vega888 Privacy Policy

§ 01 Who We Are

vega888 is an online gaming platform operating at vega888.one, licensed under an international gaming authority. For the purposes of applicable data protection law, vega888 is the data controller in respect of the personal data collected through the Platform. We are responsible for ensuring that personal data is processed in accordance with this Policy and any applicable data protection regulations.

The Platform is operated by the vega888 entity identified in your Account registration documentation. If you have questions about our data practices or the identity of the data controller, please contact us using the details in Section 14.

§ 02 Personal Data We Collect

We collect personal data across several categories. The table below summarises what we collect and why:

We do not collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where strictly required by our regulatory obligations — for example, health-related data may be collected in the context of responsible gaming self-exclusion requests where the Player voluntarily discloses such information.

§ 03 How We Collect Your Data

vega888 collects personal data through the following channels:

• Direct submission — data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion;
• Automated technical collection — data collected automatically when you interact with the Platform, including IP address, device identifiers, browser type, and session data via cookies and similar tracking technologies (see Section 7);
• Third-party sources — data received from payment processors (Maybank, CIMB, Public Bank, FPX, Touch & Go eWallet, Boost) to confirm transaction status; identity verification service providers used for KYC processing; and fraud prevention data aggregators used to protect the Platform's integrity.

§ 04 Legal Basis for Processing

vega888 processes personal data on the following legal grounds:

• Contractual necessity — processing required to fulfil our obligations under the Player Account agreement, including account management, payment processing, game delivery, and customer support;
• Legal obligation — processing required to comply with our gaming licence conditions, anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, and any other applicable regulatory obligations;
• Legitimate interests — processing carried out for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where those interests are not overridden by your data protection rights;
• Consent — processing carried out with your explicit consent, such as sending promotional communications. You may withdraw consent at any time by contacting support.

§ 05 How We Use Your Personal Data

vega888 uses your personal data for the following purposes:

• Creating and managing your Account, including processing your registration and maintaining your account profile;
• Verifying your identity and age in accordance with our KYC obligations under international gaming authority requirements;
• Processing deposits, withdrawals, and other financial transactions via your chosen MYR payment method;
• Delivering gaming products and services, including live casino, sportsbook, slots, and Fisher Game;
• Administering bonuses, promotions, and the vega888 VIP loyalty programme;
• Providing 24/7 customer support and resolving disputes;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activity;
• Monitoring gaming behaviour for responsible gaming purposes and, where necessary, applying account restrictions;
• Complying with regulatory reporting obligations and responding to lawful requests from competent authorities;
• Improving Platform performance, user experience, and product features through aggregated analytics;
• Sending account-related notifications (transaction confirmations, security alerts, KYC status updates) — these are not optional as they are required for Platform operation;
• Where you have consented, sending promotional communications about bonuses, new games, and special offers.

§ 06 Data Sharing & Disclosure

vega888 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data with the following categories of recipient only where necessary and under strict data processing agreements:

• Payment service providers — Maybank, CIMB, Public Bank, FPX, Touch & Go eWallet, Boost, and other payment processors, solely for the purpose of processing transactions;
• Identity verification providers — third-party KYC service providers used to verify your identity and age as required under our licensing obligations;
• Game software providers — Pragmatic Play, Habanero, Spadegaming, and other certified game developers who provide the gaming software accessed through the vega888 platform. These providers operate their own RNG and game logic systems independently;
• Fraud prevention and security services — service providers that assist vega888 in detecting and preventing fraudulent activity, money laundering, and other prohibited conduct;
• Regulatory and law enforcement authorities — where we are legally required to disclose data in response to a court order, regulatory investigation, or other lawful authority request;
• Professional advisers — lawyers, auditors, and other professional advisers bound by confidentiality obligations, where disclosure is necessary for obtaining professional advice.

All third-party data processors engaged by vega888 are required to process personal data only for the purposes specified, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection law.

§ 07 Cookies & Tracking Technologies

7.1 Types of Cookies Used

The vega888 Platform uses cookies and similar tracking technologies to deliver its services and improve user experience. The following categories of cookies are used:

• Essential cookies — strictly necessary for the Platform to function. These include session authentication cookies that keep you logged in, security tokens, and load-balancing cookies. These cannot be disabled without severely impairing Platform functionality.
• Functional cookies — used to remember your preferences, such as language settings, game lobby filters, and display preferences, to provide a more personalised experience across sessions.
• Analytics cookies — used to collect aggregated, anonymised data about how Players use the Platform — which pages are visited most frequently, where users drop off, and how features are used. This data is used solely to improve Platform design and performance.
• Security cookies — used to detect and prevent fraud, bot activity, and unauthorised access attempts. These cookies do not track cross-site browsing activity.

