918k Privacy Policy — Personal Data Protection for Malaysian Users

918k operates as the data controller responsible for personal data collected through the 918k.ws platform. As data controller, 918k determines the purposes and means of processing your personal data and bears full responsibility for ensuring that such processing is carried out lawfully, fairly and transparently in accordance with Malaysia's Personal Data Protection Act 2010.

For any privacy-related enquiries or to exercise your data protection rights, you may contact the 918k Privacy Officer via official email: support@918k.ws

918k collects the following categories of personal data in the course of delivering our services:

• Full name as stated on your Malaysian identification document (MyKad or Passport)
• National identification card or passport number
• Date of birth and gender
• Photo or image of identification document for KYC purposes

• An active Malaysian mobile phone number
• A valid and active email address
• Malaysian residential address (if required for KYC)

• Account name and e-wallet numbers (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay)
• Malaysian bank account details for withdrawal purposes via FPX
• Deposit and withdrawal records in Malaysian Ringgit (RM)
• Transaction history and betting activity on the 918k platform

• IP address and geolocation information
• Device type, operating system and web browser used
• Activity logs and usage timestamps on the 918k platform
• Consented cookie data and tracking technology

918k collects your personal data through the following methods:

• Directly from you — via the account registration form, KYC verification process, customer support requests and written communications with the 918k team.
• Automatically — via cookies, server logs, and tracking technologies that operate when you use the 918k platform.
• From approved third parties — such as identity verification service providers and payment processors (Touch 'n Go, GrabPay, and others) that partner with 918k to process your transactions.

918k processes your personal data solely for legitimate and necessary purposes, including the following:

918k does not sell, rent, or trade your personal data with any third party. However, in the course of normal business operations, 918k may share your data with the following parties under limited and controlled circumstances:

918k shares only the minimum necessary personal data with appointed third-party service providers engaged to support our operations, including:

• Malaysian payment processors such as Touch 'n Go, GrabPay, DuitNow, and FPX providers to process your financial transactions
• Identity verification service providers to handle KYC requirements
• IT infrastructure and cloud computing providers that host the 918k platform

All these service providers are bound by data protection agreements that prohibit them from using your data for any purpose other than what has been assigned.

918k may be required to disclose your personal data to the relevant authorities where mandated by Malaysian law, court order, or for the prevention of criminal activity.

918k retains your personal data only for as long as necessary to fulfil the purposes stated in this Policy, or to comply with legal obligations. The following are our data retention guidelines:

• Active account data: Retained for as long as your 918k account remains active and for a period of 7 years after account closure for anti-money laundering compliance purposes.
• Financial transaction records: Retained for 7 years in compliance with Malaysia's accounting and tax legal requirements.
• Security and activity logs: Retained for 2 years for the purpose of security incident investigations where necessary.
• Marketing data: Retained until you withdraw consent or request deletion.

Once the retention period has lapsed, your personal data will be securely deleted or anonymised in accordance with 918k's data management procedures.

918k implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction or improper disclosure:

• Data encryption in transit using TLS/SSL 256-bit protocol for all communication between your device and 918k's servers
• Data encryption at rest for all sensitive data including financial information and identification documents
• Role-based access control ensuring that only authorised personnel can access personal data relevant to their assigned responsibilities
• Two-factor authentication (2FA) for administrative access to 918k's internal systems
• Security scanning and penetration testing conducted periodically by an independent cybersecurity team
• Privacy awareness training for all 918k staff who handle personal data

The 918k platform uses cookies and similar tracking technologies to enhance the user experience, analyse website traffic, and enable certain functions to operate correctly.

• Necessary Cookies: Required for core 918k platform functions such as login authentication and session management. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use the 918k platform to help us improve performance and the overall user experience.
• Functional Cookies: Allows the 918k platform to remember your preferences, such as language and display settings.
• Marketing Cookies: Used to display relevant advertisements. These cookies require your consent.

You can manage your cookie preferences through your web browser settings. Disabling certain cookies may affect the functionality of the 918k platform. For more information on managing cookies, refer to your browser's help documentation.

In the course of operating the 918k platform, your personal data may be stored or processed on servers located outside Malaysia, particularly for cloud computing infrastructure and technical support services.

When your personal data is transferred outside Malaysia, 918k ensures such transfers are safeguarded through appropriate protection mechanisms, including:

• Data processing agreements incorporating standard data protection clauses
• Transfers only to countries with an equivalent level of data protection
• Compliance with the guidelines of the Malaysia Personal Data Protection Department

The 918k platform is strictly for individuals aged 21 and above. 918k does not knowingly collect personal data from minors.

If we discover that we have collected personal data from a minor without proper parental or guardian consent verification, we will take immediate steps to delete that data and close the relevant account.

To exercise any of the data protection rights set out in this Policy, you may contact the 918k Privacy Officer via:

• Email: support@918k.ws — include "Privacy Rights Request" in the email subject line
• Live Chat: Contact the 24/7 support team through the 918k platform

918k will respond to your request within 14 working days. For complex cases, we may require up to 30 days and will notify you of any delay. This service is provided free of charge for reasonable requests.

We may need to verify your identity before processing your request to ensure your data is not disclosed to unauthorised parties.

918k reserves the right to amend this Privacy Policy at any time to reflect changes in our privacy practices, legal requirements or services offered.

For material amendments, we will notify members via email or in-platform notification at least 7 days before the changes take effect. The "Updated" date at the top of this page will always reflect the latest revision.

If you have any questions, concerns or complaints regarding 918k's Privacy Policy or how we handle your personal data, please contact:

• 918k Privacy Officer: support@918k.ws
• 24/7 Live Chat: Available on the platform after logging in
• FAQ: Visit the 918k FAQ page for an immediate response

If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia Personal Data Protection Department which is the regulatory body for PDPA in Malaysia.