8fafa Privacy Policy

This Privacy Policy ("Policy") describes how 8fafa ("Company", "we", "us", "our"), operator of the online gaming and sports betting platform at https://8fafa.cam ("Platform"), collects, uses, stores, discloses, and protects personal data relating to users of the Platform ("User", "Player", "you").

8fafa is committed to protecting the privacy and personal data of all players, including those based across Malaysia — from Kuala Lumpur and Petaling Jaya to Penang, Johor Bahru, and Shah Alam. We handle personal data responsibly, in line with applicable data protection principles, and we maintain transparent practices so you always know how your information is being used.

By registering an Account or accessing the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact us to request Account closure.

For the purposes of this Policy, the following definitions apply:

8fafa collects the following categories of personal data from Players, either directly or through automated means during Platform use:

• Full legal name as it appears on your national identity document
• Date of birth (used to verify age eligibility — 21 years and above)
• Malaysian National Identity Card (MyKad) or passport number
• Residential address (including city, state, and postcode)
• Email address and mobile phone number

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method used (e.g., Maybank, CIMB, Touch 'n Go eWallet, DuitNow, GrabPay, FPX, Boost)
• Account balance history
• Cryptocurrency wallet addresses where crypto deposits are used
• Bank account or e-wallet reference details provided during withdrawal requests

• Game session history, bet records, and outcomes
• Sports betting selections including Liga Super Malaysia, EPL, and other markets
• Bonus usage records, loyalty tier status, and cashback credits
• Responsible gambling settings including deposit limits, loss limits, and self-exclusion history

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session login and logout timestamps
• Platform interaction data including pages visited and features used

• Records of live chat, email, and support ticket interactions with 8fafa Customer Support
• Survey responses and feedback submitted voluntarily

Personal data is collected through the following channels:

• Direct submission: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting Support, or submitting forms on the Platform.
• Automated collection: Technical and device data collected automatically when you access the Platform, including via cookies, web beacons, and server logs.
• Third-party sources: Identity and address verification data received from KYC verification partners and payment processors in connection with anti-fraud and anti-money-laundering obligations.
• Public sources: Where legally permitted, publicly available information used to supplement identity verification (e.g., publicly accessible records).

8fafa processes personal data on one or more of the following legal bases:

8fafa processes your personal data for the following purposes:

• Account management: Registering, verifying, and maintaining your Account, including identity and age verification.
• Service delivery: Providing access to casino games, sports betting markets, live dealer tables, and all other Platform features.
• Payment processing: Facilitating deposits and withdrawals via Malaysian payment providers and cryptocurrency networks.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, and unauthorised Account access.
• Regulatory compliance: Meeting anti-money laundering, age verification, and other legal obligations imposed on the Company.
• Responsible gambling: Monitoring gaming activity to identify potential problem gambling behaviour and applying appropriate safeguards where indicated.
• Customer support: Responding to enquiries, resolving disputes, and processing complaints efficiently.
• Marketing communications: Sending promotional offers, bonus notifications, and product updates to players who have consented to receive such communications.
• Platform improvement: Analysing usage patterns and performance data to enhance the Platform experience for Malaysian players.

8fafa does not sell, rent, or trade your personal data to third parties. We may share personal data with the following categories of recipient only to the extent strictly necessary:

Personal and financial data is shared with Malaysian payment processing partners — including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX — solely to process deposits and withdrawals. Each payment provider operates under its own privacy and security framework.

KYC and identity verification data may be shared with accredited third-party verification service providers to fulfil our age verification and anti-money laundering obligations. These providers are contractually bound to process data only for the specified purpose and to maintain appropriate security standards.

Technical data may be processed by cloud infrastructure providers, analytics platforms, and cybersecurity services engaged by 8fafa. All such providers operate under data processing agreements that restrict their use of data to the provision of services to 8fafa.

8fafa will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, court order, or regulatory direction. We will endeavour to notify you of such disclosures where permitted to do so.

