Waja88 Privacy Policy – Malaysian Member Data Protection

Waja88 collects members' personal data through several means — directly when you register an account or complete a form, automatically while you use the platform, and occasionally via legitimate third parties such as payment providers. Below are the categories of data we collect.

Registration & Identity Data: When registering a Waja88 account, you provide your full name as shown on your identification document, a Malaysian phone number, email address, and date of birth for age verification purposes. For identity verification (KYC), we may request a copy of your MyKad or passport, along with a bank statement or recent proof of address.

Financial Data: Waja88 records members' deposit and withdrawal history, payment methods used (Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX via Maybank2u or CIMB Clicks), and bank account or e-wallet details for withdrawal processing purposes. We do not store your full credit/debit card numbers, e-wallet passwords, or online banking PINs.

Platform Activity Data: Waja88 records your betting history, games played, session times, bonus and promotion usage, and account performance. This data is used to maintain platform integrity and deliver a more relevant experience for you.

Technical Data: When you access the Waja88 platform, our systems automatically record your device's IP address, browser type and version, operating system, device information (model, unique identifier), time zone, and access log data. This technical data is used for security, fraud detection, and platform maintenance purposes.

Waja88 uses members' personal data only for legitimate, necessary purposes that are proportionate to the platform's operational requirements. The following outlines the primary purposes for which data is used at Waja88.

• Account management: Creating, verifying, and managing Waja88 member accounts, including the identity verification (KYC) process required under applicable laws.
• Transaction processing: Processing member deposits and withdrawals via supported Malaysian local payment methods, ensuring accurate financial records, and resolving any transaction disputes.
• Security & fraud prevention: Detecting and preventing unauthorised activity, multiple account usage, money laundering, or any exploitation of the platform that violates Waja88's Terms & Conditions.
• Platform improvements: Analysing usage patterns in aggregate (not individually identifiable data) to improve platform design, system performance, and the overall user experience.
• Customer support: Resolving inquiries, complaints, or technical issues submitted by members via Live Chat, email, or Waja88's Telegram.
• Responsible Gambling: Monitoring account usage patterns to identify members who may benefit from responsible gambling support, and reaching out to them with relevant support information.
• Marketing communications: Sending information about promotions, bonuses, and new offers to members who have opted in to receive such communications. Members may opt out at any time.
• Legal Compliance: Fulfilling all relevant legal and regulatory obligations, including record-keeping requirements under Malaysian law.

Waja88 does not use members' personal data for automated decision-making that has legal or similarly significant effects on members without appropriate human intervention.

Waja88 operates on a "minimum data sharing" principle — we only share members' personal data when it is strictly necessary for platform operations or required by law. Waja88 does not sell member data to any third party under any circumstances.

Authorised service providers: Waja88 works with a carefully selected group of third-party service providers who have undergone rigorous security assessments — including payment processing providers, cloud infrastructure providers, cybersecurity software providers, and identity verification service providers. All providers are contractually bound to protect member data in accordance with Waja88's standards and may not use that data for their own purposes.

Competent authorities: Waja88 will disclose members' personal data to Malaysian law enforcement authorities (such as the Police, Securities Commission, or Insolvency Department) where required by law or a valid court order. In such cases, Waja88 will disclose only the minimum data necessary and, where legally permitted, will notify the affected member of the disclosure.

Waja88 invests seriously in data security infrastructure and practices to protect members' personal information from unauthorised access, disclosure, alteration, or destruction. The following are the key security measures we have implemented.

• Data encryption in transit: All communications between member devices and Waja88 servers are protected by TLS 1.3 with 256-bit SSL certificates. This covers all platform access, financial transactions, and customer support communications.
• Encryption of data at rest: Sensitive data such as identification details and financial records are encrypted at rest within Waja88's database using AES-256 encryption.
• Multi-layered access controls: Only Waja88 staff who require access to specific data in order to perform their duties are granted permission to do so — based on the principle of least privilege. All staff access to member data is logged and audited on a regular basis.
• 24/7 security monitoring: Waja88's cybersecurity team continuously monitors the platform using real-time threat detection and response systems to promptly identify and neutralise any security threats.
• Regular security testing: Waja88 conducts regular penetration testing and security audits by independent third parties to identify and address any system vulnerabilities before they can be exploited.
• Incident management: Waja88 has a clearly defined security incident response procedure. In the event of a data breach involving members' personal information, Waja88 will notify affected members and the relevant authorities within the timeframe required by law.

While Waja88 takes all reasonable steps to protect member data, no security system is 100% foolproof. Members also play an important role in keeping their accounts safe by using strong passwords and not sharing login credentials with anyone.

