Privacy Policy

1. About This Policy

1.1 This Privacy Policy ("Policy") is issued by the operator of the i1m88 platform ("i1m88", "we", "us", "our") and applies to all personal data collected from individuals ("you", "user", "Player") who access or use the i1m88 website at i1m88.app, the i1m88 Android application, the i1m88 iOS progressive web application, and any associated services (collectively, the "Platform").

1.2 i1m88 acts as the data controller in respect of personal data processed under this Policy, except where a third-party provider operates as an independent data controller in relation to services it delivers directly to you (for example, payment processing services operated by banks and e-wallet providers such as Maybank, CIMB, or Touch 'n Go).

1.3 By registering an account with i1m88 or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

2. Data We Collect

i1m88 collects personal data in the following categories:

• Identity Data: Full legal name, date of birth, nationality, and Malaysian identification number (MyKad number or equivalent passport number for non-citizens) collected during registration and KYC verification.
• Contact Data: Email address, Malaysian mobile phone number, and mailing address (where required for KYC or prize fulfilment purposes).
• Financial Data: Bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), transaction history, deposit records, withdrawal requests, and gaming account balances denominated in MYR.
• Technical Data: IP address, device type and identifier, browser type and version, operating system, referring URL, session duration, and login timestamps.
• Usage Data: Games played, bets placed, stakes, outcomes, bonus usage, and navigation patterns within the Platform.
• Communications Data: Support tickets, live chat transcripts, email correspondence, and any other communications you initiate with i1m88.
• Verification Documents: Copies of identity documents (MyKad, passport), proof of address, and source-of-funds documentation submitted during KYC processes.

i1m88 does not knowingly collect special category data (such as racial or ethnic origin, religious beliefs, or health data) except where voluntarily disclosed in the context of a responsible gaming self-exclusion or support request, in which case such data is processed only to the extent strictly necessary to fulfil the requested service.

3. How We Use Your Data

i1m88 uses the personal data it collects for the following purposes:

1. Account management and service delivery: Creating and maintaining your i1m88 account, authenticating your identity at login, processing deposits and withdrawals, and providing access to games and betting markets.
2. KYC and age verification: Verifying that you meet the minimum age requirement of 21 years and satisfying regulatory obligations relating to player identity verification and source-of-funds checks.
3. Anti-money laundering (AML) and fraud prevention: Monitoring transaction patterns, identifying suspicious activity, and fulfilling reporting obligations to financial intelligence authorities where required by applicable law.
4. Responsible gaming: Identifying indicators of problem gambling, enforcing self-exclusion requests, and implementing deposit limits or account restrictions requested by you or required by our licence conditions.
5. Customer support: Responding to your enquiries, resolving disputes, and improving the quality of support services through analysis of support interaction data.
6. Marketing communications: Sending promotional emails, SMS, or in-platform notifications about i1m88 bonuses and offers — subject to your communication preferences and applicable opt-out rights.
7. Platform improvement: Analysing aggregated usage data to identify technical issues, optimise user experience, and prioritise product development.
8. Legal compliance: Meeting obligations under gaming regulation, data protection law, tax law, and any other applicable legal or regulatory requirement.

4. Legal Bases for Processing

i1m88 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and i1m88 — including account creation, deposits, withdrawals, and game delivery.
• Legal obligation: Processing required to comply with applicable law, including KYC obligations, AML reporting, gaming licence conditions, and tax regulations.
• Legitimate interests: Processing for fraud detection, security monitoring, platform analytics, and responsible gaming risk identification, where such interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications, where you have opted in, and for any processing activity for which consent is the designated legal basis. You may withdraw consent at any time by updating your communication preferences in account settings or by contacting [email protected].

5. Cookies & Tracking Technologies

5.1 i1m88 uses cookies and similar tracking technologies (including local storage and session tokens) on the Platform for the following purposes:

• Essential cookies: Required for core Platform functionality, including session management, login state persistence, and security token validation. These cannot be disabled without impairing the Platform's operation.
• Analytical cookies: Used to collect aggregate data on how users navigate the Platform, which pages are visited most frequently, and where technical errors occur. Data collected is anonymised where possible.
• Preference cookies: Storing user interface preferences such as language selection and display settings.

5.2 You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies will prevent you from logging in to your i1m88 account and accessing Platform features.

5.3 i1m88 does not permit third-party advertising networks to place tracking cookies on the Platform without your prior consent.

