Privacy Policy

This Privacy Policy ("Policy") is published by api288 ("we", "us", "our", or "the Company"), the operator of the online gaming platform available at api288.lat ("Platform"). api288 serves registered players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout the country.

We take the privacy and security of your personal data seriously. As a regulated online gaming operator, we are required by applicable law and our licensing obligations to collect certain categories of personal information. This Policy explains what that information is, the purposes for which we use it, how long we retain it, and the rights you have in relation to it.

This Policy applies to all users of the Platform, including registered account holders and visitors who browse the Platform without registering. By accessing or using api288, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described here, you should not use the Platform.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated into our overall regulatory framework.

The following defined terms apply throughout this Privacy Policy:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifier, or any factor specific to that individual's identity.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, erasure, or destruction.
• "Data Controller" — api288, the entity that determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Subject" — The natural person (i.e., you, the Player) to whom Personal Data relates.
• "KYC Data" — Identity and verification documents collected as part of the Know Your Customer process, including government-issued identification and proof of address.
• "Payment Data" — Information relating to deposits and withdrawals, including payment method identifiers, transaction IDs, and account ownership evidence for methods such as Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, and Hong Leong Bank.
• "Technical Data" — Data automatically collected when you access the Platform, including IP address, device type, operating system, browser, and session activity logs.
• "Consent" — Freely given, specific, informed, and unambiguous agreement by the Data Subject to the Processing of their Personal Data for a stated purpose.

api288 collects Personal Data in the following categories. The specific data points collected depend on your level of engagement with the Platform — casual visitors, registered Players, and VIP account holders are subject to different collection scopes.

We do not knowingly collect sensitive personal data beyond what is strictly required for KYC compliance and responsible gambling monitoring (for example, self-exclusion status constitutes health-related data under some frameworks and is handled with the highest level of protection).

api288 processes your Personal Data for the following defined purposes only. We do not process Personal Data for any purpose that is incompatible with the purposes listed below without your prior consent:

1. Account Creation and Management: To register your Account, verify your identity through KYC procedures, maintain your account profile, and administer your ongoing relationship with api288 as a registered Player.
2. Financial Transaction Processing: To process deposits and withdrawals in MYR via your chosen payment method — including Touch 'n Go eWallet, DuitNow, FPX, and Malaysian bank transfers — and to maintain accurate transaction records for accounting and regulatory purposes.
3. Regulatory Compliance and AML Monitoring: To fulfil our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and licensing regulations, including transaction monitoring, source-of-funds verification, and reporting to competent authorities where legally required.
4. Responsible Gambling: To monitor gaming activity, identify indicators of problem gambling behaviour, administer self-exclusion requests, enforce deposit limits, and communicate with Players who may be at risk.
5. Fraud Prevention and Platform Security: To detect and prevent fraudulent activity, bonus abuse, multi-accounting, bot usage, and other prohibited conduct as defined in our Terms & Conditions.
6. Customer Support: To respond to your queries, complaints, and requests submitted via live chat or email, and to maintain records of support interactions for quality assurance and dispute resolution purposes.
7. Service Improvement and Analytics: To analyse anonymised or aggregated usage data for the purpose of improving Platform performance, game selection, and user experience. Individual profiling for marketing purposes is not conducted without your explicit consent.
8. Promotional Communications: To send you promotional offers, bonus notifications, and Platform updates where you have opted in to receive such communications. You may withdraw consent for marketing communications at any time via your Account settings.

api288 relies on the following legal bases for processing your Personal Data, depending on the specific processing activity:

• Contractual Necessity — Processing required to perform the contract between you and api288, including Account management, payment processing, and gaming service delivery. Without this data, we cannot provide the services described in our Terms & Conditions.
• Legal Obligation — Processing required to comply with applicable laws and regulations, including KYC identity verification, AML transaction monitoring, and reporting obligations imposed by our regulatory licensing.
• Legitimate Interests — Processing necessary for our legitimate interests as a gaming operator, including fraud prevention, platform security, and responsible gambling monitoring, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent — Processing for which we have obtained your freely given, specific, and informed consent, including marketing communications and optional data analytics features. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

api288 does not sell, rent, or trade your Personal Data to third parties. We share Personal Data only in the following circumstances and with the following categories of recipients:

