nft888 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how nft888 ("nft888", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data in connection with the operation of the nft888 online gaming Platform at nft888.club (the "Platform"), including all associated games, services, customer support channels, and marketing communications.

This Policy applies to all individuals who access or use the nft888 Platform, including registered account holders, prospective players who visit the Platform without registering, and individuals who contact our customer support team. By creating an nft888 account or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy.

This Policy should be read in conjunction with our Terms and Conditions and Responsible Gaming Policy, both of which are available on the nft888 Platform.

2. Data Controller Identity

For the purposes of applicable data protection legislation, the data controller responsible for your personal data in connection with the nft888 Platform is the nft888 operating entity. nft888 is an online gaming brand serving Malaysian players and operating under international gaming authority frameworks. For all data protection enquiries, you may contact us at the email address listed in Section 14 of this Policy.

3. Personal Data We Collect

nft888 collects the following categories of personal data from or about you:

• Identity Data: Full legal name, date of birth, nationality, gender, and government-issued identification document details (e.g., MyKad, passport) collected as part of Know Your Customer (KYC) verification.
• Contact Data: Email address, Malaysian mobile phone number, and residential address.
• Account Data: Username, hashed password, account registration date, account status, and account preference settings.
• Financial Data: Bank account details, e-wallet identifiers (Touch n Go eWallet, Boost), deposit and withdrawal transaction records denominated in MYR, and payment verification documents.
• Gaming Activity Data: Bet history, game session logs, wagering patterns, promotion uptake, win and loss records, and responsible gaming tool usage across all nft888 game categories including slots, live casino, sportsbook, arcade, and Sic Bo.
• Technical Data: IP address, browser type and version, device type and operating system, screen resolution, time zone, session duration, and clickstream data within the Platform.
• Communications Data: Records of your interactions with nft888 customer support, including live chat transcripts, email correspondence, and any attachments you submit (e.g., KYC documents).
• Marketing Preferences: Your expressed preferences regarding promotional communications from nft888, including opt-in and opt-out records.

nft888 does not collect sensitive personal data (such as racial or ethnic origin, religious beliefs, or health data) unless this arises incidentally through responsible gaming interactions (for example, where a player discloses a health condition in the context of requesting self-exclusion). Such data is handled with heightened care and used solely in connection with the responsible gaming request.

4. How We Collect Your Data

nft888 collects personal data through the following means:

• Direct Collection: Data you provide during account registration, KYC verification, deposit and withdrawal processing, customer support interactions, and participation in promotions.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, via cookies, web beacons, server logs, and similar tracking technologies described in Section 9.
• Third-Party Sources: Identity and fraud verification data from KYC service providers; payment verification data from payment processors; fraud screening data from anti-fraud and anti-money laundering service providers. nft888 only receives data from third parties where we have a legitimate legal basis and where those third parties are bound by appropriate data-sharing agreements.

5. Purposes and Legal Bases for Processing

nft888 processes your personal data for the following purposes, each underpinned by a lawful basis:

• Account Registration and Management — necessary for the performance of the contract between you and nft888.
• KYC and Age Verification — necessary for compliance with nft888's legal and regulatory obligations, including the strict 21+ age requirement and anti-money laundering obligations.
• Deposit and Withdrawal Processing — necessary for the performance of the contract and to comply with financial services obligations.
• Gaming and Betting Services — necessary for the performance of the contract.
• Fraud Prevention and Security — necessary for nft888's legitimate interests in protecting the Platform and its players from fraud, cheating, and unauthorised access.
• Responsible Gaming Monitoring — necessary for compliance with responsible gaming obligations and for nft888's legitimate interests in promoting player welfare.
• Customer Support — necessary for the performance of the contract and nft888's legitimate interests in maintaining service quality.
• Marketing Communications — based on your consent, where you have opted in to receiving promotional communications from nft888. You may withdraw consent at any time.
• Legal and Regulatory Compliance — necessary for nft888 to comply with applicable laws, including anti-money laundering, data retention, and regulatory reporting obligations.
• Platform Improvement and Analytics — necessary for nft888's legitimate interests in improving the Platform's performance, user experience, and game offering.

6. Sharing and Disclosure of Personal Data

nft888 does not sell your personal data to third parties. We disclose personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Game Providers: Third-party game studios and platform providers (such as live casino studios and slot game providers) receive limited technical session data necessary to deliver their games to you. These providers are bound by data processing agreements and are not permitted to use your data for their own marketing purposes.
• Payment Processors: Financial institutions, e-wallet providers (including Touch n Go eWallet and Boost), and Malaysian banks (including Maybank, CIMB, Public Bank, RHB, and Hong Leong Bank) receive the payment data necessary to process your transactions. These entities operate under their own regulatory frameworks and privacy obligations.
• KYC and Verification Providers: Identity verification service providers receive identity and address data for the purpose of fulfilling our age and identity verification obligations.
• Anti-Fraud and AML Providers: Fraud prevention and anti-money laundering screening providers receive transaction data and identity data for the purpose of detecting and preventing financial crime.
• Customer Support Platforms: Our live chat and support ticketing infrastructure providers process communications data on our behalf under data processing agreements.
• Legal and Regulatory Authorities: nft888 will disclose personal data to law enforcement agencies, regulatory authorities, or courts where required by applicable law, regulatory obligation, or valid legal process.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all nft888's assets, player personal data may be transferred to the successor entity, subject to the same privacy protections described in this Policy. Registered players will be notified of any such transfer.