6. Sharing Your Data

i1m88 does not sell or rent your personal data. We may share your data with the following categories of recipients:

• Payment processors and financial institutions: Banks (Maybank, CIMB, Public Bank, Hong Leong), e-wallet operators (Touch 'n Go, Boost, GrabPay), and FPX / DuitNow service providers, for the purpose of processing your deposits and withdrawals.
• Game providers: Software providers whose games are integrated into the i1m88 Platform (such as Pragmatic Play, PG Soft, and Evolution Gaming) where player session data must be transmitted to deliver the game experience. These providers process data under their own privacy policies and are required by i1m88 to maintain appropriate data protection standards.
• KYC and identity verification services: Third-party providers that assist with document verification and biometric identity checks as part of the KYC process.
• Regulatory authorities and law enforcement: Competent authorities, including gaming regulators, financial intelligence units, and law enforcement agencies, where i1m88 is legally required or authorised to make such disclosures.
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by i1m88 under appropriate confidentiality obligations.
• Group companies and successors: In the event of a corporate restructuring, merger, acquisition, or sale of all or part of i1m88's business assets, personal data may be transferred to the acquiring entity subject to equivalent data protection commitments.

7. International Data Transfers

7.1 i1m88 may transfer your personal data to servers, service providers, or group entities located outside Malaysia. Where such transfers occur, i1m88 implements appropriate safeguards to ensure that your data receives a level of protection equivalent to that required under applicable Malaysian and international data protection standards.

7.2 Safeguards for international transfers may include standard contractual clauses, data processing agreements with adequacy provisions, or transfers to jurisdictions recognised as providing adequate data protection.

8. Data Retention

8.1 i1m88 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of seven (7) years following the relevant transaction, in accordance with applicable financial reporting obligations.
• KYC documents: Retained for a minimum of five (5) years following the completion of the business relationship or the date of the relevant transaction, whichever is later.
• Support communications: Retained for a maximum of three (3) years from the date of the interaction unless the subject matter requires longer retention for legal proceedings.
• Marketing preferences and opt-out records: Retained indefinitely to evidence compliance with consent and opt-out obligations.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the individual's identity.

9. Security Measures

9.1 i1m88 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between your device and i1m88's servers.
• AES-256 encryption for personal data stored at rest on i1m88's servers and backup systems.
• Role-based access controls limiting internal access to personal data to authorised personnel with a documented operational need.
• Multi-factor authentication for i1m88 staff accessing internal systems containing personal data.
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security professionals.
• Audit logging of all access to personal data held in i1m88's systems.

9.2 Notwithstanding the foregoing, no data transmission over the internet or electronic storage system is entirely secure. i1m88 cannot guarantee absolute security but is committed to maintaining security standards that reflect industry best practice for a regulated gaming operator.

10. Your Rights

Subject to applicable law and certain exceptions (including where data must be retained for legal or regulatory reasons), you have the following rights in respect of your personal data held by i1m88:

• Right of access: You may request a copy of the personal data i1m88 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected and where no legal retention obligation applies.
• Right to restrict processing: You may request that i1m88 restrict processing of your data pending resolution of a dispute about its accuracy or the legitimacy of its processing.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including direct marketing. Where your objection relates to direct marketing, i1m88 will cease such processing immediately upon receipt of your request.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, submit a written request to [email protected]. i1m88 will acknowledge your request within five (5) business days and respond substantively within thirty (30) calendar days. i1m88 may request verification of your identity before processing a data subject request.

11. Children & Minors

11.1 The i1m88 Platform is strictly for users aged 21 and above. i1m88 does not knowingly collect, process, or retain personal data from persons under the age of 21. If i1m88 becomes aware that personal data has been collected from a minor, it will take immediate steps to delete that data and close the associated account.

11.2 If you believe that a minor has created an account on the i1m88 Platform, please notify us immediately at [email protected] with any supporting information. We will investigate and act promptly.

12. Third-Party Links

The i1m88 Platform may contain informational references to third-party services (such as payment providers and game developers) that have their own privacy policies. i1m88 is not responsible for the privacy practices of such third parties and encourages you to review their privacy policies before providing any personal data to them directly. i1m88 does not control third-party sites and is not liable for their data handling practices.

13. Changes to This Policy

13.1 i1m88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Players via email to the address on file or through a prominent notice on the Platform, at least seven (7) days prior to the change taking effect.

13.2 Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept a material change, you may close your account in accordance with the Terms & Conditions and request deletion of your personal data as provided in Section 10 above.

14. Contact & Complaints

14.1 For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by i1m88, please contact our Data Protection team:

• Email: [email protected]
• Subject line: "Privacy — [Your Request Type]" for faster routing
• Response time: Acknowledgement within 5 business days; substantive response within 30 calendar days

14.2 If you are not satisfied with i1m88's response to your privacy complaint, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction, or to the gaming regulatory authority under whose licence i1m88 operates.

14.3 For inquiries related to responsible gaming, account restrictions, or self-exclusion, please visit our Responsible Gaming page.