Privacy Policy — RZP88

RZP88 ("we", "us", "our", "Platform") is committed to protecting the privacy and personal data of all individuals who access or use the RZP88 online gaming platform at rzp88.cam, including registered players, prospective players, and visitors to our website (collectively, "you", "User", "Data Subject").

This Privacy Policy ("Policy") sets out in full detail the basis on which we collect, process, store, share, and protect personal data in connection with your use of the RZP88 platform and its associated services. It also explains your rights with respect to your personal data and how you may exercise those rights.

This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform. By registering an account or continuing to use RZP88, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of this Policy, the following terms shall carry the meanings set out below:

RZP88 collects personal data across several categories depending on your level of engagement with the Platform. We apply the principle of data minimisation — we collect only what is necessary for the purposes described in this Policy.

RZP88 collects personal data through the following channels and mechanisms:

• Direct Submission: Information you provide when registering an account, completing the KYC verification process, submitting a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data collected automatically when you access and use the Platform, including IP addresses, device identifiers, session data, and behavioural analytics gathered via server logs and platform instrumentation.
• Payment Providers: Confirmation data returned by Malaysian payment processors including FPX, DuitNow, and e-wallet providers following a transaction. RZP88 does not receive full payment card numbers; tokenised references are used where applicable.
• Identity Verification Partners: Where third-party KYC and age verification services are engaged to assist in verifying the authenticity of documents submitted during registration, those providers may supply verification outcome data to RZP88.
• Cookies and Tracking Technologies: Session cookies, persistent cookies, and similar technologies deployed on the Platform as described in Section 9 of this Policy.
• Third-Party Fraud Detection Services: Transaction monitoring and fraud prevention tools may provide risk scoring or alert data associated with your account activity.

We process your personal data only where we have a valid legal basis for doing so. The table below sets out the primary purposes for which we process personal data and the corresponding legal basis in each case.

RZP88 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with RZP88, plus a minimum of five (5) years following account closure to satisfy AML and regulatory record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission, as required under applicable anti-money laundering frameworks. Where a regulatory investigation is pending, retention may be extended until the conclusion of that investigation.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction to comply with financial record-keeping obligations.
• Customer Support Records: Live chat transcripts and support correspondence are retained for three (3) years from the date of the interaction, unless a longer period is required in connection with an ongoing dispute or investigation.
• Marketing Consent Records: Records of consent or opt-out for promotional communications are retained for the duration of account relationship plus three (3) years to demonstrate compliance.
• Technical and Usage Logs: Server logs and session data are typically retained for up to twelve (12) months, with aggregated anonymised analytics retained indefinitely.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in a manner that prevents reconstruction of the original personal data.

RZP88 does not sell, lease, or trade your personal data to any third party for their own commercial purposes. We may share personal data with the categories of third parties described below, strictly on a need-to-know basis and subject to binding data protection obligations.

• Payment Service Providers: Malaysian and international payment processors (including FPX network participants, DuitNow operators, Touch 'n Go, Boost, and GrabPay) receive transaction data necessary to execute your deposit and withdrawal instructions.
• KYC and Identity Verification Providers: Third-party identity verification and age-checking services receive identification documents and biometric data for the purpose of verifying your identity and confirming compliance with our 21+ age requirement.
• Fraud Prevention and AML Partners: Transaction monitoring and risk analysis providers receive relevant account and transaction data to identify and prevent fraudulent activity and money laundering.
• Game Content Providers: Third-party game studios and live casino operators may receive session identifiers and anonymised game data necessary to deliver certified game content. These providers do not receive full identity data.
• Cloud Infrastructure and Hosting Providers: Secure cloud infrastructure providers host Platform data under contractual data processing agreements that require compliance with applicable data protection standards.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to competent authorities where required by applicable law, court order, or lawful regulatory request. We will, where legally permissible, endeavour to notify affected users prior to such disclosure.
• Professional Advisers: Legal counsel, auditors, and other professional advisers engaged by RZP88 may access personal data on a confidential basis where necessary for the provision of their professional services.

RZP88 operates internationally and may transfer personal data to third-party service providers whose servers or operations are located outside Malaysia. Such transfers may occur in connection with our cloud hosting infrastructure, identity verification services, and payment processing partnerships.

