Cup8 Privacy Policy – Data Protection & Information Security

01Introduction

Welcome to the cup8 Privacy Policy. As a responsible online betting platform, cup8 takes every aspect of our members' privacy and personal data protection seriously. This policy is drafted in accordance with the Malaysia Personal Data Protection Act 2010 (PDPA 2010) and international industry best practices.

By registering and using the cup8 platform, you agree that your personal information is collected and processed as described in this Privacy Policy. We encourage you to read this document carefully so you understand your rights as a user.

Cup8 acts as the data controller responsible for all personal data collected through our platform. Any enquiries regarding this policy may be directed to our privacy team through the support channels listed at the end of this document.

02Data Collected

Cup8 collects the personal information needed to provide a safe, legitimate and high-quality service. Below are the categories of data we collect and the reasons for collecting them:

We only collect data that is strictly necessary for the stated purpose. Data minimisation is central to our privacy approach — if a piece of information is not required, we will not ask you for it.

03How Your Data Is Used

Personal information you provide to cup8 is used responsibly for the following purposes only:

• Identity verification and KYC: To verify that you meet the minimum age requirement of 18 years and the legal eligibility to use an online betting platform in Malaysia.
• Account management: To create, maintain and manage your cup8 account, including the secure processing of deposits and fund withdrawals.
• Service provision: To provide access to all games and cup8 platform features you have subscribed to, including Live Casino, Slots, Fish Shooting Games and more.
• Platform security: To identify and prevent fraud, multiple account usage, money laundering and other security threats against our platform and members.
• Service communications: To send important notices regarding your account, terms updates, security alerts and customer support.
• Payment processing: To process all your financial transactions, including deposits via FPX, DuitNow, Touch 'n Go eWallet and other supported local payment methods.
• Platform improvements: To analyse usage patterns on an aggregated (non-individual) basis to improve the user experience and technical performance of our platform.
• Legal compliance: To fulfil the legal and regulatory obligations applicable to the operation of an online betting platform.

04Data Storage & Security

Cup8 adopts a layered approach to protecting your personal data. Our security infrastructure is designed to keep your data safe from unauthorised access, loss, destruction or disclosure at all times.

• Encryption of data in transit: All communications between your device and cup8 servers are protected by TLS 1.3 protocol with 256-bit SSL encryption, ensuring no third party can intercept your data in transit.
• Encryption of data at rest: Sensitive data such as financial information and KYC documents is stored in encrypted form using AES-256 encryption standards at certified data centres.
• Strict access controls: Only cup8 staff with a legitimate business need who have passed strict background checks are permitted to access user data. All access is logged and continuously monitored.
• 24/7 monitoring: cup8's security systems are monitored around the clock by our cybersecurity team to detect and respond to any threats in real time.
• Retention period: Your personal data is retained for as long as necessary to fulfil the purpose of collection, plus the minimum period required by Malaysian law — typically no more than 7 years after account closure.
• Secure deletion: When data is no longer needed, it is deleted using secure deletion methods that ensure it cannot be recovered.

05Data Sharing with Third Parties

Cup8 does not sell, rent or disclose your personal data to third parties for their own marketing purposes. However, there are limited situations where data sharing may be necessary:

• Payment service providers: Information required to process your financial transactions is shared with licensed payment processors such as FPX, DuitNow and digital wallet providers registered in Malaysia. These providers are bound by strict confidentiality agreements.
• Game providers: Basic account information required to access games from internationally licensed providers may be shared on a limited basis. All providers partnering with cup8 comply with strict data protection standards.
• Authorities and law enforcement: cup8 may be required to disclose information when mandated by Malaysian law, court order or directive from relevant authorities, including the Royal Malaysia Police or the Malaysian Communications and Multimedia Commission (MCMC).
• Audit and compliance service providers: To ensure regulatory compliance, appointed third-party auditors may access certain data under binding confidentiality agreements.

In all data sharing situations above, cup8 ensures that only the minimum necessary information is shared, and recipients are bound by data protection obligations equivalent to our own standards.

06Cookies & Tracking Technologies

Cup8 uses cookies and similar tracking technologies to enhance your experience on our platform, maintain session security and understand how users interact with our services.

• Essential Cookies: These cookies are essential for core platform functions — including login authentication, session security and language preferences. They cannot be disabled without affecting platform functionality.
• Performance cookies: Used to gather aggregated and anonymised information about how users interact with our platform, helping us identify areas that require technical improvement.
• Functional cookies: Allows the platform to remember your preferences such as language, display settings and login details for a better user experience.
• Security cookies: Used to detect suspicious login attempts, fraudulent activity, and security threats to protect your account.

You can manage your cookie settings through your browser. Most modern browsers allow you to view, manage, and delete cookies. Please note that disabling essential cookies may affect the functionality of the cup8 platform.

07User Rights

As a cup8 member, you have the following rights regarding your personal data, in accordance with the provisions of the Malaysia Personal Data Protection Act 2010:

• Right of access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 21 business days and may be subject to a reasonable nominal fee.
• Right to rectification: If any of your personal data is inaccurate or incomplete, you have the right to request a correction. Basic updates such as phone number and email can be made directly through your account settings.
• Right to erasure: You may request the deletion of your personal data when it is no longer needed for the original purpose of collection, subject to applicable legal retention requirements.
• Right to restriction of processing: In certain situations, you have the right to request that we restrict how we process your personal data, such as during the investigation of a complaint.
• Right to object: You have the right to object to the processing of your personal data for certain purposes, particularly direct marketing.
• Right to withdraw consent: Where data processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the validity of processing carried out before the withdrawal.

To exercise any of the above rights, please contact the cup8 customer support team via Live Chat or Telegram. All requests will be handled with care and responded to within the stated timeframe.

08Child Data Protection

The cup8 platform is exclusively for adults aged 18 and above. cup8 does not knowingly collect, store or process any personal data from individuals under the age of 18.

Should we discover that personal data of a child under 18 has been collected without valid parental or guardian consent, we will take immediate steps to delete that data from our systems and close the account in question.

09Amendments to the Privacy Policy

Cup8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements or technological developments. You will be notified of any amendments via:

• A prominent notice on the cup8 platform homepage before changes take effect.
• A notification email will be sent to the address registered on your account.
• A notification pop-up will appear on your first login after the changes take effect.

The "Last Updated" date at the top of this page will always reflect the latest version of the Privacy Policy. Your continued use of the cup8 platform after any amendments take effect will be considered your acceptance of the updated policy.

We recommend checking this page regularly — at least once every three months — to stay informed about how we manage your personal data.

10Contact Us About Privacy

If you have any questions, concerns or complaints about how cup8 handles your personal data, our privacy team is ready to assist. We are committed to addressing every enquiry thoroughly and within a reasonable timeframe.