Section 01
Introduction
orange888 ("orange888", "we", "us", "our") operates the online gaming platform accessible at https://orange888.cam ("Platform"). We are committed to protecting the privacy and personal data of all individuals who visit, register on, or interact with our Platform ("you", "Player", "User").
This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which we process that data, the legal grounds on which we rely, how we share data, how long we retain it, and the rights available to you in respect of your personal information.
This Policy applies to all personal data processed by orange888 in connection with your use of the Platform, including registration, account management, deposits and withdrawals via Malaysian payment methods (including Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong), bonus participation, customer support interactions, and marketing communications.
This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. By using the Platform, you acknowledge that you have read and understood this Policy.
If you have any questions about this Policy or how your personal data is handled, please contact our Data Protection team at
[email protected] before using the Platform.
Section 02
Definitions
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
- Personal Data — Any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. Examples include your name, NRIC/passport number, email address, IP address, and device identifiers.
- Processing — Any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or any other handling of that data.
- Data Controller — The entity that determines the purposes and means of processing Personal Data. orange888 is the Data Controller in respect of the Personal Data it collects from Players.
- Data Processor — A third party that processes Personal Data on behalf of the Data Controller, under the Data Controller's instructions (e.g., payment service providers, KYC verification vendors).
- Consent — A freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their Personal Data for a stated purpose.
- Cookies — Small text files placed on a Player's device by the Platform to store preferences, session data, and analytics information.
- KYC — Know Your Customer — the identity verification process required to comply with Anti-Money Laundering (AML) and responsible gaming obligations.
Section 03
Data We Collect
orange888 collects the following categories of Personal Data, depending on your level of interaction with the Platform:
3.1 Registration & Identity Data
- Full legal name as it appears on your government-issued identity document
- Date of birth (for age verification — orange888 requires players to be aged 21 and above)
- Malaysian NRIC number or passport number
- Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)
- Email address and mobile phone number
- Username and hashed password
3.2 Financial & Transaction Data
- Deposit and withdrawal transaction records, including amounts in MYR and timestamps
- Payment method details — the name and masked account/wallet identifier associated with your Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong account
- Cryptocurrency wallet addresses (BTC/USDT) where applicable
- Account balance history and wagering records
3.3 Technical & Usage Data
- IP address and approximate geolocation derived from IP
- Device type, operating system, and browser information
- Session duration, pages visited, and in-game activity logs
- Login timestamps and authentication records
3.4 Communication Data
- Live chat transcripts, email correspondence, and WhatsApp message content (where applicable) between you and our support team
- Records of responsible gambling tool activations (deposit limits, self-exclusions, cooling-off periods)
- Survey responses and feedback submissions
You Register
Data Collected
Lawfully Processed
Securely Stored
Deleted When No Longer Required
Section 04
How We Collect Your Data
orange888 collects Personal Data through the following means:
- Direct submission: Information you provide when registering an account, completing KYC verification, submitting a support request, or participating in a survey.
- Automated collection: Technical and usage data collected automatically through cookies, session tracking technologies, server logs, and analytics tools when you browse or use the Platform.
- Payment processors: Transaction confirmation data shared by our payment processing partners (e.g., DuitNow, FPX, Touch 'n Go eWallet) when you make a deposit or withdrawal.
- KYC verification partners: Identity verification data returned by our third-party KYC service provider when you submit identity documents for account verification.
- Third-party game providers: Game session data and RNG audit logs shared by our licensed game providers for integrity and dispute resolution purposes.
Section 05
Legal Basis for Processing
orange888 processes your Personal Data on the following legal grounds:
Account registration & management
Performance of a contract
Necessary to provide the Platform service
Processing deposits & withdrawals
Performance of a contract
Required to execute your payment instructions
Age & identity verification (KYC)
Legal obligation
Required under AML and responsible gaming regulations
Fraud detection & security monitoring
Legitimate interests
To protect Platform integrity and other Players
Marketing & promotional communications
Consent
You may withdraw consent at any time
Responsible gambling monitoring
Legal obligation / Legitimate interests
To identify and support at-risk players
Customer support interactions
Performance of a contract
To fulfil our support obligations to you
Section 06
How We Use Your Data
orange888 uses your Personal Data for the following purposes:
- Account operations: Creating and managing your account, processing login requests, and maintaining your account preferences and history.
- Transaction processing: Facilitating MYR deposits and withdrawals via your chosen payment method, reconciling your account balance, and issuing transaction confirmations.
