Privacy Policy — candy88

This Privacy Policy (hereinafter referred to as "Policy") is issued by candy88, the operator of the online gaming and sports betting platform accessible at candy88.cam (the "Platform"). This Policy applies to all individuals who visit, register on, or otherwise interact with the Platform, including registered players, prospective customers, and general visitors.

candy88 is committed to protecting the privacy and personal data of all individuals who use the Platform. This Policy sets out, in clear and accessible language, the categories of personal data we collect, the purposes for which that data is processed, the legal bases on which we rely for processing, the circumstances in which data may be shared with third parties, and the rights available to you in relation to your personal data.

By registering an account on candy88, making a deposit, or otherwise using any service offered on the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" means candy88, which determines the purposes and means by which personal data is processed.
• "Data Processor" means any third party that processes personal data on behalf of candy88, subject to a data processing agreement.
• "Data Subject" means the individual to whom personal data relates — i.e., you, the registered Player or visitor.
• "Cookies" means small text files placed on your device by the Platform to store session information, preferences, and usage analytics.
• "KYC" means Know Your Customer, the identity verification process required for account compliance and fraud prevention.
• "AML" means Anti-Money Laundering, the regulatory framework requiring financial service providers to detect and prevent money laundering activity.

candy88 collects the following categories of personal data from Players and visitors:

3.1 Identity Data

Full legal name, date of birth, gender, nationality, and government-issued identification details (e.g., MyKad number for Malaysian players, or passport number for international players).

3.2 Contact Data

Email address, mobile telephone number, and residential address (city, state, postcode, and country). For Malaysian players, this may include references to specific states or cities such as Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, or Shah Alam.

3.3 Account Data

Username, account registration date, account status, login history (timestamps, IP addresses, and device identifiers), and session duration data.

3.4 Financial Data

Transaction history including deposits, withdrawals, bonus credits, and wager records. Payment method details including e-wallet identifiers (e.g., Touch 'n Go eWallet registered number, Boost account reference), bank account numbers, and cryptocurrency wallet addresses used for transactions. Full payment card numbers are never stored by candy88 — card transactions are processed directly by licensed payment service providers.

3.5 Gaming Activity Data

Game play history, betting patterns, win and loss records, session lengths, preferred game categories, and sports markets wagered on (e.g., Liga Super Malaysia, EPL, UFC).

3.6 KYC Verification Data

Copies of government-issued identity documents, proof of address documentation, selfie photographs submitted for identity matching, and source-of-funds declarations where requested.

3.7 Technical Data

IP address, browser type and version, device type and operating system, screen resolution, referring URLs, and cookie identifiers collected automatically when you access the Platform.

3.8 Communications Data

Records of your correspondence with candy88 support, including live chat transcripts, email exchanges, and any feedback or complaints submitted.

candy88 collects personal data through the following channels:

• Account Registration: Data you provide when creating a candy88 account, including your name, email, date of birth, and contact details.
• KYC Verification: Identity documents and selfie photographs submitted during the verification process.
• Deposits and Withdrawals: Payment method details and transaction records generated when you fund or withdraw from your account using channels such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, or cryptocurrency.
• Platform Usage: Automatically collected technical data including IP addresses, device information, and session logs as you navigate and use the Platform.
• Customer Support Interactions: Information you provide when contacting the candy88 support team via live chat or email.
• Cookies and Tracking Technologies: Automatically collected preference and analytics data via cookies placed on your browser or device, as described in Section 8.
• Third-Party Verification Services: Identity and age verification data received from authorised third-party KYC service providers used to complete account verification.

candy88 processes your personal data under the following legal bases, depending on the specific processing activity:

candy88 uses the personal data collected for the following purposes:

6.1 Account Administration

To register and maintain your account, authenticate your identity at login, process account changes, and communicate important account-related information to you.

6.2 Transaction Processing

To process deposits made via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX) and cryptocurrency channels, and to process withdrawal requests to your designated payment method.

6.3 Identity Verification and Compliance

To conduct KYC verification as required by anti-money laundering and fraud prevention obligations, and to verify your age (21+) and eligibility to use the Platform.

6.4 Fraud Prevention and Security

To monitor for suspicious account activity, detect and prevent fraud, money laundering, cheating, and other prohibited conduct, and to protect the integrity of the Platform and other Players.

6.5 Responsible Gambling

To identify patterns consistent with problem gambling behaviour, to administer self-exclusion and limit-setting tools, and to communicate relevant responsible gambling information to at-risk Players.

6.6 Marketing and Promotions

To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time via your account settings or by contacting support.

6.7 Platform Improvement

To analyse Platform usage patterns, identify technical issues, improve the user experience, and optimise game recommendations and interface design based on aggregated, anonymised analytics data.

6.8 Legal and Regulatory Compliance

To comply with applicable legal obligations, respond to lawful requests from regulatory authorities, law enforcement agencies, or courts of competent jurisdiction, and to defend candy88's legal rights in the event of a dispute.

candy88 does not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipient, strictly limited to what is necessary for the purposes described in this Policy:

7.1 Payment Service Providers

Payment processors and e-wallet providers (including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow infrastructure, and FPX) who require transaction data to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to applicable financial data protection regulations.

7.2 KYC and Identity Verification Partners

Third-party identity verification service providers who process submitted identity documents to complete KYC checks. These providers are engaged under data processing agreements that mandate the confidentiality and security of shared data.

7.3 Fraud Prevention and Security Services

Specialist fraud detection and cybersecurity service providers who assist in monitoring for suspicious activity, processing security alerts, and maintaining Platform integrity.

