grab888 Privacy Policy

1. About This Policy

1.1 This Privacy Policy ("Policy") describes how grab888 ("we", "us", "our", "the Company") processes personal data collected from individuals ("you", "the Player") who access or use the grab888 website and associated services at grab888.win (the "Platform").

1.2 By registering an account or using the grab888 Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

1.3 This Policy should be read in conjunction with the grab888 Terms & Conditions. Defined terms used but not defined in this Policy carry the meanings given to them in the Terms & Conditions.

2. Personal Data We Collect

2.1 grab888 collects personal data through multiple channels in the course of providing its services to Malaysian players. The categories of data we collect are:

2.1 Registration & Identity Data

• Full legal name as it appears on government-issued identification;
• Date of birth (for mandatory 21+ age verification);
• Malaysian MyKAD number, passport number, or equivalent national ID;
• Residential address;
• Email address;
• Malaysian mobile phone number.

2.2 Financial Data

• Bank account details or e-wallet identifiers used for FPX, DuitNow, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch n Go eWallet, Boost, GrabPay, or USDT transactions;
• Deposit and withdrawal transaction records;
• Account balance history;
• Source-of-funds documentation provided for KYC or enhanced due diligence purposes.

2.3 Gaming Activity Data

• Bet placement records including game type, stake, odds, and outcome;
• Session duration, frequency, and timing;
• Bonus and promotion usage records;
• Game preference and interaction history.

2.4 Technical & Device Data

• IP address and geolocation data;
• Device type, operating system, and browser information;
• Cookies and similar tracking identifiers (see Section 6);
• Login timestamps and session activity logs.

2.5 Communications Data

• Records of live chat, email, and other support interactions with grab888;
• Marketing preferences and opt-in/opt-out records;
• Complaint and dispute correspondence.

3. How We Use Your Personal Data

3.1 grab888 uses collected personal data for the following purposes:

3.2 grab888 will not use your personal data for any purpose materially different from those listed above without obtaining your prior consent, except where required by law or regulation.

4. Legal Basis for Processing

4.1 grab888 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contractual obligations to you as a registered player, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with applicable laws including anti-money laundering legislation, age verification requirements, and regulatory reporting obligations;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where our legitimate interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing communications and non-essential cookies, where you have provided explicit, informed consent that you may withdraw at any time.

5. Data Sharing & Third Parties

5.1 grab888 does not sell your personal data to third parties. We share your data only in the following circumstances and only to the extent necessary:

• Payment processors: Your financial data is shared with Malaysian payment service providers (FPX, DuitNow operators, e-wallet providers) solely to process transactions you initiate;
• KYC/AML service providers: Identity and document data is shared with accredited identity verification providers for age and identity checks required under our licensing obligations;
• Game providers: Limited gaming session data is shared with our licensed game providers (Evolution Gaming, Pragmatic Play, PG Soft, etc.) to facilitate gameplay and resolve disputes;
• Regulatory and law enforcement authorities: We may disclose data where required by our licensing authority, a court order, or a lawful request from Malaysian or international law enforcement;
• IT and infrastructure providers: Technical data is processed by our hosting, security, and platform infrastructure providers under binding data processing agreements;
• Professional advisers: Legal, audit, and compliance advisers may access data where necessary and are bound by professional confidentiality obligations.

5.2 All third parties with whom grab888 shares personal data are required to implement appropriate technical and organisational security measures and to process data only for specified, lawful purposes.

6. Cookies & Tracking Technologies

6.1 grab888 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Session management, authentication, and security — these cannot be disabled as the Platform cannot function without them;
• Functional cookies: Saving your language preferences, display settings, and game history for a smoother experience;
• Analytics cookies: Measuring Platform performance and user behaviour in aggregate to improve grab888's services (anonymised data only);
• Marketing cookies: With your consent, tracking interactions to deliver relevant promotions. You may withdraw consent at any time via your account settings.

6.2 You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the grab888 Platform, but some personalisation features may be unavailable.

7. Data Retention

7.1 grab888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations:

• Account and identity data: retained for a minimum of five (5) years following account closure, as required by AML and gaming licensing regulations;
• Transaction records: retained for a minimum of five (5) years from the date of each transaction;
• Gaming activity records: retained for five (5) years or such longer period as required by our regulator;
• Support and communications records: retained for three (3) years from the date of the last interaction;
• Marketing consent records: retained until withdrawal of consent and for one (1) year thereafter.

7.2 After the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

8. Data Security

8.1 grab888 implements and maintains appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit;
• Encryption of sensitive personal data at rest;
• Role-based access controls limiting staff access to data on a strict need-to-know basis;
• Regular third-party penetration testing and security audits;
• Intrusion detection and 24/7 security monitoring systems;
• Formal incident response procedures with regulatory notification protocols.

8.2 In the event of a personal data breach that poses a risk to your rights and freedoms, grab888 will notify affected players without undue delay and will fulfil all applicable regulatory notification obligations.

9. Your Data Rights

9.1 Subject to applicable law and certain exceptions, you have the following rights in respect of your personal data held by grab888:

• Right of access: You may request a copy of the personal data we hold about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where we no longer have a lawful basis for retaining it (subject to our legal retention obligations);
• Right to restrict processing: You may request that we limit how we use your data in certain circumstances;
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to us;
• Right to object: You may object to processing based on legitimate interests, including profiling for direct marketing purposes;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

9.2 To exercise any of these rights, please contact grab888 support via live chat or email. We will respond within 30 days. We may require identity verification before processing your request.

10. Children & Minors

10.1 The grab888 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from persons under 21. If we become aware that personal data has been collected from a person under 21, we will delete that data immediately and close the associated account.

10.2 If you believe that a minor has accessed the grab888 Platform and provided personal data, please contact our support team immediately so that we may take appropriate action.

11. International Data Transfers

11.1 As grab888 operates under an international gaming licence, some of your personal data may be transferred to and processed in jurisdictions outside Malaysia by our technology providers, game suppliers, or group entities. Such transfers are conducted only where:

• The receiving country provides an adequate level of data protection as recognised by applicable standards; or
• Appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or equivalent data transfer mechanisms; or
• The transfer is necessary for the performance of our contract with you (e.g., processing a payment via an international network).

11.2 You may request information about the safeguards governing any international transfer of your data by contacting grab888 support.

12. Changes to This Policy

12.1 grab888 may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated by email to your registered address and by a prominent notice on the Platform at least seven (7) days before taking effect, where practicable.

12.2 Your continued use of the grab888 Platform after the effective date of any updated Policy constitutes acceptance of the revised terms. If you do not agree to the revised Policy, please cease using the Platform and contact us to close your account.

13. Contact Us

13.1 For any privacy-related enquiries, data subject rights requests, or concerns about how grab888 handles your personal data, please contact our Data Protection team: