01 Introduction
This Privacy Policy ("Policy") is issued by AR88 ("we", "us", "our", "the Platform") and governs the collection, processing, storage, and use of personal data relating to all registered users and visitors ("you", "User", "Player") of the AR88 online gaming platform available at ar88.cam.
AR88 takes the privacy of its users seriously. We are committed to processing personal data in a transparent, fair, and lawful manner consistent with applicable data protection principles and the requirements of our international gaming licence. This Policy describes our data practices in plain language so that every player — whether based in Kuala Lumpur, Penang, Johor Bahru, or anywhere else in Malaysia — understands precisely how their information is used.
By creating an Account on AR88 or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood the data practices described herein. If you do not agree with any provision of this Policy, you must discontinue use of the Platform and may request Account closure in accordance with our Terms & Conditions.
This Policy should be read alongside AR88's Terms & Conditions and our Responsible Gambling policy, both of which contain additional provisions that are relevant to your relationship with the Platform.
02 Definitions
For the purposes of this Privacy Policy, the following terms shall carry the meanings ascribed to them below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably be used to identify a living individual, including name, email address, date of birth, IP address, payment details, and device identifiers. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, or deletion. |
| "Data Controller" | AR88, which determines the purposes and means by which Personal Data is processed. |
| "Data Processor" | A third party that processes Personal Data on behalf of AR88 under a contractual data processing agreement. |
| "KYC Data" | Identity and age verification documents collected as part of the Know Your Customer process, including government-issued identification and proof of address. |
| "Cookies" | Small text files stored on a User's device by the Platform's web server, used to record session state, preferences, and analytical data. |
| "Third Parties" | External organisations engaged by AR88 to provide services that involve access to or processing of Personal Data, including payment processors, game studios, fraud prevention providers, and analytics suppliers. |
03 Personal Data We Collect
AR88 collects Personal Data across several categories, depending on the nature of your interaction with the Platform. We collect only the data that is necessary and proportionate to the purposes described in this Policy.
Collected at the point of Account registration. This data is used to create and maintain your Account, communicate with you, and satisfy our obligations under applicable know-your-customer and anti-money laundering requirements.
Required before withdrawal processing can be completed. KYC data is handled with enhanced security controls and retained only for the duration required by our licensing and AML obligations.
Includes records of all deposits, withdrawals, and in-Platform transactions. We do not store full card numbers or banking credentials. Payment method references are stored in tokenised form where applicable. Malaysian e-wallet details (Touch 'n Go, Boost, GrabPay, DuitNow) are referenced by account identifier only.
Collected automatically during Platform use via cookies, server logs, and analytics tools. This data is used to ensure Platform security, detect fraud, improve user experience, and compile aggregated statistical reports.
Records of all support interactions, formal complaints, and user-initiated communications are retained for quality assurance, training, dispute resolution, and compliance purposes.
Data relating to responsible gambling tools you have activated on your Account. This data is processed in your best interests and retained for the minimum period necessary to enforce the relevant restriction.
04 How We Collect Your Data
AR88 collects Personal Data through the following mechanisms:
- Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, set responsible gambling preferences, or otherwise interact with the Platform.
- Automatically — through cookies, web beacons, server access logs, and analytics software embedded in the Platform, which record technical and behavioural data during your session.
- From third parties — including identity verification service providers used to verify the documents you submit during KYC, payment processors who relay confirmation of transactions, and fraud detection partners who flag unusual patterns against industry-wide risk databases.
