vag88 Privacy Policy

1. Data Controller Identity

This Privacy Policy is issued by the operator of the vag88 platform accessible at vag88.asia ("vag88", "we", "us", "our"). vag88 is the data controller responsible for the personal data collected through the Platform and through any communications you have with us.

This Policy applies to all personal data collected from individuals who access or use the vag88 website, mobile-optimised site, and any gaming, promotional or support services provided through a vag88 Account (together, the "Platform").

For the purposes of the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards, vag88 processes personal data in accordance with the seven data protection principles: general, notice, disclosure, security, retention, data integrity and access.

2. Personal Data We Collect

2.1 Registration Data

When you open a vag88 Account, we collect the following information which you provide directly:

• Full legal name as it appears on your identity document;
• Date of birth (used for age verification — all members must be 21 or above);
• Email address;
• Mobile phone number;
• Residential address;
• Username and encrypted password (passwords are stored as salted hashes and are never accessible in plain text by vag88 staff).

2.2 Identity Verification (KYC) Data

To comply with international gaming authority requirements and to verify your age and identity, we may collect copies of:

• Malaysian Identity Card (MyKad) or passport;
• Proof of address documents (utility bill, bank statement dated within 90 days);
• Payment method verification documents where required by our fraud prevention processes.

2.3 Financial Data

We collect information necessary to process your deposits and withdrawals, including:

• Payment method details (Touch n Go eWallet ID, Boost account reference, bank account number, bank name);
• Transaction history including deposit amounts, withdrawal requests, dates and processing status;
• Bonus and wagering activity records.

vag88 does not store full card numbers or full bank account credentials. Financial data is processed through certified payment gateway partners subject to PCI-DSS compliance.

2.4 Technical & Usage Data

We automatically collect certain technical data when you access the Platform:

• IP address and approximate geolocation (country/city level);
• Device type, operating system and browser version;
• Session duration, pages visited, features used and betting activity;
• Cookie identifiers and similar tracking data (see Section 8).

2.5 Communications Data

Records of communications between you and vag88 support, including live chat transcripts, email correspondence and any documents submitted as part of a support request or dispute, are retained for quality assurance and compliance purposes.

3. How We Collect Your Data

vag88 collects personal data through the following channels:

• Directly from you — when you register an Account, complete KYC, make a deposit or withdrawal, contact support, or participate in a promotion;
• Automatically through the Platform — via cookies, web beacons, server logs and similar technologies when you browse or use the Platform (see Section 8);
• From third-party verification services — identity and age verification providers engaged by vag88 to assist with KYC compliance;
• From payment service providers — transaction confirmation and fraud screening data from Touch n Go, Boost, Maybank and other payment partners.

4. Purpose & Legal Basis for Processing

vag88 processes your personal data for the following purposes and under the following legal bases:

• Contract performance — processing your Account registration, deposits, bets, withdrawals and support requests is necessary to fulfil the contractual relationship between you and vag88 under our Terms and Conditions;
• Legal obligation — KYC, age verification, anti-money laundering checks and regulatory reporting are required by the international gaming authority under whose licensing vag88 operates, and by applicable Malaysian law;
• Legitimate interests — fraud detection, platform security monitoring, responsible gaming risk assessment, and Platform analytics are processed on the basis of vag88's legitimate interests in maintaining a secure and compliant platform;
• Consent — marketing communications, personalised promotions and non-essential cookies are processed only where you have given your express consent, which you may withdraw at any time.

5. Data Sharing & Disclosure

vag88 does not sell or rent your personal data. We may share your data with the following categories of recipients only where necessary and subject to appropriate data protection agreements:

• Payment service providers — Touch n Go, Boost, Maybank, CIMB, Public Bank and other payment partners for the processing of deposits and withdrawals;
• Identity verification providers — third-party KYC and age verification services engaged under data processing agreements;
• Game content providers — casino game studios and sportsbook data providers receive only the minimum data required to process game rounds and settle bets;
• Regulatory and law enforcement authorities — vag88 may be required to disclose data to gaming regulators, financial intelligence units, tax authorities or law enforcement agencies in accordance with applicable legal obligations;
• Professional advisers — legal, audit and compliance advisers engaged by vag88, subject to professional confidentiality obligations.

All third-party service providers engaged by vag88 are subject to contractual obligations requiring them to process personal data only for the specified purpose and to maintain security standards at least equivalent to those applied by vag88.

6. International Data Transfers

vag88's primary data infrastructure is hosted in secure data centres operating under international gaming authority jurisdictional requirements. Certain operational functions — including game studio integrations and payment processing — may involve the transfer of limited personal data to systems located outside Malaysia.

