spade88 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy ("Policy") is published by spade88 ("the Company", "we", "us", "our"), the operator of the online gaming platform accessible at spade88.co ("the Platform"). This Policy describes how spade88 collects, uses, stores, shares, and protects the personal data of individuals who visit, register on, or interact with the Platform ("you", "the User", "Data Subject").

By accessing or using the spade88 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must cease using the Platform immediately.

This Policy should be read alongside the spade88 Terms and Conditions, which govern your overall use of the Platform.

spade88 is the data controller responsible for the personal data processed under this Privacy Policy. As data controller, spade88 determines the purposes and means of processing personal data collected through the Platform.

For all data protection enquiries and requests, you may contact the spade88 Data Protection team via the contact details provided in Section 14 of this Policy. spade88 aims to respond to all data protection requests within thirty (30) calendar days of receipt.

spade88 collects the following categories of personal data in connection with your use of the Platform:

3.1 Registration and Identity Data

• Full legal name as it appears on your official identification document
• Date of birth (used to verify that you are 21 years of age or older)
• Residential address (including city, postcode, and country)
• Email address
• Mobile telephone number
• Username and encrypted account password
• National Registration Identity Card (NRIC/MyKad) number or passport number, collected during KYC verification

3.2 Financial and Transaction Data

• Payment method details (e-wallet identifiers, bank account numbers associated with FPX transactions, or other payment method references — card numbers are never stored in full by spade88)
• Deposit history, withdrawal history, and transaction amounts in MYR
• Bonus credits applied to your account
• Wager history and game session records

3.3 Technical and Usage Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser version
• Session logs, login timestamps, and session durations
• Pages visited on the Platform and game titles accessed
• Cookie identifiers and similar tracking data (see Section 6)

3.4 Communications Data

• Records of correspondence between you and spade88 via Live Chat, email, or any other support channel
• Preferences regarding promotional communications

3.5 Responsible Gaming Data

• Deposit limits, loss limits, and session time alerts set by the player
• Self-exclusion records and their effective dates
• Any information provided voluntarily in connection with responsible gaming support requests

spade88 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or submit any form on the Platform.
• Automatically through Platform use: Technical and usage data is collected automatically through server logs, cookies, and similar tracking technologies when you access or interact with the Platform.
• From third-party payment processors: When you make a deposit or withdrawal, spade88 receives transaction confirmation data from the relevant payment processor (e.g., Touch 'n Go eWallet, Boost, DuitNow, FPX). spade88 does not receive or store your full payment credentials.
• From identity verification service providers: In the context of KYC verification, spade88 may use third-party identity verification services to confirm the authenticity of identity documents provided by you.
• From fraud prevention and AML screening services: spade88 may receive data outputs from third-party services engaged to screen for fraud indicators or to comply with anti-money laundering obligations.

spade88 processes your personal data for the following purposes, each supported by a lawful basis for processing:

1. Account registration and management — Processing is necessary for the performance of the contract between you and spade88 as set out in our Terms and Conditions.
2. Identity and age verification (KYC) — Processing is necessary for compliance with our legal and regulatory obligations under our international gaming authority licence, including the obligation to prevent underage gambling and to conduct AML checks.
3. Processing deposits, wagers, and withdrawals — Processing is necessary for the performance of the contract between you and spade88.
4. Customer support — Processing is necessary for the performance of the contract and for legitimate interests in providing effective support services.
5. Fraud prevention and security — Processing is necessary for compliance with legal obligations and for legitimate interests in preventing fraud and protecting the security of the Platform and its users.
6. Responsible gaming monitoring — Processing is necessary for compliance with regulatory obligations and in our legitimate interests of promoting responsible gambling practices.
7. Direct marketing and promotional communications — Processing is based on your consent, which you may withdraw at any time by updating your communication preferences in your account settings or by contacting support.
8. Platform analytics and improvement — Processing is based on our legitimate interests in understanding how the Platform is used and in improving its performance and user experience.

spade88 uses cookies and similar tracking technologies (including local storage objects and session tokens) on the Platform. Cookies are small data files stored on your device that help us operate the Platform effectively, remember your preferences, and understand how players use different features.

spade88 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. You cannot opt out of these cookies as they are required for the Platform to operate.
• Functional Cookies: Used to remember your preferences such as language settings and whether you have agreed to this Policy. These persist across sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform. This information helps spade88 identify areas for improvement.
• Performance Cookies: Used to monitor Platform performance and identify technical issues affecting user experience.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect certain functional features.

