Privacy Policy

SMB888 ("we", "us", "our", "the Company", "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with our online casino and sports betting platform, accessible at https://smb888.cam ("the Platform").

This Privacy Policy ("Policy") describes how SMB888 collects, processes, stores, shares, and protects personal information in connection with your registration, use of the Platform, transactions, and communications with our team. It also sets out the rights you hold in relation to your personal data and explains how to exercise those rights.

This Policy applies to all current and former Members, prospective users who have initiated but not completed registration, and individuals who communicate with us via email, live chat, or any other channel. By accessing the Platform or submitting personal information to SMB888, you acknowledge that you have read and understood this Policy.

Throughout this Policy, the following terms carry the meanings assigned to them below:

SMB888 collects Personal Data that is necessary to provide, secure, and improve our services. We collect data in three principal ways: data you provide directly, data generated through your use of the Platform, and data obtained from third parties.

3.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, mobile number, and preferred username and password.
• KYC documentation: Government-issued identity documents (e.g., MyKad, passport), proof of address, and, where required, source of funds declarations.
• Payment information: Bank account numbers, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), FPX/DuitNow account references, and cryptocurrency wallet addresses used for deposits and withdrawals in MYR or other accepted currencies. SMB888 does not store full card numbers or CVV codes.
• Support communications: Messages, complaint submissions, and attachments sent to our customer support team via live chat or email.
• Preference and survey data: Game preferences, marketing opt-in choices, and responses to any voluntary surveys or feedback requests.

3.2 Data Generated Through Platform Use

• Technical data: IP address, browser type and version, device type, operating system, screen resolution, and time zone settings.
• Session data: Login timestamps, session duration, pages visited, features used, and actions taken within the Platform.
• Transaction data: Deposit amounts, withdrawal requests, wager history, game outcomes, bonus activations, and Wallet Balance movements.
• Geolocation data: Approximate geographic location derived from IP address, used for fraud detection and jurisdictional compliance. We do not collect GPS-level precise location data.
• Responsible gambling data: Self-imposed deposit limits, cooling-off periods, session reminders, and self-exclusion requests.

3.3 Data from Third Parties

• Identity verification providers: Results of automated KYC checks conducted through third-party identity verification services.
• Payment processors: Transaction confirmation data and fraud risk signals from payment gateway providers including banks and e-wallet operators.
• Anti-fraud and AML services: Risk scores and watchlist match results from compliance screening partners.

SMB888 processes your Personal Data on one or more of the following legal bases:

SMB888 uses Personal Data collected from Members and users for the following purposes:

• Account administration: Creating, verifying, and maintaining your Member Account, including processing registration, KYC verification, and account updates.
• Transaction processing: Handling deposits and withdrawals in MYR via DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency channels.
• Service delivery: Enabling access to casino games, sports betting markets, live dealer tables, and other Platform features.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent transactions, money laundering, collusion, identity fraud, and unauthorised account access.
• Legal compliance: Meeting our obligations under anti-money laundering (AML), counter-terrorism financing (CTF), and age verification regulations.
• Responsible gambling: Applying self-imposed limits, monitoring for problem gambling indicators, and enforcing self-exclusion requests.
• Customer support: Responding to Member enquiries, complaints, and disputes via live chat and email.
• Platform improvement: Analysing usage patterns and technical performance data to identify and fix issues, optimise user experience, and develop new features.
• Marketing communications: Sending promotional offers, bonus notifications, and news where you have opted in to receive such communications. You may unsubscribe at any time.
• Personalisation: Adapting Platform content and recommendations based on your gaming preferences and account history, where applicable.

SMB888 shares Personal Data only where necessary and only with parties who are contractually obligated to handle it appropriately. Categories of recipients include:

• Payment service providers: Banks, e-wallet operators (Touch 'n Go, Boost, GrabPay), FPX/DuitNow infrastructure providers, and cryptocurrency exchange services — to process your financial transactions.
• Identity verification and KYC providers: Third-party services used to verify identity documents and conduct age and sanctions screening as required by law.
• Fraud and AML compliance vendors: Risk management and compliance screening providers who assist us in meeting our legal obligations.
• Game software providers: Certified iGaming studios and live dealer operators whose games are hosted on the Platform. These providers may receive limited session and wager data necessary to deliver gameplay.
• IT infrastructure and hosting providers: Cloud hosting, content delivery network (CDN), and cybersecurity service providers who process data on our behalf under strict data processing agreements.
• Regulatory and law enforcement authorities: Government bodies, regulators, or law enforcement agencies where we are legally required or permitted to disclose Personal Data.
• Professional advisors: Lawyers, auditors, and accountants under professional confidentiality obligations, where necessary for legitimate business purposes.