05 Data Processing & Use
AR88 processes Personal Data for the following purposes:
| Purpose | Data Used | Basis |
|---|---|---|
| Account creation and management | Registration data, identity data | Contract performance |
| KYC age and identity verification | KYC documents, date of birth | Legal obligation / Contract |
| Payment processing (deposits & withdrawals) | Financial data, transaction records | Contract performance |
| Fraud prevention and AML compliance | Financial data, IP, device, usage patterns | Legal obligation / Legitimate interest |
| Customer support and complaints | Communications data, account data | Contract performance / Legitimate interest |
| Responsible gambling monitoring | Play records, limit settings, exclusion data | Legal obligation / Legitimate interest |
| Platform security and integrity | IP, device, session, geolocation | Legitimate interest |
| Service improvement and analytics | Usage data, aggregated play statistics | Legitimate interest |
| Regulatory reporting | Transaction data, account data, KYC | Legal obligation |
| Marketing communications (where consented) | Email, name, preferences | Consent |
AR88 does not use Personal Data for purposes that are incompatible with those listed above without providing prior notice and, where required, obtaining fresh consent.
06 Legal Basis for Processing
AR88 processes Personal Data under one or more of the following legal bases, as applicable to each processing activity:
- Performance of a Contract: Processing necessary to deliver the gaming services you have requested by registering an Account, including account management, payment processing, and customer support.
- Legal Obligation: Processing required to comply with applicable laws and our licensing obligations, including KYC identity verification, anti-money laundering record keeping, responsible gambling enforcement, and regulatory reporting.
- Legitimate Interests: Processing carried out for AR88's legitimate business interests, where such interests are not overridden by your fundamental privacy rights. This includes fraud prevention, Platform security, analytics, and service improvement.
- Consent: Where we rely on your freely given, specific, informed, and unambiguous consent — primarily for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent for marketing will not affect your ability to use the Platform.
07 Data Sharing with Third Parties
AR88 does not sell, rent, or trade Personal Data to any third party for their own marketing or commercial purposes. We share Personal Data only in the limited circumstances described below:
We engage third-party service providers to perform specific functions on our behalf under contractual data processing agreements. These include:
- Payment processors — facilitating MYR transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX bank transfers (Maybank, CIMB, Public Bank), and cryptocurrency channels (USDT TRC20, BTC)
- Identity verification providers — processing KYC documents and performing age and identity checks
- Fraud detection and AML compliance tools — screening transactions against known fraud and money laundering risk indicators
- Game studios — game play data is necessarily processed by the platform infrastructure of our licensed game studio partners to generate and verify game outcomes
- Analytics and platform performance tools — providing aggregated usage and performance data to help us improve the Platform
- Cloud hosting and infrastructure providers — storing and processing Platform data on secure, access-controlled infrastructure
All Data Processors are required to process Personal Data only as instructed by AR88, to maintain appropriate technical and organisational security measures, and to delete or return data at the termination of their engagement.
AR88 may disclose Personal Data to competent authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by law, court order, or the terms of our gaming licence. This may include disclosure of transaction records, account data, or communications in connection with criminal investigations or regulatory audits.
08 Data Retention
AR88 retains Personal Data for no longer than is necessary for the purposes for which it was collected, taking into account our legal and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of Account + 5 years post-closure | AML regulatory obligation |
| KYC identity documents | Duration of Account + 5 years post-closure | AML / licensing obligation |
| Financial transaction records | 7 years from transaction date | AML / accounting obligation |
| Customer support communications | 3 years from last interaction | Legitimate interest / dispute resolution |
| Self-exclusion and RG records | Minimum 5 years | Responsible gambling obligation |
| Session and usage logs | 13 months | Security / analytics |
| Marketing consent records | Until consent is withdrawn + 2 years | Compliance evidence |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our data destruction procedures. Where anonymisation is applied, the resulting data no longer constitutes Personal Data and may be retained indefinitely for statistical purposes.