8fafa retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following general retention principles apply:

• Active Accounts: Personal data is retained for the duration of the Account relationship and for a minimum of five (5) years following Account closure, in line with anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years from the date of the transaction.
• Communication Records: Support interactions and correspondence are retained for three (3) years from the date of the last interaction.
• Marketing Data: Consent records and marketing preference data are retained for the duration of the consent plus two (2) years to demonstrate compliance.
• KYC Documents: Identity documents submitted during verification are retained for five (5) years following Account closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

8fafa implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and the 8fafa Platform is protected using 256-bit SSL/TLS encryption. Look for the HTTPS protocol and padlock indicator in your browser address bar.
• Encryption at rest: Sensitive personal and financial data stored on 8fafa servers is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All staff with data access are subject to confidentiality obligations.
• Two-factor authentication: 8fafa supports and encourages the use of two-factor authentication on all Player Accounts as an additional layer of security.
• Intrusion detection: Continuous monitoring systems detect and alert on suspicious access patterns, potential breaches, and anomalous activity.
• Regular security audits: 8fafa conducts periodic security assessments and penetration testing of Platform infrastructure.

While 8fafa takes all reasonable steps to protect your data, no internet transmission or electronic storage system can be guaranteed to be 100% secure. In the event of a data security incident affecting your personal data, we will notify you in accordance with applicable legal requirements.

The 8fafa Platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and gather analytics data that helps us improve the Platform.

You can manage or disable non-essential cookies through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Please note that disabling certain cookies may affect the functionality of the Platform. Instructions for managing cookies are available in your browser's help section.

The Platform may display content sourced from third-party game providers and may utilise third-party infrastructure for payment processing, analytics, and security monitoring. Each third-party service provider operates under its own privacy policy and data protection framework.

8fafa does not include external third-party advertising networks or social media tracking pixels on the Platform. Any third-party services engaged by 8fafa are subject to contractual data processing agreements that limit data use to the provision of services to 8fafa and prohibit the independent use of your personal data for the third party's own purposes.

Players are advised to review the privacy policies of any external services they interact with independently, including their chosen bank or e-wallet provider when processing transactions with 8fafa.

Subject to applicable data protection law and certain statutory exceptions, you have the following rights in relation to your personal data held by 8fafa:

You may request a copy of the personal data 8fafa holds about you, together with information about how and why it is being processed. We will respond to verified access requests within 30 days.

If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. You may update certain information directly in your Account Settings. For data that cannot be self-corrected, contact Support to request rectification.

You may request the deletion of your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent (where consent is the lawful basis); or the data has been unlawfully processed. This right is subject to exceptions, including where 8fafa is required to retain data to comply with legal obligations (such as AML record-keeping requirements).

You may request that 8fafa restricts the processing of your personal data in certain circumstances — for example, while a rectification request is pending, or where you have objected to processing and the outcome is under review.

Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a structured, commonly used, machine-readable copy of the personal data you have provided to 8fafa.

You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, in which case 8fafa will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

To exercise any of the above rights, please contact our Data Support team via live chat or by emailing us at the address listed in Section 16. We may need to verify your identity before processing your request. We aim to acknowledge all rights requests within 5 business days and to respond substantively within 30 days.

The 8fafa Platform is strictly intended for use by adults aged 21 years and above. We do not knowingly collect or process personal data from any individual under the age of 21.

If 8fafa discovers or is informed that personal data has been collected from an individual under the age of 21, we will take immediate steps to close the associated Account, delete the personal data, and refund any deposits where applicable.

If you are a parent or guardian and believe that a minor has accessed the Platform and provided personal data, please contact us immediately via the details in Section 16. We will act promptly to investigate and remediate.

In the course of operating the Platform, personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, 8fafa ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses requiring the recipient to apply equivalent data protection standards.
• Transfer only to jurisdictions that maintain adequate data protection frameworks recognised by applicable authorities.
• Regular review of data transfer arrangements to ensure ongoing compliance with evolving data protection standards.

If you have concerns about the international transfer of your personal data, please contact us using the details in Section 16.

8fafa reserves the right to update this Privacy Policy at any time. Where changes are material, we will notify registered players via a notice on the Platform or by email to the address registered on your Account, with reasonable advance notice of the effective date.

The "Last updated" date at the top of the Table of Contents sidebar reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy.

If you do not agree with any change to this Policy, please cease using the Platform and contact us to request Account closure and erasure of your personal data where applicable.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 8fafa, please contact us through the following channels:

• Support Email: [email protected] (plain text only — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, via the Platform
• Languages: Enquiries accepted in English, Bahasa Melayu, and Mandarin

We aim to acknowledge all privacy-related enquiries within 2 business hours and to resolve substantive matters within 30 days. Where your concern is complex or requires extended investigation, we will keep you informed of progress throughout.

If you are not satisfied with 8fafa's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.