Privacy Policy

1. Introduction

This Privacy Policy ("Policy") applies to all personal data processed by rmc88 ("rmc88", "we", "us", "our") in connection with the operation of the rmc88 Platform accessible at rmc88.app and any associated services (collectively, the "Platform"). rmc88 is the data controller in respect of personal data collected through the Platform.

By registering for an rmc88 Account or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the terms of this Policy, you should not use the rmc88 Platform.

This Policy should be read together with the rmc88 Terms and Conditions, which govern the contractual relationship between rmc88 and registered Users.

2. Data We Collect

rmc88 collects the following categories of personal data from Users and visitors to the Platform:

2.1 Registration & Identity Data

• Full legal name and date of birth (required for age verification and KYC compliance).
• Residential address, nationality, and country of residence.
• Email address and mobile phone number (Malaysian or international).
• Username and encrypted password.

2.2 Identity Verification (KYC) Documents

• Government-issued identification documents (e.g., Malaysian MyKad, passport, or driving licence).
• Proof of residential address (e.g., utility bill, bank statement).
• Source-of-funds documentation where required by compliance obligations.

2.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amount, method, and timestamp.
• Payment method identifiers (e.g., Touch n Go eWallet account reference, Boost eWallet ID, bank account last digits, USDT wallet address). Full payment credentials are not stored on the rmc88 Platform.
• Account balance history and bonus redemption records.

2.4 Usage & Gaming Data

• Betting and gaming history, including wager amounts, game selections, and outcomes.
• Session logs, including login timestamps, session duration, and logout events.
• Platform navigation behaviour and feature usage patterns.

2.5 Technical & Device Data

• IP address and approximate geolocation derived therefrom.
• Device type, operating system, browser type and version.
• Cookie identifiers and session tokens.

2.6 Communication Data

• Records of customer support interactions, including live chat transcripts and email correspondence.
• Marketing communication engagement records (open rates, click-through events) where consent to marketing has been provided.

3. How We Use Your Data

rmc88 uses the personal data collected for the following purposes:

• Account Administration: Creating, managing, and maintaining your rmc88 Account, including processing deposits, withdrawals, and bonus allocations.
• Identity & Age Verification: Verifying your identity and confirming that you meet the minimum age requirement of 21 years to use the Platform.
• Legal & Regulatory Compliance: Fulfilling obligations under applicable anti-money laundering (AML) regulations, counter-terrorism financing (CTF) requirements, and other legal obligations, including the retention of transaction records for the periods required by law.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, unauthorised account access, collusion, and other prohibited activity on the Platform.
• Customer Support: Responding to inquiries, resolving disputes, and providing technical assistance to registered Users.
• Service Improvement: Analysing aggregated and anonymised usage data to improve Platform performance, user experience, and game selection.
• Responsible Gaming: Monitoring account activity to identify indicators of problem gambling behaviour and to fulfil rmc88's responsible gaming commitments, including administering self-exclusion requests.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Users who have provided consent to receive such communications. You may withdraw consent at any time.

4. Legal Basis for Processing

rmc88 processes personal data on the following legal bases:

• Contract Performance: Processing necessary to perform the rmc88 Terms and Conditions, including Account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including AML/KYC requirements and financial record retention.
• Legitimate Interests: Processing necessary for rmc88's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and non-essential cookie usage, where your explicit consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. Data Sharing

5.1 Service Providers. rmc88 shares personal data with trusted third-party service providers who assist in operating the Platform, including payment processors, identity verification providers, fraud detection services, cloud infrastructure providers, and customer support platform operators. All service providers are bound by data processing agreements requiring them to protect your data in accordance with applicable law and rmc88's standards.

5.2 Game Providers. Where necessary to facilitate game access, rmc88 may share a pseudonymous player identifier and session token with licensed game studio providers. Game providers do not receive your full name, financial data, or contact information.

5.3 Legal & Regulatory Disclosure. rmc88 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, court order, or regulatory direction — including in response to AML/CTF investigation requests.

