ekplus8 Privacy Policy

01 Scope & Data Controller

This Privacy Policy applies to all personal data collected by ekplus8 through the ekplus8.lat website and platform, including the casino lobby, sportsbook, account management system, live chat support, and all associated services (collectively, the "Platform").

ekplus8 acts as the data controller in respect of the personal data described in this Policy. As data controller, ekplus8 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted in accordance with applicable data protection obligations.

This Policy should be read in conjunction with ekplus8's Terms & Conditions. By registering an Account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

02 Personal Data We Collect

ekplus8 collects personal data through several means: directly from you during registration and account management; automatically through your use of the Platform; and from third parties in connection with KYC verification and fraud prevention. The categories of data collected are described below.

ekplus8 does not knowingly collect sensitive personal data such as biometric data, health data, or religious beliefs unless specifically required for responsible gaming compliance and only with your explicit consent.

03 Legal Basis for Processing

ekplus8 processes your personal data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and ekplus8, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC obligations under anti-money laundering requirements and responsible gaming obligations under ekplus8's Licensing Authority.
• Legitimate interests: Processing for ekplus8's legitimate business interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your privacy rights.
• Consent: Processing for purposes such as direct marketing or non-essential analytics, where you have provided your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

04 How We Use Your Personal Data

ekplus8 uses your personal data for the following purposes:

• Creating and managing your ekplus8 Account, including authentication and access control.
• Processing MYR deposits and withdrawals via Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, and other supported payment methods.
• Conducting KYC and identity verification prior to your first withdrawal and at any subsequent point required by our AML obligations.
• Delivering games and sportsbook services, including personalising game recommendations based on your activity history where you have consented.
• Administering bonus and promotional offers, including verifying eligibility and tracking wagering requirement fulfilment.
• Providing customer support via live chat and email, including maintaining records of support interactions for quality assurance.
• Administering responsible gaming tools, including deposit limits, session timers, and self-exclusion processing.
• Detecting and preventing fraud, cheating, money laundering, and other prohibited activity on the Platform.
• Complying with legal and regulatory reporting obligations to ekplus8's Licensing Authority and other competent authorities.
• Sending transactional communications including payment confirmations, account security alerts, and policy update notifications.
• Where consent has been given: sending promotional communications about ekplus8 offers and new games relevant to your preferences.

05 Cookies & Tracking Technologies

ekplus8 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for Platform operation, including session management, authentication, and security. These cannot be disabled without affecting Platform functionality.
• Performance cookies: Collect anonymised data about how Players use the Platform (e.g., pages visited, session duration) to help ekplus8 improve user experience. These are only deployed with your consent.
• Functional cookies: Remember your preferences such as language settings, preferred game categories, and login state where "Remember Me" has been selected.
• Analytics cookies: Help ekplus8 understand aggregate usage patterns for product development and service improvement. Analytics data is not linked to personally identifiable information without your consent.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to use the ekplus8 Platform. Your consent preferences for non-essential cookies can be updated at any time through the cookie settings accessible on the Platform.

06 Third-Party Data Sharing

ekplus8 does not sell, rent, or trade personal data. We share personal data with third parties only in the following limited circumstances:

• Payment processors: Financial data is shared with payment processing partners (including e-wallet operators and banking partners) solely to facilitate deposits and withdrawals.
• KYC and identity verification providers: Identity and verification data is shared with third-party KYC service providers who perform verification on ekplus8's behalf under strict data processing agreements.
• Game providers: Gameplay data necessary for game delivery may be shared with certified game studios whose products are available on ekplus8. Game providers do not receive financial or identity data beyond what is necessary for the delivery of their game.
• Fraud prevention and security providers: Technical and behavioural data may be shared with fraud detection services for the purpose of detecting and preventing prohibited activity on the Platform.
• Regulatory authorities: ekplus8 may share data with its Licensing Authority, financial intelligence units, or law enforcement agencies where required by law or a valid legal process.
• Professional advisers: Legal, accounting, and compliance advisers may access personal data where necessary for the provision of their professional services, subject to confidentiality obligations.