Where personal data is transferred outside Malaysia, RZP88 takes reasonable steps to ensure that the recipient jurisdiction and the relevant recipient organisation provide an adequate level of data protection. Safeguards we employ include:

• Execution of standard contractual data processing agreements with all international data processors that impose data protection obligations equivalent to those applicable to RZP88;
• Transfer of personal data only to jurisdictions assessed as providing an adequate level of data protection;
• Encryption of data in transit using 256-bit SSL/TLS protocols for all international data flows.

By using the RZP88 Platform, you acknowledge and consent to the transfer of your personal data in the circumstances described in this Section, subject to the safeguards outlined above.

RZP88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the Platform from operating correctly. RZP88 does not use third-party advertising or retargeting cookies.

RZP88 implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data exchanged between your device and RZP88 servers is encrypted via TLS 1.2 or higher (256-bit SSL). This applies to all Platform pages, API communications, and payment flows.
• Encryption at Rest: Sensitive personal data stored in our databases — including identity documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to RZP88 personnel and authorised processors who require it to perform their specific role. Access is governed by role-based permissions and logged for audit purposes.
• Two-Factor Authentication: Administrative access to systems holding personal data requires multi-factor authentication. Players are strongly encouraged to enable 2FA on their individual accounts.
• Penetration Testing and Security Audits: The Platform undergoes regular third-party security assessments, including penetration testing, to identify and remediate vulnerabilities.
• Data Breach Response: RZP88 maintains a documented data breach response procedure. In the event of a breach that is likely to result in risk to your rights and freedoms, we will notify affected individuals without undue delay and in accordance with applicable regulatory requirements.

No security system is entirely impenetrable. While we make every effort to protect your personal data, we cannot guarantee absolute security. You play an important role in protecting your own data by maintaining the confidentiality of your account credentials and notifying us promptly of any suspected unauthorised account access.

As a Data Subject, you have the following rights with respect to the personal data we hold about you. These rights are subject to applicable legal exceptions and may be limited in certain circumstances, such as where processing is required for legal compliance or the prevention of fraud.

To exercise any of these rights, please contact our Data Protection team via live chat or email at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 72 hours and provide a substantive response within 30 calendar days. We may require identity verification before processing your request to ensure data is not disclosed to an unauthorised party.

The RZP88 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory component of the account registration and KYC process, and we take robust steps to enforce this restriction.

If we become aware that personal data has been collected from an individual under the age of 21 — whether through a registration error, a fraudulent age declaration, or any other means — we will immediately suspend the relevant account, delete or quarantine all associated personal data to the extent permitted by our legal obligations, and forfeit any balance held in that account in accordance with our Terms & Conditions.

The RZP88 Platform may contain references to or integrations with third-party services, including payment gateways and game content providers. These third parties operate their own independent privacy policies and data handling practices, for which RZP88 accepts no responsibility.

When you interact with a third-party payment interface — for example, when completing a DuitNow transfer or authorising a Touch 'n Go eWallet transaction — you are subject to that provider's own terms and privacy policy in addition to this Policy. We recommend reviewing the privacy policies of all payment providers you use in connection with your RZP88 account.

RZP88 takes care to partner only with reputable, regulated service providers, and we require all third-party processors to maintain data protection standards consistent with those applied by RZP88 under this Policy.

RZP88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the services we offer. The version number and effective date displayed at the top of this document indicate the currently applicable version.

Where amendments are material — meaning they substantially affect how we collect, use, or share your personal data — we will provide advance notice of the changes via email to your registered address and by posting a prominent notice on the Platform for a minimum of 14 days prior to the changes taking effect.

Your continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgment of and agreement to the updated terms. We encourage you to review this Policy periodically to remain informed of our data handling practices. The most current version is always accessible at rzp88.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data we hold about you, please reach out through the following channels:

We acknowledge all data-related enquiries within 72 hours and aim to resolve them fully within 30 calendar days. For formal data subject access requests or erasure requests, identity verification will be required before we can process the request.

For questions about our responsible gambling tools and player protection policies, please visit our Responsible Gambling page. For the full terms governing your use of the Platform, please refer to our Terms & Conditions.