8lucky Privacy Policy – Player Data Protection in Malaysia

8lucky ("we", "the platform" or "8lucky") is an online betting platform operating through the website 8lucky.best and all associated services. We understand that privacy is a deeply personal matter and we take this responsibility seriously.

This Privacy Policy explains in detail the types of personal data we collect from you when you register, use, or interact with the 8lucky platform, the purposes for which that data is collected, how we store and protect it, who we may share it with, and your rights as a data subject under Malaysian law.

This Privacy Policy applies to all users of the 8lucky platform, including registered players, website visitors, and anyone who interacts with any 8lucky service. This Policy should be read together with Terms and Conditions 8lucky, which forms part of the full agreement between you and our platform.

8lucky operates in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable data privacy laws. We treat compliance with these laws as a minimum standard, not the ceiling of our privacy commitment.

8lucky collects your personal data through several means — directly when you provide it to us during registration or platform use, and automatically through standard technologies used to operate online platforms. Below are the details of the types of data we collect:

Data You Provide Directly:

• Registration Information: Full name, Malaysian phone number, email address, password (stored in encrypted hash form and unreadable) and date of birth for age verification.
• Identity Verification Information: MyKad number or passport number, along with copies of identification documents when required for the standard identity verification process for large withdrawals.
• Payment Information: The e-wallet or banking account details you register for deposits and withdrawals — including your Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow account numbers, or the FPX information required. Full bank card numbers are never stored in 8lucky's systems.
• Communications: Customer support conversation records via live chat or email, including any complaints, enquiries, or feedback you have submitted to us.

Automatically Collected Data:

• Platform Usage Data: Login records, date and time of each session, games played, bets placed, game outcomes, and deposit and withdrawal transaction history in Malaysian Ringgit (RM).
• Device & Technical Data: Your internet browser type, operating system, device type (mobile or desktop), screen resolution, and IP address. This data is used for security purposes and to optimise your platform experience.
• General Location Data: General location based on IP address for Malaysian residency verification and fraud prevention purposes. We do not collect precise GPS location from your device.
• Cookie Data: Information collected through cookies and other tracking technologies, as further described in Section 6 below.

8lucky uses the personal data we collect for the following purposes, all of which are directly related to providing you with our online betting platform services:

8lucky does not use your personal data to build psychological profiles, make automated decisions that materially affect your rights without human review, or for third-party advertising purposes. Any marketing communications from 8lucky relate solely to 8lucky's own services — promotions, bonuses, and new offers — and you may unsubscribe at any time.

8lucky does not sell, rent, or trade your personal data to any third party. However, in the course of operating the platform, we may need to share your data with certain categories of third parties under the limited circumstances described below:

• Payment Service Providers: To process your deposit and withdrawal transactions via your chosen Malaysian payment method — Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX via Maybank2u or CIMB Clicks — we are required to share the minimum necessary transaction information with the relevant provider. This data is transmitted through secure channels, and these providers are subject to their own privacy policies.
• Game Providers: The 8lucky platform uses games from licensed third-party providers. For technical game operation purposes, minimal game session information may be shared with the relevant provider. These providers do not receive your full personal identification details.
• Technical Service Providers: This includes server hosting, cybersecurity, and platform analytics services that help us operate 8lucky safely and efficiently. All such providers are bound by strict data protection agreements with 8lucky.
• Legal Authorities: 8lucky will disclose personal data to Malaysian legal authorities when required by law, court order, or a valid request from a relevant enforcement body. We will not disclose your data beyond what is legally required.

In all of the data-sharing cases above, 8lucky shares only the minimum data necessary for the relevant purpose. We do not grant any third party access to your full data profile.

Protecting your personal data is a core technical and operational priority at 8lucky. We implement multiple layers of security to safeguard your data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All communication between your browser and 8lucky's servers is encrypted using the same TLS protocol employed by Malaysian banking institutions. This means data in transit — including login credentials and transaction details — cannot be intercepted or read by third parties, even with sophisticated equipment.
• Secure Password Storage: Your account password is never stored in readable form in our systems. We use strong one-way cryptographic hash functions — meaning that even if our servers were ever accessed without authorisation, your password could not be retrieved.
• Data Segregation: Sensitive personal data such as MyKad numbers and payment information is stored separately from gameplay data and protected with additional layers of encryption.
• Active Security Monitoring: The 8lucky system continuously monitors account activity to detect suspicious access patterns, repeated failed login attempts, and other signs of potential unauthorised access. Automated systems will temporarily freeze an account if suspicious activity is detected.
• Internal Access Controls: Only 8lucky staff who require access to your personal data to perform their specific duties are granted that access — and all such access is logged and monitored. No 8lucky employee has unrestricted access to all user data.
• Regular Security Audits: 8lucky conducts regular security assessments to identify and address potential vulnerabilities before they can be exploited.

