ekplus8 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") is issued by ekplus8 ("we", "us", "our", "the Operator") and applies to all personal data collected from individuals who access, register with, or use the ekplus8 platform at ekplus8.one ("the Platform"), including its website, mobile interface, games, sportsbook, and associated communications.

By using the ekplus8 Platform or by submitting personal data through any ekplus8 channel, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with the ekplus8 Terms & Conditions.

2. Data Controller Identity

For the purposes of applicable data protection legislation, ekplus8 is the data controller in respect of the personal data described in this Policy. ekplus8 determines the purposes for which and the means by which personal data is processed. All data-related enquiries, access requests, and complaints should be directed to our data compliance contact as set out in Section 15 of this Policy.

3. Personal Data We Collect

ekplus8 collects the following categories of personal data from Players and website visitors:

ekplus8 does not intentionally collect sensitive personal data (such as health data, racial or ethnic origin, or political opinions) from Players. Where such data is incidentally provided — for example, in a support query — it will be handled with heightened protection and used solely for the purpose of resolving the query.

4. How We Collect Your Data

4.1 Direct Collection

ekplus8 collects data directly from you when you: complete the registration form on the Platform; submit identity verification documents for KYC purposes; make a deposit or withdrawal; contact our support team; or respond to promotional communications.

4.2 Automated Collection

When you access the ekplus8 Platform, we automatically collect technical data via server logs, cookies, and similar technologies. This includes your IP address, device fingerprint, browser information, and session activity. This data is collected to ensure Platform security, maintain session integrity, and detect fraudulent or automated access attempts.

4.3 Third-Party Sources

In limited circumstances, ekplus8 may receive personal data about you from third-party sources, including: payment service providers (to confirm deposit and withdrawal transactions); identity verification services used in the KYC process; and fraud prevention databases used in our AML compliance programme. Data received from third parties is handled in accordance with this Policy.

5. Legal Basis for Processing

ekplus8 processes your personal data on the following legal bases, consistent with GDPR-aligned principles:

• Contract Performance: Processing necessary to provide the ekplus8 gaming services you have registered for, including account management, deposits, withdrawals, and game access;
• Legal Obligation: Processing required to comply with applicable gaming regulations, AML obligations, tax reporting requirements, and data retention mandates imposed by ekplus8's licensing authority;
• Legitimate Interests: Processing for Platform security, fraud detection, responsible gaming monitoring, and improvement of our services — where such interests are not overridden by your data protection rights;
• Consent: For the use of non-essential cookies and for direct marketing communications — where your explicit consent has been obtained and is recorded.

6. How We Use Your Personal Data

ekplus8 uses your personal data for the following purposes:

• Creating and managing your ekplus8 player account;
• Processing and verifying deposits and withdrawals to Malaysian bank accounts and eWallets;
• Verifying your identity and age as part of our KYC and responsible gaming obligations;
• Detecting and preventing fraud, money laundering, and abuse of platform systems;
• Providing customer support and resolving disputes;
• Administering bonuses, promotions, and loyalty programmes;
• Monitoring gaming activity for responsible gaming purposes — including identification of at-risk players;
• Sending transactional communications (account notifications, deposit confirmations, security alerts);
• Sending promotional communications where you have consented or where permitted under the applicable legal basis;
• Complying with reporting obligations to ekplus8's licensing authority and relevant regulators;
• Improving and developing the Platform based on aggregate usage analytics.

ekplus8 will not use your personal data for purposes materially different from those listed above without providing you with advance notice and, where required, obtaining your consent.

7. Data Sharing and Third Parties

7.1 Service Providers

ekplus8 shares personal data with carefully selected third-party service providers who process data on our behalf under contractual data processing agreements. These providers include: KYC and identity verification services; payment processors and eWallet operators (including FPX banking partners, Touch n Go, Boost, GrabPay); licensed game studio software providers; cloud hosting and infrastructure providers; and customer support platform providers. All third-party processors are required to implement appropriate technical and organisational security measures.

7.2 Legal and Regulatory Disclosure

ekplus8 may disclose personal data to law enforcement agencies, regulatory authorities, or other third parties where required by applicable law, court order, or the directives of ekplus8's gaming licensing authority. Such disclosures are made in accordance with applicable legal process and are limited to what is strictly required.

7.3 No Sale of Data

ekplus8 does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. Any data shared with third parties is shared solely for the operational purposes described in this Section.

