Privacy Policy RTF88 – Data Protection Malaysian Member Personal

This Privacy Policy is published by RTF88 and applies to all users who access the RTF88 platform via the website rtf88.xyz, the mobile app, and all other official RTF88 channels. This document outlines the personal data collection, use, storage and protection practices applied by RTF88.

By using the RTF88 platform, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please stop using the platform and contact our support team for assistance with closing your account and requesting deletion of your data.

RTF88 takes the privacy of our Malaysian members seriously. We understand that trust is the foundation of our relationship with you — and a clear, transparent, and upheld privacy policy is how we prove that trust is more than just words.

RTF88 only collects information that is directly necessary to provide a safe, efficient and legally compliant service. The types of information we collect are as follows:

RTF88 no directly collect credit or debit card information — all payments are processed through approved third-party payment providers such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay and FPX (Maybank2u, CIMB Clicks), each of which maintains its own privacy policy and security standards.

RTF88 uses your personal data solely for the following legitimate and necessary purposes:

• Service provision: Managing your account, processing deposits and withdrawals in Malaysian Ringgit (MYR), crediting winnings and bonuses, and ensuring a seamless gaming experience on the RTF88 platform.
• Identity verification and security: Ensuring every account is held by a verified individual aged 18 and above, and preventing fraud, money laundering and platform misuse.
• Legal compliance: Meeting RTF88's obligations under Malaysia's PDPA, the Anti-Money Laundering Act (AMLA), and relevant industry regulations.
• Service communications: Sending important notifications relating to your account, transactions, active promotions and service updates via SMS, email or in-platform notifications.
• Platform improvement: Analysing aggregated (not individual) usage patterns to improve the design, performance, and features of the RTF88 platform.
• Responsible gaming: Monitoring gameplay patterns to identify members who may benefit from responsible gaming support – as part of RTF88's commitment to member well-being.
• Customer support: Enabling the RTF88 support team to efficiently resolve enquiries, complaints, and technical issues in Bahasa Melayu.

RTF88 will not use your data for purposes beyond those listed above without first obtaining your renewed consent.

In accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), RTF88 processes your personal data on the following lawful bases:

• Consent: You provide explicit consent when registering an RTF88 account and accepting these Terms & Conditions and Privacy Policy. You may withdraw this consent at any time by contacting the RTF88 privacy team.
• Performance of contract: RTF88 needs to process certain data to fulfil our contractual obligations to you – including processing deposits, paying out winnings, and managing promotional bonuses.
• Legal obligation: Some data processing is mandatory under applicable Malaysian law, including anti-money laundering requirements that oblige us to retain certain transaction records.
• Legitimate interests: RTF88 processes certain technical data on the basis of legitimate interests to prevent fraud, ensure platform security and improve our services — provided these interests do not override your privacy rights.

However, there are limited situations in which RTF88 may need to share your data with other parties, all for legitimate purposes and governed by confidentiality agreements:

• Payment providers: Required information is shared with Malaysia's e-wallet and online banking providers (DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, Maybank2u, CIMB Clicks) solely for the purpose of processing your financial transactions.
• Technology infrastructure provider: RTF88 uses cloud computing services and other technologies from carefully selected providers. These providers are bound by strict data processing agreements and are not permitted to use RTF88 member data for their own purposes.
• Lawful authorities: RTF88 may be required to disclose data to law enforcement agencies, courts, or regulatory authorities in Malaysia where mandated by a court order or applicable law. In each such case, RTF88 will endeavour to notify the relevant member if permitted to do so by law.
• Business transfer: In the event of a merger, acquisition or transfer of RTF88's assets, member data may be transferred to the successor entity. In such cases, RTF88 will ensure that the receiving party upholds data protection standards at least equivalent to those in this policy, and members will be notified prior to the transfer.

RTF88 continuously invests in the latest data security infrastructure. The technical and organisational measures we employ to protect member data are as follows:

• 256-bit SSL Encryption: All data transmitted between your browser or app and RTF88's servers is encrypted using TLS 1.3 — the latest standard ensuring no third party can intercept or read your data while in transit.
• Database-level data encryption: Sensitive data such as identification numbers and financial information is stored in encrypted form within RTF88's databases, not in plain text.
• Role-based access control: RTF88 staff may only access member data within the scope of their respective roles. Access to sensitive data requires multi-level approval and is fully logged.
• Two-factor authentication (2FA): All RTF88 internal systems storing member data require two-factor authentication for staff access. We also encourage members to enable 2FA on their own accounts.
• Real-time threat monitoring: RTF88's security systems monitor for abnormal activity 24 hours a day, 7 days a week. Any suspicious activity automatically triggers an immediate response and investigation by the security team.
• Regular security audits: RTF88 conducts regular internal security audits and independent penetration testing to identify and address any vulnerabilities before they can be exploited.