While we implement robust security measures, no online security system can guarantee absolute protection at all times. The security of your account also depends on your own actions — use a strong and unique password, do not share your login credentials, and contact 8lucky immediately if you suspect any suspicious activity on your account.

The 8lucky platform uses cookies and similar tracking technologies to ensure core platform functions operate correctly, enhance the user experience, and understand general usage patterns. Below are the types of cookies we use:

Essential Cookies (Cannot Be Disabled):

These essential cookies are required for the 8lucky platform to function properly. Without them, core functions such as maintaining your login session, saving bets placed before verification, and handling security requests cannot operate. You cannot disable these cookies and continue using the platform.

Functional Cookies (Optional):

Functional cookies remember your preferences and settings within the 8lucky platform — such as your favourite games, bet limits you have set, and display preferences. This saves you from having to reconfigure your settings every time you log in.

Analytics Cookies (Optional):

Analytics cookies help us understand how players use the 8lucky platform — which pages are visited most frequently, where players encounter technical issues, and how the platform performs under various network conditions. Analytics data is collected anonymously and in aggregate — we cannot personally identify you from analytics data.

You can manage your cookie settings through your internet browser settings. However, disabling essential cookies may affect or prevent full use of the 8lucky platform.

8lucky retains your personal data for as long as necessary to fulfil the purposes stated in this Privacy Policy, or for as long as your account is active, or as required to meet our legal obligations. The following are retention period guidelines for the various types of data we hold:

• Active Account Data: For as long as your account remains active with 8lucky. This includes registration information, transaction records, and gaming history.
• Financial Transaction Data: Deposit and withdrawal transaction records are retained for a minimum of 7 years from the transaction date, in accordance with Malaysia's applicable financial and tax legal requirements.
• Support Communication Records: Customer support conversation records are retained for 3 years for reference and dispute resolution purposes.
• Security Logs: Security activity logs are retained for 12 months to support incident investigations when required.
• Data After Account Closure: When you close your 8lucky account, personal data that is not required for legal compliance will be deleted or anonymised within 90 days. Data that must be retained to meet legal obligations (such as financial transaction records) will be kept only for the required period and will not be used for any other purpose.

If you wish to request early deletion of your data before the standard retention period expires, you may submit a request to the 8lucky customer support team. Such requests will be processed in accordance with your rights under Malaysia's PDPA and may be subject to applicable legal retention requirements.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and 8lucky's commitment to privacy standards that go beyond the minimum legal requirements, you have the following rights regarding your personal data:

To submit any request relating to the rights above, contact the 8lucky customer support team via live chat or email at support@8lucky.best. We will verify your identity before processing any personal data request — this step is in place to protect your privacy from unauthorised parties. Requests will be processed within 21 days of receipt.

The 8lucky platform is intended exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

The 8lucky registration process requires age verification, and we take reasonable steps to ensure that only adults register and use our platform. If we discover that personal data of an individual under 18 has been collected without our knowledge, we will delete that data promptly and close the account in question.

If you have reason to believe that a child or individual under the age of 18 is using the 8lucky platform, please contact us immediately at support@8lucky.best so that we can take the appropriate action.

8lucky may update this Privacy Policy from time to time to reflect changes in our privacy practices, developments in Malaysian law, or changes to the services we offer. When we make significant changes, we will:

• Updating the "Last Updated" date at the top of this page.
• Display an in-platform notification on 8lucky the first time you log in after the changes take effect.
• Sending notifications via the email address or phone number you registered, at least 14 days before significant changes take effect — unless the changes are required immediately for legal or security reasons.

The latest version of this Privacy Policy is always available on this page. We encourage you to check back periodically. Continued use of the 8lucky platform after changes take effect will be considered acceptance of the updated policy. If you do not agree with the changes, you have the right to close your account before they come into effect.

If you have any questions, concerns, or complaints regarding how 8lucky handles your personal data, or if you wish to exercise any of your data subject rights, please contact us through the following channels:

• Live Chat: The fastest option — click the live chat icon within the 8lucky platform while logged in. Our team is available 24 hours a day, 7 days a week in Bahasa Malaysia.
• Email: Send an email to support@8lucky.best with the subject line "Data Privacy Enquiry" and your account number. We aim to provide an initial response within 24 hours and to resolve data subject rights requests within 21 business days.

When contacting us about personal data, please include the following to help us process your request promptly: your 8lucky account number, the type of request you are making (access, correction, deletion, etc.), and any additional information relevant to your request. We will verify your identity before processing any request in order to protect your privacy.

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia, the relevant regulatory authority under PDPA 2010.