Privacy Policy

This Privacy Policy ("Policy") is issued by SPD88 ("we", "us", "our") and applies to all personal data processed in connection with the operation of the SPD88 online casino and sports betting platform accessible at spd88.cam and any related subdomains or mobile interfaces.

SPD88 respects the privacy of all users and is committed to handling personal data responsibly, transparently, and in accordance with internationally recognised data protection principles — including principles aligned with the General Data Protection Regulation (GDPR) and applicable international privacy standards. We acknowledge that Malaysian users are subject to Malaysian personal data protection legislation, specifically the Personal Data Protection Act 2010 (PDPA), and we are committed to meeting applicable obligations under that framework.

This Policy explains: what categories of personal data we collect; how and why we collect it; the legal bases on which we process it; with whom we share it; how long we retain it; and the rights available to you as a data subject. Please read this Policy in full before providing any personal data to SPD88.

The following terms carry the meanings defined below throughout this Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifiers, financial information, and any combination of data that can be used to identify an individual.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — SPD88, which determines the purposes and means of processing Personal Data.
• "Data Processor" — Any third party that processes Personal Data on behalf of SPD88 under a contractual arrangement.
• "Data Subject" — The individual whose Personal Data is being processed — in this context, a registered or prospective SPD88 Member.
• "Member" — A natural person who has registered an Account on the SPD88 platform.
• "KYC Data" — Identity verification documentation collected pursuant to Know Your Customer obligations, including government-issued identification, proof of address, and source of funds documentation.
• "Cookies" — Small text files stored on a user's device by a web browser to record session and preference data.
• "PDPA" — The Personal Data Protection Act 2010 of Malaysia, governing the processing of personal data in commercial transactions.

SPD88 collects the following categories of personal data in the course of providing its services:

• Full legal name as it appears on official identification
• Date of birth (for age verification purposes)
• Nationality and country of residence
• Government-issued identification documents (e.g., Malaysian National Identity Card (MyKad), passport)
• Chosen username and encrypted password credentials

• Email address
• Mobile telephone number
• Residential address (for KYC and correspondence purposes)
• Communication preferences (e.g., marketing opt-in/opt-out status)

• Deposit and withdrawal transaction records
• Payment method identifiers (e.g., bank account reference numbers, e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX)
• Transaction amounts and timestamps in MYR and where applicable in cryptocurrency (BTC, USDT)
• Wagering and betting history
• Bonus activation and fulfilment records

• IP address and geolocation data (country/city level)
• Device type, operating system, and browser information
• Session timestamps, page view logs, and navigation behaviour
• Game activity logs, including games played, stakes placed, and outcomes
• Login and logout timestamps

• Customer support chat transcripts and email correspondence
• Survey and feedback responses submitted voluntarily
• Dispute and complaint records

• Self-imposed deposit limits, loss limits, and session limits
• Self-exclusion requests and cooling-off period records
• Responsible gambling assessment responses where provided

SPD88 collects personal data through the following channels and mechanisms:

SPD88 processes personal data only where a valid legal basis exists under applicable data protection law. The following table sets out the primary processing purposes and their corresponding legal bases:

Where processing is based on consent (e.g., marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

SPD88 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the circumstances described below, and only to the minimum extent necessary:

SPD88 engages third-party service providers who process personal data on our behalf as Data Processors under contractual data processing agreements. These include: identity verification providers; payment processors and banking partners (including operators of DuitNow, FPX, Touch 'n Go eWallet, and other supported Malaysian payment rails); fraud and AML screening services; IT infrastructure and hosting providers; customer support platform operators; and analytics service providers.

SPD88 may disclose personal data to regulatory authorities, law enforcement agencies, courts, or other government bodies where required to do so by applicable law, a court order, or a lawful regulatory requirement — including disclosures required under our international licensing framework or under applicable AML legislation.

In the event of a merger, acquisition, corporate restructuring, or sale of all or a substantial part of SPD88's business assets, personal data may be transferred to the acquiring entity as part of that transaction. Members will be notified of any such transfer and any material change to the applicable privacy regime in advance.

SPD88 uses cookies and similar tracking technologies to operate the platform effectively, personalise the user experience, and gather analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for platform functionality, including session management, authentication, and security features. These cookies cannot be disabled without materially affecting platform usability.
• Performance & Analytics Cookies: Used to collect anonymous statistical data about how Members interact with the platform — including pages visited, features used, and session duration — to improve platform performance and user experience.
• Functional Cookies: Enable personalisation features, such as remembering language preferences, display settings, and responsible gambling limit preferences.
• Marketing & Targeting Cookies: Used to deliver relevant promotional content to Members who have opted in to marketing communications. These cookies are activated only with your prior consent.

