Privacy Policy

01 Introduction

change88 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all individuals who access or use our website at https://change88.cam and any associated services ("the Platform"). This Privacy Policy ("Policy") sets out how change88 collects, processes, stores, shares, and protects personal information in connection with your use of our services.

This Policy applies to all registered Players, prospective users who browse the Platform, and any individuals who communicate with our support team. By accessing the change88 Platform or registering an Account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, each of which forms part of the contractual framework governing your relationship with change88.

02 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, device identifier, location data, and financial information.
• "Processing" means any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means change88, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of change88 under a data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" means identity verification documents and associated information collected for Know Your Customer compliance purposes, including national identity cards (MyKad), passports, and proof of address.
• "Transaction Data" means financial records associated with deposits, withdrawals, and betting activity on the Platform, including MYR amounts, payment method identifiers, and timestamps.
• "Cookie" means a small text file placed on your device by the Platform to store preference, session, and behavioural data.

03 Personal Data We Collect

change88 collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity & Contact Data

Full Name Date of Birth MyKad / Passport Number Email Address Phone Number Residential Address

This data is collected at account registration and during KYC verification. We use it to confirm your identity, verify that you meet the minimum age requirement of 21 years, and comply with anti-money laundering obligations.

3.2 Financial & Transaction Data

Deposit Amounts (MYR) Withdrawal Records Payment Method Identifiers Bank Account Details E-Wallet Identifiers Cryptocurrency Wallet Addresses

Financial data is processed to facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels. This data is also used for AML monitoring and fraud prevention.

3.3 Account & Activity Data

Username Login Timestamps Betting History Game Session Data Bonus Redemption Records Support Interaction Logs

3.4 Technical & Device Data

IP Address Device Type & Model Browser Type & Version Operating System Geolocation (country/region level) Session Duration

Technical data is collected automatically when you access the Platform and is used for security monitoring, fraud detection, and platform performance optimisation.

3.5 Responsible Gambling Data

Deposit Limit Settings Self-Exclusion Records Cooling-Off Period Records Problem Gambling Risk Indicators

This data is processed exclusively for player protection purposes and is never used for marketing or profiling in a manner contrary to a player's interests.

04 How We Collect Your Data

change88 collects personal data through the following channels:

• Direct submission: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting our support team, or responding to surveys and promotions.
• Automated collection: Technical and device data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access the Platform.
• Third-party providers: Identity verification data received from KYC service providers; transaction data received from payment processors including DuitNow, FPX gateway operators, and e-wallet providers such as Touch 'n Go, Boost, and GrabPay; fraud risk data from specialist screening services.
• Public sources: In limited circumstances, change88 may supplement account data with information from publicly available sources for the purpose of AML compliance or fraud prevention.

05 Purpose & Legal Basis for Processing

change88 processes your personal data on one or more of the following legal bases:

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. See Clause 10 for details on exercising your rights.

06 Data Sharing & Disclosure

change88 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your data with the following categories of recipients, solely to the extent necessary for the purposes identified in Clause 5:

6.1 Service Providers (Data Processors)

We engage third-party service providers to assist in operating the Platform, including payment processors (DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency gateway providers), KYC verification providers, IT infrastructure and hosting providers, customer support platform operators, and fraud screening services. All such providers are contractually required to process data only on our instructions and in accordance with appropriate data protection standards.

6.2 Game Content Providers

Some game session data, including bet amounts and game results, may be shared with our third-party game content providers for the purpose of game outcome verification and dispute resolution. These providers do not receive your identity or contact data unless required for regulatory compliance.

6.3 Regulatory & Law Enforcement Authorities

change88 may be required to disclose personal data to governmental authorities, financial intelligence units, or law enforcement agencies in response to a valid legal order, court order, or regulatory requirement. We will notify affected Players of such disclosure to the extent permitted by law.

6.4 Corporate Transactions

In the event of a merger, acquisition, asset sale, or corporate restructuring affecting change88, personal data may be transferred to the acquiring or successor entity. Players will be notified of any such transfer and the relevant privacy terms applicable thereafter.

07 Cookies & Tracking Technologies

change88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. They cannot be disabled without disrupting Platform functionality.
• Functional Cookies: Store your preferences such as language settings, display preferences, and recently viewed games, so that the Platform adapts to your typical usage pattern across sessions.
• Analytics Cookies: Collect aggregated, anonymised data about how Players interact with the Platform — including pages visited, session duration, and navigation paths — to help us identify usability issues and improve the user experience.
• Security & Fraud Prevention Cookies: Help us detect and prevent fraudulent activity, including detection of multiple Accounts, unusual login patterns, and automated bot activity.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent you from logging into your Account or using certain Platform features. change88 does not use third-party advertising or behavioural tracking cookies.

