Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how ace888 ("ace888", "we", "us", "our") collects, processes, stores, and discloses personal data relating to individuals ("you", "User", "Player") who access or use the ace888 online gaming platform at ace888.cam and all associated sub-domains, mobile interfaces, and applications (collectively, the "Platform").

ace888 is committed to handling personal data responsibly, lawfully, and transparently. Our data practices are aligned with the Malaysian Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR) where applicable to Users accessing the Platform from relevant jurisdictions.

By registering an account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to close your account.

2 Definitions

The following definitions apply throughout this Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including names, identification numbers, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means ace888, which determines the purposes and means by which Personal Data is processed.
• "Data Processor" means a third party that processes Personal Data on behalf of ace888 under a contractual arrangement and pursuant to ace888's instructions.
• "KYC" means Know Your Customer — the identity and age verification process conducted by ace888 as required by applicable anti-money laundering and responsible gambling obligations.
• "Sensitive Personal Data" means Personal Data relating to health, financial account details, government-issued identification numbers, and biometric data, which is subject to a higher standard of protection under this Policy.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Retention Period" means the defined duration for which Personal Data is held before it is securely deleted or anonymised.

3 Data We Collect

ace888 collects personal data through multiple touchpoints across the Platform. The categories of data collected, and the contexts in which they are collected, are set out in the table below:

We do not knowingly collect Personal Data from individuals under the age of 21. Identity documents submitted during KYC that reveal an individual is under 21 will result in immediate account suspension and data handling in accordance with Section 12 of this Policy.

4 Legal Basis for Processing

ace888 processes Personal Data only where a lawful basis exists for doing so. The primary legal bases upon which we rely are as follows:

• Contractual Necessity: Processing required to perform our obligations under the account agreement with you, including account creation, payment processing, game provision, and withdrawal handling.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, tax reporting duties, and regulatory reporting mandates under our operating licence.
• Legitimate Interests: Processing necessary for ace888's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided those interests are not overridden by your rights and interests.
• Consent: Where required by applicable law, we obtain your explicit consent before processing certain categories of data, including for direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5 How We Use Your Data

ace888 uses Personal Data for the following purposes:

• Account Management: Creating, maintaining, and operating your ace888 account, including authentication, security monitoring, and account communications.
• Payment Processing: Facilitating deposits and withdrawals through your chosen Malaysian payment method (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, RHB, or cryptocurrency), and conducting associated financial compliance checks.
• Identity & Age Verification: Conducting KYC checks to verify your identity, confirm that you are aged 21 or above, and comply with applicable AML and responsible gambling obligations.
• Service Delivery: Providing access to casino games, live dealer tables, sports betting markets, and all other Platform features.
• Responsible Gambling: Monitoring gaming behaviour for indicators of problem gambling, enforcing player-set limits and self-exclusion, and fulfilling our duty-of-care obligations to Players.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account abuse, money laundering, and other prohibited conduct described in our Terms & Conditions.
• Customer Support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality assurance and audit purposes.
• Legal & Regulatory Compliance: Meeting our obligations under applicable laws, responding to lawful requests from regulatory and law enforcement authorities, and maintaining records as required by our operating licence.
• Platform Improvement: Analysing usage patterns and player behaviour (on an aggregated and anonymised basis where possible) to improve the Platform's features, performance, and user experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Players who have opted in to receive such communications. Players may opt out at any time by contacting support or updating their account preferences.

6 Data Sharing & Disclosure

ace888 does not sell, rent, or trade your Personal Data to any third party for their own independent commercial purposes. Personal Data is shared only in the following limited circumstances:

• Payment Service Providers: We share financial data with payment processors and banking partners — including FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), e-wallet operators (Touch 'n Go, Boost, GrabPay, DuitNow), and cryptocurrency exchange services — strictly to process your transactions.
• KYC & Identity Verification Providers: Identity documents and personal details are shared with licensed identity verification service providers to conduct mandatory KYC checks. These providers are contractually bound to use your data solely for verification purposes.
• Game Software Providers: Session data and gaming activity may be shared with our licensed game content providers for the purposes of game audit, fairness certification, and RTP reporting.
• Fraud Prevention Networks: In cases of suspected fraud or financial crime, relevant data may be shared with industry fraud prevention databases and networks to protect the integrity of the Platform and the broader online gaming ecosystem.
• Regulatory & Law Enforcement Authorities: We may disclose Personal Data to competent regulatory bodies, law enforcement agencies, financial intelligence units, and courts where required by applicable law or lawful order, without prior notice to you where legally required.
• Professional Advisers: Lawyers, auditors, accountants, and insurers may access Personal Data on a confidential, need-to-know basis in the course of providing professional services to ace888.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of ace888's business, Personal Data held at that time may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.

All third-party Data Processors engaged by ace888 are required to enter into written data processing agreements that obligate them to process Personal Data only on ace888's instructions, maintain appropriate security measures, and comply with applicable data protection laws.

