Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Chili88 ("the Company", "we", "us", "our") collects, processes, stores, and protects personal data relating to users ("Player", "you", "your") of the Chili88 platform, accessible athttps://chili88.cam ("the Platform").

Chili88 is committed to handling personal data responsibly and in compliance with applicable data protection laws and regulations. We operate the Platform as an English-language online gaming service primarily serving players located in Malaysia, and this Policy reflects the data privacy expectations relevant to that context.

By registering an account on the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that relates to an identified or identifiable natural person — including but not limited to name, identification number, contact details, financial information, and device identifiers.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For this Platform, the Data Controller is Chili88.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under a contractual arrangement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity and payment verification process required before withdrawals are processed, as detailed in our Terms & Conditions.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, personalisation, and analytics.

3. Data Controller

Chili88 operates as the Data Controller for all personal data collected through the Platform. If you have questions about how your data is handled or wish to exercise any of your data rights, please contact our Data Protection team using the contact details provided in Section 17of this Policy.

Where Chili88 engages third-party service providers to process data on its behalf (for example, payment processors, fraud detection providers, or KYC verification services), those providers act as Data Processors and are bound by contractual data processing agreements that require them to handle data only in accordance with our instructions and applicable law.

4. Data We Collect

Chili88 collects the following categories of personal data from Players:

4.1 Registration & Identity Data

• Full legal name as per government-issued identity document
• Date of birth (for age verification — players must be 21 or above)
• Residential address (including city, state, and postcode in Malaysia)
• Email address
• Mobile phone number
• Username and encrypted password

4.2 KYC & Verification Data

• Copy of government-issued identity document (MyKad, passport)
• Proof of address documentation (utility bills, bank statements)
• Proof of payment method ownership (screenshots, bank statements from Maybank, CIMB, Public Bank, Touch'n Go eWallet, Boost, or other approved methods)
• Selfie or video verification where requested for enhanced KYC

4.3 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment methods used
• Transaction reference numbers and payment processor identifiers
• Account balance history
• Cryptocurrency wallet addresses used for deposits or withdrawals (where applicable)

4.4 Gaming & Behavioural Data

• Betting history, game session records, and wager amounts
• Bonus claims and wagering progress records
• Game type preferences and platform navigation patterns
• Responsible gambling tool usage and self-imposed limits

4.5 Technical & Device Data

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session timestamps and platform access logs
• Cookie identifiers and session tokens

4.6 Communication Data

• Records of live chat, email, and support ticket interactions
• Email correspondence sent to or received from Chili88
• Marketing preference records (opt-in or opt-out status)

5. How We Collect Data

Chili88 collects personal data through the following channels:

• Direct collection: Information you provide during registration, account updates, KYC submissions, or when contacting our support team.
• Automated collection: Technical data collected automatically when you access the Platform, including device identifiers, IP addresses, and session activity via cookies and server logs.
• Third-party providers: Payment processors (including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and DuitNow/FPX), identity verification service providers, and fraud prevention systems may share relevant data with us to facilitate your account transactions and compliance obligations.
• Public sources: Where required for compliance, we may cross-reference data against publicly available sources such as sanctions lists and politically exposed person (PEP) databases.

6. Purposes of Processing

Chili88 processes your personal data for the following purposes:

Purpose	Description
Account Management	Creating, maintaining, and securing your Chili88 player account.
Payment Processing	Facilitating deposits and withdrawals via local Malaysian payment methods and cryptocurrency networks.
Identity Verification (KYC)	Verifying player identity and age (21+ requirement) in compliance with applicable regulations.
Fraud & AML Compliance	Detecting, investigating, and preventing fraud money laundering, and other prohibited activities.
Customer Support	Responding to support queries, complaints, and account-related requests.
Responsible Gambling	Monitoring gaming behaviour to identify and support players who may be at risk of gambling harm.
Platform Improvement	Analysing usage patterns to improve Platform functionality, game offerings, and user experience.
Marketing Communications	Sending promotional emails and offers to players who have opted in to receive marketing materials.
Legal Obligations	Complying with applicable laws, regulations, court orders, and requests from competent authorities.

7. Legal Basis for Processing

Chili88 processes personal data under the following legal bases:

• Contract performance: Processing necessary to fulfil our obligations under the Terms & Conditions agreed upon account registration (e.g., account management, payment processing, gaming services).
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, KYC obligations, and data retention requirements.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gambling monitoring, where these interests do not override the fundamental rights of the data subject.
• Consent: Processing for optional marketing communications, where you have explicitly opted in. You may withdraw this consent at any time by contacting our support team or using the unsubscribe link in any marketing email.

8. Data Sharing & Disclosure

Chili88 does not sell, rent, or trade personal data. We share personal data only in the following circumstances:

8.1 Payment Service Providers

Personal and transaction data is shared with payment processors necessary to facilitate deposits and withdrawals. This includes e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank), DuitNow/FPX operators, and cryptocurrency network service providers. These parties process data strictly as required to execute payment transactions.

