Privacy Policy — Ong888

Introduction

This Privacy Policy ("Policy") is issued by Ong888 ("we", "us", "our", "the Platform") and applies to all personal data collected, processed, stored, and shared in connection with your use of the ong888 platform at https://ong888.cam and any associated services, mobile interfaces, and communications.

Ong888 is committed to protecting the privacy and personal data of all users ("you", "your", "the User") in accordance with applicable data protection and privacy legislation, including the Personal Data Protection Act 2010 (Malaysia) ("PDPA") and any other relevant regulations applicable to the jurisdictions in which we operate.

By registering an account on ong888, making use of our services, or continuing to browse the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the platform and may request account closure in accordance with our Terms & Conditions.

Definitions

For the purposes of this Privacy Policy, the following terms shall bear the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Data Subject" means any natural person whose personal data is processed by ong888, including registered users, prospective users, and support requestees.
• "Data Controller" means ong888, which determines the purposes and means of processing personal data.
• "Data Processor" means any third party engaged by ong888 to process personal data on its behalf, such as payment processors, KYC verification providers, and cloud infrastructure partners.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity verification process required of all users before processing withdrawal requests, in compliance with AML obligations.

Personal Data We Collect

Ong888 collects personal data across several categories depending on the nature of your interaction with the platform. The following table sets out the categories of personal data we collect and examples of the specific data points within each category:

Ong888 does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless expressly required for regulatory compliance purposes, in which case additional specific consent will be sought.

How We Collect Personal Data

Ong888 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, submitting support requests, or communicating with our team via live chat or email.
• Automated Technical Collection: Data collected automatically when you access or use the platform, including IP addresses, device identifiers, browser fingerprints, and session activity logs, through server logs, cookies, and similar tracking technologies.
• Third-Party Payment Processors: Transaction confirmations, payment method ownership verifications, and fraud signals shared with ong888 by payment processors including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and card networks.
• Identity Verification Partners: Results of KYC and document verification checks conducted by ong888's appointed third-party verification service providers in connection with account opening and withdrawal requests.
• Publicly Available Sources: In limited circumstances, ong888 may verify identity-related information against publicly available government or credit bureau databases where required for AML compliance purposes.

Data Processing & Use

Ong888 processes personal data only for specific, legitimate purposes. The following table sets out the primary purposes for which we process personal data and the corresponding legal basis for each:

Ong888 will not use your personal data for purposes incompatible with those listed above without obtaining your prior consent. Where we wish to use personal data for direct marketing purposes, we will request separate, explicit opt-in consent and provide a clear and easy mechanism to withdraw that consent at any time.

Legal Basis for Processing

Ong888 processes personal data under one or more of the following legal bases, in accordance with the Personal Data Protection Act 2010 (Malaysia) and applicable international data protection standards:

1. Contractual Necessity: Processing is necessary for the performance of our contract with you — specifically, to operate your account, process transactions, and deliver the services you have requested.
2. Legal Obligation: Processing is required for compliance with applicable legal obligations, including anti-money laundering (AML) laws, know-your-customer (KYC) regulations, and tax reporting requirements.
3. Legitimate Interests: Processing is necessary for the legitimate interests of ong888, including fraud prevention, platform security, responsible gambling monitoring, and product improvement — provided those interests are not overridden by your fundamental rights and freedoms.
4. Consent: Where we rely on consent as the legal basis — such as for optional marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

Ong888 does not sell, rent, or commercially trade your personal data. We share personal data only in the following limited and controlled circumstances:

• Payment Service Providers: Transaction data is shared with payment processors including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and associated Malaysian banking partners (Maybank, CIMB, Public Bank, Hong Leong) solely to facilitate the processing of deposits and withdrawals.
• Identity Verification Partners: Identity documents and personal data are shared with appointed KYC and AML compliance service providers for the purpose of verifying your identity and satisfying regulatory obligations.
• Platform Technology Partners: Technical data may be shared with cloud hosting, analytics, and cybersecurity service providers engaged by ong888 on a data processing agreement basis. These partners are contractually prohibited from using data for any purpose other than the services they provide to ong888.
• Regulatory and Law Enforcement Authorities: Ong888 will disclose personal data to government authorities, regulators, or law enforcement agencies where required to do so by law, court order, or regulatory instruction — including in connection with AML investigations or fraud reporting.
• Professional Advisers: In limited circumstances, personal data may be disclosed to legal counsel, auditors, or other professional advisers where necessary for the conduct of legal proceedings or regulatory compliance activities.