7.2 Cookie Management

You can manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Please note that disabling essential cookies will impair your ability to log in and use the vega888 Platform. Instructions for managing cookies are available in the help documentation of your browser.

§ 08 Data Security

vega888 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser and vega888 servers;
• Encryption at rest for all sensitive personal data and financial records stored in vega888 databases;
• Role-based access controls ensuring that only authorised personnel with a documented operational need can access personal data;
• Multi-factor authentication requirements for all vega888 staff with access to production data systems;
• Regular independent security audits and penetration testing conducted by qualified third-party security firms;
• Automated intrusion detection systems monitoring for anomalous access patterns in real time;
• Incident response procedures for detecting, reporting, and remediating any personal data breach within the timeframes required by applicable regulation.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is 100% secure. In the event of a data breach affecting your personal data, vega888 will notify you and the relevant regulatory authority in accordance with applicable legal requirements.

§ 09 Data Retention

vega888 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. The following general retention periods apply:

• Account and identity data — retained for the duration of your account and for a minimum of five (5) years following account closure, as required under anti-money laundering regulations;
• Financial transaction records — retained for a minimum of seven (7) years from the date of the transaction, as required for financial compliance and tax purposes;
• Gaming history — retained for a minimum of five (5) years to support dispute resolution and regulatory audit obligations;
• Support communications — retained for a minimum of two (2) years from the date of the interaction;
• Marketing consent records — retained for as long as the consent is active and for a period thereafter sufficient to demonstrate historical consent status if required.

Data that is no longer required for any legitimate purpose is securely deleted or anonymised in accordance with vega888's internal data lifecycle management procedures.

§ 10 Your Data Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by vega888:

• Right of access — the right to request a copy of the personal data we hold about you;
• Right to rectification — the right to request correction of inaccurate or incomplete personal data;
• Right to erasure — the right to request deletion of your personal data, subject to our legal obligations to retain certain data (see Section 9);
• Right to restriction of processing — the right to request that we restrict processing of your data in certain circumstances;
• Right to data portability — the right to receive a copy of your personal data in a structured, commonly used, machine-readable format where technically feasible;
• Right to object — the right to object to processing based on legitimate interests, including profiling for marketing purposes;
• Right to withdraw consent — where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact vega888 support via Live Chat or the email address in Section 14. We will respond to all data rights requests within thirty (30) calendar days. We may need to verify your identity before processing a request. In some cases, applicable law may permit or require us to refuse a request — where this occurs, we will explain the reason in our response.

§ 11 Children's Privacy

The vega888 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from an individual under 21, we will take immediate steps to delete that data and close the associated account. Any winnings generated by an underage user will be forfeited in full.

Parents and guardians are responsible for ensuring that minors do not access the Platform on shared devices. If you believe a minor has registered an account on vega888, please contact our support team immediately so that appropriate action can be taken.

§ 12 International Data Transfers

In the course of operating the vega888 Platform, your personal data may be transferred to and processed in countries outside Malaysia — for example, by third-party game software providers or cloud infrastructure providers whose servers are located in other jurisdictions. Where such transfers occur, vega888 ensures that appropriate safeguards are in place to protect your personal data, including: contractual protections via data processing agreements with all third-party processors; and use of service providers who maintain security standards equivalent to or exceeding those required under applicable Malaysian and international data protection law.

§ 13 Updates to This Policy

vega888 reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered Players via email notification to the address on file or via a notification upon next login to the Platform. The "Last Updated" date at the top of this page reflects when the current version of the Policy took effect. Continued use of the Platform following notification of a material change constitutes acceptance of the revised Policy.

We encourage you to review this Policy periodically to stay informed about how we handle your personal data. If you have questions about any changes, please contact us using the details below.

§ 14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or vega888's data practices, please contact our Data Privacy team through the following channels:

• Live Chat: Available 24/7 via the Platform — average response time 3–5 minutes;
• Email (plain text — not a link): [email protected]

For formal data protection requests (access, erasure, portability), please use the email channel and include "Data Rights Request" in the subject line along with your registered username. We aim to acknowledge all formal requests within three (3) business days and resolve them within thirty (30) calendar days.