Privacy Policy Rafi88 – Malaysian Player Data Protection

Rafi88 collects the personal data necessary to provide a safe, fair, and legally compliant online casino service. The data we collect falls into three main categories.

• Full name: As it appears on your MyKad or Malaysian passport.
• MyKad or passport number: Used for KYC (Know Your Customer) processing and age verification.
• Date of birth: To verify that you are 18 years of age or older.
• Email address: For account communications, transaction confirmations and security notifications.
• Phone number: For SMS verification, customer support, and important notifications.
• Residential address: For compliance and identity verification purposes.

• Bank account or e-wallet number: Used to process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, or ShopeePay.
• Transaction records: All deposits, withdrawals, bets, and winnings are logged for compliance and customer support purposes.
• Game history: Records of games played, session duration, and betting activity for responsible gaming purposes.

• IP address: For location verification, fraud detection and account security purposes.
• Device information: Device type, operating system, and browser version to optimise the user experience.
• Cookie data: Session information, user preferences, and platform usage analytics.

Rafi88 collects your personal data through several different methods depending on how you interact with our platform. We are committed to collecting only the minimum data necessary — a "data minimisation" principle we strictly follow.

• Registration form: Data you enter directly when opening a new rafi88 account.
• KYC Process: Identity verification documents (copies of your MyKad or passport) that you upload to complete account verification.
• Financial transactions: Data generated automatically when you make a deposit via DuitNow, FPX, Touch 'n Go, GrabPay, Boost, or ShopeePay, or when you submit a withdrawal request.
• Gaming activity: Data collected automatically while you play slots, Live Casino, place Sports Betting or e-sports wagers on the rafi88 platform.
• Customer support interactions: Records of LiveChat conversations, emails, and other communications between you and the rafi88 support team.
• Cookies and tracking technologies: Data collected automatically via browser cookies and similar technologies as you browse the rafi88 platform.

Rafi88 uses your personal data solely for legitimate, clearly stated purposes. Below is a full list of the purposes for which rafi88 uses your data, along with the legal basis for each.

Rafi88 will not use your personal data for any purpose other than those stated above without informing you in advance and, where necessary, obtaining your fresh consent.

Rafi88 does not sell your personal data to any third party. However, in the course of operating our platform, we may share certain information with the following parties under limited and controlled circumstances.

• Payment processing providers: DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost and ShopeePay receive the transaction details required to process your deposits and withdrawals. This data is protected under data protection agreements between rafi88 and each respective provider.
• Licensed game providers: Third-party gaming platforms integrated with rafi88 may receive anonymous account identifiers for game processing purposes. Personal identification details such as your name or MyKad number are not shared with game providers.
• Law enforcement authorities: rafi88 will disclose personal data to Malaysian authorities when required by law, court order, or other valid legal process.
• IT service providers: Companies providing technology infrastructure, cloud services, and cybersecurity for rafi88 are bound by strict confidentiality agreements and are not permitted to use your data for their own purposes.
• Independent auditors and assessors: Licensed audit firms conducting compliance and security audits on rafi88's operations may access data within the scope of their audit responsibilities, subject to binding confidentiality agreements.

Rafi88 continually invests in data security infrastructure to ensure your personal information remains protected at all times. Below are the security layers we employ to safeguard your data.

• Data encryption in transit: All communications between your device and rafi88's servers use TLS 1.3 with 256-bit SSL encryption — no data is transmitted in plain text.
• Data-at-rest encryption: Sensitive data such as MyKad numbers, banking information and passwords are stored in encrypted form using industry-standard encryption algorithms. Passwords are stored as hashed values that cannot be decrypted.
• Layered access controls: A role-based access control (RBAC) system ensures that only employees with a legitimate operational need can access player data. All access is automatically logged and monitored.
• Two-factor authentication (2FA): All administrative access to rafi88 systems requires 2FA. Players are also encouraged to enable 2FA in their account settings as an added layer of protection.
• Continuous threat monitoring: rafi88's cybersecurity team monitors all systems 24 hours a day to detect and respond to security threats in real time.
• Regular penetration testing: rafi88 conducts regular security testing and vulnerability assessments by independent security firms to ensure our systems remain resilient against the latest threats.
• Incident response plan: rafi88 has a clear security incident response procedure to ensure any data breach is addressed swiftly and effectively, minimising impact on players.

