Privacy Policy cyl8 — Personal Data Protection for Malaysia Members

Cyl8 is an online betting platform that places member trust at the core of its operations. This Privacy Policy is designed to give you a clear and transparent understanding of how we handle your personal data — from the moment you register through every subsequent interaction on the platform.

We understand that privacy is not merely a technical requirement — it is a fundamental right of every user. That is why cyl8 has built a data management system that prioritises data minimisation, collecting only what is strictly necessary to deliver the best service to you.

This policy covers all cyl8 service channels, including the main website, Android and iOS mobile apps, customer support systems, and any related services we provide. Where a specific service has additional privacy terms, these will be stated separately and should be read alongside this document.

Cyl8 collects personal data across several key categories depending on the type of interaction you have with the platform. Here is a summary of the data types we collect and their purposes:

We do not collect sensitive data such as health information, political views, or religious beliefs unless required by applicable law.

Every piece of data we collect has a clear and legitimate purpose. cyl8 does not use your personal data for purposes unrelated to platform operations. Here are the primary ways we use your information:

• Account Management: Create and maintain your account, process registration, and verify identity through the required KYC process.
• Transaction Processing: Manage deposits, withdrawals, bonuses, and all financial activity within your account securely and accurately.
• Platform Security: Detect and prevent fraud, money laundering, multiple account usage, and any suspicious activity that could harm the platform or other members.
• Service Improvement: Analyse usage patterns in aggregate (not individually) to enhance the gaming experience, platform speed, and customer support quality.
• Account-Related Communications: Send important notifications regarding your account, security, transactions, and policy changes that require your attention.
• Personal Promotions: Offer relevant bonuses and promotions based on your gaming activity, subject to your chosen marketing communication preferences.
• Legal Compliance: Fulfil legal obligations, including mandatory reporting to relevant authorities.

Cyl8 will only use your data for purposes to which you have given consent, or where we have a legitimate interest or legal obligation to do so.

Cyl8 does not sell, rent, or share member personal data with third parties for their own marketing purposes. However, within the context of legitimate operations, there are limited situations where your data may be shared:

• Payment Service Providers: Payment gateways and banks that process your deposit and withdrawal transactions receive only the information required to complete the transaction.
• KYC Service Providers: Third-party identity verification companies we engage to meet anti-money laundering (AML) compliance requirements.
• Technical Service Providers: Hosting companies, CDN providers, and technical infrastructure providers that support platform operations, bound by strict confidentiality agreements.
• Legal Requirements: When required by court order, regulatory authority directive, or applicable law — cyl8 will disclose only the minimum data necessary.
• Platform Protection: In cases of fraud or serious security threats, relevant information may be shared with law enforcement agencies.

Cyl8 continuously invests in the latest security infrastructure to ensure your personal data is always protected. The security measures we implement cover multiple layers of defence:

• Data Encryption in Transit: All communications between the app and servers are protected by TLS 1.3 and 256-bit SSL encryption, ensuring data cannot be intercepted.
• Data Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 algorithms, ensuring data remains unreadable even if servers are accessed without authorisation.
• Layered Access Controls: Only authorised staff with a clear operational need are permitted to access member data. All access is logged and monitored automatically.
• Periodic Vulnerability Scanning: The cyl8 security team conducts regular penetration testing and vulnerability scans to detect and address any system weaknesses.
• Two-Factor Authentication (2FA): cyl8 provides and encourages the use of 2FA for all member accounts as an effective additional layer of security.
• Automatic Backup: Member data is automatically backed up to multiple secure locations to ensure data availability and resilience.

Cyl8 uses cookies and similar tracking technologies to enhance your experience on our platform. Here are the types of cookies we use and their functions:

• Essential Cookies: Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collect aggregate information on how members use the platform to help us identify areas requiring improvement. This data does not identify individuals.
• Functional Cookies: Save your preferences such as language, region, and display settings so you do not need to reconfigure them each time you use the platform.
• Analytics Cookies: Helps us understand platform usage patterns for the purpose of product and service improvement. This analytics data is processed in aggregate form.

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality and your experience on the cyl8 platform. Detailed instructions for managing cookies can be found in your browser's documentation.

As a cyl8 member, you have clear rights regarding your personal data. cyl8 is committed to respecting and facilitating the exercise of these rights:

To exercise any of the above rights, contact the cyl8 support team via live chat on the platform or our support email. We will process your request within 14 business days.

Cyl8 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable law.

• Active Account Data: Retained for the duration your account is active and for the designated period following account closure to meet compliance requirements.
• Financial Transaction Records: Retained for a minimum of seven years in accordance with financial compliance and anti-money laundering requirements.
• Security Logs: Retained for 12 months for fraud detection and security investigation purposes where required.
• Support Communication Records: Retained for three years for service quality purposes and historical complaint reference.
• KYC Data: Retained in accordance with applicable legal requirements, typically between five to seven years after the business relationship ends.

Once the relevant retention period has expired, your personal data will be securely deleted or anonymised so it can no longer be linked to you as an individual.

Cyl8 takes seriously ensuring that this platform is not accessed by individuals under the age of 18. Our platform is designed exclusively for adults, and we take proactive steps to prevent use by minors.

• The registration process requires strict age verification through a KYC mechanism.
• Cyl8 does not knowingly collect personal data from individuals under the age of 18.
• If we find that someone under the age of 18 has registered, the account will be closed immediately and all related data will be deleted.
• Parents or guardians who suspect their child is using this platform are urged to contact our customer support immediately.

Cyl8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. We are committed to notifying you of any material changes.

• Material amendments will be communicated via in-platform notifications and the registered email address at least 14 days before taking effect.
• The "Updated" date at the top of this document will always reflect the date of the latest revision.
• Continued use of the platform after amendments take effect will be deemed acceptance of the updated policy.
• Previous versions of this Privacy Policy can be requested from our customer support team for historical reference.

We encourage you to review this Privacy Policy periodically to ensure you are always informed of how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, our team is ready to assist.

For data rights requests (access, correction, deletion), please clearly state the type of request, your full name and registered email, and any relevant details so we can process your request faster and more accurately.