5.4 No Sale of Data. rmc88 does not sell, rent, or trade personal data to third-party advertisers, data brokers, or any party for commercial purposes unrelated to the operation of the Platform.

5.5 Business Transfers. In the event of a merger, acquisition, or transfer of all or part of rmc88's business, personal data held by rmc88 may be transferred to the acquiring entity, subject to equivalent data protection commitments.

6. Cookies & Tracking Technologies

The rmc88 Platform uses cookies and similar tracking technologies to maintain session state, remember User preferences, detect fraudulent activity, and analyse Platform usage.

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication tokens. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language and display settings across sessions.
• Analytics Cookies: Collect anonymised and aggregated data on Platform usage patterns to support service improvement. These are deployed only where consent has been obtained.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the rmc88 Platform, including the rmc88 login process.

7. Data Retention

rmc88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to legal and regulatory retention requirements. Specifically:

• Account and transaction data is retained for a minimum of five (5) years following Account closure, in compliance with applicable AML record-keeping obligations.
• KYC verification documents are retained for the period required by applicable regulations, typically five (5) years from the end of the business relationship.
• Customer support communication records are retained for three (3) years from the date of the interaction.
• Marketing communication records are retained until consent is withdrawn or the Account is closed, whichever is earlier.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised.

8. Data Security

rmc88 implements technical and organisational security measures appropriate to the risk presented by the processing of personal data. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between Users and the Platform.
• Encryption of sensitive data at rest, including stored credentials and financial identifiers.
• Role-based access controls limiting employee access to personal data to what is necessary for their role.
• Regular security assessments and penetration testing of Platform infrastructure.
• Audit logging of access to personal data by rmc88 personnel and service providers.

In the event of a personal data breach that presents a material risk to Users, rmc88 will notify affected Users without undue delay and take immediate remediation steps.

9. Your Rights

Subject to applicable law, you have the following rights in relation to the personal data rmc88 holds about you:

• Right of Access: You may request a copy of the personal data rmc88 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to rmc88's legal retention obligations.
• Right to Restriction: You may request that rmc88 restrict the processing of your personal data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact rmc88 via the 24/7 live chat facility or by email at [email protected]. rmc88 will respond to data rights requests within 30 days, or within any shorter period required by applicable law.

10. Children & Minors

The rmc88 Platform is strictly intended for individuals aged 21 years and older. rmc88 does not knowingly collect personal data from individuals under 21 years of age. If rmc88 becomes aware that personal data has been collected from a person under 21, that Account will be immediately closed and all associated data deleted in accordance with our data retention policy.

If you have reason to believe that a person under 21 has registered an rmc88 Account, please notify rmc88 immediately via the support channels below.

11. International Data Transfers

rmc88's operations involve cloud infrastructure providers and service partners whose servers may be located outside Malaysia. Where personal data is transferred to jurisdictions outside Malaysia, rmc88 implements appropriate safeguards — including contractual data protection clauses — to ensure that the transferred data receives an equivalent level of protection to that applicable within Malaysia.

12. Third-Party Links

The rmc88 Platform does not contain links to external third-party websites for advertising or commercial purposes. Where references are made to payment partners (such as Touch n Go eWallet, Boost, Maybank, CIMB, or Public Bank), those references are for informational purposes and do not constitute an endorsement of those parties' privacy practices. rmc88 is not responsible for the privacy policies of any third-party services you access independently.

13. Changes to This Policy

rmc88 may update this Privacy Policy from time to time to reflect changes in legal requirements, Platform operations, or data processing practices. Material changes will be communicated to registered Users via the email address associated with your rmc88 Account and/or through a notice on the Platform. The date of the most recent revision is displayed at the top of this Policy. Continued use of the Platform following notification of a revised Policy constitutes acceptance of the updated terms.

14. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or rmc88's data processing practices, please contact us via:

• 24/7 Live Chat: Available within your rmc88 Account dashboard.
• Email: [email protected]

rmc88 aims to acknowledge all formal privacy-related queries within 2 business days and to resolve them within 30 days. Where a request relates to data subject rights, the applicable statutory response period applies.