You can manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the availability or performance of some platform features.

SPD88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention principles apply:

• Active Account Data: Retained throughout the active lifetime of a Member's Account plus a minimum of five (5) years following permanent Account closure, in accordance with AML and licensing record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of collection or from the date of the last transaction, whichever is later, in accordance with applicable AML legislation.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Retained for three (3) years from the date of the relevant communication, unless required longer for ongoing dispute resolution.
• Marketing Consent Records: Retained for the duration of the consent plus three (3) years, to evidence compliance in the event of a regulatory inquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

SPD88 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security measures in place include:

• Transport Layer Security (TLS) / SSL encryption for all data transmitted between your device and SPD88's servers
• Encryption of sensitive data at rest, including KYC documentation and payment information
• Role-based access controls ensuring that personal data is accessible only to authorised personnel with a legitimate operational need
• Regular security assessments, penetration testing, and vulnerability scanning of platform infrastructure
• Secure, segregated data storage environments for player funds records
• Multi-factor authentication requirements for internal administrative systems accessing personal data
• Formal incident response procedures for detecting, reporting, and managing personal data breaches

In the event of a personal data breach that poses a risk to affected individuals, SPD88 will notify affected Members and relevant regulatory authorities in accordance with applicable legal requirements and within the timeframes prescribed by applicable data protection law.

SPD88 operates within an international infrastructure and may transfer personal data to data processors or service providers located outside of Malaysia and outside of the European Economic Area (EEA). Such transfers are conducted only where appropriate safeguards are in place, including:

• Adequacy decisions by relevant data protection authorities recognising the recipient jurisdiction's data protection standards
• Standard contractual clauses (SCCs) or equivalent data transfer mechanisms binding the recipient to data protection standards equivalent to those applicable in the originating jurisdiction
• Binding corporate rules applicable to intra-group transfers

For Malaysian users: transfers of personal data outside of Malaysia are conducted in accordance with the PDPA 2010 and any applicable data transfer notifications or approvals. SPD88 takes all reasonable steps to ensure that personal data transferred internationally receives a level of protection consistent with Malaysian law requirements.

Subject to applicable data protection law — including the Malaysian PDPA 2010 and internationally aligned GDPR principles — you have the following rights in relation to your personal data held by SPD88:

• Right of Access: You may request a copy of the personal data SPD88 holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. For standard profile data, you can make corrections directly via your Account settings.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you may request deletion of your personal data. Note that this right is subject to limitations where processing is required for legal compliance, AML obligations, or the establishment, exercise, or defence of legal claims.
• Right to Restrict Processing: You may request that SPD88 suspend processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Objections to direct marketing will be honoured immediately and unconditionally.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please submit a written request to our Data Protection Officer. Contact details are provided in Section 14. SPD88 will respond to verified requests within thirty (30) days of receipt. We may require identity verification before processing a data subject rights request to protect against fraudulent requests.

The SPD88 platform is strictly intended for adults aged 21 years and above. SPD88 does not knowingly collect, process, or retain personal data from individuals under 21 years of age.

If SPD88 becomes aware — through KYC verification, third-party reporting, or any other means — that personal data has been collected from an individual under 21, the relevant Account will be immediately suspended, all associated data will be reviewed, and the matter will be handled in accordance with applicable child protection and data protection obligations.

If you are a parent or guardian and believe that a minor under your care has registered an Account on SPD88, please contact our support team immediately via live chat or email so that appropriate action can be taken without delay.

SPD88 reserves the right to update or amend this Privacy Policy at any time. Material changes — including changes to processing purposes, new categories of data collected, or changes affecting Member rights — will be communicated to registered Members via email notification and/or in-Platform notification at least fourteen (14) days prior to the effective date of the change.

The effective date of the current version of this Policy is stated at the top of the page. Continued use of the SPD88 platform following notification of a material amendment constitutes acceptance of the revised Policy. If you do not accept a material amendment, you must close your Account and cease using the platform before the amendment's effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy or to SPD88's data processing practices, please contact our Data Protection Officer through the following channels. The email address below is displayed as plain text and is not a clickable link:

• Data Protection Email: [email protected] (plain text — not a clickable link)
• General Support Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the SPD88 Platform interface
• WhatsApp: Available 24/7 — reachable via the Platform contact section
• Support Languages: English, Bahasa Melayu, and Chinese

Malaysian Members who consider that their data protection rights under the PDPA 2010 have been infringed may also direct complaints to the relevant authority under Malaysian law.

SPD88 is committed to resolving privacy-related inquiries and complaints promptly. We will acknowledge receipt of a formal complaint within five (5) business days and aim to provide a substantive response within thirty (30) days.