Privacy Policy
wa88 is committed to protecting the personal data and financial information of every Member who uses our platform. This Privacy Policy explains precisely what data we collect, why we collect it, how it is processed, and the rights you hold as a data subject under our care.
Your Privacy Matters. wa88 does not sell, rent, or trade your personal data to third parties for marketing or advertising purposes. Data shared with our operational partners is governed by strict data processing agreements and is limited to what is strictly necessary for the provision of our Services.
1Introduction
wa88 ("we", "us", "the Company") operates the online casino and sports betting platform accessible at wa88.buzz (the "Platform"). In the course of providing our Services to Members registered in Malaysia — including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across the country — wa88 collects, processes, and stores personal data in accordance with the principles set out in this Privacy Policy.
This Privacy Policy applies to all personal data processed in connection with your use of the wa88 Platform and Services, including registration and account management, financial transactions (deposits and withdrawals via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and cryptocurrency channels), customer support interactions, and marketing communications where applicable.
This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.
2Definitions
In this Privacy Policy, the following terms carry the meanings defined below:
| Term | Definition |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers. |
| "Data Controller" | wa88, the entity that determines the purposes and means of processing personal data collected through the Platform. |
| "Data Processor" | Any third-party service provider that processes personal data on behalf of wa88 under a binding data processing agreement. |
| "Member" | Any individual who has registered a verified Account on the wa88 Platform. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, alteration, erasure, or transmission. |
| "KYC" | Know Your Customer — the regulatory identity verification process used to confirm a Member's identity, age, and source of funds. |
| "Cookie" | A small data file stored on a Member's device by the Platform for purposes of session management, security, and analytics. |
3Data We Collect
wa88 collects personal data across several categories, as described in the table below. We collect only data that is necessary for the stated purpose (data minimisation principle).
| Data Category | Specific Data Elements |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued identification number (e.g., MyKad number, passport number), gender. |
| Contact Data | Email address, mobile phone number, residential address (including city and state within Malaysia). |
| Account Data | Chosen username, encrypted password, account creation date, login history, session data, communication preferences. |
| Financial Data | Bank account details or e-wallet identifiers used for deposits and withdrawals (FPX, DuitNow, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay), cryptocurrency wallet addresses (BTC, ETH, USDT, BNB), transaction amounts and timestamps, deposit and withdrawal history. |
| KYC Documentation | Copies of government-issued identification documents, proof of address documents (utility bills, bank statements), source-of-funds declarations, and selfie or liveness verification data where applicable. |
| Gaming & Betting Data | Game participation history, betting records, wager amounts, win/loss records, bonus usage history, RTP outcome data. |
| Technical Data | IP address, device type and operating system, browser type and version, cookie identifiers, referring URL, Platform interaction logs, and session duration data. |
| Communication Data | Records of all communications between you and wa88 support staff, including Live Chat transcripts, email correspondence, and WhatsApp message metadata. |
| Responsible Gambling Data | Self-set deposit limits, session time limits, loss thresholds, self-exclusion requests, and responsible gambling tool usage records. |
4How Data Is Collected
wa88 collects personal data through the following channels and mechanisms:
- Direct Collection: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, contacting our support team, or participating in promotions.
- Automated Collection: Technical and behavioural data collected automatically when you access the Platform, including through cookies, server logs, and analytics tools embedded in the Platform interface.
- Payment Processors: Transaction data received from approved Malaysian payment processors and banking partners when you deposit funds via FPX, DuitNow, or e-wallets such as Touch 'n Go eWallet, Boost, and GrabPay.
- Third-Party Verification Providers: Identity and address data returned by KYC and age verification service providers engaged by wa88 to support regulatory compliance obligations.
- Fraud Detection Systems: Data inputs from automated fraud prevention and anti-money laundering (AML) monitoring systems that analyse transactional patterns in real time.
5Purpose of Processing
wa88 processes your personal data for the following purposes:
| Purpose | Data Categories Used |
|---|---|
| Account Registration & Management | Identity Data, Contact Data, Account Data |
| Age & Identity Verification (KYC) | Identity Data, KYC Documentation, Contact Data |
| Payment Processing | Financial Data, Identity Data, Transaction Records |
| Platform Security & Fraud Prevention | Technical Data, Financial Data, Account Data |
| Regulatory Compliance (AML/KYC) | Identity Data, Financial Data, KYC Documentation |
| Customer Support | Communication Data, Account Data, Gaming Data |
| Responsible Gambling Monitoring | Gaming Data, Responsible Gambling Data, Account Data |
| Platform Analytics & Improvement | Technical Data, Gaming Data (aggregated, anonymised) |
| Promotional Communications (opt-in only) | Contact Data, Communication Preferences |
wa88 does not use your personal data for profiling, automated decision-making that produces significant legal effects, or the sale of data to advertising networks or data brokers.
