Privacy Policy — How pg688 Handles Your Data

This Privacy Policy ("Policy") describes how pg688 ("we", "us", "our", or "the Platform") collects, processes, stores, and protects the personal data of individuals ("you", "User", "Member") who access or use the pg688 online gaming platform at pg688.cam and any associated mobile applications or services.

pg688 is committed to protecting your privacy and handling your personal data responsibly, transparently, and in accordance with applicable data protection law — including, where relevant, Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection principles.

By registering an Account on pg688, accessing the Platform, or otherwise providing us with your personal information, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform immediately.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy. Capitalised terms not defined in this Policy have the meanings given to them in our Terms and Conditions.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, including name, identification number, contact details, financial data, and online identifiers such as IP address.
• "Data Controller" means pg688, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party that processes personal data on behalf of pg688 under written contract and in accordance with this Policy.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, alteration, and deletion.
• "Data Subject" means the individual to whom personal data relates — in most cases, a registered Member of pg688.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the Data Subject of their agreement to the processing of their personal data for a stated purpose.
• "Sensitive Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or data relating to criminal offences or convictions.
• "PDPA" refers to Malaysia's Personal Data Protection Act 2010 and any regulations or guidelines issued thereunder.
• "Cookies" means small data files stored on your device by your web browser when you visit the Platform, which help us provide functionality, remember preferences, and analyse usage patterns.

pg688 collects personal data that is necessary to provide our services, fulfil our legal obligations, and ensure the security and integrity of the Platform. The categories of data we collect are outlined below.

When you create an Account, we collect:

• Full legal name
• Date of birth (to verify you are aged 21 or above)
• Gender (optional)
• Malaysian mobile phone number and/or email address
• Residential address (city, postcode, state — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
• Username and encrypted password hash
• Preferred currency (MYR by default)

As part of our mandatory KYC process, we collect:

• Government-issued identification documents (MyKad, Passport, or Driver's Licence)
• Proof of residential address (utility bills, bank statements dated within 3 months)
• Selfie photograph holding the identity document
• Source of funds documentation (where applicable for large transactions)

To process deposits and withdrawals, we collect:

• Bank account details (account number, bank name — Maybank, CIMB, Public Bank, Hong Leong, etc.)
• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay account reference numbers)
• DuitNow or FPX transaction reference numbers
• Cryptocurrency wallet addresses (for USDT TRC20 transactions)
• Transaction history (deposits, withdrawals, wager amounts, winnings)

We automatically collect the following data when you use the Platform:

• IP address and geolocation data (city/country level)
• Device type, operating system, and browser information
• Session timestamps and duration
• Pages visited, features used, and clickstream data
• Game history and betting activity logs
• Login history and authentication events

When you contact our support team or respond to communications from pg688, we retain:

• Live chat transcripts
• Email correspondence
• Support ticket content and resolution history
• Feedback and survey responses

pg688 collects personal data through the following channels:

• Directly from you: When you register an Account, complete KYC verification, make deposits or withdrawals, contact support, respond to promotions, or interact with any feature of the Platform.
• Automatically: Through cookies, server logs, and tracking technologies that operate when you access the Platform (see Section 10 for full details).
• From third-party payment processors: Transaction confirmation data from payment providers including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency network providers.
• From identity verification providers: Results and outputs from third-party KYC and document verification services engaged by pg688.
• From fraud prevention services: Risk scores, device fingerprinting results, and flagged indicators from fraud detection partners.
• From publicly available sources: Publicly accessible information relevant to regulatory compliance and anti-money laundering due diligence.

pg688 processes your personal data for the specific, explicit purposes set out in the table below. We do not use your data for purposes incompatible with those stated.

pg688 relies on the following legal bases for processing personal data:

• Contractual Necessity: Processing required to fulfil the contract between pg688 and the Member — including account creation, game access, payment processing, and support services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering laws, Know Your Customer obligations, age verification requirements, and licensing conditions.
• Legitimate Interests: Processing necessary for pg688's legitimate business interests where those interests are not overridden by the Member's rights and freedoms — such as fraud prevention, security monitoring, platform analytics, and responsible gambling oversight.
• Consent: Processing based on your explicit, freely given consent — primarily for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

pg688 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share your data only in the circumstances described below, and only to the extent necessary for each stated purpose.

