18bba Privacy Policy – Malaysia Member Personal Data Protection

Welcome to the 18bba Privacy Policy. This document is the official agreement between you as a member or visitor and 18bba as the platform operator. We understand that your trust depends on how we handle the personal information you provide to us.

18bba operates as an online casino entertainment platform serving players across Malaysia. In the course of these operations, we need to collect certain personal information to ensure the platform runs smoothly, securely, and in compliance with applicable legal requirements.

This Privacy Policy explains in detail:

• What types of personal information we collect from you.
• Why and how we use that information.
• Who your information may be shared with and under what circumstances.
• The security measures we take to protect your data.
• Your rights regarding the personal data we hold.

By registering or using the 18bba platform, you confirm that you have read, understood, and accepted this Privacy Policy. If you disagree with any part of this policy, please contact us before continuing to use the platform.

We collect two main types of information: information you provide directly to us, and information collected automatically as you use our platform.

A. Information You Provide Directly

• Registration information: Full name, date of birth, NRIC number, email address, phone number and password.
• KYC verification information: A copy of your identity card, passport or driving licence for identity and age verification purposes.
• Financial information: Bank account details, digital wallets, or other payment methods you use for deposits and withdrawals.
• Communication information: Any messages, complaints or enquiries you submit to our support team.
• Profile information: Account settings, game preferences, and other profile information you voluntarily update.

B. Information Collected Automatically

Every piece of information we collect has a clear and lawful purpose. 18bba does not use your data for any purpose not stated in this policy without first obtaining your additional consent.

• Account management: Creating, verifying and maintaining your member account, including KYC processes required by law.
• Transaction processing: Processing deposits, withdrawals and any financial transactions you make on the platform securely and accurately.
• Service provision: Ensuring all platform features, including games, promotions and the VIP programme, function correctly and remain relevant to you.
• Security and fraud prevention: Detecting, investigating and preventing fraudulent activity, money laundering or any security breaches.
• Service communications: Sending important notices related to your account, transactions, policy updates and security alerts.
• Marketing (with consent): Sending promotional information, bonus offers and platform updates — only if you have opted in to receive such communications.
• Responsible gaming: Monitoring gameplay patterns to identify early signs of problem gambling and offering appropriate support.
• Legal compliance: Meeting reporting and compliance obligations to relevant authorities as required by law.
• Platform improvement: Analysing usage patterns to develop new features, improve performance and deliver a better user experience.

18bba does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, there are certain situations where we need to share your information with specific parties to keep the platform functioning properly.

Parties That May Receive Your Information

• Payment service providers: DuitNow, FPX, Touch 'n Go, GrabPay, Boost, and crypto processing networks are shared only the minimum transaction details required to process your payment.
• Game software providers: Third-party gaming platforms that form part of the 18bba game catalogue may receive session identifiers required for technical functionality.
• Cloud & security service providers: Technical infrastructure supporting our platform operations, subject to strict confidentiality agreements.
• Legal authorities: Information may be disclosed to law enforcement authorities, regulatory bodies, or courts when required by Malaysian law.
• Related companies: Entities within the same group as 18bba, subject to equivalent or stricter privacy policies.

The security of your data is among 18bba's highest priorities. We continuously invest in the latest security infrastructure to ensure your information is always protected from unauthorised access, loss, or breach.

The security measures we implement include:

• Encryption of data in transit: All communications between your device and our servers are encrypted using TLS 1.3 with a 256-bit SSL certificate.
• Encryption of data at rest: Sensitive data such as passwords and financial details are encrypted at rest using irreversible hashing algorithms.
• Two-factor authentication (2FA): We support and encourage the use of two-factor authentication for an added layer of security on your account.
• 24/7 Monitoring: A real-time threat detection system operates around the clock to identify and repel any intrusion attempts.
• Regular security audits: Our platform undergoes penetration testing and security audits by independent third parties on a regular basis.
• Internal access controls: 18bba staff only have access to the data required for their specific duties, with all access logged and monitored.
• Incident response plan: We have a comprehensive incident response procedure to address any security breaches swiftly and effectively.

The 18bba platform uses cookies and similar tracking technologies to enhance the user experience, maintain security and understand how you use our platform. Cookies are small files stored on your device when you visit our platform.

Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login authentication, session security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information about how you use the platform — pages visited, time spent and any errors encountered — to help us improve performance.
• Functional Cookies: Saving your preferences such as display settings, game preferences and language settings to deliver a more personalised experience.
• Analytics Cookies: Helping us understand aggregate usage patterns for platform improvement and new feature development.

You can manage your cookie settings through your web browser settings. Please note that disabling certain cookies may affect specific functions of the 18bba platform and impact your gaming experience.

18bba retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable Malaysian law.

• Active account data: Retained for the duration your account remains active and in use.
• Closed account data: Retained for a minimum of 7 years after account closure in line with Malaysia's financial and anti-money laundering regulatory requirements.
• Financial transaction records: Retained for a minimum of 7 years for audit and tax compliance purposes.
• Support communication logs: Retained for 3 years for reference and dispute resolution purposes.
• Security logs: Retained for 2 years for threat analysis and incident investigation purposes.
• Marketing data: Retained until you withdraw consent or close your account, whichever comes first.

Once the retention period expires, your data will be securely deleted or converted into an unidentifiable form (anonymised) using established procedures.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have specific rights regarding the personal data we hold. 18bba is committed to respecting and facilitating the exercise of these rights.

The 18bba platform is intended exclusively for individuals who are aged 18 years and above. We do not knowingly collect or process any personal information from individuals under the age of 18.

As part of our registration and KYC verification process, all members are required to verify their age by providing a valid identity document. This is our primary measure to ensure the platform is not accessed by underage children or minors.

If we discover that personal data of an individual under 18 years of age has been inadvertently collected, we will take immediate action to:

• Closing the relevant account immediately.
• Delete all data associated with that individual.
• Refunding any deposits that may have been made, where applicable.

Parents or guardians who become aware that a child under their care has registered on this platform without consent are requested to contact our support team immediately.

18bba reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. We are committed to notifying you of any significant changes.

When significant changes occur:

• The "Updated" date at the top of this page will be changed to reflect the latest version.
• A notice will be displayed on the platform for at least 30 days before changes take effect.
• For significant changes, we will send a notice directly to the email address you registered with.

Continued use of the 18bba platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. We therefore encourage you to review this page periodically.

If you have any questions, concerns or complaints regarding how 18bba handles your personal data, we warmly welcome you to contact us. Our privacy team is ready to assist you.

Ways to reach us:

• Live Chat: Available 24 hours a day, 7 days a week via the 18bba platform — the fastest way to get an immediate response.
• Email: Send your enquiry to [email protected] — we will respond within 24 hours.

When contacting us regarding privacy, please include the following information to help us process your request more quickly:

• Your full name as registered on your account.
• The email address associated with your account.
• Clear details about your request or concern.
• Any transaction reference number, where applicable.