Privacy Policy PH8 — Protection Data You

PH8 is an online gaming platform built to serve the entertainment needs of members in Malaysia. We understand that your trust is our most valuable asset, and much of that trust depends on how carefully and responsibly we manage your personal data.

This Privacy Policy applies to all information we collect through the ph8 website, mobile app, interactions with our customer support team, and any other communication channels provided by ph8. It covers all data categories — from basic registration details to detailed platform usage data.

We also want you to know that this Privacy Policy is updated from time to time to reflect changes in law, technology, or how we operate. The latest version is always available on this page, and the date of the last update will be clearly noted.

PH8 only collects data that is strictly necessary for defined purposes. We do not collect excessive data or data unrelated to the platform's operational requirements. Below are the categories of data we collect and the purposes for which they are collected:

We also collect information you provide voluntarily, such as feedback via survey forms or participation in promotional programmes. All such data collection is carried out with your explicit consent and for the stated purposes.

The data we collect is used solely for legitimate purposes relevant to the operation of the ph8 platform. We do not use your data for unrelated purposes without obtaining fresh consent from you. The following are the primary ways we use your personal data:

• Account Management: Creating, verifying, and maintaining your member account including the KYC process required by regulators.
• Transaction Processing: Processing all deposits, withdrawals, and other financial transactions securely and accurately.
• Platform Security: Detecting and preventing fraudulent activity, hacking, or system abuse that could compromise your security and that of other members.
• Customer Support: Providing relevant and effective assistance when you contact our support team.
• Service Communications: Sending important notifications related to your account, transactions, system updates, and policy changes.
• Responsible Gaming: Monitoring usage patterns to identify signs of problem gambling and offering appropriate assistance.
• Regulatory Compliance: Meeting legal obligations including AML reporting and other applicable compliance requirements.
• Service Improvement: Analysing usage patterns in aggregate and anonymised form to improve the platform's user experience.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), ph8 processes your personal data on a valid legal basis. It is important for you to understand this basis as it determines your rights regarding that data:

• Consent: For most data processing, we rely on the explicit consent you provide during registration or when using certain platform features.
• Contract: Data processing required to fulfill the agreement between you and PH8, including transaction processing and account management.
• Legal Obligation: Data that must be processed to comply with applicable laws, including AML requirements and regulatory reporting.
• Legitimate Interest: Processing required for PH8's legitimate interests such as platform security, fraud prevention, and service improvement, as long as it does not override your fundamental rights.

You have the right to withdraw your consent at any time for processing based on consent. However, this withdrawal does not affect the validity of any processing that took place prior to it.

PH8 does not sell, rent, or share your personal data with third parties for their own marketing purposes. However, there are specific situations where data sharing is necessary for the continued operation of the platform:

• Service Providers: Companies that help us operate, such as technology infrastructure providers, payment service providers, and KYC service providers. All such providers are bound by strict confidentiality agreements.
• Regulatory Authority: When required by law or directed by a legitimate regulatory authority, PH8 will disclose the necessary information.
• Anti-Fraud Authority: In cases of suspected fraud or money laundering, relevant information may be shared with law enforcement agencies.
• Business Transfers: In the event of a merger, acquisition, or asset transfer, member data may be transferred to the new entity subject to equivalent privacy protections.

PH8 invests seriously in security infrastructure to protect your personal data from unauthorized access, loss, destruction, or accidental disclosure. The security measures we implement cover multiple layers of protection:

• Data Encryption in Transit: All communications between your device and PH8's servers are encrypted using TLS 1.3 protocol with 256-bit SSL encryption.
• Data Encryption at Rest: Sensitive data stored in our databases, including financial information and identity documents, is encrypted using AES-256.
• Multi-Factor Authentication: Two-factor authentication is available for all member accounts to add an extra layer of security.
• Continuous Monitoring: A threat detection system operates 24/7 to identify and respond to any suspicious activity in real time.
• Internal Access Controls: A least-privilege access principle is enforced — staff may only access data that is strictly necessary for their role.
• Security Audit: Independent security assessments are conducted periodically by external experts to identify and address any potential vulnerabilities.
• Disaster Recovery Plan: A robust backup system ensures your data remains safe even in the event of an unexpected technical failure.

While we take all reasonable precautions, no system can be guaranteed 100% secure. It is important that you also play your part in keeping your account safe by using a strong password and not sharing it with anyone.

PH8 does not retain your personal data longer than necessary for its defined purposes. Our retention periods are determined based on operational requirements, legal obligations, and the platform's legitimate interests:

• Active Account Data: Retained for as long as your account is active and for the required period after account closure for regulatory purposes.
• Financial Transaction Records: Retained for 7 years in compliance with Malaysia's anti-money laundering laws and financial reporting requirements.
• KYC Documents: Retained for 5 to 7 years after account closure in accordance with applicable regulatory requirements.
• Support Communication Logs: Retained for 2 years for quality control and dispute resolution purposes.
• Technical Log Data: Retained for 90 days for security and technical troubleshooting purposes.

Once the retention period has expired, data will be securely deleted or anonymized so that it can no longer be linked to you personally. This deletion process is carried out using methods that meet internationally recognized information security standards.

PH8 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. They help us provide you with a better and more secure experience.

The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information about how you use the platform — such as the most frequently visited pages — to help us improve our services. All information is collected anonymously.
• Functional Cookies: Allows the platform to remember your preferences such as language, display settings, and other choices to deliver a more personalised experience.
• Security Cookies: Used to detect and prevent fraudulent activity, keeping your session secure at all times.

You can manage your cookie settings through your browser at any time. However, disabling certain cookies may affect platform functionality. ph8 cookie lifespans range from session-only to a maximum of 12 months depending on the cookie type.

Under Malaysia's Personal Data Protection Act 2010, you have several important rights regarding your personal data held by ph8. We are committed to ensuring all these rights can be exercised easily and without undue barriers:

To exercise any of the rights above, please contact our Data Protection team by email at [email protected] or via the platform's live chat. We may require identity verification before processing your request to ensure the security of your data.

PH8 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the way we operate. We are committed to notifying you of any significant changes in a transparent and easy-to-understand manner.

When significant changes are made to this Privacy Policy, PH8 will:

• Sending a notification to your registered email at least 14 days before changes take effect.
• Displaying clear notices on the platform's home page and login page.
• Updating the "Last Updated" date at the top of this Privacy Policy page.
• In cases where changes require new consent, we will obtain your explicit agreement before proceeding.

Your continued use of the PH8 platform after the effective date of any changes will be deemed as your acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request data deletion in accordance with the established procedure.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, PH8's Data Protection Officer (DPO) team is ready to assist you.

You can reach us through the following channels:

• Email: [email protected] — for privacy-related enquiries and data requests
• Live Chat: Available 24/7 via the PH8 platform
• Response Time: We are committed to responding within 5 business days for privacy-related enquiries.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant regulatory authority. We encourage you to contact us first so we can resolve any issues directly and save you time.