rai88 Privacy Policy

1Who We Are

rai88 is an international online gaming platform operating at rai88.win under applicable international gaming authority regulatory frameworks. rai88 serves players primarily based in Malaysia, including those in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and other Malaysian states and territories.

For the purposes of this Privacy Policy, rai88 acts as the data controller in respect of personal data collected through the Platform. All enquiries relating to your personal data and this Policy should be directed to rai88 using the contact details in Section 14.

2Categories of Personal Data We Collect

rai88 collects and processes the following categories of personal data, to the extent necessary for the purposes described in this Policy:

rai88 does not knowingly collect sensitive personal data (including data relating to racial or ethnic origin, religious beliefs, political opinions, health data, or biometric data) except where strictly required by applicable regulatory obligations (for example, age verification). Where such data is collected, appropriate safeguards are applied.

3How We Collect Personal Data

rai88 collects personal data through the following means:

• Direct Collection: Data you provide directly to rai88 when registering an account, completing identity verification, making deposits or withdrawal requests, contacting customer support, or updating your account profile.
• Automated Collection: Technical data collected automatically when you access the rai88 Platform, including through cookies, web beacons, server logs, and similar technologies (see Section 6).
• Third-Party Sources: Data received from third-party identity verification service providers, payment processing partners, fraud detection services, and applicable regulatory databases, where permitted by law and relevant to the operation of the Platform.

4Purposes and Legal Basis for Processing

rai88 processes your personal data for the following purposes. The applicable legal basis for each processing activity is indicated in parentheses:

• Account registration and management — creating and maintaining your rai88 account, verifying your identity, and communicating account-related information to you. (Performance of contract; legal obligation)
• Provision of gaming services — enabling you to access and use the games, sportsbook, and other Services available on the Platform. (Performance of contract)
• Payment processing — processing your deposits and withdrawals via approved Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, Maybank, and CIMB. (Performance of contract; legal obligation)
• Regulatory compliance — fulfilling our obligations under applicable international gaming authority requirements, including Know Your Customer (KYC) verification, anti-money laundering (AML) checks, and age verification. (Legal obligation)
• Responsible gaming — monitoring account activity to identify potential problem gambling indicators, administering player-requested limits and self-exclusion measures, and complying with responsible gaming requirements. (Legal obligation; legitimate interests)
• Fraud prevention and security — detecting, investigating, and preventing fraudulent activity, money laundering, multiple account creation, and other prohibited conduct. (Legitimate interests; legal obligation)
• Customer support — responding to your enquiries, resolving complaints, and providing technical assistance. (Performance of contract; legitimate interests)
• Platform improvement — analysing anonymised and aggregated usage data to improve the performance, functionality, and content of the rai88 Platform. (Legitimate interests)
• Marketing communications — where you have consented, sending you information about rai88 promotions, bonuses, and new features. You may withdraw marketing consent at any time through your account settings. (Consent)

5Data Sharing and Disclosure

rai88 does not sell your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes set out in this Policy:

• Payment processors and eWallet providers — including Touch 'n Go eWallet, Boost, GrabPay, and Malaysian banking institutions — to process your financial transactions on the Platform.
• Identity verification providers — third-party KYC and AML service providers used to verify your identity and conduct regulatory due diligence in accordance with our obligations under applicable gaming authority requirements.
• Game content providers — licensed game studios and content suppliers whose titles are offered on the Platform, to the extent necessary to operate those games and record game outcomes and transactions.
• IT and infrastructure providers — cloud hosting, data storage, cybersecurity, and platform maintenance service providers who process data on rai88's behalf under data processing agreements with appropriate data protection obligations.
• Regulatory and law enforcement authorities — where required to do so by applicable law, court order, or regulatory directive, including disclosure to the applicable international gaming authority, financial intelligence units, or Malaysian authorities in connection with AML or fraud investigations.
• Professional advisers — legal, accounting, audit, and compliance professionals who are bound by confidentiality obligations and who require access to data in connection with the services they provide to rai88.

Where rai88 shares personal data with third-party processors, we require those processors to maintain appropriate technical and organisational data protection measures and to process data only on rai88's documented instructions.

6Cookies and Tracking Technologies

The rai88 Platform uses cookies and similar tracking technologies to operate the Platform, improve user experience, and support security and fraud detection. The categories of cookies used include:

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state while you navigate the Platform. These cookies cannot be disabled without preventing use of the Platform.
• Functional Cookies: Store your preferences such as language settings, display preferences, and responsible gaming limit configurations to improve your experience on return visits.
• Analytics Cookies: Collect anonymised data about how Players use the Platform — pages visited, session duration, game preferences — to help rai88 improve Platform performance and content. Data collected through analytics cookies does not identify individual users.
• Security Cookies: Used to detect and prevent fraudulent activity, including identification of multiple account attempts and detection of automated access patterns.

