data18 | Privacy Policy – How We Protect Your Personal Data

1

Introduction & data18's Privacy Commitment

data18 is an online entertainment platform operating under the official domain data18.my, designed exclusively for adult users in Malaysia. We understand that your trust is the foundation of everything we build, and the most critical part of that trust is how we handle your personal information.

This Privacy Policy is established to ensure all members data18 fully understand:

What personal information we collect from you
Why we collect that information and how it is used
Who your information may be shared with in certain circumstances
How we protect your information from unauthorised access
Your rights as a data subject and how you may exercise them

This Privacy Policy applies to all aspects of your use of the data18 — including account registration, gaming activity (slots such as Mermaid Gold, Big Bass Bonanza, Dinosaur Tycoon, The Warriors, 8 Golden Dragon; video poker Deuces Wild; crash game Spaceman; and all other games), financial transactions via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX, as well as your interactions with our customer support team.

data18's Commitment: We never sell your personal information to any third party for marketing or commercial purposes. Your privacy is our responsibility — not a source of revenue.

2

Personal Information We Collect

data18 collects your personal information through several means — directly from you, automatically through your use of the platform, and in certain cases from legitimate third parties. Below is a full breakdown of the types of information we collect:

Data Category	Examples	Collection Methods
Identity Information	Full name, national identification number, date of birth, gender	Account registration, KYC
Contact Information	Phone number, email address, residential address	Account registration
Financial Information	Bank account numbers, bank names, e-wallet information (TnG, GrabPay, DuitNow, Boost, ShopeePay)	Deposit / withdrawal process
Gaming Activity Data	Betting history, wins, losses, games played, session duration	Automatically during gameplay
Technical Data	IP address, web browser type, device type, operating system, cookie information	Automatically upon platform access
Communication Data	Customer support chat logs, emails, and complaint records	Interactions with the support team

We collect only the information that is genuinely necessary for the stated purposes. data18 does not collect sensitive information such as biometric data, medical records, or ethnic origin unless required by applicable law.

3

How We Use Your Personal Information

data18 uses personal information collected solely for lawful and transparent purposes. Below is a complete list of how your data may be used:

Platform Operations Purposes:

Creating and managing your member account on data18
Processing deposits and withdrawals using your preferred payment method (Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX Maybank2u, CIMB Clicks)
Providing access to all games and services on data18
Processing and crediting bonuses and promotions you are entitled to
Verifying your identity during the KYC (Know Your Customer) process

Security & Compliance Purposes:

Detecting and preventing fraud, money laundering, and other illegal activities
Ensuring compliance with applicable legal and regulatory requirements
Verifying that you meet the minimum age requirement (18 years and above)
Complying with directives from authorities and law enforcement agencies when required
Maintaining complete transaction records for audit purposes

Service Improvement Purposes:

Analysing platform usage patterns to identify areas for improvement
Introducing new games and platform features more relevant to Malaysian players' preferences
Personalising your experience based on your gaming habits and preferences
Testing and developing new features prior to official launch

Communication Purpose:

Sending important notifications relating to your account, transactions, and security
Keeping you informed about promotions, bonuses, and new games (subject to your marketing preferences)
Responding to enquiries and complaints submitted to the data18 support team

You may opt out of receiving marketing communications from data18 at any time by contacting our support team. However, essential operational communications related to your account and security cannot be stopped while your account remains active.

4

Information Sharing & Disclosure

data18 does not sell, rent, or disclose members' personal information to third parties for marketing purposes without your consent. However, there are certain situations where we may need to share your information with specific parties in the interest of operations and legal compliance:

Approved Third-Party Service Providers:

Payment Processors: Required transaction information is shared with approved payment processors such as Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, and banks supporting FPX (Maybank, CIMB, and others) solely for the purpose of processing your financial transactions.
Identity Verification Providers: For the KYC process, your identity information may be shared with accredited identity verification service providers.
Game Software Providers: Game providers supplying slots, video poker, and other games on the data18 platform receive only the minimum technical data necessary to operate the games fairly.
Technical Infrastructure Providers: Cloud computing and infrastructure service providers supporting data18's operations have limited access to data stored within their systems, subject to strict confidentiality agreements.

Legal Obligations:

Data18 may disclose your personal information without your consent where required or permitted by law, including in the following circumstances:

Complying with court orders, writs, or directions from lawful legal authorities
Reporting suspicious activity to the Financial Intelligence Unit (FIED) under the Anti-Money Laundering Act (AMLA)
Cooperating with fraud investigations or financial crime inquiries
Protecting the rights, property, or safety of data18, its members, or the general public

data18 guarantee: Every third-party service provider working with data18 is required to sign a strict data protection agreement before being granted any access to member information. They are prohibited from using such data for any purpose beyond what is specified in the agreement.

5

Data Retention & Security Measures

data18 continuously invests in the latest security technologies to ensure that all members' personal information remains protected against unauthorised access, loss, or data breaches at all times.

Technical Security Measures:

SSL 256-Bit Encryption: All data transmitted between your device and data18's servers is protected with SSL 256-bit encryption — the same security standard used by Malaysia's leading banks.
Stored Data Encryption: Sensitive information such as passwords (stored in hashed form) and financial information is stored in encrypted form within protected databases.
Multi-Layered Firewall: data18's infrastructure is protected by multi-layered firewalls and an intrusion detection system (IDS) that actively monitors suspicious traffic.
Two-Factor Authentication (2FA): data18 offers two-factor authentication to protect your account login from unauthorised access.
24/7 Security Monitoring: The data18 security team monitors our systems around the clock to detect and respond to any threats promptly.