Rafi88 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by Malaysian law. Our data retention schedule is as follows.

• Active account data: Retained for as long as your account remains active with rafi88. This data is required to manage your account and deliver ongoing services.
• Financial transaction records: Retained for a minimum of 7 years from the date of the transaction, in line with Malaysian financial compliance requirements, including anti-money laundering (AML) obligations.
• KYC Documents: Retained for 5 years after account closure or termination of the business relationship, in accordance with Malaysia's AMLA requirements.
• Support communication records: Retained for 2 years from the date of communication for reference and dispute resolution purposes.
• Technical data and system logs: Retained for a maximum of 12 months, then automatically deleted or anonymised.
• Marketing data (with consent): Retained until you withdraw your consent to receive marketing communications from rafi88.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. Data that must be retained for legal purposes will be anonymised wherever possible to protect your privacy.

The rafi88 platform uses cookies and similar tracking technologies to enhance the user experience, analyse platform usage, and maintain security. Below is an explanation of the types of cookies we use.

• Essential cookies (required): Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance and analytics cookies: Collects information on how you use the rafi88 platform — pages visited, time spent, and any technical issues encountered. This data is used to improve platform performance.
• Functional cookies: Stores your preferences such as language selection, display settings, and login information for a more convenient experience in future sessions.
• Security cookies: Helps detect suspicious activity, prevent fraud, and protect your account from unauthorised access.

You can manage your cookie preferences through your web browser settings. However, disabling essential cookies may affect the functionality of the rafi88 platform. Continued use of the rafi88 platform after a cookie notice is displayed will be considered as consent to the use of cookies as described.

As a rafi88 player and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), you have certain rights regarding the personal data we hold about you. Rafi88 is committed to respecting and facilitating the exercise of these rights.

Rafi88 is a platform designed exclusively for adults aged 18 and above. We do not knowingly collect or store personal data from individuals under the age of 18.

• All prospective members are required to confirm they are 18 years of age or older at the point of registration. Additional age verification through identity documents is conducted during the KYC process.
• If rafi88 discovers that personal data belonging to an individual under the age of 18 has been collected without parental or guardian consent, we will take immediate steps to delete that data and close the associated account.
• Parents or guardians who believe their child has registered a rafi88 account should contact us immediately at support@rafi88.asia for appropriate action.

Rafi88 reserves the right to update or modify this privacy policy at any time to reflect changes in our practices, legal requirements, or operational circumstances. Any updates will be published on this page with a revised update date.

• Material changes: For any changes that materially affect how we process your personal data or that reduce your rights, we will provide notice via your registered email address at least 30 days before the changes take effect.
• Minor changes: Clarifications, corrections, or minor improvements may be updated without prior notice, but the updated date will always be displayed at the top of this page.
• Ongoing consent: Continued use of the rafi88 platform after an updated privacy policy takes effect will be considered acceptance of those changes. If you do not agree, you should stop using the platform and contact us to close your account.

We encourage you to review this page from time to time to stay informed about how rafi88 protects your privacy.

If you have any questions, concerns, or requests regarding this privacy policy or the way rafi88 handles your personal data, we encourage you to reach out to us directly.

• Privacy email: Send your privacy-related enquiries to support@rafi88.asia with the subject line "Data Privacy Request". We will respond within 5 business days.
• LiveChat: For general privacy enquiries, the rafi88 support team is available 24 hours a day via LiveChat within the platform. For formal data requests, email is our preferred channel.
• Data access requests: To request a copy of the personal data rafi88 holds about you, submit a written request to support@rafi88.asia along with a copy of your MyKad for identity verification. We will process your request within 30 business days.
• Complaints: If you are dissatisfied with how rafi88 handles your personal data, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia under the Ministry of Digital.