While no security system can guarantee absolute protection in a digital environment, RTF88 takes all reasonable steps in line with industry standards to ensure member data is protected to the greatest extent possible.

RTF88 retains member personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required under Malaysian law:

• Active account data: Retained for the duration of your account and for several years after account closure to meet legal requirements.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date, in line with Malaysia's financial and anti-money laundering legal requirements.
• Customer support communication logs: Retained for 3 years to facilitate the resolution of complaints and historical service reference.
• Technical data and access logs: Retained for 12 months for security and fraud detection purposes.
• Marketing data (with consent): Retained until you withdraw your consent to marketing communications.

Once the retention period expires, RTF88 will either securely delete your data or anonymize it so that it can no longer be linked to you personally. The deletion process follows industry-standard methods to ensure that deleted data cannot be recovered.

The RTF88 platform uses cookies and similar tracking technologies to enhance your experience. Cookies are small text files stored on your device when you visit our website. The following are the types of cookies we use:

You can manage your cookie preferences through your web browser settings. Please note that disabling required cookies may affect core functions of the RTF88 platform, such as the ability to stay logged in. Optional cookies can be disabled without impacting the platform's main functionality.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and RTF88's privacy policy, you have the following rights regarding your personal data:

• Right to access data: You have the right to request a copy of all personal data RTF88 holds about you. Requests will be processed within 14 business days and can be submitted by email to privacy@rtf88.xyz.
• Right to correct data: If any information we hold about you is inaccurate or incomplete, you have the right to request a correction. Basic details such as your phone number can be updated directly in your account settings.
• Right to erasure ("right to be forgotten"): You may request that RTF88 delete your personal data, subject to our legal obligations to retain certain records (such as financial transaction records).
• Right to object to processing: You may object to the processing of your data for specific purposes, particularly for direct marketing. You can opt out of marketing communications at any time via the unsubscribe link in our emails or through your account settings.
• Right to restrict processing: In certain circumstances, you may request that RTF88 restrict the processing of your data — for example, while you are disputing the accuracy of your data or awaiting the outcome of a complaint.
• Right to data portability: You have the right to receive the personal data you have provided to RTF88 in a machine-readable format (such as CSV or JSON) for the purpose of transferring it to another service provider.
• Right to withdraw consent: Where the processing of your data is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to the withdrawal.

To exercise any of the above rights, contact RTF88's Privacy Officer at privacy@rtf88.xyz or via live chat on the platform. We will respond to your request within the timeframe required by law.

Should we become aware that personal data belonging to an individual under the age of 18 has been collected without valid parental or guardian consent, RTF88 will immediately take the following steps:

• Immediate account closure
• Deleting all personal data belonging to that individual from our systems
• Returning any valid financial balance to the original payment method
• Reporting the incident to the relevant authorities where necessary

If you believe or suspect that someone under the age of 18 is using the RTF88 platform, please contact us immediately at support@rtf88.xyz so that we can take the appropriate action.

RTF88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in data processing practices, new legal requirements, or improvements to our services. Any amendments will be communicated to members via:

• In-platform notification on RTF88 when you log in after the amendments take effect
• Notification email sent to the email address registered to your account
• Update the "Last Updated" date at the top of this document

For material amendments that significantly affect your privacy rights, RTF88 will provide at least 14 days' notice before the changes take effect and will request your active confirmation where required. Your continued use of the RTF88 platform after the amendments take effect will be considered acceptance of the updated Privacy Policy.

If you have any questions, concerns or complaints regarding this Privacy Policy or how RTF88 handles your personal data, please contact our Privacy Officer through the following channels:

• Privacy Email: privacy@rtf88.xyz (for privacy enquiries and data rights requests)
• Support Email: support@rtf88.xyz (for general enquiries)
• Live Chat: Available 24/7 within the RTF88 platform in Bahasa Melayu

The RTF88 privacy team is committed to responding to all privacy-related enquiries within 5 business days. For requests that require longer processing time — such as data access or data deletion requests — we will inform you of the estimated completion time in our initial response.