Data Retention

Ong888 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to applicable legal requirements. The following general retention periods apply:

• Account Data: Retained for the duration of the account relationship and for a minimum of five (5) years following permanent account closure, in compliance with AML record-keeping obligations.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years from the date of the transaction, as required for tax and financial reporting compliance.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years post-account closure, in accordance with AML legislation.
• Support Communications: Customer service interactions are retained for three (3) years to enable effective complaint management and dispute resolution.
• Technical and Usage Data: Aggregated usage and technical data is retained for up to two (2) years for platform improvement and security monitoring purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Where anonymisation is performed, the resulting aggregated data is no longer personal data and may be retained indefinitely for analytical purposes.

Data Security

Ong888 implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the ong888 platform;
• Encrypted storage of all sensitive personal and financial data at rest using industry-standard encryption protocols;
• Role-based access controls ensuring that personal data is accessible only to authorised personnel with a demonstrated operational need;
• Two-factor authentication (2FA) available for all user accounts and required for all internal staff accessing personal data systems;
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists;
• Documented incident response procedures enabling prompt identification, containment, and notification in the event of a data security incident; and
• Employee training on data protection obligations and security best practices.

Notwithstanding these measures, no internet transmission or electronic storage system is entirely immune to security risk. If you become aware of any unauthorised access to your account or suspect a security breach, please notify us immediately at [email protected].

Cookies & Tracking Technologies

Ong888 uses cookies — small text files placed on your device — and similar tracking technologies to enable core platform functionality, enhance your browsing experience, and collect aggregate usage analytics. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session authentication cookies, security tokens, and load-balancing identifiers. These cannot be disabled without impacting platform usability.
• Functional Cookies: Enable personalised features such as remembering your language preference, display settings, and previously selected game categories.
• Analytical Cookies: Collect anonymised, aggregated data about how users interact with the platform — including pages visited, session duration, and navigation paths — to help us understand and improve platform performance.
• Security Cookies: Used for fraud detection and to identify unusual access patterns that may indicate account compromise or bot activity.

You may manage or disable non-essential cookies through your browser's privacy settings at any time. Please note that disabling certain cookies may affect the availability of some platform features. Ong888 does not use third-party advertising or retargeting cookies.

Your Data Rights

As a data subject, you are entitled to exercise the following rights in relation to your personal data held by ong888. To exercise any of these rights, please contact our support team via live chat or at [email protected], quoting your registered account email address:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. You may update certain account information directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected. Note that certain data must be retained to comply with AML and tax obligations, which will take precedence over erasure requests in those circumstances.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, subject to our ability to demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

Ong888 will respond to all data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

Minors & Age Restriction

The ong888 platform is strictly intended for use by adults aged 21 years and above. Ong888 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory element of our account registration and KYC processes.

If ong888 becomes aware that personal data has been collected from a person under the age of 21 without appropriate consent, we will take prompt steps to delete that data and close the associated account. Any winnings accrued on such an account are void and will not be paid out, as set out in our Terms & Conditions.

International Data Transfers

Ong888's primary operations and data processing infrastructure are located in the Asia-Pacific region. In certain limited circumstances — such as where ong888 engages cloud service providers or KYC verification partners with infrastructure located outside Malaysia — personal data may be transferred to and processed in jurisdictions outside your country of residence.

Where personal data is transferred internationally, ong888 ensures that appropriate safeguards are in place to protect the data in accordance with the applicable data protection standards, including contractual data processing agreements with receiving parties that incorporate appropriate data protection obligations and, where applicable, standard contractual clauses or equivalent mechanisms.

By using the ong888 platform and providing your personal data, you acknowledge and consent to the international transfer of your data for the purposes described in this Policy, subject to the safeguards described above.

Amendments to This Policy

Ong888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes to this Policy will be communicated to registered users via email to the address held on file and by a prominent notice on the ong888 platform for a period of not less than 14 days prior to the effective date of the change.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how we protect your data. Your continued use of the ong888 platform following the effective date of any update constitutes your acceptance of the revised Policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ong888, please contact our Data Protection team through the following channels:

• Email: [email protected] — Please include "Privacy Request" or "Data Enquiry" in the subject line, along with your registered account email address. Responses will be provided within 5 business days for general enquiries and within 30 calendar days for formal data rights requests.
• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the ong888 platform. Live chat is suitable for general privacy enquiries; formal data rights requests should be submitted via email for proper documentation.
• Help Centre: Our FAQ page contains answers to many common questions about account data, security, and privacy practices on ong888.