Data Retention Period:

Data18 retains your personal information for as long as your account remains active or as long as necessary to provide services to you. Following account closure, we will retain certain records for periods stipulated under applicable Malaysian law:

Financial transaction records: Minimum 7 years (tax and anti-money laundering legal requirements)
Identity verification records (KYC): Minimum 5 years after account closure
Game activity logs: 2 years from the date of activity
Customer support communication logs: 2 years after case resolution

Once the required retention period has expired, data18 will securely delete or anonymise your information.

6

Cookies & Tracking Technologies

Platform data18 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform operates smoothly. The following explains the types of cookies we use:

Essential Cookies (Required):

Login session cookie — keeps you signed in as you browse the data18 platform
Security cookies — help identify legitimate requests and protect against CSRF attacks
Language preference and settings cookies — saves your display preferences

Analytics Cookies (Non-Personal):

Cookies that collect aggregated data on how visitors use the data18 platform — such as the most frequently visited pages, navigation flows, and time spent on each page
This data is used solely to help us understand how to improve the user experience on the data18 platform

Managing Your Cookie Preferences:

You may manage or delete cookies through your web browser settings. Please note, however, that disabling essential cookies may affect certain functions of the data18 platform, including your ability to remain logged in to your account.

data18 does not use cookies to track your activity outside of our platform, nor do we share cookie data with third-party advertisers. Our cookies are used solely to enhance your experience on data18.

7

Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and the privacy principles adopted by data18, you have the following rights with respect to your personal information:

Right of Access

You have the right to request a copy of the personal information we hold about you. Requests may be submitted via email to [email protected], and data18 will process them within 30 business days. Identity verification may be required before any information is disclosed.

Right to Rectification

If you find that any personal information we hold about you is inaccurate or incomplete, you have the right to request a correction. Contact the data18 support team with the relevant supporting documents and we will update your records promptly.

Right to Erasure ("Right to be Forgotten")

When your account is closed, you may request the deletion of your personal information, subject to record retention requirements mandated under Malaysian law. data18 will process valid deletion requests within 30 business days.

Right to Object to Marketing

You may withdraw your consent to receive marketing communications from data18 at any time, without giving any reason. Simply use the "unsubscribe" link in any marketing email or contact our support team directly.

Data Portability Rights

You have the right to request your personal data in a machine-readable format (such as CSV or JSON) for transfer to another service provider, subject to applicable technical and security limitations.

Right to Lodge a Complaint

If you believe data18 has violated your privacy rights, you are entitled to first raise a complaint with us at [email protected]. If you are unsatisfied with our response, you may escalate your complaint to the Personal Data Protection Commissioner of Malaysia.

8

Protection of Children's Data

data18 strictly prohibits the use of the platform by individuals under the age of 18. We do not knowingly collect or process personal information from minors or underage individuals.

Should we discover that personal information belonging to a minor has been collected inadvertently, we will take immediate steps to delete that information, terminate the associated account, and block further access to the platform.

Parental / Guardian Responsibilities: If you believe that a minor under your care may have accessed or registered an account on data18, please contact us immediately at [email protected] so we can take the appropriate action without delay.

9

International Data Transfers

In the course of operating the platform, data18 may need to store or process your data on servers located outside Malaysia — for example, through internationally accredited cloud computing service providers.

In such situations, data18 ensures that all cross-border data transfers are carried out with adequate safeguards in place, including:

Ensuring that the recipient country maintains a level of data protection comparable to or higher than Malaysia's
Binding service providers with data transfer agreements that comply with Malaysia's PDPA requirements
Ensuring that all transferred data is encrypted both in transit and at rest
Limiting data transferred to the minimum necessary for each specific purpose

By using the data18 platform, you consent to such international data transfers subject to the safeguards outlined above.

10

Changes to This Privacy Policy

data18 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, evolving legal requirements, or improvements in how we handle personal data.

When significant changes are made to this Privacy Policy, we will:

Updating the "Last Updated" date at the top of this page
Sending notifications to all active members via their registered email address
Displaying a prominent notice on the data18 platform homepage for a specified period after the changes take effect

Your continued use of the data18 platform after any Privacy Policy changes take effect constitutes your acceptance of the updated policy. It is your responsibility to review this page periodically.

This Privacy Policy is effective as of January 2026. If you have any questions regarding a previous version of this policy, please contact us at [email protected] within 30 days of the amendment's effective date.

11

Contact the data18 Privacy Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or how data18 regarding your personal information, please do not hesitate to contact us through the following channels:

Privacy Email: [email protected] (please state "Privacy Enquiry" in the email subject line)
Live Chat: Available 24 hours a day, 7 days a week via the data18 platform
Target Response Time: We aim to respond to all privacy-related enquiries within 3 business days

For more information about your rights as a data subject in Malaysia, you may also refer to the Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.

For information regarding the platform's terms of use, please refer to the Terms & Conditions. For responsible gaming guidance, please visit the Responsible Gaming. Frequently asked questions can be found on the FAQ us.

Data18 Privacy Policy – Personal Data Protection for Malaysian Members