The Waja88 platform uses cookies and similar tracking technologies to enhance the user experience, maintain platform security, and analyse how members use our services. Below are the types of cookies used by Waja88.

• Essential cookies: These cookies are essential for the core operation of the Waja88 platform — including maintaining your login session, saving language preferences, and ensuring session security. Essential cookies cannot be disabled without affecting platform functionality.
• Performance cookies: Used to collect information on how members interact with the Waja88 platform — including the most frequently visited pages, time spent, and errors encountered. This data is collected in aggregate and without individual identification, used solely to improve the platform.
• Functionality cookies: Enables the Waja88 platform to remember your preferences — such as your preferred payment method, display settings, and sports preferences — to deliver a more personalised and efficient experience.
• Security cookies: Used to monitor suspicious activity, prevent fraud, and verify that the person accessing an account is its legitimate owner.

You can manage cookie settings through your web browser. However, disabling certain cookies may affect your experience on the Waja88 platform. For more information on managing cookies in your browser, refer to your browser's help documentation.

Waja88 retains members' personal data only for as long as necessary for the purposes stated in this Privacy Policy, or as required by applicable Malaysian law. Waja88's data retention policy is as follows.

• Active account data: While a member's account remains active, registration data, betting history, and transaction records are continuously stored and updated.
• After account closure: Upon account closure, Waja88 retains member data for the minimum period required under Malaysian record-keeping laws — typically 7 years for financial records — before the data is permanently deleted or anonymised.
• KYC Data: Identity verification documents are retained for the period required under Malaysia's anti-money laundering (AML) requirements.
• Security logs: Access logs and security activity logs are retained for 12 months for audit and security incident investigation purposes.
• Marketing data: If you choose to opt out of marketing communications, Waja88 will remove your details from our mailing list within 48 hours — though your financial records and account information may still be retained as required by law.

When data is no longer needed and there is no legal obligation to retain it, Waja88 will securely delete or anonymise that data using methods that ensure it cannot be recovered.

As a Waja88 member, you have the following rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). Waja88 is committed to respecting and facilitating the exercise of these rights.

• Right of access: You have the right to request a copy of the personal data we hold about you. Requests will be processed within 14 business days.
• Right to rectification: If the data we hold about you is inaccurate or incomplete, you have the right to request a correction. Some information can be updated directly in your account settings.
• Right to object: You have the right to object to the processing of your personal data for certain purposes — in particular, processing carried out for direct marketing purposes.
• Right to withdraw consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to the withdrawal.
• Right to erasure: In certain circumstances — such as when data is no longer needed for its original purpose, or when you withdraw your consent — you may request the deletion of your personal data. Such requests are subject to legal record-keeping obligations that may require us to retain certain data.

To exercise any of the rights above, please contact Waja88's support team via Live Chat on the platform, or send an email to support@waja88.xyz stating the type of privacy request you wish to make. Waja88 may require identity verification before processing certain requests to ensure the security of your data.

The Waja88 platform is for adults aged 18 and above only. Waja88 does not knowingly collect or process personal data from individuals under the age of 18. If you believe someone under 18 has registered a Waja88 account, please contact us immediately so we can take appropriate action, including closing the account and deleting the relevant data.

Waja88 applies an age verification process during registration and may request additional identity verification at any time to ensure compliance with this minimum age requirement. Failure to verify age eligibility will result in immediate account closure.

Waja88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements, or changes in how the platform operates. The date of the most recent update is always displayed at the top of this page.

For material amendments that significantly affect how we use members' personal data, Waja88 will notify members via email or in-platform notification at least 14 days before the changes take effect. Continued use of the Waja88 platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

We encourage members to review this Privacy Policy page periodically to stay informed about how Waja88 protects their personal information.

If you have any questions, concerns, or enquiries about how Waja88 handles your personal data, or wish to exercise any of your privacy rights, the Waja88 data protection team is ready to assist.

• Live Chat: Available on the Waja88 platform 24 hours a day. For privacy enquiries that do not require disclosure of sensitive details, Live Chat is the fastest way to get an answer.
• Email: support@waja88.xyz — for formal privacy requests such as data access, correction, or deletion, please send an email with the subject line "Privacy Request" along with appropriate identity verification.
• Telegram: @waja88support — for quick communication in Bahasa Malaysia or English.

Waja88 will endeavour to respond to all privacy-related enquiries within 5 business days. For more complex requests such as data deletion or data export, processing may take up to 14 business days. We will keep you updated on the progress of your request throughout the process.

For information on platform usage rules, please refer to Terms & Conditions us. For responsible gambling guidance, please visit the Responsible Gaming.