7. International Data Transfers

nft888 is an internationally operating gaming platform. Your personal data may be transferred to and processed in countries outside Malaysia, including countries where our game providers, payment processors, or infrastructure providers are established. Where such transfers occur, nft888 takes steps to ensure that appropriate safeguards are in place to protect your personal data at a standard equivalent to that afforded within Malaysia, including through the use of contractual data transfer agreements and by selecting service providers that maintain internationally recognised data protection certifications.

8. Data Retention

nft888 retains personal data for as long as is necessary for the purposes for which it was collected, and as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account Data and Gaming History: Retained for the duration of your nft888 account and for a minimum of five (5) years following permanent account closure, to satisfy anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Financial Transaction Records: Retained for a minimum of seven (7) years to comply with financial record-keeping obligations.
• Customer Support Records: Retained for three (3) years from the date of the support interaction, unless a longer period is required in connection with an ongoing dispute or regulatory matter.
• Marketing Preference Records: Opt-in and opt-out records are retained for the lifetime of your nft888 account and for three (3) years after account closure to evidence compliance with marketing consent requirements.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in accordance with nft888's data destruction procedures.

9. Cookies and Tracking Technologies

nft888 uses cookies and similar tracking technologies on the Platform to provide essential functionality, improve your user experience, and support our analytics and security operations. The categories of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, load balancing, and fraud prevention. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings, account preferences, and game lobby layouts, to personalise your experience on the nft888 Platform.
• Analytics Cookies: Collect aggregated, anonymised data about how players navigate the Platform — helping nft888 identify usability issues and improve the overall experience.
• Security Cookies: Help nft888 detect and prevent account hijacking, credential stuffing, and other malicious activity targeting player accounts.

You can manage cookie preferences through your browser settings. Disabling functional or analytics cookies may affect your experience on the nft888 Platform but will not prevent you from accessing core gaming services. Disabling strictly necessary cookies may prevent you from using the Platform entirely.

10. Your Data Subject Rights

Subject to applicable data protection legislation, you have the following rights in relation to the personal data nft888 holds about you:

• Right of Access: Request a copy of the personal data nft888 holds about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where we no longer have a lawful basis to retain it, subject to overriding legal or regulatory retention obligations.
• Right to Restriction of Processing: Request that we restrict processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Request a copy of personal data you have provided to nft888 in a structured, machine-readable format.
• Right to Object: Object to processing based on nft888's legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, contact nft888 customer support via live chat or at the email address in Section 14. nft888 will respond to verified data subject requests within thirty (30) days. We may require identity verification before processing certain requests to protect against unauthorised access to your data.

11. Children and Minors

The nft888 Platform is strictly for persons aged 21 years or over. nft888 does not knowingly collect personal data from individuals under 21 years of age. If we become aware that we have collected personal data from a person under 21, we will immediately close the relevant account, void any associated transactions, and delete the personal data in question. If you are aware of a person under 21 who has accessed the nft888 Platform, please notify us immediately via our customer support channels.

12. Security Measures

nft888 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the nft888 Platform;
• Encryption of sensitive stored data, including financial information and identity documents;
• Access controls and role-based permissions limiting staff access to personal data on a need-to-know basis;
• Regular security audits and vulnerability assessments of Platform infrastructure;
• Two-factor authentication (2FA) options for player accounts to mitigate the risk of unauthorised access;
• Real-time fraud and anomaly detection systems monitoring account activity patterns.

While nft888 takes all reasonable steps to protect your data, no digital platform is entirely immune from security incidents. In the event of a data breach that poses a risk to your rights and freedoms, nft888 will notify affected players in accordance with applicable data breach notification requirements.

13. Changes to This Privacy Policy

nft888 reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered players via the email address on file or via a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date at the top of this Policy will be revised with each update. Your continued use of the nft888 Platform following notification of material changes constitutes your acknowledgement of the revised Policy.

14. Contact and Complaints

For any questions, concerns, or data subject rights requests relating to this Privacy Policy or nft888's data processing activities, please contact us through the following channels:

• Live Chat: Available 24/7 via the nft888 Platform
• Email: [email protected]
• Support Hours: 9:00 AM – 2:00 AM MYT

If you are unsatisfied with nft888's response to a data protection concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction of residence. nft888 will cooperate fully with any supervisory authority investigation.

This Privacy Policy was last reviewed and updated on 1 June 2026.