• Payment Service Providers: We share necessary transaction data with our verified Malaysian payment partners — including Touch 'n Go eWallet, GrabPay, Boost, DuitNow, FPX, and partner banks (Maybank, CIMB, Public Bank, RHB, Hong Leong) — to the extent required to process your deposits and withdrawals. These providers are contractually bound to handle your data securely and only for the specified transaction purpose.
• Identity Verification Providers: KYC data including identity documents and selfie images may be shared with regulated third-party identity verification service providers who assist us in fulfilling our regulatory verification obligations.
• Game Studio Partners: Anonymised and aggregated gaming activity data may be shared with our licensed game studio partners for technical and game performance purposes. No personally identifiable data is shared with game studios for marketing use.
• Regulatory and Law Enforcement Authorities: We may disclose Personal Data to competent authorities — including financial intelligence units, licensing regulators, or law enforcement agencies — where we are legally required to do so or where disclosure is necessary to prevent or detect serious crime or regulatory breach.
• Professional Advisors: In limited circumstances, Personal Data may be disclosed to legal counsel, auditors, or compliance consultants acting in a professional advisory capacity, who are bound by professional confidentiality obligations.

api288 retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any applicable legal, accounting, or reporting obligations. The following retention periods apply as a general guide:

After the applicable retention period expires, Personal Data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is used, the resulting anonymous data is no longer subject to this Policy and may be retained and used indefinitely for analytical and statistical purposes.

api288 implements appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the api288 Platform is encrypted using industry-standard SSL/TLS protocols, preventing interception by third parties.
• Data Encryption at Rest: Sensitive Personal Data stored in our databases — including identity documents and payment method details — is encrypted using strong cryptographic standards.
• Access Controls: Access to Personal Data within api288 is restricted to personnel who have a legitimate need for that information in the performance of their duties. All staff with data access are subject to confidentiality obligations.
• Regular Security Audits: Our platform infrastructure and data handling practices are subject to periodic security assessments and penetration testing by qualified third parties.
• Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, api288 has procedures in place to assess the breach, contain it, and notify affected individuals and relevant authorities in accordance with applicable legal requirements.

api288 uses cookies and similar tracking technologies on the Platform to ensure the proper functioning of the website, enhance your user experience, and support our security and analytics functions. A cookie is a small text file placed on your device when you visit the Platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable core features such as session management, Account login state, and security token validation. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: These cookies remember your preferences and settings — such as language preference, deposit limit configurations, and game category filters — to improve your experience on return visits.
• Analytics Cookies: We use anonymised analytics data to understand how Players interact with the Platform, which pages are visited most frequently, and where improvements can be made. This data is aggregated and does not identify individual users.
• Security Cookies: These cookies help detect and prevent fraudulent access, bot traffic, and multi-accounting by monitoring session behaviour and device fingerprinting patterns.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform, including your ability to log in or access certain features.

Subject to applicable data protection laws and our regulatory obligations, you hold the following rights in relation to your Personal Data processed by api288. You may exercise these rights by contacting us via the channels set out in Section 13 of this Policy.

api288 will respond to all rights requests within 30 days of receipt. In cases of complex or high-volume requests, we may extend this period by an additional 30 days, in which case we will notify you of the extension and the reasons for it. Some rights are subject to exceptions under applicable law — for example, we cannot erase data we are legally required to retain under AML regulations.

api288 is strictly a platform for adults aged 21 years and above. We do not knowingly collect Personal Data from persons under the age of 21. Age verification is a mandatory component of our KYC process — all registered Players must provide valid government-issued identification (such as a Malaysian MyKad or passport) confirming that they meet the minimum age requirement before any withdrawal, significant deposit, or promotional redemption is processed.

If api288 becomes aware that Personal Data has been collected from a person under the age of 21 — or that a registered Account is being operated by such a person — we will immediately suspend the Account, reverse any related transactions to the extent possible, and securely delete any associated Personal Data in excess of what is required to document the breach and ensure it is not repeated.

Parents and guardians who believe their minor child may have accessed the api288 Platform should contact our support team immediately via live chat or at support@api288.lat.

api288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our Platform services. When material changes are made, we will notify registered Players via the email address on file and/or by posting a prominent notice on the Platform prior to the change taking effect.

Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acknowledgement of the updated terms. We recommend reviewing this Policy periodically. The effective date and last updated date at the top of this document reflect the currency of the version you are reading.

For any questions, requests, or concerns relating to this Privacy Policy, your Personal Data, or the exercise of your data subject rights, please contact api288 through the following channels:

• Live Chat Support — Available 24 hours a day, 7 days a week through the Platform. Recommended for urgent Account and security matters.
• Email — support@api288.lat — for formal data subject rights requests, privacy complaints, and KYC document submissions. We aim to respond to all email enquiries within 2 business days.
• Coverage Area — api288 serves Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and nationally. All privacy communications are handled in English.

When submitting a data subject rights request by email, please include your full name, Account username, and a clear description of the right you wish to exercise. We may request additional identity verification before processing your request.