Privacy Policy

This Privacy Policy ("Policy") describes how okto88 ("okto88", "we", "us", "our"), the operator of the online betting and gaming platform at https://okto88.asia (the "Platform"), collects, processes, stores, and discloses personal data relating to individuals who register for, access, or interact with the Platform ("Players", "Users", "you").

We recognise that personal data is a matter of trust, and we take our obligations under applicable data protection legislation seriously. This Policy is written in plain English and structured to give you a clear and complete understanding of our data practices — not to obscure them behind impenetrable legal language.

This Policy applies to all personal data collected through the Platform, including data provided during registration, during KYC verification, in the course of depositing or withdrawing funds, and through your general use of our sports betting and casino services.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly — including name, identification number, contact information, financial data, device identifiers, and behavioural data.
• "Processing" means any operation performed on personal data, including but not limited to collection, recording, storage, organisation, retrieval, use, disclosure, erasure, and destruction.
• "Data Controller" means okto88 in its capacity as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party engaged by okto88 to process personal data on our behalf and under our documented instructions.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" means Know Your Customer — the regulatory identity and verification process required before withdrawal privileges are unlocked on a Player Account.
• "Special Category Data" means personal data relating to racial or ethnic origin, health, political opinions, religious beliefs, sexual orientation, or criminal records, the processing of which is subject to heightened restrictions under applicable law.

okto88 collects the following categories of personal data in connection with the operation of the Platform:

okto88 does not intentionally collect Special Category Data. If you choose to disclose health-related information in the context of a responsible gambling request (for example, when setting a self-exclusion limit), such information will be used only to facilitate the responsible gambling measure requested and will be handled with the highest level of care.

okto88 collects personal data through the following channels:

• Directly from you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or interact with any feature of the Platform;
• Automatically through the Platform: Technical and behavioural data is collected automatically through cookies, session tokens, and server logs as you browse and use the Platform;
• From third-party payment processors: When you initiate a transaction through Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or other payment partners, relevant transaction confirmation data is shared with okto88 to reconcile your Account;
• From identity verification providers: During the KYC process, okto88 may use a third-party verification service to cross-reference identity documents. These providers act as Data Processors under our instruction;
• From fraud prevention services: okto88 may receive risk signals from fraud detection partners relating to IP addresses, device fingerprints, and transaction patterns.

okto88 processes your personal data only where a lawful basis for doing so exists. The following legal bases apply to our processing activities:

• Contractual Necessity: Processing required to perform our contract with you — including account management, payment processing, and customer support — is carried out on the basis of contractual necessity. Without this processing, we cannot provide the Platform services.
• Legal Obligation: Processing carried out to comply with applicable anti-money-laundering (AML) legislation, KYC regulations, tax reporting obligations, and licensing requirements is carried out on the basis of legal obligation. We cannot waive these obligations at your request.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and internal analytics is carried out on the basis of our legitimate interests, balanced against your rights and interests.
• Consent: Processing for marketing communications — including promotional emails, SMS notifications, and personalised offers — is carried out on the basis of your consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

okto88 uses your personal data for the following specific purposes:

• To create, verify, and maintain your Player Account;
• To process deposits and withdrawals through your chosen payment method (Touch 'n Go, Boost, DuitNow, FPX, bank transfer, or USDT TRC20);
• To verify your identity and age as part of the KYC process;
• To detect and prevent fraud, money laundering, and other prohibited conduct;
• To monitor your betting patterns in connection with our responsible gambling obligations — including identifying potential problem gambling indicators and, where appropriate, reaching out to offer support;
• To calculate and apply your Loyalty Programme tier status, cashback entitlements, and bonus eligibility;
• To respond to your customer support enquiries and resolve disputes;
• To send you transactional communications (deposit confirmations, withdrawal updates, security alerts);
• To send marketing communications, where you have provided consent to receive them;
• To comply with our regulatory and licensing obligations, including reporting requirements;
• To analyse aggregate Platform usage data for performance optimisation and product improvement purposes (using anonymised or pseudonymised data where possible).

okto88 does not sell your personal data. We share your personal data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage third-party service providers who process data on our behalf under strict contractual obligations. These include payment processing partners (including operators of Touch 'n Go, Boost, GrabPay, DuitNow, FPX rails), KYC and identity verification providers, fraud detection services, IT infrastructure and hosting providers, and customer support platform providers.

7.2 Regulatory and Legal Authorities

We may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where we are required to do so by applicable law, court order, or regulatory direction. Where legally permissible, we will notify you of such disclosures.