- Identity & age verification: Verifying that you are aged 21 or above and that your identity matches the payment methods linked to your account, as required for KYC compliance.
- Bonus & promotions administration: Determining your eligibility for welcome bonuses, loyalty rewards, cashback offers, and referral programmes; tracking wagering requirements and enforcing bonus terms.
- Customer support: Responding to your queries, complaints, and support requests via live chat, email, or WhatsApp; maintaining records of our interactions to ensure service quality and consistency.
- Responsible gambling: Monitoring account activity for indicators of problem gambling behaviour; administering self-exclusion requests, deposit limit changes, and cooling-off periods; contacting you proactively where our responsible gaming team identifies a concern.
- Fraud prevention & security: Detecting and preventing money laundering, duplicate accounts, bonus abuse, and other forms of fraud; enforcing our Terms & Conditions.
- Platform improvement: Analysing aggregated and anonymised usage data to improve the Platform's design, game selection, payment flow, and overall user experience.
- Marketing communications: Sending you promotional emails, SMS notifications, or in-platform messages about new games, bonuses, and special events — where you have consented to receive such communications. You may opt out at any time.
- Legal & regulatory compliance: Meeting our obligations under applicable anti-money laundering laws, gaming regulations, and tax reporting requirements.
Section 07
Data Sharing & Disclosure
orange888 does not sell your Personal Data to third parties. We may share your data with the following categories of recipients, strictly to the extent necessary for the purposes described in this Policy:
- Payment service providers: Entities that process your deposit and withdrawal transactions on our behalf, including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Connect. These providers receive only the data necessary to execute and confirm your transactions.
- KYC and identity verification vendors: Third-party providers contracted to verify your identity documents and cross-reference watchlist data for AML compliance. These vendors operate under binding data processing agreements.
- Licensed game providers: Software and live dealer game providers whose games are hosted on the Platform. Game providers receive anonymised session data for integrity auditing; they do not receive your full account profile unless required for an active dispute investigation.
- IT infrastructure and cloud service providers: Vendors who host our servers, databases, and backup systems. All infrastructure partners are bound by confidentiality and data security obligations.
- Regulatory and law enforcement authorities: Where we are required by law, court order, or regulatory instruction to disclose your Personal Data — for example, in connection with an AML investigation or a formal regulatory inquiry.
- Fraud prevention services: Industry-standard fraud detection and blacklist-sharing services used to identify and prevent multi-accounting, bonus abuse, and financial fraud across the online gaming industry.
All third parties with whom orange888 shares Personal Data are required to handle that data in compliance with applicable data protection standards and are prohibited from using it for any purpose other than the specific service they provide to us.
Section 08
Cookies & Tracking Technologies
The orange888 Platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain your session, and gather analytical data about Platform usage. The following categories of cookies are used:
- Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in during your visit and security cookies that prevent cross-site request forgery (CSRF) attacks. These cookies cannot be disabled without impairing Platform functionality.
- Performance and analytics cookies: Used to collect anonymised data about how Players navigate the Platform — which pages are visited most frequently, where players drop off in registration flows, and how game categories perform. This data is used solely to improve the Platform experience.
- Functionality cookies: Remember your preferences, such as preferred language, display settings, and last-played game categories, to personalise your experience on return visits.
- Marketing cookies: Where you have consented, these cookies enable us to deliver targeted promotional content relevant to your gaming interests and to measure the effectiveness of marketing campaigns. You may withdraw consent for marketing cookies at any time via your browser settings or the cookie management tool on our Platform.
Most web browsers allow you to manage or delete cookies through your browser settings. Please note that disabling strictly necessary cookies may impair your ability to log in and use the Platform. For detailed guidance, consult your browser's help documentation.
Section 09
Data Retention
orange888 retains your Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply by data category:
Account & Identity Data
Retained for the duration of your account plus 7 years following permanent account closure, to comply with AML record-keeping obligations.
Financial Transaction Records
Retained for 7 years from the date of the transaction in accordance with standard financial regulatory requirements.
KYC Documents
Retained for 7 years from the date of submission or the date of account closure, whichever is later, as required under Anti-Money Laundering obligations.
Customer Support Logs
Retained for 3 years from the date of the interaction to support dispute resolution and service quality review.
Marketing Consent Records
Retained for 5 years from the date of consent, or until consent is withdrawn, to demonstrate lawful basis for marketing communications.
Cookies & Analytics Data
Session cookies expire at the end of each browser session. Persistent analytics cookies are retained for up to 13 months from the date of collection.