Where such transfers occur, vag88 ensures that appropriate safeguards are in place, including contractual data protection clauses equivalent to those required under the Malaysian PDPA and applicable international standards. vag88 will not transfer personal data to jurisdictions without adequate data protection frameworks without implementing the required safeguard mechanisms.

7. Data Retention

vag88 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following retention standards:

• Active Account data — retained for the duration of the Account relationship plus 7 years following Account closure, in compliance with anti-money laundering record-keeping requirements;
• KYC and identity documents — retained for 5 years following the completion of the KYC process or Account closure, whichever is later;
• Transaction records — retained for 7 years in accordance with financial record-keeping requirements;
• Support communications — retained for 2 years from the date of the communication;
• Marketing consent records — retained until consent is withdrawn or the Account is closed.

Following the applicable retention period, personal data is securely deleted or anonymised in accordance with vag88's data destruction procedures.

8. Cookies & Tracking Technologies

8.1 Types of Cookies Used

The vag88 Platform uses the following categories of cookies and similar technologies:

• Strictly Necessary Cookies — required for the Platform to function, including session management, login authentication and security. These cookies cannot be disabled.
• Performance & Analytics Cookies — used to understand how members use the Platform, identify technical issues and improve Platform performance. Activated only with your consent.
• Functionality Cookies — remember your preferences such as language settings and game lobby filters. Activated only with your consent.
• Marketing Cookies — used to deliver relevant promotional content and measure the effectiveness of marketing campaigns. Activated only with your express consent.

8.2 Managing Cookies

You may manage cookie preferences through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the vag88 Platform. Marketing and analytics cookies require your consent and can be withdrawn through your Account settings.

9. Your Data Protection Rights

As a vag88 member whose personal data we process, you have the following rights under the Malaysian Personal Data Protection Act 2010 and applicable international data protection standards:

• Right of Access — you may request a copy of the personal data vag88 holds about you;
• Right to Correction — you may request that inaccurate or incomplete personal data be corrected;
• Right to Withdraw Consent — where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing;
• Right to Restrict Processing — in certain circumstances, you may request that we restrict processing of your data while a dispute is investigated;
• Right to Data Portability — you may request that data you have provided be supplied to you in a structured, commonly used format;
• Right to Erasure — subject to legal retention obligations, you may request deletion of your personal data.

To exercise any of these rights, contact vag88 Data Protection at: [email protected]

Requests will be acknowledged within 5 business days and actioned within 30 days. Where a request is complex or involves a large volume of data, vag88 may extend this period by a further 30 days with written notice.

10. Children's Privacy

The vag88 Platform is strictly for persons aged 21 and above. vag88 does not knowingly collect personal data from persons under 21. If you believe that a person under 21 has registered or is using a vag88 Account, please contact support immediately.

Upon receiving a verified notification that personal data has been collected from a person under 21, vag88 will immediately close the Account, void all transactions, return any deposited funds to the original payment source and permanently delete all personal data associated with that Account.

11. Security Measures

vag88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration or destruction:

• 256-bit AES encryption for all data stored at rest;
• TLS 1.3 encryption for all data transmitted between your browser and vag88 servers;
• Multi-factor authentication requirements for all internal systems with access to member data;
• Role-based access controls ensuring that staff access only the data necessary for their specific function;
• Regular independent security audits and penetration testing;
• Automated anomaly detection systems monitoring for unusual access patterns or data exfiltration attempts.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, vag88 will notify affected members without undue delay and in accordance with applicable regulatory notification requirements.

12. Marketing Communications

vag88 may send you promotional emails, SMS notifications and in-Platform messages about new games, bonuses, loyalty programme updates and special offers where you have provided consent to receive such communications at registration or through your Account settings.

You may opt out of marketing communications at any time by: (a) updating your communication preferences in your vag88 Account settings; or (b) contacting vag88 support and requesting removal from marketing lists. Opt-out requests will be processed within 5 business days. Opting out of marketing will not affect transactional communications necessary for Account management, including deposit confirmations, withdrawal notifications and security alerts.

13. Changes to This Privacy Policy

vag88 may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements or Platform functionality. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

Material changes to this Policy will be communicated to members via email to the registered Account address or via a prominent notice on the Platform at least 14 days before the changes take effect. Continued use of the Platform following notification of material changes constitutes your acknowledgement of the revised Policy. If you do not accept a material change, you should contact vag88 to close your Account before the effective date.

14. Contact & Complaints

For any questions, concerns or requests relating to this Privacy Policy or the processing of your personal data by vag88, please contact our Data Protection team:

Email: [email protected]

Live Chat: Available 24/7 through the vag88 Platform after signing in to your Account.

vag88 aims to respond to all privacy-related enquiries within 5 business days. If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction or to the gaming regulatory body under whose authority vag88 operates.