All third-party Data Processors engaged by SMB888 are subject to written data processing agreements that restrict their use of Personal Data to the specific purposes for which it was shared and require them to maintain appropriate technical and organisational security measures.

SMB888 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, and improve your experience. The types of cookies we use include:

• Essential cookies: Required for the Platform to function. These enable secure login sessions, maintain your Wallet Balance display, and ensure the Platform operates correctly. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to understand how Members use the Platform — including which pages are visited, which features are used most frequently, and where technical errors occur. This data is aggregated and used to improve the Platform.
• Preference cookies: Store your Platform settings and preferences (e.g., language, display options) so they are retained between sessions.
• Marketing cookies: Used only where you have provided explicit consent, to deliver relevant promotional content and track the effectiveness of our marketing activities. You can opt out at any time.

SMB888 retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention principles are:

• Active account data: Retained for the duration of your Membership and for a minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping obligations.
• Transaction and wager records: Retained for a minimum of five (5) years following the date of the relevant transaction, consistent with financial record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Support communications: Retained for three (3) years from the date of the most recent interaction, unless retention is required in connection with an ongoing dispute or regulatory matter.
• Marketing data: Retained until you withdraw consent or unsubscribe, plus a brief period to honour suppression lists and avoid re-contacting opted-out Members.
• Technical and session logs: Retained for up to twelve (12) months for security monitoring and fraud detection purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

SMB888 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, loss, destruction, or alteration:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using 256-bit Transport Layer Security (TLS/SSL) protocols.
• Encryption at rest: Sensitive Personal Data stored in our systems, including KYC documents and payment references, is encrypted at rest using industry-standard encryption algorithms.
• Access controls: Access to Personal Data within SMB888 is restricted on a strict need-to-know basis. Staff with access to Member data are subject to confidentiality obligations and regular security training.
• Two-factor authentication (2FA): Available for all Member Accounts. We strongly recommend enabling 2FA to protect your account against unauthorised access.
• Security monitoring: Continuous monitoring of our systems for unusual activity, intrusion attempts, and data access anomalies.
• Penetration testing: Regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.

As a Member or user of the SMB888 Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact our Data Privacy team using the details in Section 15.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data. For basic account data, you can update most information directly from within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Note that data subject to mandatory retention periods (e.g., AML records) cannot be erased before the expiry of those periods.
• Right to Restriction of Processing: You may request that we restrict processing of your data in certain circumstances — for example, where you contest its accuracy pending verification.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdrawal of Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

SMB888 will respond to verified rights requests within thirty (30) days of receipt. In complex cases, we may extend this period by a further thirty (30) days, with prior notification. We do not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

The SMB888 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain Personal Data from individuals under 21 years of age.

All registration submissions are subject to age verification. Where we have reasonable grounds to believe that an Account has been created by or on behalf of a minor, we will immediately suspend the Account, conduct a verification review, and permanently close the Account if the suspicion is confirmed. Any funds associated with such an Account will be handled in accordance with applicable legal requirements.

If you are a parent or guardian and believe that your child has registered on the SMB888 Platform, please contact us immediately at [email protected]. We will take prompt action to investigate and close any such account.

The operation of the SMB888 Platform may involve the transfer of Personal Data to servers or service providers located outside Malaysia. Such transfers may occur in connection with our cloud hosting infrastructure, identity verification providers, or game software partners.

Where Personal Data is transferred internationally, SMB888 takes appropriate safeguards to ensure that the receiving party provides a level of data protection equivalent to that applied by SMB888 itself. These safeguards may include contractual clauses, data processing agreements, and adequate destination country assessments.

The SMB888 Platform may contain references to third-party payment methods and services (such as Touch 'n Go eWallet, DuitNow, or FPX infrastructure providers). Where you interact with these third-party services, their own privacy policies govern the collection and use of your data by those parties. SMB888 is not responsible for the privacy practices of third-party providers.

We recommend reviewing the privacy policies of any third-party payment or identity verification service you use in connection with your SMB888 Account.

SMB888 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable law. Material changes to this Policy will be communicated to Members via email notification or a prominent on-site notice prior to the changes taking effect.

The "Last reviewed" date at the top of this Policy will always reflect the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following notification of changes constitutes your acknowledgement of the updated Policy.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a data privacy concern, please contact the SMB888 Data Privacy team through any of the following channels:

When submitting a data subject rights request by email, please include your registered username, a clear description of your request, and any supporting information that will help us process your request efficiently. We may need to verify your identity before fulfilling the request to protect against unauthorised access to account data.