We engage carefully selected third-party service providers who process data on our behalf under binding data processing agreements, including:

• Payment processors: FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and USDT network providers — to process your financial transactions
• Identity verification providers: KYC and document verification services used to authenticate your identity and age
• Fraud prevention and risk management services: To detect, prevent, and investigate suspicious activity
• Cloud infrastructure and hosting providers: For secure data storage and platform operation
• Customer support platforms: Live chat and ticketing systems used by our support team
• Analytics providers: Anonymised or pseudonymised usage data only, for platform performance monitoring

pg688 may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or government bodies where required to do so by applicable law, court order, or regulatory direction. This includes disclosures related to anti-money laundering (AML) investigations, tax reporting obligations, or licensing authority compliance reviews.

In the event of a merger, acquisition, restructuring, or sale of all or part of pg688's business, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and the applicable privacy arrangements in advance, to the extent permitted by law.

Some of pg688's service providers and technical infrastructure are located outside Malaysia. When your personal data is transferred outside of Malaysia to a jurisdiction that may not provide an equivalent level of data protection, pg688 takes appropriate safeguards to ensure that such transfers are conducted lawfully and securely.

These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities
• Data processing agreements incorporating binding data protection obligations
• Transfers only to jurisdictions recognised as providing adequate data protection
• Encryption of data in transit and at rest during cross-border transfers

By using the pg688 Platform, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia as described in this section, subject to the safeguards outlined above.

pg688 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes or enforce agreements. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Data that is the subject of an active legal dispute, regulatory investigation, or court order will be retained until the matter is fully resolved.

pg688 uses cookies and similar tracking technologies to ensure the Platform operates correctly, to remember your preferences, and to gather aggregated analytics about how Members use the service. The table below describes the categories of cookies we use.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing your account or completing transactions. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Safari, Firefox, Edge, or Opera).

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable data protection principles, you have the following rights with respect to your personal data held by pg688. To exercise any of these rights, please submit a written request to [email protected].

pg688 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encryption at rest for sensitive personal data and financial information stored on our servers
• Password hashing using industry-standard algorithms — pg688 staff cannot view your password
• Two-factor authentication (2FA) available for all account logins
• Automated intrusion detection and security monitoring systems operating 24/7
• Regular security audits and penetration testing conducted by independent security professionals
• Access controls ensuring only authorised personnel can access personal data systems, on a need-to-know basis

• All staff with access to personal data undergo data protection training
• Data access is logged and audited on a regular basis
• Confidentiality agreements are in place for all employees and contractors handling personal data
• Data breach response procedures are documented and tested

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, pg688 will notify affected individuals and, where required, the relevant regulatory authority, within the timeframes required by applicable law. Notifications will be made to your registered contact details on file.

The pg688 Platform is strictly an age-restricted service intended solely for individuals aged 21 years and above. pg688 does not knowingly collect, process, or retain personal data from individuals under the age of 21.

Age verification is a mandatory component of the pg688 KYC process. If pg688 discovers that personal data has been collected from an individual who does not meet the minimum age requirement, the relevant Account will be immediately suspended, all data will be reviewed, and the situation will be addressed in accordance with our child safeguarding procedures.

If you believe that a minor has created an Account on pg688 or provided personal data to us, please report it immediately to [email protected] and we will take prompt action.

The pg688 Platform may reference or interface with third-party services — including payment providers (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay), game content providers, and analytics platforms. These third-party services operate under their own privacy policies, which are independent of this Policy.

pg688 is not responsible for the privacy practices or data handling of third-party service providers beyond the contractual data processing obligations we impose on them. We encourage you to review the privacy policies of any third-party service you use in connection with your use of the Platform — in particular, your chosen payment provider.

All third-party Data Processors engaged by pg688 are subject to written data processing agreements that require them to handle personal data only in accordance with pg688's instructions and this Privacy Policy, and to implement appropriate security measures.

pg688 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify Members by:

• Displaying a prominent notice on the Platform homepage for a minimum of 14 days before the changes take effect
• Sending a notification to your registered email address where the changes materially affect your rights or the way we use your data
• Updating the "Last Updated" date at the top of this Policy

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy. If you do not agree with any updated provisions, you may close your Account by contacting our support team at [email protected].

Previous versions of this Privacy Policy are available on request from our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your rights as a Data Subject, or want to raise a privacy-related concern or complaint, please contact pg688 through the following channels:

• Privacy & Data Requests Email: [email protected] — please mark the subject line as "Privacy Request" or "Data Subject Request"
• Live Chat: Available 24 hours a day, 7 days a week including Malaysian public holidays, via the chat widget on the Platform. Please mention "Privacy Query" when initiating the chat.
• Response Commitment: Data subject requests acknowledged within 5 business days; full response within 30 calendar days

pg688 takes all privacy enquiries and complaints seriously. If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant data protection supervisory authority in Malaysia or your jurisdiction of residence.