You can control non-essential cookies through your browser settings. Disabling certain cookies may affect Platform functionality. Strictly necessary cookies cannot be disabled through cookie controls as they are required for Platform operation.

7Data Retention

rai88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation. The following standard retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years from account closure, as required under applicable AML and gaming regulatory obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support records: Retained for three (3) years from the date of the relevant interaction, or longer where required in connection with unresolved disputes or regulatory investigations.
• Marketing consent records: Retained for the duration of the marketing relationship and for a reasonable period thereafter to evidence consent.
• Technical and log data: Generally retained for twelve (12) months for security and fraud detection purposes, subject to regulatory requirements.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with rai88's data destruction procedures.

8Your Data Protection Rights

Subject to applicable law and regulatory restrictions, you have the following rights in relation to your personal data held by rai88. To exercise any of these rights, please contact rai88 using the details in Section 14.

• Right of access: You have the right to request a copy of the personal data rai88 holds about you and information about how it is being processed.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure: In certain circumstances you may request deletion of your personal data. This right is subject to limitations where rai88 is required to retain data for regulatory compliance or legal proceedings.
• Right to restrict processing: You have the right to request that rai88 restrict processing of your data in certain circumstances, for example while the accuracy of data is contested.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where rai88 processes your data on the basis of consent (such as for marketing communications), you may withdraw that consent at any time through your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
• Right to object: You have the right to object to processing based on legitimate interests, including direct marketing.

9Data Security

rai88 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Security measures in place include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your device and the rai88 Platform.
• Encryption of sensitive personal data at rest in rai88 databases and storage systems.
• Access controls limiting access to personal data to authorised personnel on a need-to-know basis.
• Regular security assessments and penetration testing of Platform infrastructure.
• Industry-standard password hashing — rai88 staff cannot view your account password.
• Fraud detection and monitoring systems that operate continuously to identify and respond to suspicious activity.

While rai88 takes data security seriously, no system can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, rai88 will take prompt remedial action and notify affected individuals and relevant authorities as required by applicable law.

10International Data Transfers

As an international gaming platform, rai88 may transfer personal data to service providers and partners located outside Malaysia and the jurisdiction in which rai88 is registered. Such transfers are made only where appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by the applicable regulatory authority.
• Data processing agreements incorporating appropriate data protection obligations.
• Transfer to jurisdictions recognised as providing an adequate level of data protection.

You may request further information about the safeguards applicable to international transfers of your personal data by contacting rai88 using the details in Section 14.

11Children and Minors

If rai88 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted promptly and the associated account closed. If you are a parent or guardian and believe that your minor child has provided personal data to rai88, please contact us immediately using the details in Section 14.

12Third-Party Links

The rai88 Platform does not contain links to third-party websites for navigational purposes, in accordance with our platform design policy. However, where game content is supplied by third-party studios, those studios may process certain technical data in connection with the delivery of game content to your device. Such processing is governed by the respective studio's data practices, which are incorporated into the agreements rai88 holds with those content providers.

rai88 is not responsible for the privacy practices of third-party game content providers. If you have specific questions about data processing by a particular game studio, please contact rai88 support and we will endeavour to provide relevant information.

13Amendments to This Privacy Policy

rai88 may update this Privacy Policy from time to time to reflect changes in our data processing activities, regulatory requirements, or applicable law. The date of the most recent revision is displayed at the top of this page.

Where amendments are material, rai88 will use reasonable efforts to notify affected Players by a notice on the Platform or by email to the registered account address prior to the changes taking effect. Your continued use of the rai88 Platform following publication of an updated Privacy Policy constitutes acknowledgement of the updated terms.

We encourage you to review this Privacy Policy periodically to remain informed about how rai88 handles your personal data.

14Contact Us — Data Privacy Enquiries

For all enquiries relating to this Privacy Policy, to exercise your data protection rights, or to raise a data privacy concern, please contact the rai88 data privacy team through the following channels:

• Email: [email protected]
• Live Chat: Available through the rai88 Platform during operational hours
• Subject Line: Please include "Privacy Request" or "Data Rights" in the subject line of email enquiries to ensure prompt routing to the appropriate team

rai88 will acknowledge data rights requests promptly and respond within the timeframe required by applicable law. In some cases, rai88 may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to an unauthorised party.

If you are not satisfied with rai88's response to a data privacy concern, you may be entitled to raise a complaint with the applicable supervisory authority or under the dispute resolution mechanism established by the relevant Regulatory Authority.