

While VIP288 employs industry-standard security measures, no online system is entirely immune to security threats. You can reduce risk by keeping your login credentials confidential, enabling 2FA on your Account, and notifying us immediately if you suspect unauthorised access.

Third-Party Links

The VIP288 Platform does not contain links to third-party websites for advertising or affiliate marketing purposes. Game interfaces provided by our game technology partners operate within an embedded framework on the Platform and are subject to those providers' own privacy practices in respect of game session data.

VIP288 is not responsible for the privacy practices, data handling, or content of any third-party entity whose services are integrated into the Platform. We encourage players to review the privacy policies of our payment processors and game providers where such policies are made publicly available by those providers.

Policy Amendments

VIP288 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. The date of the most recent revision is displayed at the top of this page.

Where changes are material — for example, where we propose to use personal data for a new purpose, or where we add a new category of data collection — we will notify registered players by email to their registered address at least fourteen (14) days prior to the changes taking effect, or immediately in cases required by law.

Minor clarifications and non-material amendments may be made without prior notice, in which case the updated effective date at the top of this page will reflect the change. We recommend reviewing this Policy periodically. Continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights as described in Section 11, or wish to raise a data protection concern, please contact VIP288 through the following channels:

• Support Email: Send your enquiry to [email protected]. For data rights requests, include your registered Account ID and the subject line "Data Rights Request — [Account ID]". We aim to respond within thirty (30) calendar days.
• Live Chat: Our 24/7 live chat support team is available for general privacy enquiries and can log formal data rights requests for escalation to our compliance team. Core support hours are 9:00 AM – 3:00 AM (MYT) with emergency coverage outside those hours.

We are committed to addressing all privacy-related concerns promptly and transparently. If you are dissatisfied with our response to a data protection concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.