umb88 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how umb88 ("the Company", "we", "us", "our"), the operator of the online gaming platform at umb88.net and associated sub-domains and applications (collectively, "the Platform"), collects, processes, stores, and shares personal data in connection with the provision of our services to registered Members.

umb88 is committed to handling personal data responsibly and in compliance with applicable data protection legislation, including the Personal Data Protection Act 2010 (PDPA) of Malaysia and the requirements of our international gaming authority licence. By registering an account or using any part of the umb88 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms and Conditions and Responsible Gaming Policy, both of which are published on this Platform and incorporated into this Policy by reference.

2. Data Controller

For the purposes of applicable data protection law, umb88 is the data controller in respect of personal data collected through the Platform. If you have questions or concerns about how umb88 handles your personal data, you may contact our Data Protection team by written enquiry to [email protected], clearly marking your correspondence "Privacy / Data Protection".

3. Personal Data We Collect

umb88 collects personal data in two principal ways: information you provide directly, and information collected automatically through your use of the Platform.

Information you provide directly:

• Identity data: full legal name, date of birth, national identification number (MyKad or passport number), nationality.
• Contact data: residential address, email address, and mobile telephone number.
• Financial data: bank account details, e-wallet identifiers (such as your GrabPay or Touch n Go eWallet account reference), transaction history, and source-of-funds documentation where required by our KYC procedures.
• Account credentials: username and hashed password (umb88 does not store passwords in plain text).
• Verification documents: copies of identity documents, utility bills, or bank statements submitted during Know Your Customer (KYC) verification.
• Communications: records of messages exchanged with our support team via live chat or email.

Information collected automatically:

• Technical data: IP address, device identifiers, browser type and version, operating system, and screen resolution.
• Usage data: pages visited, features accessed, games played, betting history, session duration, login timestamps, and click-stream data.
• Cookie data: session cookies, preference cookies, and analytics cookies as further described in Section 9 of this Policy.
• Geolocation data: approximate location derived from IP address, used solely for regulatory compliance and fraud prevention purposes.

4. Purposes and Legal Bases for Processing

umb88 processes your personal data only where a lawful basis exists. The primary purposes and corresponding legal bases are as follows:

• Contract performance: Processing necessary to register your account, verify your eligibility, facilitate deposits and withdrawals (including via GrabPay, Boost, Maybank, and CIMB), provide gaming services, and process withdrawals of winnings.
• Legal obligation: Processing required to comply with anti-money laundering (AML) obligations, Know Your Customer (KYC) regulations, responsible gaming requirements, and conditions imposed by our gaming licence, including age verification to enforce the 21+ minimum age policy.
• Legitimate interests: Fraud detection and prevention, platform security, abuse prevention, and internal analytics to improve the umb88 gaming experience — provided such interests are not overridden by your fundamental rights.
• Consent: Sending you promotional communications about umb88 offers, bonuses, and new games where you have opted in to receive such communications. You may withdraw consent at any time by contacting support or adjusting your notification preferences in account settings.

5. How We Share Your Personal Data

umb88 does not sell, rent, or trade personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipient, strictly on a need-to-know basis:

• Payment service providers: Including GrabPay, Touch n Go eWallet, Boost, and banking institutions, to process deposits and withdrawals.
• Game software providers: Licensed game studios whose content appears in the umb88 lobby, to the extent required to deliver gameplay functionality.
• Identity verification providers: Third-party KYC and AML screening services that assist umb88 in verifying Member identity and monitoring for financial crime.
• Regulatory and licensing authorities: Our international gaming authority licensor and, where legally required, law enforcement or government agencies in response to a valid legal process.
• IT infrastructure providers: Cloud hosting and cybersecurity service providers operating under data processing agreements that impose equivalent data protection standards.

All third-party recipients are required by contract to handle umb88 Member data confidentially and only for the purposes for which it was shared.

6. Data Retention

umb88 retains personal data for as long as your account remains active and for a period thereafter as required by applicable law and our gaming licence conditions. Specifically:

• Account and transaction records are retained for a minimum of five (5) years following account closure to satisfy AML record-keeping obligations.
• Communications with support are retained for two (2) years unless a longer retention period is required in connection with an ongoing dispute or investigation.
• KYC documentation is retained for the duration of the account and for five (5) years following closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with umb88's data disposal procedures.

7. Your Rights

Subject to applicable law, you hold the following rights in respect of your personal data held by umb88:

• Right of access: You may request a copy of the personal data umb88 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where we no longer have a lawful basis to retain it, subject to our legal obligations to retain certain data as described in Section 6.
• Right to restriction: You may request that we restrict processing of your personal data in certain circumstances.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". umb88 will respond within 30 days of receipt. Identity verification may be required before your request is processed.

8. Data Security

umb88 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the umb88 Platform.
• Hashing and salting of account passwords — umb88 staff cannot view your password in plain text.
• Role-based access controls ensuring that only staff with a legitimate operational need can access Member personal data.
• Regular security assessments and penetration testing of Platform infrastructure.
• Optional two-factor authentication (2FA) available to all Members to further secure umb88 login access.

No data transmission over the internet is entirely risk-free. While umb88 takes all reasonable steps to protect your data, we cannot guarantee absolute security. Members are encouraged to use strong, unique passwords and to enable 2FA on their umb88 accounts.

9. Cookies and Tracking Technologies

The umb88 Platform uses cookies and similar tracking technologies to enhance your experience, maintain your session after umb88 login, and collect analytics data that helps us improve the Platform. The main categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function, including session management and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and preferred game lobby view.
• Analytics cookies: Collect aggregated, anonymised data about how Members interact with the Platform, used to identify areas for improvement.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the umb88 Platform.

10. International Data Transfers

In order to provide the umb88 Platform, personal data may be transferred to and processed in countries outside Malaysia, including countries where our game software providers and cloud infrastructure are located. Where such transfers occur, umb88 ensures that appropriate safeguards are in place — including contractual data protection clauses — to provide an equivalent level of protection to that available under Malaysian PDPA.

11. Children and Minors

The umb88 Platform is strictly for individuals aged 21 years and above. umb88 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from an underage individual, we will take immediate steps to delete that data and close the associated account. Parents or guardians who believe a minor has registered with umb88 should contact us immediately at [email protected].

12. Changes to This Policy

umb88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform features. Material changes will be communicated to registered Members via the email address on file or by prominent notice on the Platform. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the umb88 Platform following notification of changes constitutes acceptance of the updated Policy.

13. Contact

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or believe that umb88 has not handled your personal data in accordance with this Policy, please contact us at [email protected] with the subject line "Privacy Enquiry". Our Malaysia-based support team is available daily from 9 AM to 2 AM MYT via live chat on the Platform for general account queries.