Zalo88 Privacy Policy — Data Protection Malaysian Member Privacy

Zalo88 collects personal information from members through several channels — directly when you register and use our platform, automatically through tracking technologies, and in some cases from legitimate third-party sources for verification purposes.

We do not collect sensitive data categories such as health information, religious beliefs, or political views unless required by specific legal obligations. All data collection is conducted on the principle of data minimisation — we only collect what is strictly necessary.

Zalo88 processes members' personal data on a lawful legal basis. Every use of data has a clear purpose and will not be used for any other purpose without prior notice to you.

• Account management: Register, verify, and manage your member account, including the mandatory KYC process.
• Transaction processing: Process deposits, withdrawals, and bonus payments through your chosen payment channel.
• Platform security: Detect and prevent fraud, money laundering, and any suspicious activity that could compromise your account or our platform.
• Customer support: Respond to inquiries, resolve complaints, and provide technical assistance whenever you need it.
• Service communications: Send important account-related notifications such as transaction confirmations, security alerts, and policy updates.
• Platform improvement: Analyse aggregated usage patterns to improve the functionality, performance, and user experience of the zalo88 platform.
• Legal compliance: Fulfil reporting obligations under anti-money laundering (AML) regulations and other applicable legal requirements.

Zalo88 does not sell or rent members' personal data to any party. We only share information in limited, lawful circumstances as follows:

• Service providers: Companies that help us operate the platform — such as payment service providers (FPX, DuitNow, Touch 'n Go), cloud infrastructure providers, and identity verification service providers — are all bound by strict confidentiality agreements and may only use your data for purposes we specify.
• Legal requirement: When required by Malaysian law, court order, or a lawful request from law enforcement agencies such as the Royal Malaysia Police or Bank Negara Malaysia.
• Fraud prevention: With trusted industry partners for the purpose of detecting and preventing fraud, money laundering, and identity theft that may affect our members.
• Business transfers: In the event of a merger, acquisition, or asset sale, member data may be transferred as part of that transaction. You will be notified in advance and your rights under the PDPA will remain fully protected.

Zalo88 continuously invests in the latest security infrastructure to protect members' personal data from unauthorized access, loss, destruction, or accidental disclosure. Key security measures we implement include:

• Data in transit is encrypted using TLS 1.3 and SSL 256-bit protocols.
• Data at rest is encrypted using AES-256 standard.
• Two-factor authentication (2FA) is available for all member accounts.
• 24/7 security monitoring by our dedicated information security team.
• Role-based access control (RBAC) ensures that only authorised staff can access member data.
• Regular security audits conducted by qualified independent parties.
• A comprehensive incident response plan with clear notification procedures.

While we take all reasonable precautions, no system can guarantee 100% security. In the event of a data breach that affects your rights and freedoms, zalo88 will notify you within the timeframe required by the PDPA and take immediate remedial action.

You are also responsible for keeping your account secure by not sharing your password, using a strong and unique password, and ensuring your device is safe and up to date.

Zalo88 retains members' personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by Malaysian law. Our retention period guidelines are as follows:

• Active account data: Retained for the duration your account remains active and operational.
• KYC and identity verification data: Retained for a minimum of 7 years after account closure in accordance with Malaysian AML legal requirements.
• Financial transaction records: Retained for 7 years in accordance with financial and tax reporting requirements.
• Customer support communication logs: Retained for 3 years for reference and dispute resolution.
• Usage and analytics data: Aggregated anonymized data may be retained indefinitely as it can no longer be identified as your personal data.

When data is no longer needed and there is no legal requirement to retain it, Zalo88 will securely delete or anonymize that data using methods that comply with industry standards.

Zalo88 uses cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and ensure session security. The types of cookies we use include:

• Essential cookies: Required for core platform functions such as login session management and security. These cookies cannot be disabled as they are critical to platform operation.
• Performance cookies: Collect information about how you use the platform — pages visited, time spent, and any errors encountered. All such data is aggregated and cannot identify you personally.
• Functional cookies: Remember your preferences such as language, time zone, and display settings for a more personalised experience.
• Analytics cookies: Helps us understand overall platform usage patterns to make continuous improvements. This data is not shared with advertisers.

You can manage or disable non-essential cookies through your web browser settings at any time. Please note that disabling certain cookies may affect the functionality of some parts of the Zalo88 platform.

As a data subject under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding your personal data held by zalo88:

• Right of access: You have the right to obtain a copy of the personal data we hold about you. Data access requests will be processed within 21 working days.
• Right to rectification: If your data is inaccurate, outdated, or incomplete, you have the right to request a correction. We encourage you to update your profile information through your account settings.
• Right to withdraw consent: You may withdraw consent for specific processing at any time, without affecting the validity of processing carried out prior to withdrawal.
• Right to object to direct marketing: You may object to the use of your data for direct marketing communications at any time.
• Right to erasure: In certain circumstances, such as when data is no longer needed for its original purpose, you may request deletion of your data, subject to any legal requirements for data retention.

To exercise any of these rights, please contact our data protection team via Live Chat or email at [email protected]. We will respond within the timeframe stipulated by the PDPA.

In operating the Zalo88 platform, member personal data may be processed or stored on servers located outside Malaysia. This occurs when we use international cloud infrastructure providers to ensure optimal platform availability and performance.

However, zalo88 ensures that any cross-border data transfers are carried out with safeguards equivalent to Malaysia's PDPA standards:

• All third-party service providers are bound by comprehensive data processing agreements (DPAs).
• We only use providers based in countries or regions with equivalent levels of data protection.
• Standard contractual protection mechanisms are applied to ensure your data is protected to the same standard even when processed outside Malaysia.

The zalo88 platform is strictly for adults aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

Should we discover that personal data of a child or minor has been collected without our knowledge, we will take immediate action to delete that data and close the relevant account. Parents or guardians who believe their child has registered a zalo88 account should contact us immediately.

Zalo88 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with this Privacy Policy and Malaysia's PDPA. If you have any questions, concerns, or complaints regarding how we handle your personal data, please reach out to us through the following channels:

• Live Chat: Available 24/7 via the chat icon at the bottom corner of the zalo88 platform.
• Privacy email: [email protected] — for specific enquiries regarding PDPA and personal data rights.
• Support email: [email protected] — for general enquiries regarding your account and services.

We are committed to responding to all privacy-related inquiries within 14 business days. If you are not satisfied with our response, you have the right to file a complaint with the Personal Data Protection Commissioner of Malaysia under PDPA 2010.

This Privacy Policy may be updated from time to time to reflect changes in our practices or legal requirements. Any significant amendments will be communicated to members via their registered email at least 14 days before taking effect.