RM8 Privacy Policy – Personal Data Protection for Malaysian Members

Rm8 ("we", "the rm8 platform", or "rm8.best") is an online casino platform operator providing digital entertainment services to registered members in Malaysia. We understand that your personal data is sensitive and valuable — and we take our responsibility to protect it very seriously.

This Privacy Policy transparently describes how RM8 collects, processes, stores, shares, and protects your personal information when you register an account, make a deposit using Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, play on our platform, or interact with the RM8 support team.

This policy is framed in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices. rm8 operates as the data controller for all personal information you provide to us, and we are fully responsible for ensuring that data is handled in accordance with the law and established ethical standards.

Rm8 only collects data that is genuinely necessary to provide and improve the platform's services to you. Below are the categories of data we collect, along with their purposes and legal basis:

RM8 does not collect sensitive personal data such as medical information, religious beliefs, or political affiliations, and we do not request information beyond what is necessary for the operation of our platform.

RM8 uses your personal data only for legitimate, necessary purposes directly related to the operation of our online casino platform. The following are the primary ways RM8 uses your personal data:

• Account Management: Creating and managing your RM8 account, processing your registration, and maintaining accurate membership records.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX (Maybank2u, CIMB Clicks) and withdrawal requests to the same methods.
• Identity Verification (KYC): Conducting legally required KYC checks to verify identity and age, and to ensure compliance with anti-money laundering (AML) regulations.
• Platform Security: Detecting and preventing fraud, unauthorised access, bonus abuse, and other suspicious activity through usage pattern monitoring.
• Customer Support: Providing effective technical support and dispute resolution based on your account history and interaction records with RM8.
• Legal Compliance: Fulfil the reporting and disclosure obligations mandated by Malaysian law, including the PDPA, AMLATFPUA, and the requirements of relevant regulatory bodies.
• Responsible Gaming: Analysing play patterns to identify signs of problem gambling and extending support to members who need it through the Responsible Gaming rm8.
• Platform Improvements: Using aggregated usage data (without identifying any individual) to enhance the user experience, introduce new features, and optimise RM8 platform performance.

RM8 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, in the course of normal platform operations, RM8 may share necessary data with the following categories of parties, and only to the extent required for those purposes:

• Payment Processors: RM8 shares the necessary transaction information with approved payment processors to facilitate deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks), and to ensure withdrawals are processed securely. All of our payment processors comply with PCI-DSS security standards.
• Technology Service Providers: Providers that support rm8's technical infrastructure — such as cloud server services, anti-fraud systems, and analytics platforms — may process your data as part of the services they provide to rm8. All such providers are subject to strict data processing agreements.
• Identity Verification Provider: For KYC purposes, RM8 uses approved third-party identity verification services. Any data shared is kept to the minimum necessary and limited strictly to what is required for verification.
• Legal Authorities: rm8 will disclose personal data to Malaysian authorities (such as the Royal Malaysia Police, Bank Negara Malaysia, or relevant regulatory bodies) when required by law, court order, or in the context of a legitimate investigation into unlawful activity.

Rm8 continuously invests in the latest security infrastructure to ensure your personal data remains protected at all times. The following are the key security layers rm8 employs:

While rm8 takes all reasonable steps to protect your data, no security system is entirely foolproof. You also play an important role in keeping your own data safe — use a strong, unique password for your rm8 account, enable 2FA, and never share your login credentials with anyone.

The rm8 platform uses cookies and similar tracking technologies to enhance your experience, maintain account security, and understand how our platform is used. The following are the types of cookies rm8 uses:

You can manage your cookie preferences through your browser settings at any time. However, disabling essential cookies may cause certain features on the RM8 platform to malfunction, including the login process and transaction security.

As an RM8 member and as an individual protected under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by RM8. RM8 is committed to making it straightforward for you to exercise these rights, free of charge:

To exercise any of the above rights, contact the RM8 privacy team by email at support@rm8.best stating the right you wish to exercise. rm8 may require identity verification before processing any request relating to your data in order to safeguard that information.

The rm8 platform is strictly limited to individuals aged 18 and above. rm8 does not knowingly collect any personal data from individuals under the age of 18.

RM8's registration process includes age verification designed to prevent access by underage individuals. Should RM8 become aware of or have reasonable grounds to believe that personal data has been collected from a child under the age of 18 without valid parental or guardian consent, we will take immediate steps to:

• Suspend the account in question immediately.
• Deleting all collected data related to that individual.
• Refunding any deposits that have been made.
• Reporting the incident to the relevant authorities where necessary.

If you are a parent or guardian and believe your underage child has registered an RM8 account, please contact us immediately at support@rm8.best and we will respond within 24 hours.

In some cases, the operation of the rm8 platform may involve your personal data being processed by third parties operating outside Malaysia — for example, cloud service providers whose server infrastructure spans multiple countries.

When your personal data needs to be transferred outside Malaysia, RM8 ensures that such transfers are carried out with adequate safeguards in place, including:

• Ensuring that data recipients comply with data protection standards equivalent to or stricter than those required under Malaysia's PDPA.
• Implementing Standard Contractual Clauses that require data recipients to protect your data to the standards set by RM8.
• Only transferring the minimum data genuinely required for the relevant operation.

RM8 retains your personal data only for as long as necessary to fulfil the original purpose for which it was collected, or as required by Malaysian law. The following are the data retention guidelines we adhere to:

• Active Account Data: Retained for as long as your rm8 account is active, and for a defined period after account closure for audit purposes and the resolution of any disputes that may arise.
• Financial Transaction Records: Retained for a minimum of 7 years after the transaction date, in line with Malaysia's financial and anti-money laundering legal requirements.
• KYC Documents: Retained for a minimum of 6 years after the end of the business relationship, in accordance with Malaysia's AMLATFPUA requirements.
• Support Communication Logs: Retained for 3 years for quality control purposes and resolution of any disputes that may arise after the original interaction.
• Technical Usage Data: Technical logs and analytics data that do not identify any individual are retained for a maximum of 12 months.
• Inactive Accounts: Accounts that have been inactive for more than 24 months will go through a review process, and any data that is no longer required will be securely disposed of in accordance with RM8's procedures.

Once the retention period expires, your personal data will be securely disposed of using methods that ensure the data cannot be recovered — including secure deletion for digital data and physical destruction for any existing printed copies.

RM8 reserves the right to review and update this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or updates to RM8 platform features. The "Last Updated" date at the top of this page indicates when this Privacy Policy was last reviewed.

For material changes — that is, changes that significantly alter how RM8 collects or uses your data — RM8 will:

• Displaying a clear notice on the RM8 platform homepage for at least 14 days before the changes take effect.
• Sending a notification via email to the registered address on your RM8 account.
• In the case of highly material changes, we may request your renewed consent before the changes take effect.

Your continued use of the rm8 platform after the effective date of any changes will be considered your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your rm8 account and request the deletion of your personal data.

If you have any questions, concerns, or wish to exercise your rights under this Privacy Policy, the RM8 privacy team is ready to assist you through the following channels:

When contacting RM8 regarding a personal data request, please include the following details to help expedite the process: your RM8 account username, registered phone number, the type of request you are making, and any relevant context or additional information. Identity verification will be carried out before any sensitive information is disclosed or any action is taken on your data.