07 International Data Transfers

ekplus8's servers and data processing infrastructure may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, ekplus8 ensures that appropriate safeguards are in place, including:

• Transfers to jurisdictions recognised as providing an adequate level of data protection.
• Use of standard contractual clauses or equivalent data transfer mechanisms with recipient entities.
• Compliance with the international data transfer requirements of ekplus8's Licensing Authority.

By using the ekplus8 Platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia. ekplus8 will not make international transfers that materially reduce the protections described in this Policy.

08 Data Retention

ekplus8 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention requirements:

• Account and identity data: Retained for the duration of the Account and for a minimum of five (5) years following Account closure, in compliance with AML and KYC record-keeping obligations.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity data: Retained for a minimum of three (3) years for responsible gaming monitoring and dispute resolution purposes.
• Support communications: Retained for two (2) years from the date of the last interaction.
• Technical and log data: Retained for up to twelve (12) months for security and fraud investigation purposes.

After the applicable retention period, personal data is securely deleted or anonymised in accordance with ekplus8's data disposal procedures.

09 Security Measures

ekplus8 implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data in transit between your device and ekplus8 servers.
• Encryption of sensitive data at rest, including identity documents and financial data.
• Role-based access controls limiting personal data access to authorised personnel on a need-to-know basis.
• Multi-factor authentication requirements for ekplus8 staff accessing personal data systems.
• Regular security assessments and penetration testing of the Platform infrastructure.
• Incident response procedures, including notification protocols for any data breach that may affect your rights.

No data transmission over the internet can be guaranteed to be completely secure. While ekplus8 takes every reasonable measure to protect your data, we cannot guarantee absolute security. In the event of a data breach materially affecting your rights, ekplus8 will notify you as required by applicable law.

10 Your Data Rights

Subject to applicable legal limitations, you have the following rights in respect of your personal data held by ekplus8:

• Right of access: Request a copy of the personal data ekplus8 holds about you, including the purposes for which it is processed.
• Right to rectification: Request correction of inaccurate or incomplete personal data without undue delay.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data where it is no longer necessary for the purpose collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to ekplus8's legal retention obligations.
• Right to restrict processing: Request that ekplus8 restrict the processing of your data in certain circumstances, such as while an accuracy challenge is being resolved.
• Right to data portability: Receive your personal data in a structured, machine-readable format where processing is based on consent or contract.
• Right to object: Object to processing based on legitimate interests, including profiling and direct marketing. Where you object to direct marketing, ekplus8 will cease that processing immediately.
• Right to withdraw consent: Withdraw consent for any consent-based processing at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact ekplus8 at [email protected] (plain text — not a clickable link). ekplus8 will respond to all data rights requests within thirty (30) calendar days. Where a request is complex or numerous, this period may be extended by a further sixty (60) days, and you will be notified accordingly.

11 Children's Privacy

The ekplus8 Platform is strictly for persons aged 21 years and above. ekplus8 does not knowingly collect personal data from any individual under the age of 21. Where ekplus8 becomes aware that personal data has been submitted by a person under 21, the relevant Account will be suspended and the data will be deleted in accordance with our legal obligations.

If you believe that a minor has registered an ekplus8 Account or submitted personal data to ekplus8, please contact support immediately at [email protected].

12 Amendments to this Policy

ekplus8 may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. Material changes will be communicated to registered Players via email to the registered address and/or via a prominent Platform notification not less than 14 days prior to the effective date.

The date of the most recent revision is stated at the top of this Policy. Your continued use of the ekplus8 Platform following the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not accept a material change, you may request Account closure prior to the effective date.

13 Contact & Data Enquiries

For all privacy-related enquiries, data rights requests, or to report a privacy concern, please contact ekplus8's data team:

ekplus8 takes privacy complaints seriously. If you are not satisfied with ekplus8's response to a privacy concern, you may refer the matter to the relevant data protection authority or to ekplus8's Licensing Authority's player complaints process.