7.3 Business Transfers

In the event that okto88 undergoes a merger, acquisition, restructuring, or sale of substantially all of its assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified in advance of any such transfer and of any material change to this Privacy Policy that results.

okto88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in accordance with AML and record-keeping obligations;
• Financial Transaction Data: Retained for a minimum of seven (7) years following the date of each transaction, in accordance with applicable financial record-keeping requirements;
• KYC Documentation: Retained for the period required by applicable anti-money-laundering legislation, typically five (5) years following the end of the customer relationship;
• Communications Data (support logs): Retained for two (2) years following resolution of the relevant query, or longer where the subject matter of the communication is the subject of an active legal dispute;
• Technical and Behavioural Data: Retained in identifiable form for up to two (2) years; may be retained in anonymised or aggregated form indefinitely for analytics purposes.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle procedures.

okto88 implements and maintains appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. Our security measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser or device and the okto88 Platform is encrypted using TLS (Transport Layer Security), commonly associated with HTTPS;
• Encryption at Rest: Sensitive personal data stored in our databases is encrypted at rest using industry-standard encryption algorithms;
• Access Controls: Access to personal data is restricted to okto88 personnel and authorised processors with a documented need to access that data, on a role-based access control basis;
• Two-Factor Authentication (2FA): Player Accounts support two-factor authentication as an additional layer of login security;
• Security Monitoring: We maintain ongoing monitoring for unusual access patterns, intrusion attempts, and data exfiltration indicators;
• Vulnerability Management: Regular vulnerability assessments and penetration testing are conducted on Platform infrastructure.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed as completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, okto88 will notify you without undue delay in accordance with applicable data protection law.

okto88 uses cookies and similar tracking technologies to operate, secure, and improve the Platform. Cookies are small text files placed on your device when you visit the Platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the functioning of the Platform — including session management, login state, and security token maintenance. These cannot be disabled without disrupting core Platform functionality;
• Functional Cookies: Allow the Platform to remember your preferences (such as language, currency display, and last-visited game categories) to provide a more personalised experience;
• Analytics Cookies: Collect anonymised or pseudonymised data about how players navigate and use the Platform, enabling us to identify performance issues and improve the user experience;
• Security Cookies: Used for fraud detection, bot identification, and session integrity verification.

okto88 does not use third-party advertising cookies or behavioural tracking cookies that serve cross-site advertising. Where analytics tools are in use, they are configured to anonymise IP addresses and avoid cross-site tracking.

You may manage cookie preferences through your browser settings. Please note that disabling cookies may affect the availability or performance of certain Platform features.

Subject to applicable law and our legal retention obligations, you have the following rights in relation to your personal data held by okto88:

To exercise any of the above rights, please submit a request to [email protected] with the subject line "Data Subject Request – [Right Type]". We will respond within 30 calendar days of receiving your verified request. Identity verification may be required before we process any data subject request.

okto88 does not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from a person under this age threshold, we will take immediate steps to delete such data and close the associated Account. If you are a parent or guardian and believe your child has registered an Account on the Platform, please contact us immediately at [email protected].

The Platform integrates services from third-party providers — including payment processors, KYC verification services, and analytics tools — solely for the purpose of operating and improving our services. These third-party providers operate under their own privacy policies and are engaged by okto88 under data processing agreements that require them to handle your data in accordance with applicable data protection standards.

okto88 is not responsible for the privacy practices of any third-party website, application, or service that is not operated by us. If you follow a link to an external site, we recommend that you review the privacy policy of that site independently.

References to payment methods such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, and others are made for the purpose of identifying supported payment options. okto88 does not have any special data-sharing arrangements with these providers beyond what is necessary to process your payment transactions.

okto88 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, a change in the purposes for which we use your data, a change in the categories of data we collect, or a change to the third parties with whom we share data — we will notify registered Players via email or a prominent Platform notification at least fourteen (14) days in advance of the change taking effect, where practicable.

The current version of this Privacy Policy, together with its effective date, is always available at https://okto88.asia/privacy-policy. Continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which okto88 handles your personal data, please contact us through the following channels:

• Data & Privacy Enquiries — Email: [email protected] (please use subject line "Privacy Enquiry" or "Data Subject Request")
• Live Chat: Available 24/7 via the on-site chat widget — for general questions, an agent can direct your query to the appropriate team
• Response Commitment: We aim to acknowledge all privacy-related correspondence within five (5) business days and to resolve substantive requests within thirty (30) calendar days

Where you believe that okto88 has processed your personal data in a manner that is inconsistent with applicable data protection law and we have been unable to resolve your concern, you retain the right to lodge a complaint with the relevant supervisory authority or data protection regulator in your jurisdiction.