spade88 does not sell or rent your personal data to third parties. We may share your personal data with the following categories of recipients only where necessary and only to the extent required for the relevant purpose:

• Payment processors: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and banking partners — to process your deposits and withdrawals in MYR.
• Identity verification and KYC providers: Third-party service providers engaged to assist with age verification and document authentication, as required by our international gaming authority licence.
• Fraud prevention and AML screening services: Third-party services that assist spade88 in detecting and preventing fraudulent activity and in meeting anti-money laundering compliance obligations.
• Game software providers: Providers whose games are available on the Platform receive the minimum data necessary to operate game sessions associated with your account.
• Regulatory and law enforcement authorities: spade88 may disclose your personal data to licensing authorities, law enforcement agencies, or other competent authorities where required to do so by applicable law or by the terms of our gaming licence.
• Responsible gaming organisations: Where you have enrolled in a self-exclusion programme or where we are required by our licence conditions to notify relevant responsible gaming bodies.

spade88 is an internationally licensed gaming operator. In the course of our operations, your personal data may be transferred to and processed in countries outside Malaysia, including the jurisdiction in which our licensing authority is based. Where such international transfers occur, spade88 ensures that appropriate safeguards are in place to protect your personal data, including contractual clauses that impose data protection obligations on the receiving parties consistent with the standards described in this Policy.

spade88 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encrypted storage of passwords using industry-standard one-way hashing algorithms
• Role-based access controls ensuring that spade88 staff access personal data only to the extent required for their specific job function
• Regular security assessments and penetration testing of the Platform infrastructure
• Automated monitoring systems designed to detect and respond to unusual access patterns or potential security incidents

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, spade88 will notify you and relevant regulatory authorities as required by applicable law and our licensing obligations.

spade88 retains your personal data for as long as your account is active and for a period thereafter as required by our international gaming authority licence and applicable laws. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AML and gaming regulatory requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support records: Retained for three (3) years from the date of the most recent interaction.
• Technical and usage data: Retained for up to twenty-four (24) months in identifiable form, after which it may be anonymised for analytical purposes.
• Self-exclusion records: Retained for the full period of the exclusion and for five (5) years thereafter.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by spade88:

1. Right of Access: You have the right to request a copy of the personal data spade88 holds about you and information about how it is processed.
2. Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may also update certain account details directly through your account dashboard.
3. Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected. This right is subject to overriding legal and regulatory obligations that require spade88 to retain certain data.
4. Right to Restrict Processing: You have the right to request that spade88 restricts the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
5. Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted directly to another data controller where technically feasible.
6. Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, although spade88 may be entitled to continue processing where there are compelling legitimate grounds.
7. Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact spade88 via the details provided in Section 14. spade88 will respond to all data subject requests within thirty (30) calendar days of receipt. Where requests are complex or numerous, this period may be extended by a further two months, in which case spade88 will notify you of the extension within the initial thirty-day period.

The spade88 Platform is strictly prohibited to individuals under the age of 21. spade88 does not knowingly collect personal data from individuals under 21. If spade88 discovers that personal data has been collected from a person under 21, the relevant account will be closed immediately, any funds in the account will be handled in accordance with our Terms and Conditions, and the associated personal data will be deleted from our systems as quickly as practicable, subject to any overriding regulatory retention obligations.

If you believe that spade88 may have inadvertently collected personal data from a person under 21, please contact us immediately at the details provided in Section 14.

spade88 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, the purposes of processing, or your rights — spade88 will notify registered users by email or via a prominent notice on the Platform prior to the changes taking effect. The date of the most recent revision is indicated at the top of this Policy. Your continued use of the Platform following notification of material changes constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how spade88 protects your personal data.

For all privacy-related enquiries, data subject rights requests, or complaints regarding spade88's handling of your personal data, please contact the spade88 Data Protection team through the following channels:

• 📧 Email: support@spade88.co
• 💬 Live Chat: Available 24 hours a day, 365 days a year from the spade88 Platform
• ⏰ Response Time Target: Within 30 calendar days for data subject requests; within 24 hours for general support enquiries

spade88 is committed to resolving all privacy concerns promptly and transparently. If you feel your concern has not been adequately addressed by spade88, you may have the right to lodge a complaint with the relevant data protection authority or with our international gaming authority licensing body.