7 Cookies & Tracking Technologies

ace888 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage, and support security functions. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for Platform operation, including session management, authentication state, and security token functions. These cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your language preferences, game display settings, and other personalisation choices to improve your experience across sessions.
• Analytical Cookies: Collect aggregated, anonymised data about how Players navigate and use the Platform. This data is used solely for internal Platform improvement and is not linked to individual Player profiles for marketing purposes.
• Security Cookies: Used to detect fraudulent activity, enforce account security, and identify suspicious login behaviour.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform, though some features may be affected. ace888 does not use third-party advertising cookies or cross-site tracking technologies that share your data with external advertising networks.

8 Data Retention

ace888 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention guidelines apply:

• Active Account Data: Retained for the duration of the account relationship and for a minimum of five years following account closure, to satisfy AML record-keeping obligations and regulatory requirements under our operating licence.
• KYC Documentation: Identity verification documents are retained for a minimum of five years after the end of the account relationship, in line with standard AML regulatory requirements.
• Transaction Records: Deposit, withdrawal, and betting history is retained for a minimum of seven years to satisfy financial record-keeping and audit obligations.
• Support Communications: Live chat transcripts and email correspondence are retained for three years from the date of the interaction for quality assurance and dispute resolution purposes.
• Technical & Usage Data: Log files and session data are retained for up to 24 months and thereafter anonymised or deleted.
• Marketing Preferences: Opt-in records are retained for as long as the account is active plus three years, to evidence consent in the event of a complaint.

Upon expiry of the applicable Retention Period, Personal Data is securely deleted using industry-standard data destruction methods, or anonymised such that it can no longer be linked to any individual.

9 International Data Transfers

As an online platform serving Players primarily in Malaysia, ace888 may process or store certain categories of Personal Data on servers and through service providers located outside of Malaysia. Where Personal Data is transferred outside of Malaysia, ace888 ensures that appropriate safeguards are in place, including:

• Contractual clauses that impose data protection obligations on the receiving party equivalent to those applicable under Malaysian PDPA principles.
• Transfers only to jurisdictions that maintain an adequate standard of data protection, as assessed by ace888's data protection review process.
• Encryption of data in transit and at rest, regardless of the jurisdiction in which it is processed or stored.

10 Data Security

ace888 implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption: All data transmitted between your browser or application and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). Data stored on our servers is encrypted at rest using AES-256.
• Access Controls: Access to systems containing Personal Data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all administrative access.
• Network Security: Our infrastructure is protected by enterprise-grade firewalls, intrusion detection and prevention systems, and continuous security monitoring.
• Audit Logging: All access to Personal Data by ace888 personnel is logged and subject to regular audit review.
• Penetration Testing: ace888's systems undergo regular independent penetration testing and vulnerability assessments.
• Incident Response: ace888 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights, we will notify affected Players within 72 hours of becoming aware of the breach, where required by applicable law.

Notwithstanding the above measures, no internet-based transmission or digital storage system is completely secure. Players are also responsible for maintaining the security of their own Account credentials and should contact us immediately if they suspect unauthorised access to their Account.

11 Your Rights

Subject to applicable law, you have the following rights in respect of your Personal Data held by ace888:

• Right of Access: You may request confirmation of whether ace888 holds Personal Data about you and, if so, a copy of that data together with information about how it is processed. We will respond to access requests within 30 calendar days.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data held about you. Where possible, corrections can be made directly through your Account Settings.
• Right to Erasure: In certain circumstances, you may request deletion of your Personal Data. Please note that this right is subject to limitations where retention is required by law (for example, AML record-keeping obligations) or where the data is necessary for the exercise or defence of legal claims.
• Right to Restriction: You may request that ace888 restrict processing of your Personal Data in certain circumstances, for example where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to processing of your Personal Data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to ace888's ability to demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us using the details in Section 14. We may need to verify your identity before processing your request. All rights requests are handled free of charge unless they are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

12 Children & Minors

The ace888 Platform is strictly intended for use by individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from persons under the age of 21.

If we become aware, through KYC verification or any other means, that Personal Data has been collected from a person under the age of 21, we will:

• Immediately suspend access to the account in question.
• Securely delete all Personal Data associated with the account to the extent permitted by applicable law.
• Return any deposited funds that can be verified as belonging to or originating from a guardian or parent, net of any bonuses received.

If you believe that a person under the age of 21 may have accessed or registered on the Platform, please contact us immediately using the details in Section 14.

13 Amendments to This Policy

ace888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The most current version of this Policy will always be accessible at ace888.cam/privacy-policy.

Where changes are material — meaning they substantively affect the way in which we collect, use, or share your Personal Data, or affect your rights — we will provide at least 14 days' advance notice to registered Players via account notification or email prior to the changes taking effect.

Non-material changes, such as typographical corrections or clarifications that do not affect the substance of the Policy, may take effect immediately upon publication without prior notice. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

14 Contact Us

If you have any questions, concerns, or formal requests relating to this Privacy Policy or the processing of your Personal Data by ace888, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the Platform. This is the fastest channel for general queries and account-specific questions.
• Email: [email protected] — plain text only, not a clickable link. For formal data rights requests (access, erasure, portability), please submit by email and include your full registered name, Account username, and a clear description of your request.

ace888 will acknowledge all formal data rights requests within 5 business days and provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reasons for it.

Our support team operates 24 hours a day, 7 days a week, with primary coverage aligned to Malaysia Standard Time (UTC+8), ensuring that Players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions of Malaysia can reach us during their local day.