6Legal Basis for Processing
wa88 processes your personal data on the following legal bases:
- Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you have agreed to — including account management, payment processing, and the provision of gaming Services.
- Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and age verification mandates.
- Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, Platform security, responsible gambling monitoring, and service quality improvement, provided such interests are not overridden by your fundamental rights and freedoms.
- Consent: Where we send you optional promotional communications, we rely on your explicit opt-in consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.
7Data Sharing & Disclosure
7.1 No Sale of Data. wa88 does not sell, rent, or otherwise transfer your personal data to any third party for commercial or marketing purposes. This is an absolute commitment.
7.2 Authorised Processors. wa88 may share your personal data with the following categories of authorised third-party data processors, who are bound by strict data processing agreements:
- Payment Service Providers: Banks and e-wallet operators (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay) and payment gateway operators (FPX, DuitNow) for the purposes of processing deposits and withdrawals.
- KYC & Identity Verification Providers: Third-party service providers engaged to conduct age verification, document authentication, and AML screening.
- Fraud Prevention & Security Vendors: Technology providers whose systems analyse transaction data to detect and prevent fraudulent activity and money laundering.
- Cloud & Infrastructure Providers: Hosting and infrastructure partners who store Platform data on secured servers in jurisdictions with adequate data protection standards.
- Customer Support Platforms: Technology providers that facilitate our Live Chat, WhatsApp, and email support functions — solely for service delivery purposes.
7.3 Regulatory Disclosure. wa88 may disclose personal data to regulatory authorities, law enforcement agencies, or judicial bodies where required to do so by applicable law, court order, or the directives of a competent regulatory authority. We will seek to notify you of such disclosure where legally permissible.
7.4 Business Transfers. In the event of a corporate restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity, subject to equivalent data protection obligations.
8Data Retention
wa88 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention guidelines apply:
| Data Category | Retention Period |
|---|---|
| Account & Identity Data (active accounts) | Duration of Account plus 5 years post-closure |
| KYC Documentation | 5 years from the date of verification or Account closure (whichever is later), as required for AML compliance |
| Financial Transaction Records | 7 years from the date of transaction, in accordance with standard financial record-keeping obligations |
| Gaming & Betting History | 5 years from the date of each betting activity |
| Customer Support Communications | 3 years from the date of the communication |
| Technical & Log Data | 12 months, unless required for active fraud investigation |
| Responsible Gambling Records | Duration of any active self-exclusion period plus 5 years |
| Marketing Consent Records | Until consent is withdrawn, plus 3 years for evidentiary records |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our internal data lifecycle management procedures.
9Cookies & Tracking Technologies
9.1 What Are Cookies. Cookies are small text files stored on your device when you visit the wa88 Platform. They enable the Platform to remember your preferences, maintain your session state, and collect anonymised usage analytics to improve the Member experience.
9.2 Types of Cookies We Use.
- Strictly Necessary Cookies: Essential for the Platform to function. They manage your authenticated session, maintain security tokens, and prevent cross-site request forgery. These cannot be disabled without impairing Platform functionality.
- Performance & Analytics Cookies: Collect anonymised data about how Members interact with the Platform — such as pages visited, time spent, and errors encountered — to help us improve the user experience. No personally identifiable data is used in these reports.
- Functionality Cookies: Remember your preferences, such as language settings and responsible gambling tool configurations, between sessions.
- Security Cookies: Used by our fraud detection and anti-abuse systems to identify suspicious patterns and protect the integrity of the Platform.
9.3 Cookie Control. You may adjust your browser settings to refuse cookies, though certain Platform features may not function correctly if strictly necessary cookies are blocked. For performance and functionality cookies, you may opt out at any time via the cookie preference centre accessible on the Platform.
10Security Measures
wa88 implements a comprehensive suite of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:
- 256-Bit SSL/TLS Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard 256-bit SSL/TLS protocols — the same encryption standard used by Malaysian banking institutions including Maybank2u and CIMB Clicks.
- Data Encryption at Rest: Sensitive personal and financial data stored in our databases is encrypted at rest using AES-256 encryption.
- Access Controls: Internal access to personal data is governed by role-based access controls. Only authorised personnel with a legitimate business need may access Member personal data.
- Segregated Account Funds: Member account balances are held in segregated financial accounts, separate from wa88's operational funds, ensuring Member money is protected independently.
- Real-Time Fraud Monitoring: Automated systems continuously monitor all transactions for patterns indicative of fraud, account takeover, or money laundering activity.