09 Data Security
AR88 implements and maintains appropriate technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:
- 256-bit SSL/TLS encryption for all data transmitted between your browser or device and the AR88 Platform
- Encryption at rest for sensitive Personal Data stored in AR88's databases, including KYC documents and financial records
- Strict access controls limiting employee access to Personal Data on a need-to-know basis, with access privileges reviewed and audited regularly
- Two-factor authentication options for Player Accounts, and mandatory multi-factor authentication for all AR88 staff with access to production systems
- Regular security audits and penetration testing conducted by independent third-party security specialists
- Incident response procedures ensuring that data security breaches are identified, contained, investigated, and — where legally required — reported within applicable timeframes
11 Your Data Rights
Subject to applicable law and the limitations described below, you have the following rights in relation to your Personal Data held by AR88:
- Right of Access: You have the right to request a copy of the Personal Data AR88 holds about you, together with information about how it is processed. We will provide this within 30 days of a valid request.
- Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data. Note that certain data fields — particularly identity data — can only be corrected via a formal KYC update process.
- Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. This right is subject to AR88's legal retention obligations — we cannot delete data we are required by law or licence to retain.
- Right to Restrict Processing: In certain circumstances, you may request that we restrict processing of your data — for example, while a dispute about data accuracy is being resolved.
- Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format where processing is based on your consent or a contract.
- Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gambling monitoring purposes. We will consider your objection and cease processing unless we have compelling legitimate grounds that override your interests.
- Right to Withdraw Consent: Where processing is based on your consent — primarily marketing communications — you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of the above rights, please contact our Data Privacy team via the contact details in Section 15. We may request identity verification before fulfilling data rights requests to ensure we do not disclose data to an unauthorised third party.
12 Minors & Age Policy
AR88 is an online gambling platform strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain Personal Data relating to individuals under the age of 21.
Age verification is conducted as part of the mandatory KYC process before any withdrawal from an Account is processed. Where AR88 has reasonable grounds to believe that an Account may belong to a person under 21, the Account will be suspended immediately and all associated data will be subject to an enhanced review.
If you believe that AR88 may have inadvertently collected Personal Data relating to a person under the age of 21, please contact us immediately at the details in Section 15 so that we may investigate and take appropriate remedial action, including deletion of the relevant data.
13 International Data Transfers
AR88 operates as an international platform. In the course of our operations, your Personal Data may be transferred to and processed in countries outside Malaysia, including the jurisdiction in which AR88 holds its gaming licence and the locations of our third-party service providers' infrastructure.
Where Personal Data is transferred outside Malaysia, AR88 takes appropriate steps to ensure that an adequate level of protection is maintained, consistent with the data protection principles applicable under our licensing framework. These steps include:
- Executing data processing agreements with all third-party processors that incorporate appropriate data protection obligations
- Selecting service providers who maintain internationally recognised security certifications
- Ensuring that any recipient jurisdiction provides an adequate level of protection for Personal Data, or that appropriate contractual safeguards are in place
By using AR88, you acknowledge that your Personal Data may be processed in jurisdictions outside Malaysia as described in this section.
14 Amendments to This Policy
AR88 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. When material changes are made, we will notify registered Players by email to their registered address and/or by displaying a prominent notice on the Platform prior to the changes taking effect.
The effective date of the most recent revision is displayed at the top of this page. We recommend that you review this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy.
If any amendment reduces your rights or increases AR88's data processing activities in a materially adverse way, we will provide not less than 14 days' advance notice before the change takes effect, and you will have the option to close your Account if you do not agree to the revised terms.
15 Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy, your Personal Data, or your data rights, please contact AR88 through the following channels:
| Channel | Details | Response Time |
|---|---|---|
| Live Chat | Available via the Platform interface (bottom-right chat icon) | Under 90 seconds, 24/7 |
| Privacy Email | support@ar88.cam — Subject line: "Privacy Request" | Within 30 days for data rights requests; acknowledgement within 48 hours |
For formal data rights requests (access, erasure, portability, objection), please submit your request in writing via email with a subject line beginning "Data Rights Request:" and include your registered email address and the nature of your request. We will acknowledge your request within 48 hours and provide a substantive response within 30 days.
AR88 serves players across Malaysia — from Kuala Lumpur and Petaling Jaya to Penang, Johor Bahru, and Shah Alam. Our team is available around the clock to address any privacy query or concern you may have.