7.4 Technology and Infrastructure Providers

Cloud hosting providers, content delivery network (CDN) operators, and other IT infrastructure service providers who host or support the Platform's technical operations, all subject to strict data confidentiality agreements.

7.5 Regulatory Authorities and Law Enforcement

Where required by applicable law, court order, or formal request from a regulatory authority or law enforcement body, candy88 may disclose personal data. We will, where legally permissible, notify you of such disclosure.

candy88 uses cookies and similar tracking technologies on the Platform to ensure optimal functionality, improve the user experience, and support analytics. A cookie is a small text file stored on your device that allows the Platform to recognise your browser and retain certain session preferences.

8.1 Types of Cookies Used

• Essential Cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. You cannot opt out of essential cookies without ceasing to use the Platform.
• Functional Cookies: Store your preferences (such as language settings, preferred payment method, and display options) to personalise your experience on return visits.
• Analytics Cookies: Collect anonymised data about how Players navigate the Platform — which pages are visited, how long sessions last, and which game categories are most popular — to help us improve the Platform.
• Marketing Cookies: Used to deliver relevant promotional content based on your past behaviour on the Platform. These are only deployed where you have provided consent.

8.2 Managing Cookie Preferences

You may manage non-essential cookie preferences through your browser settings or via the cookie preference centre available on the Platform. Disabling certain cookies may affect Platform functionality. Most modern browsers allow you to block, delete, or be notified of cookies through their settings menus.

candy88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention principles apply:

• Active Account Data: Retained for the full duration of your account's active status plus a period following closure to meet post-closure compliance obligations.
• Transaction Records: Financial transaction data (including deposit and withdrawal records) is retained for a minimum of five (5) years from the date of the transaction, in compliance with anti-money laundering record-keeping requirements.
• KYC Documentation: Identity documents are retained for a minimum of five (5) years from account closure, or longer if required by applicable regulatory obligations at the time.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, or longer if the correspondence relates to an ongoing dispute or investigation.
• Technical Logs: IP address and session logs are retained for up to twelve (12) months for security and fraud prevention purposes, after which they are anonymised or deleted.
• Marketing Consent Records: Records of marketing consent are retained for the duration of your account relationship and for three (3) years after the most recent opt-in event, as evidence of lawful processing.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that renders re-identification impossible.

candy88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Transport Layer Security (TLS) / SSL 256-bit encryption for all data transmitted between your browser and our servers.
• Encryption of sensitive data fields at rest within our databases, including financial identifiers and KYC document storage.
• Multi-factor authentication requirements for access to internal systems containing personal data.
• Role-based access controls ensuring that staff can only access personal data where it is necessary for their specific job function.
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent security specialists.
• Dedicated fraud monitoring systems operating 24 hours a day, 7 days a week.
• Incident response procedures designed to identify, contain, and remediate data security incidents promptly.

In the event of a data security incident that is reasonably likely to result in material harm to affected individuals, candy88 will notify affected Players without undue delay, and will take all reasonable steps to mitigate the impact of the incident.

As a Data Subject, you have the following rights in relation to the personal data that candy88 holds about you. To exercise any of these rights, please contact us using the details provided in Section 16.

The candy88 Platform is a self-contained environment and does not incorporate third-party social media widgets, external advertising networks, or affiliate tracking pixels that collect personal data for external third-party purposes without your knowledge.

Where candy88 engages third-party service providers (such as payment processors, KYC verification partners, or analytics providers) who process personal data on our behalf, such providers are engaged under formal data processing agreements. These agreements require third-party processors to: process data only on our documented instructions; implement appropriate technical and organisational security measures; not engage sub-processors without prior authorisation; and return or destroy data at the conclusion of the processing relationship.

candy88 is not responsible for the privacy practices of any external websites that may be linked to or from the Platform through user-generated content or third-party services. This Policy does not apply to such external websites.

The candy88 Platform is strictly restricted to individuals aged 21 years and above. candy88 does not knowingly collect personal data from, or permit the registration of accounts by, any person under the age of 21.

If candy88 becomes aware, through KYC verification or any other means, that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended, all associated personal data will be deleted to the extent not required by legal retention obligations, and any deposited funds will be returned to the originating payment method.

If you are a parent or guardian and believe that your child may have registered an account on candy88 without your knowledge, please contact us immediately at [email protected] so that we may take appropriate action.

candy88 operates an international online gaming platform and, in the course of providing services to Players in Malaysia and other jurisdictions, your personal data may be transferred to, stored on, or processed by servers or service providers located outside of Malaysia.

Where such international transfers occur, candy88 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable data protection principles. Safeguards may include: data processing agreements incorporating standard contractual clauses; adequacy decisions recognising the destination jurisdiction's data protection framework; or other lawful transfer mechanisms as applicable.

candy88 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or Platform functionality. The "Last Updated" date at the top of this Policy will be revised to reflect the date of any material change.

Where a material change is made to this Policy, candy88 will notify registered Players via email or a prominent notice on the Platform not less than fourteen (14) days prior to the effective date of the change. Your continued use of the Platform following the effective date of the revised Policy constitutes your acknowledgement of and agreement to the updated terms.

We recommend reviewing this Policy periodically to remain informed of how candy88 handles your personal data. The current version is always accessible at candy88.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by candy88, please contact our Data Protection team using the following channel:

For general platform support, please also visit our FAQ page. For information about responsible gambling tools and self-exclusion, please visit our Responsible Gambling page.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previous versions. The authoritative version is always accessible at candy88.cam/privacy-policy.