8.2 Identity Verification & Compliance Providers

KYC and identity verification data may be shared with specialist third-party verification providers who verify identity documents and cross-reference compliance databases. All such providers are bound by data processing agreements and security standards consistent with this Policy.

8.3 Fraud Prevention & Security

Where fraud, money laundering, or other prohibited activity is suspected, relevant data may be shared with financial intelligence units, law enforcement agencies, or regulatory bodies as required by applicable law.

8.4 Legal & Regulatory Disclosure

Chili88 will disclose personal data where required to do so by a court order, regulatory directive, or other legally binding obligation. We will, where lawfully permitted, notify affected players prior to such disclosure.

8.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Chili88, personal data held by the Platform may be transferred to the acquiring entity as part of that transaction. Affected players will be notified prior to their data being transferred and will be subject to a revised Privacy Policy where applicable.

9. International Data Transfers

Chili88 primarily stores and processes personal data on servers located within the Asia-Pacific region. In certain circumstances — such as where third-party service providers operate infrastructure in other regions — personal data may be transferred internationally.

Where such transfers occur, Chili88 ensures that appropriate safeguards are in place to protect personal data in transit and at rest, including contractual clauses, data processing agreements, and technical security controls consistent with the standards applied to domestic data processing.

10. Data Retention

Chili88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal retention requirements. As a general guideline:

• Account data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, to comply with anti-money laundering record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following the completion of the business relationship, as required by applicable financial crime prevention regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of transaction.
• Support communications: Retained for up to three (3) years from the date of communication, unless required longer for compliance or dispute purposes.
• Marketing preference records: Retained until updated or the account is closed, as evidence of consent or opt-out.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data lifecycle management procedures.

11. Cookies & Tracking Technologies

The Chili88 Platform uses cookies and similar tracking technologies to ensure the Platform operates correctly and to improve your experience. We use the following categories of cookies:

• Essential cookies: Required for the Platform to function. These enable session management, login authentication, and security features. They cannot be disabled without preventing platform access.
• Functional cookies: Used to remember your preferences, such as language settings and display preferences, to provide a more personalised experience.
• Analytics cookies: Used to collect aggregated and anonymised data about how players use the Platform — such as page visit frequency and navigation paths — to help us improve functionality and content.
• Security cookies: Used to detect and prevent fraud, abuse, and automated access attempts.

Chili88 does not use third-party advertising cookies or cross-site tracking technologies. You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair or prevent Platform access.

12. Children's Privacy

The Chili88 Platform is strictly intended for adults aged21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been created by or for a person under 21, we will immediately close the account, return any eligible real-money balance following verification, and delete all personal data associated with that account.

If you believe that a minor has accessed the Platform or created an account, please contact us immediately at [email protected] (plain text — not a link).

13. Security Measures

Chili88 employs a range of technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmission between your device and our servers;
• Encrypted storage of sensitive personal and financial data at rest;
• Access controls ensuring that personal data is accessible only to authorised personnel on a need-to-know basis;
• Regular security audits, vulnerability assessments, and penetration testing;
• Multi-factor authentication for internal system access;
• Automated fraud detection and anomaly monitoring systems;
• Incident response procedures for detecting and responding to data breaches promptly.

Despite these measures, no internet-based platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, Chili88 will notify affected players and relevant authorities in accordance with applicable legal requirements.

14. Your Data Rights

Subject to applicable law, you hold the following rights in relation to your personal data held by Chili88:

• Right of Access (Article 17, PDPA): You may request a copy of personal data held about you, free of charge in most circumstances.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data at any time through your account settings or by contacting support.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Restriction of Processing: You may request that we limit our processing of your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing, at any time.
• Rights re: Automated Decision-Making: You may request human review of automated decisions that significantly affect you.

To exercise any of the above rights, please contact our data team using the details in Section 17. We will respond to valid requests within thirty (30) calendar days. Where requests are complex or numerous, we may extend this period by up to a further thirty (30) days, with prior notice to you.

15. Third-Party Links

The Chili88 Platform may contain references to third-party services, including payment gateways and support systems, which operate under their own privacy policies. Chili88 is not responsible for the privacy practices or content of any third-party platforms. We encourage you to review the privacy policies of any third-party services you interact with.

16. Policy Amendments

Chili88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. Material changes will be communicated to registered Players via email notification or a prominent notice on the Platform prior to the changes taking effect.

The revised Policy will display an updated "Last Updated" date at the top of this page. Your continued use of the Platform following notification of material changes constitutes your acceptance of the revised Policy. We recommend reviewing this page periodically.

17. Contact & Data Requests

For all privacy-related enquiries, data access requests, or complaints regarding the handling of your personal data, please contact Chili88 using the following details:

• Email: [email protected]  (plain text — not a clickable link)
• Subject Line for Data Requests: "Privacy — Data Request" or "Privacy — Data Complaint"
• Response Time: We aim to acknowledge all privacy requests within 2 business days and provide a full response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week including Malaysian public holidays

If you are unsatisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction. For players based in Malaysia, the relevant authority is the Personal Data Protection Commissioner under the Personal Data Protection Act 2010 (PDPA).