Privacy Policy 918iss – Malaysia Member Personal Data Protection

This Privacy Policy applies to all users who access the 918iss website at 918iss.com, the 918iss mobile app, and all services we provide whether accessed via mobile device, desktop, or any other digital platform. This covers all information you provide directly as well as data we collect automatically while you use our platform.

As a data controller under Malaysia's Personal Data Protection Act 2010 (PDPA), 918iss bears full responsibility for the processing of personal data within the scope of our operations. We appoint an internal Data Protection Officer (DPO) responsible for ensuring ongoing compliance with all applicable legal obligations.

This policy does not apply to third-party websites that may be linked from our platform. We encourage you to read the privacy policy of any website you visit separately, as 918iss is not responsible for the privacy practices of those sites.

We collect various categories of information to enable us to provide you with a safe, responsible and high-quality service. Below is a detailed breakdown of the information collected:

We do not collect sensitive information such as biometric data, health information or political views unless specifically required to comply with legal obligations or for responsible gaming purposes such as addiction risk assessments.

The personal data we collect is used exclusively for legitimate, stated purposes. The following are the primary purposes for which your data is used:

• Account Management: Creating, verifying and managing your member account including the KYC process and age verification.
• Transaction Processing: Processing deposits, withdrawals and any financial transactions you make on the platform securely and accurately.
• Service Provision: Enabling you to access all features and functions of the 918iss platform including sports betting, Live Casino and slot games.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, collusion and any misuse of the platform.
• Legal Compliance: Fulfilling reporting obligations to the relevant authorities in compliance with anti-money laundering (AMLA) and PDPA legislation.
• Responsible Gaming: Monitoring betting patterns to identify signs of addiction and provide appropriate support to members who need it.
• Customer Support: Providing technical support and efficiently resolving member complaints or enquiries.
• Consent-Based Marketing: Sending promotional information, bonuses and exclusive offers to members who have given consent to receive such communications.
• Service Improvement: Analysing usage data to understand member needs and improve platform quality over time.

We ensure that every use of your data is based on a valid legal ground — whether on the basis of a contractual agreement, legal obligation, legitimate business interest or your explicit consent.

918iss upholds the principle that your personal data belongs to you. We do not sell or trade your data. However, there are specific situations where we need to share your information with certain parties, and this is done in a limited and responsible manner:

• Payment Service Providers: Transaction information is shared with approved payment processors such as FPX, DuitNow, e-wallet and banking service providers to facilitate the completion of deposit and withdrawal transactions.
• Game Software Providers: Minimal game session data is shared with third-party game platform providers solely to enable games to function properly and to ensure the integrity of results.
• KYC Verification Companies: Identity documents are shared with approved identity verification service providers to ensure the KYC process is carried out securely and efficiently.
• Relevant Authorities: We are obligated to disclose information to regulatory authorities, law enforcement agencies or courts when required to do so under Malaysian law.
• Affiliated Companies: Within the 918iss group of companies, information may be shared between member entities for internal operational purposes, subject to the same level of protection.

We continuously invest in the latest security technologies and procedures to ensure your personal data remains safe at all times. Our security infrastructure comprises multiple layers of protection working in unison:

• Data-in-Transit Encryption: All data transmitted between your device and 918iss servers is encrypted using TLS 1.3 protocol with AES-256-bit encryption.
• Data-at-Rest Encryption: Data stored in our databases is also encrypted using the same encryption standards to protect against unauthorized access.
• Role-Based Access Control: Only authorized personnel with a legitimate business need may access members' personal data, and every access is logged for audit purposes.
• 24/7 Monitoring: A real-time threat detection system monitors all suspicious activity, and any unauthorised access attempts are immediately blocked and reported.
• Periodic Security Audits: Independent security audits are conducted periodically by third-party cybersecurity firms to identify and remediate any vulnerabilities.
• Incident Response Plan: We have detailed incident response procedures in place. In the event of a data breach affecting members, we will notify affected parties within 72 hours.

While we implement best-in-class security measures, no system can guarantee absolute security. We encourage members to also take personal protective steps such as using strong passwords, enabling two-factor authentication (2FA), and not sharing login credentials.

The 918iss platform uses cookies and similar tracking technologies to enhance user experience, maintain session security, and understand how members interact with our platform. The following are the types of cookies we use:

• Strictly Necessary Cookies: Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled as they are essential to the security of your account.
• Performance Cookies: Collecting anonymous information about how the platform is used to help us identify technical issues and improve platform speed and stability.
• Functional Cookies: Saving your preferences such as language, time zone and display settings to deliver a more personalised experience on future visits.
• Analytics Cookies: Used to analyze aggregated usage patterns to understand popular games, peak active hours, and member navigation behavior.

You can manage cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality or security of the 918iss platform. For guidance on managing cookies in popular browsers, refer to your browser's help documentation.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data we hold about you. We fully respect these rights and provide accessible channels for you to exercise them:

To exercise any of the above rights, contact our privacy team via 918iss customer support. All requests will be processed within 14 business days. In complex cases, this period may be extended to up to 30 days, with prior notice given to you.

918iss retains your personal data only for as long as necessary for the stated purposes or as required by law. The following are our data retention guidelines:

Once the retention period expires, your personal data will be securely deleted or anonymized using methods that ensure it can no longer be linked back to your identity. The deletion and anonymization process is carried out in accordance with established internal procedures that are audited on a regular basis.

If you have any questions, concerns or complaints regarding how 918iss handles your personal data, our Data Protection team is ready to assist. We are committed to responding to every enquiry seriously and within a reasonable timeframe.

You can reach us through the following channels:

• Privacy Email: [email protected]
• Live Support: Use the live chat function within the 918iss platform (available 24/7)
• Help Page: 918iss FAQ Centre

If you are not satisfied with our response, you have the right to lodge a complaint with Department of Personal Data Protection (JPDP) Malaysia — the official regulatory body overseeing PDPA compliance in Malaysia.