Privacy Policy — Poka88

Poka88 ("we", "us", "our", "the Company") operates the online gaming and sports betting platform accessible at https://poka88.lat and its associated subdomains and mobile interfaces (collectively, the "Platform"). This Privacy Policy ("Policy") sets out our practices regarding the collection, use, storage, disclosure, and protection of personal data submitted by or collected from users ("you", "User", "Player") of the Platform.

We are committed to handling personal data responsibly, transparently, and in accordance with applicable international data protection standards. By accessing the Platform, registering an account, or making use of any Poka88 service, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms and Conditions and our Responsible Gambling Policy. In the event of any inconsistency between this Policy and any other document on the Platform, this Policy shall prevail in respect of privacy and data protection matters.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Poka88 collects the following categories of personal data, limited to what is necessary for the purposes described in Section 5:

Poka88 collects personal data through the following channels:

4.1 Direct Collection

Data you voluntarily provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, participating in promotions, or updating your account profile. This includes information submitted via the Platform's registration forms, identity verification portals, and support chat interfaces.

4.2 Automated Collection

Technical and usage data collected automatically when you access the Platform, via cookies, server log files, session tracking technology, and similar mechanisms. See Section 10 for full details on cookies and tracking.

4.3 Third-Party Sources

In some cases, we may receive data from third parties, including: identity verification service providers (for KYC checks), payment processors such as DuitNow, FPX, Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank (for transaction confirmation and fraud screening), fraud prevention databases, and publicly available sources (for AML screening purposes only).

Poka88 processes personal data solely for the following purposes:

• Account administration: Creating, maintaining, and operating your Poka88 account, including authentication and session management.
• Payment processing: Facilitating deposits via Malaysian payment channels (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank transfer, Visa/Mastercard, and cryptocurrency) and processing withdrawal requests.
• Regulatory compliance: Fulfilling Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations under the Platform's international licensing framework.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account compromise, money laundering, and other prohibited activities.
• Customer support: Responding to support enquiries, resolving disputes, and maintaining records of communications for quality and compliance purposes.
• Platform improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and user experience.
• Responsible gambling: Monitoring for indicators of problem gambling behaviour, enforcing deposit limits, and facilitating self-exclusion requests.
• Direct communications: Sending service notifications, security alerts, policy updates, and — where you have consented — promotional communications about offers available on Poka88.

Poka88 processes your personal data on the following legal grounds, which correspond to internationally recognised data protection principles:

• Contract performance: Processing necessary to operate your account, process payments in MYR, and deliver the gaming services you have contracted for.
• Legal obligation: Processing required to comply with AML regulations, KYC obligations, and reporting requirements under the Platform's applicable licensing framework.
• Legitimate interests: Processing for fraud prevention, Platform security, and aggregated analytics, where these interests do not override your fundamental privacy rights.
• Consent: Processing for optional purposes such as marketing communications, where we have obtained your explicit consent. You may withdraw consent at any time without affecting prior lawful processing.

Poka88 does not sell, rent, or trade personal data. We share personal data only in the following limited circumstances:

7.1 Service Providers

We engage carefully vetted third-party service providers to process data on our behalf, including payment processors (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency network providers), identity verification services, customer support platform providers, hosting and infrastructure providers, and fraud screening services. All such providers are subject to contractual data processing agreements that prohibit secondary use of your data.

7.2 Legal & Regulatory Disclosure

We may disclose personal data to regulatory authorities, licensing bodies, law enforcement agencies, or courts where we are legally required to do so, including in response to lawful court orders, regulatory investigations, or AML reporting obligations. We will notify you of such disclosures where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Poka88's business, personal data held by the Company may be transferred to the relevant acquiring entity. We will provide reasonable advance notice of any such transfer and ensure that the acquiring entity is bound by equivalent data protection obligations.

As an internationally licensed platform serving users across multiple jurisdictions, Poka88 may process and store personal data on servers located outside Malaysia. Transfers to third countries are conducted only where adequate data protection safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules applicable to group companies;
• Transfers to countries recognised as providing adequate levels of data protection under applicable frameworks.

Where personal data is processed by payment processors operating in Malaysia — including DuitNow, FPX, Touch 'n Go eWallet, Maybank, CIMB, and Public Bank — such processing is governed by those providers' own privacy notices and applicable Malaysian financial regulations.

Poka88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law or regulation. The following indicative retention periods apply:

At the end of the applicable retention period, personal data is securely deleted or anonymised using industry-standard data destruction procedures such that it can no longer be associated with any individual.

Poka88 uses cookies and similar technologies on the Platform. A cookie is a small text file stored on your device when you visit the Platform. We use the following categories of cookies:

10.1 Essential Cookies

Strictly necessary for the Platform to function. These include session cookies that maintain your login state, security tokens, and preference settings. The Platform cannot operate correctly without these cookies, and they do not require your consent.

10.2 Analytics Cookies

Used to collect aggregated, anonymised data about how users interact with the Platform — which pages are visited most frequently, how long sessions last, and where technical errors occur. This data is used exclusively to improve Platform performance and is not linked to individual user profiles for marketing purposes.

10.3 What We Do Not Use

Poka88 does not deploy third-party advertising cookies, social media tracking pixels, or any technology designed to track your behaviour across external websites for the purpose of serving targeted advertising.

Most web browsers allow you to refuse or delete cookies via your browser settings. Disabling essential cookies may impair the functionality of the Platform. Disabling analytics cookies will not affect your ability to use the Platform but will limit our ability to improve the service.

Poka88 implements a comprehensive set of technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS 1.3): All data in transit between your device and the Platform is encrypted using TLS 1.3, the current industry standard for web security.
• Encryption at rest: Sensitive data fields, including identity documents, financial records, and authentication credentials, are encrypted at rest using AES-256 or equivalent algorithms.
• Access controls: Internal access to personal data is restricted on a role-based, least-privilege basis. Employees with no operational need to access specific data categories are denied access by default.
• Two-factor authentication: Available and recommended for all Player accounts; mandatory for administrative staff accounts.
• Penetration testing and security audits: The Platform undergoes regular security assessments conducted by independent third-party security professionals.
• Incident response: Poka88 maintains a documented data breach response procedure. In the event of a breach affecting your data, we will notify you and relevant authorities as required by applicable standards within a reasonable timeframe.

Subject to applicable law and our legitimate operational and regulatory requirements, you hold the following rights in respect of your personal data held by Poka88:

To exercise any of the above rights, please contact our support team via the channels listed in Section 16. We will acknowledge your request within 48 hours and respond substantively within 30 calendar days. We may need to verify your identity before processing a rights request to prevent unauthorised access to another person's data.

The Poka88 platform is strictly for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data relating to individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process, and accounts found to have been created by minors will be immediately suspended and all associated data deleted in accordance with applicable child protection standards.

If you believe that a minor has registered an account on the Platform, please contact us immediately at the address in Section 16 so that we may investigate and take appropriate action without delay.

The Poka88 Platform may contain links to or integrations with third-party services, including payment processors and identity verification providers. These third parties operate under their own privacy policies, which govern the collection and use of data in connection with their services.

Poka88 is not responsible for the privacy practices of third-party providers. We encourage you to review the privacy notices of any third-party services you interact with in the course of using our Platform — in particular the privacy policies of your chosen payment provider (such as Touch 'n Go eWallet, Boost, GrabPay, or your bank's digital banking portal).

Poka88 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory guidance. All changes will be published on this page with an updated "Last updated" date at the top of the document.

For material changes that significantly affect your rights or the way we process your data, we will provide reasonable advance notice via email to the address registered with your account, or via a prominent notice on the Platform, before the changes take effect.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of those changes. If you do not agree with an updated Policy, you may request account closure in accordance with the Terms and Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection team through the following channels:

If you are not satisfied with our response to a privacy concern, you have the right to escalate the matter to the relevant supervisory authority in your jurisdiction, or to seek independent dispute resolution in accordance with our Terms and Conditions.