08 Data Retention

change88 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with any individual.

09 Data Security

change88 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in transit: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive personal data, including identity documents and financial records, is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, governed by role-based access control policies and multi-factor authentication requirements.
• Network security: Our infrastructure is protected by firewalls, intrusion detection systems, and DDoS mitigation controls operated at our hosting facilities.
• Vulnerability management: Regular security assessments, penetration testing, and patch management cycles are conducted to identify and remediate security vulnerabilities.
• Incident response: change88 maintains a documented data breach response plan. In the event of a personal data breach that poses a material risk to Players, affected individuals will be notified without undue delay.

While we apply industry-standard security measures, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your Account credentials and for ensuring that your device and network connection are secure when accessing the Platform.

10 Your Data Rights

Subject to applicable law, you hold the following rights in respect of your personal data processed by change88. To exercise any of these rights, please contact our Data Privacy team via the channels listed in Clause 15.

• Right of Access: You have the right to request a copy of the personal data that change88 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (see Clause 8). Note that AML and KYC data may be required to be retained regardless of a deletion request.
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain circumstances — for example, where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that your data be provided to you in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your data where it is based on legitimate interests or for direct marketing purposes. Upon receipt of a valid objection to direct marketing, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing prior to withdrawal.

change88 will respond to all verified data rights requests within 30 calendar days. We may extend this period by a further 60 days in cases of complexity, subject to providing you with notice and reasons for the extension. We reserve the right to request identity verification before processing any data rights request.

11 Children & Minors

change88 is strictly an adult platform. The Platform is intended for use by individuals aged 21 years and above only. We do not knowingly collect personal data from anyone under the age of 21.

If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete such data, close the associated Account, and where required by our responsible gambling obligations, report the matter to our compliance team.

If you are a parent or guardian and believe that a minor has accessed the Platform or submitted personal data to change88, please contact us immediately at [email protected] so that we can take appropriate action without delay.

change88 implements age verification controls at the point of registration and through KYC procedures specifically to prevent access by underage individuals. We take this obligation seriously as part of our broader responsible gambling commitments. See our Responsible Gambling page for further information.

12 International Data Transfers

change88 operates under international licensing and may store or process your personal data in countries outside of Malaysia. In particular, our server infrastructure, KYC service providers, and certain game content providers may be located in jurisdictions with different data protection laws from those in force in Malaysia.

Where personal data is transferred internationally, change88 takes the following measures to ensure appropriate protection:

• Transfers to service providers are governed by data processing agreements that impose obligations equivalent to applicable data protection standards.
• We conduct due diligence on all international processors to assess their security practices and data protection compliance prior to engagement.
• Where a transfer involves a jurisdiction that does not provide an adequate level of data protection, we implement appropriate contractual safeguards.

By using the Platform, you acknowledge and consent to the international transfer of your personal data in accordance with this Policy.

13 Third-Party Links & Services

The change88 Platform may contain references to or integrations with third-party services, including payment providers and game content platforms. This Policy applies solely to personal data collected and processed by change88. It does not extend to the data practices of third-party service providers operating their own platforms.

When you interact with a third-party payment gateway — such as initiating a DuitNow transfer, FPX payment, or Touch 'n Go eWallet transaction — you are subject to that provider's own privacy policy in respect of data processed by them. change88 is not responsible for the privacy practices of third-party service providers.

We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of change88.

14 Amendments to This Policy

change88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The date of the most recent revision is indicated in the "Last Updated" field at the top of this page.

Where changes to this Policy are material — for example, where we introduce a new category of personal data processing or a new purpose — we will provide advance notice to registered Players via the Platform interface or by email to the address registered on your Account, no less than 14 days prior to the changes taking effect.

For minor amendments (such as clarifications or typographical corrections), the updated Policy will be published without advance notice. Continued use of the Platform following any amendment constitutes your acceptance of the revised Policy. If you do not agree with an amendment, you should cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

15 Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our Data Privacy team through the following channels. Note that our email address is provided as plain text for reference only.

• Data Privacy Enquiries (Email): [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request – [Your Username]" as applicable. We aim to respond within 5 business days.
• Live Chat Support: Available 24/7 via the Platform interface. For data rights requests, our live chat team can direct you to the appropriate form and process.
• Formal Written Requests: For formal data rights requests (access, erasure, portability), please submit in writing via email with identity verification documents attached. We will acknowledge receipt within 2 business days and respond substantively within 30 calendar days.

change88 takes data privacy seriously. All enquiries are handled with discretion, and any personal data submitted as part of a privacy enquiry will be used solely for the purpose of responding to your request.