kaya888 Privacy Policy

1. About This Policy

This Privacy Policy applies to all personal data collected by kaya888 in connection with the operation of the kaya888 online gaming platform and related services. "Personal data" means any information that identifies or could reasonably be used to identify a living individual, directly or indirectly.

kaya888 is committed to handling personal data responsibly, transparently, and in compliance with applicable data protection laws, including the Malaysian Personal Data Protection Act 2010 (PDPA) and international data protection standards under our gaming licensing obligations.

By accessing or using the kaya888 Platform — whether you are browsing as a visitor or accessing as a registered Player — you acknowledge that your data may be processed as described in this Policy.

2. Data We Collect

kaya888 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

kaya888 does not collect special category data (e.g., health, ethnicity, political views) except where required by law or with your explicit consent.

3. How We Collect Data

1. Directly from you — when you register an Account, complete KYC, make transactions, use live chat support, or interact with the Platform in any way that requires you to provide information.
2. Automatically — through cookies, server logs, and similar tracking technologies when you visit or use the kaya888 Platform. This includes IP address, session data, device identifiers, and browsing behaviour within the Platform.
3. From third-party payment processors — when you make a deposit or withdrawal, kaya888 receives transaction confirmation data from payment service providers such as Touch 'n Go eWallet, Boost, GrabPay, and bank transfer facilities. kaya888 does not store full payment card numbers.
4. From identity verification providers — during KYC, kaya888 may use third-party identity verification services that process your submitted documents and return a verification result.

4. Purpose & Legal Basis for Processing

kaya888 processes your personal data for the following purposes, each with the corresponding legal basis:

• Account creation and management — necessary for the performance of a contract between you and kaya888.
• Identity verification (KYC) — compliance with legal obligations under anti-money laundering (AML) and gaming licensing requirements.
• Processing deposits and withdrawals — necessary for the performance of a contract; compliance with financial regulations.
• Preventing fraud and money laundering — legitimate interests of kaya888 and compliance with legal obligations.
• Responsible gaming monitoring — legitimate interests of kaya888 and compliance with gaming licensing obligations to protect player welfare.
• Providing customer support — necessary for the performance of a contract; legitimate interests.
• Marketing communications — with your consent, where you have opted in to receive promotional communications from kaya888. You may withdraw consent at any time through your Account settings.
• Platform analytics and improvement — legitimate interests of kaya888 to maintain and improve the Platform.
• Compliance with legal obligations — including responding to lawful requests from regulatory authorities.

5. Disclosure to Third Parties

1. kaya888 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes.
2. kaya888 may disclose your personal data to the following categories of recipients, only to the extent necessary for the stated purpose:

• Payment service providers — Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and other processing partners, for the purpose of executing transactions.
• Identity verification providers — third-party KYC and document verification services operating under data processing agreements with kaya888.
• Game software providers — licensed game studios (e.g., Pragmatic Play, PG Soft, Evolution Gaming) may receive Player identifiers for the purpose of game session management.
• Regulatory and law enforcement authorities — where required by applicable law, court order, or the requirements of kaya888's gaming licensing authority.
• IT and security service providers — cloud hosting, cybersecurity, and data analytics providers operating under contractual data protection obligations.

All third-party recipients are required to handle personal data in a manner consistent with this Policy and applicable data protection law.

6. International Data Transfers

kaya888 operates under an international gaming licence and may process or store data on servers located outside of Malaysia. Where personal data is transferred internationally, kaya888 ensures that appropriate safeguards are in place — including contractual protections equivalent to those required under the Malaysian PDPA — to maintain the security and integrity of your personal data.

By using the kaya888 Platform, you acknowledge that your data may be transferred to, stored in, and processed in jurisdictions outside Malaysia. kaya888 will always apply the protections described in this Policy regardless of where data is processed.

7. Data Retention

1. kaya888 retains personal data only for as long as necessary to fulfil the purposes outlined in this Policy, or as required by applicable law.
2. Account data is retained for the duration of the Account's active life and for a minimum of five (5) years following Account closure, to comply with anti-money laundering regulations and gaming licensing obligations.
3. Transaction records are retained for a minimum of seven (7) years in accordance with financial recordkeeping requirements.
4. Marketing preference data is retained until you withdraw consent or request deletion, after which it is removed from active marketing systems within 30 days.
5. After the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

8. Security Measures

kaya888 implements technical and organisational measures designed to protect your personal data against unauthorised access, loss, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and kaya888 servers
• Server-side password hashing using modern cryptographic algorithms — passwords are never stored in plaintext
• Two-factor authentication (2FA) available on all Accounts
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Regular security audits and penetration testing of the Platform infrastructure
• Automatic session timeouts and suspicious login activity monitoring

Whilst kaya888 takes all reasonable precautions, no internet transmission or electronic storage is completely secure. Players are encouraged to use strong, unique passwords and to enable 2FA on their kaya888 Account.

9. Cookies & Tracking Technologies

1. kaya888 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse how Players use the site.
2. Strictly necessary cookies are required for the Platform to function (e.g., session authentication). These cannot be disabled.
3. Analytical cookies help kaya888 understand how Players navigate the Platform, which pages are visited most frequently, and where improvements are needed. These are aggregated and do not identify individual users.
4. Preference cookies remember your settings and customisations (e.g., language, display preferences) to improve your experience on return visits.
5. You may control non-essential cookies through your browser settings. Note that disabling certain cookies may affect Platform functionality.

10. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data held by kaya888:

• Right of access — you may request a copy of the personal data kaya888 holds about you.
• Right to rectification — you may request correction of inaccurate or incomplete personal data.
• Right to erasure — you may request deletion of your personal data, subject to kaya888's legal retention obligations.
• Right to restriction — you may request that kaya888 restrict processing of your data in certain circumstances.
• Right to data portability — you may request your personal data in a structured, commonly used format.
• Right to object — you may object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact kaya888 support via in-platform live chat or at [email protected]. kaya888 will respond to verified requests within 30 days.

11. Children's Privacy

The kaya888 Platform is strictly intended for individuals aged 21 years and above. kaya888 does not knowingly collect personal data from individuals under this age. If kaya888 becomes aware that personal data has been collected from a minor, the relevant Account will be immediately closed and all associated data will be deleted without delay.

Parents or guardians who believe a minor has registered on the kaya888 Platform should contact support immediately via live chat or at [email protected].

12. Changes to This Policy

1. kaya888 may update this Privacy Policy from time to time to reflect changes in legal requirements, Platform features, or data processing practices.
2. Material changes will be communicated to registered Players via in-platform notification or email to the registered address, at least 14 days before taking effect.
3. Continued use of the kaya888 Platform after the effective date of any updated Policy constitutes acceptance of the revised terms.
4. The most current version of this Privacy Policy is always available at kaya888.win/privacy-policy.

13. Contact & Complaints

For questions, access requests, or complaints regarding this Privacy Policy or kaya888's data processing practices, please contact us through the 24/7 in-platform live chat, or at [email protected].

If you are not satisfied with kaya888's response to a data protection complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction. For Malaysian residents, the relevant authority is the Department of Personal Data Protection Malaysia (JPDP).