Responsible Gambling Records
Self-exclusion and deposit limit records are retained indefinitely to prevent circumvention of responsible gambling restrictions, even after account closure.
At the end of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with you.
Section 10
Data Security
orange888 implements appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:
- 256-bit TLS/SSL encryption for all data transmitted between your device and our servers.
- Encryption at rest for sensitive data fields including identity documents, financial records, and KYC verification outcomes.
- Access controls and role-based permissions ensuring that employee access to Personal Data is limited to what is necessary for their specific job function.
- Regular security audits and penetration testing conducted by independent third-party security specialists.
- Intrusion detection and monitoring systems operating 24/7 to identify and respond to anomalous activity on our infrastructure.
- Incident response procedures — in the event of a confirmed data breach that is likely to result in a risk to your rights, orange888 will notify affected individuals and relevant authorities within the timeframes required by applicable law.
While we take robust steps to protect your data, no online system is entirely immune to risk. We encourage you to use a strong, unique password for your orange888 account and to enable two-factor authentication (2FA) from your Account settings.
Section 11
Your Rights
You have the following rights in relation to the Personal Data that orange888 holds about you. To exercise any of these rights, please contact us at [email protected] or via 24/7 live chat, providing your registered username and a description of your request. We will respond within 30 calendar days.
Right of Access
Request a copy of the Personal Data we hold about you and information about how it is being processed.
Right to Rectification
Request correction of any inaccurate or incomplete Personal Data we hold about you.
Right to Erasure
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Right to Restrict Processing
Request that we temporarily halt processing of your data while a dispute about its accuracy or lawfulness is being resolved.
Right to Data Portability
Request your Personal Data in a structured, machine-readable format for transfer to another service provider, where technically feasible.
Right to Object
Object to the processing of your Personal Data for marketing purposes. Your objection to marketing will be acted upon immediately with no adverse consequences to your account.
Note on Erasure Requests: Certain data — particularly KYC documents, financial transaction records, and responsible gambling history — must be retained for defined periods under applicable law, regardless of an erasure request. Where erasure is not possible in full, we will inform you of the specific retention obligation and delete all other data not subject to that obligation.
Section 12
International Data Transfers
The orange888 Platform serves players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond. Certain of our third-party service providers — including infrastructure providers, game platform vendors, and KYC verification services — may be located in jurisdictions outside Malaysia.
Where Personal Data is transferred internationally, orange888 ensures that appropriate safeguards are in place, which may include contractual clauses that impose data protection obligations on the recipient equivalent to those applicable to orange888, or reliance on the recipient's operation within a jurisdiction that provides an adequate level of protection for Personal Data.
All international transfers of Personal Data are conducted only to the extent necessary for the specific service being provided and are subject to binding confidentiality and security obligations.
Section 13
Minors & Age Policy
orange888 is strictly prohibited for use by persons under the age of 21. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and accounts that cannot be verified as belonging to a person aged 21 or above will be immediately closed.
If you become aware that a minor has accessed or registered on the orange888 Platform, or has submitted Personal Data through it, please notify us immediately at [email protected]. We will investigate and take all appropriate steps, including deletion of any Personal Data collected and immediate account closure.
Orange888 strongly encourages parents and guardians to use parental control software to prevent minors from accessing online gaming platforms. Responsibility for ensuring that minors do not access gambling platforms also lies with the account holder.
Section 14
Third-Party Links
The orange888 Platform may display informational references to third-party services (such as payment method providers like Maybank, CIMB, Touch 'n Go eWallet, or DuitNow). These references are made for the purpose of identifying available payment options and do not constitute hyperlinks to third-party websites from this Privacy Policy page.
To the extent that any third-party website or service is accessed through the orange888 Platform, orange888 does not control and is not responsible for the privacy practices or content of those third-party websites. You are encouraged to review the privacy policy of any third-party service you use in connection with your orange888 account — including your bank, e-wallet provider, or internet service provider — independently.
Section 15
Amendments to This Policy
orange888 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or the nature of our services. Material changes will be communicated to registered Players via email to the address associated with their account, and/or via a prominent notice on the Platform, at least 14 days before the updated Policy takes effect.
The "Last Updated" date at the top of this page indicates when the current version of this Policy became effective. We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any revised Policy constitutes your acknowledgement of the updated terms.
If you do not agree with the revised Privacy Policy, you should cease using the Platform and may request closure of your account by contacting our support team.