8. Cookies and Tracking Technologies

8.1 Types of Cookies Used

ekplus8 uses the following categories of cookies on the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication cookies that maintain your logged-in state after ekplus8 login, and security cookies that support fraud detection. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby layout preferences, and "Remember Me" login choices. These improve your experience but are not essential.
• Analytics Cookies: Aggregate, anonymised data on Platform usage patterns — used to identify areas for improvement. No individual player activity is identifiable from analytics data.

8.2 Third-Party Cookies

ekplus8 does not permit third-party advertising cookies or cross-site tracking cookies on the Platform. Any third-party scripts present on the Platform are strictly limited to licensed game studio integrations and payment gateway scripts, each of which is subject to that provider's own privacy policy.

8.3 Cookie Management

You may manage non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair the functionality of the ekplus8 Platform and may prevent successful login and transaction processing.

9. Data Retention

ekplus8 retains personal data for the following periods:

• Active account data: Retained for the duration of the account's active status plus a minimum of 5 years following account closure, in compliance with gaming regulatory and AML record-keeping requirements;
• Transaction records: Retained for a minimum of 7 years from the date of the transaction, consistent with financial record-keeping obligations;
• KYC documents: Retained for 5 years following the end of the customer relationship, or longer if required by licensing authority directives;
• Support communications: Retained for 3 years from the date of the communication, unless the subject matter requires longer retention;
• Technical/log data: Retained for 12 months from the date of collection, then anonymised or deleted.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

10. Data Security

ekplus8 implements the following technical and organisational security measures to protect personal data:

• 256-bit SSL/TLS encryption for all data in transit between the Player's device and ekplus8 servers;
• Encryption at rest for all personal data stored on ekplus8 infrastructure;
• Role-based access controls ensuring that personal data is accessible only to ekplus8 staff with a legitimate operational need;
• Regular independent security audits and penetration testing of Platform infrastructure;
• Multi-factor authentication requirements for ekplus8 staff access to data systems;
• Incident response procedures to detect, contain, and notify of data breaches within required regulatory timeframes.

Notwithstanding the above measures, no data transmission or storage system is entirely impervious to breach. If you have reason to believe that your ekplus8 account or associated data has been compromised, contact ekplus8 support immediately.

11. Your Rights as a Data Subject

Subject to applicable law and the requirements of ekplus8's gaming licence, you have the following rights in respect of your personal data:

• Right of Access: To request a copy of the personal data ekplus8 holds about you;
• Right to Rectification: To request correction of inaccurate or incomplete personal data;
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected — subject to ekplus8's overriding legal retention obligations;
• Right to Restrict Processing: To request that ekplus8 restricts processing of your data in certain circumstances — for example, while a rectification request is being assessed;
• Right to Data Portability: To receive a structured, machine-readable copy of the personal data you have provided to ekplus8, where technically feasible;
• Right to Object: To object to processing based on legitimate interests, including for direct marketing purposes;
• Right to Withdraw Consent: Where processing is based on consent, to withdraw that consent at any time — without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, submit a written request to ekplus8 via the contact details in Section 15. We will respond within 30 days. We may require identity verification before processing data subject requests to protect against unauthorised data access.

12. Children's Privacy

The ekplus8 Platform is strictly intended for individuals aged 21 years and above. ekplus8 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an individual under 21, we will take immediate steps to delete that data and close the associated account. If you believe that a minor has registered with ekplus8, please contact us immediately at the address in Section 15.

13. International Data Transfers

ekplus8's infrastructure and some of its third-party service providers are located outside of Malaysia. Where personal data is transferred outside of Malaysia, ekplus8 ensures that appropriate safeguards are in place to protect the data — including contractual clauses that impose GDPR-equivalent data protection obligations on the receiving party, or reliance on adequacy decisions where applicable.

Transfers to third-party game studio providers (such as those processing game session data) are governed by data processing agreements that require those studios to maintain appropriate security standards and to process player data solely for the purposes of delivering the licensed game content.

14. Changes to This Privacy Policy

ekplus8 reserves the right to update this Privacy Policy at any time. Material changes — those that affect your rights or how your data is processed in a significant way — will be communicated to registered players by email to the address on record, or via an in-platform notification, at least 7 days before the change takes effect. Non-material changes (such as typographical corrections or clarifications) may be published immediately. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Platform following publication of an updated Policy constitutes acceptance of the revised terms.

15. Contact and Data Requests

For any questions about this Privacy Policy, to exercise your data subject rights, or to report a data-related concern, please contact ekplus8 at:

Data Compliance Contact — ekplus8

Email: [email protected]

Please mark your correspondence as "Privacy Request" or "Data Subject Request" in the subject line to ensure it reaches our data compliance team. We aim to respond to all privacy-related enquiries within 10 business days and to formal data subject requests within 30 calendar days.