- Regular Security Audits: wa88 conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities proactively.
Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, wa88 will notify affected Members and relevant regulatory authorities within the timeframes prescribed by applicable data protection law.
11Your Rights as a Data Subject
As a Member of the wa88 Platform, you hold the following rights with respect to your personal data. These rights may be subject to certain limitations where overriding legal obligations — such as AML or KYC requirements — apply.
To exercise any of the above rights, please contact our Data Protection team in writing via [email protected] with the subject line "Data Subject Rights Request". wa88 will acknowledge your request within five (5) business days and endeavour to respond substantively within thirty (30) days.
12Minors & Age Policy
The wa88 Platform is strictly intended for use by persons aged 21 years and above. We do not knowingly collect, store, or process the personal data of individuals under the age of 21.
Age verification is a mandatory step in the wa88 Account registration and KYC process. Any Account found to be held or used by a person under the age of 21 will be immediately suspended. All personal data associated with the underage Account will be securely deleted, subject to any mandatory retention obligations under applicable law.
If you believe a minor has registered on the wa88 Platform, please notify us immediately at [email protected]. We will investigate and take appropriate action without delay. Protecting young people from exposure to gambling content is a non-negotiable commitment for wa88.
13Third-Party Services & Links
The wa88 Platform may reference or integrate with third-party services, including Malaysian payment providers such as FPX (Financial Process Exchange), DuitNow, and e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay). These third-party services operate under their own independent privacy policies.
wa88 has no control over the data practices of third-party payment processors and service providers beyond the contractual data processing obligations we impose upon them. We strongly encourage Members to review the privacy policies of any third-party service they engage with in connection with their wa88 Account.
All data passed to third-party processors is limited to what is strictly necessary for the transaction or service in question, in accordance with the data minimisation principle.
14Changes to This Privacy Policy
wa88 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or the Services we provide. The "Last Updated" date at the top of this page will be revised whenever a material change is made.
Where changes are material — meaning they significantly affect your rights or how we use your personal data — wa88 will provide at least fourteen (14) days' advance notice via a prominent Platform notification and, where you have provided a verified email address, by email.
Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms. If you do not accept the revised Privacy Policy, you must discontinue your use of the Platform and may request Account closure in accordance with our Terms & Conditions.
15Contact Us — Data Protection Enquiries
For all privacy-related enquiries, data subject rights requests, or concerns about how wa88 handles your personal data, please contact our team using the details below. All contact information is provided as plain text for your reference.
Privacy & Data Protection: [email protected] — Subject: "Privacy Enquiry" or "Data Subject Rights Request"
24/7 Live Chat: Available on the wa88 Platform — avg. response 3–5 minutes. For urgent data concerns, please also follow up by email.
wa88 aims to respond to all privacy-related requests within five (5) business days of receipt, with a substantive resolution within thirty (30) calendar days. For complex requests, we will inform you of any extension required, up to a maximum of sixty (60) days.
How wa88 Protects Your Privacy
Six concrete ways wa88 safeguards your data — built to the same standard as the Malaysian banking infrastructure we rely on.
256-Bit SSL Encryption
Every page of the wa88 Platform is protected by 256-bit SSL/TLS encryption — the same standard used by Maybank2u and CIMB Clicks. Data in transit between your device and our servers is fully encrypted at all times.
We Never Sell Your Data
wa88 has a strict no-sale policy on personal data. We do not sell, trade, or rent your information to advertising networks, data brokers, or any third party for commercial purposes — full stop.
Data Minimisation by Design
We collect only the personal data strictly necessary for account management, KYC compliance, and payment processing. Unnecessary data collection is avoided by design — not as an afterthought.
Your Rights, Clearly Stated
Access, rectify, erase, restrict, port, or object to the processing of your personal data at any time. Submit a request to [email protected] and we will respond within 30 calendar days.
Defined Retention Periods
Every category of data we hold has a defined retention period. When data is no longer needed, it is securely deleted or anonymised — we do not retain personal information indefinitely without legal justification.
Breach Notification Protocol
In the unlikely event of a data breach affecting your information, wa88 has a defined incident response protocol. Affected Members and relevant authorities will be notified promptly, with full transparency about what occurred and what steps we are taking.
Privacy That Matches Our Banking-Grade Standards
wa88 was built from the ground up with the same trust-first philosophy as the Malaysian financial infrastructure we integrate with — FPX, DuitNow, Maybank, CIMB, and DuitNow. Your personal data is treated with the same care as the funds in your Account: protected, segregated, and never misused. If you have any questions about this Privacy Policy or how your data is handled, our multilingual support team is ready to help.
For players aged 21 and above only. Please gamble responsibly. Responsible Gambling Policy →