atas88 Privacy Policy — How We Collect, Use, and Protect Your Data

1. Introduction

This Privacy Policy describes how atas88 ("the platform", "we", "our", "us") collects, uses, discloses, stores, and protects personal data provided by or generated through the use of the atas88 website, account services, casino games, live dealer tables, sports betting markets, promotional offers, and customer support facilities. It applies to all registered players and visitors regardless of the device used to access the service.

By creating an atas88 account, making a deposit, placing a wager, claiming a promotion, or using any feature of the platform, you confirm that you have read and understood this Policy and consent to the data practices described. If you do not agree, you should not use the service.

This Policy should be read alongside the Terms & Conditions, which govern the rules of your account, and the Responsible Gambling page, which explains the tools available to help you manage your play safely.

2. Definitions

The following terms have the meanings set out below throughout this Policy:

• Personal Data — Any information that identifies or can reasonably be used to identify a living individual, whether directly or in combination with other data.
• Processing — Any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, alteration, retrieval, consultation, blocking, erasure, or destruction.
• Data Controller — atas88, which determines the purposes and means of processing personal data.
• Data Processor — A third party that processes personal data on behalf of and under the instructions of atas88.
• Player — A registered individual who holds an atas88 account and uses the platform.
• KYC — Know Your Customer procedures used to verify identity, age, residence, and payment ownership.
• Cookie — A small data file placed on a device when a website is visited, used to remember preferences, session states, and browsing activity.

3. Personal Data We Collect

atas88 collects personal data from the following categories of source:

3.1 Information You Provide Directly

• Full legal name, date of birth, and gender provided during registration.
• Malaysian residential address or overseas address where applicable, including city references such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or Shah Alam.
• Email address, mobile phone number, and username.
• Identity documents submitted for KYC verification, including national identity card, passport, driving licence, or equivalent.
• Payment information including bank account details, FPX-linked bank names, DuitNow registered numbers, and e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, or Hong Leong accounts.
• Proof-of-address documents such as utility bills, bank statements, or government correspondence.
• Communications submitted through live chat, support emails, or complaint forms.
• Responsible gambling preferences, including deposit limits, loss limits, cooling-off requests, and self-exclusion submissions.

3.2 Data Collected Automatically

• IP address, approximate geolocation derived from network data, and country of access.
• Device type, operating system, browser type, browser version, and screen resolution.
• Pages visited, session duration, click paths, game titles accessed, and betting activity.
• Login timestamps, session identifiers, and logout events.
• Cookie identifiers and local storage data where cookies are accepted.

3.3 Data Received from Third Parties

• Identity verification outcomes from KYC service providers used to confirm document authenticity.
• Fraud risk scores or alerts generated by payment fraud prevention systems.
• Chargeback notifications or payment dispute records supplied by financial institutions or payment processors.
• Politically Exposed Person (PEP) or sanctions list screening results.

4. Purposes and Legal Bases for Processing

The table below summarises the primary purposes for which atas88 processes personal data and the basis on which processing is conducted.

5. Disclosure of Personal Data

atas88 does not sell personal data to third parties. Data may be shared in the following circumstances and with the following categories of recipient, each bound by appropriate contractual safeguards:

• Payment and banking providers — Banks, FPX gateway operators, DuitNow participants, and e-wallet platforms including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong, to the extent required to process a transaction.
• Identity verification services — KYC and document authentication providers used to confirm player age, identity, and address in support of regulatory obligations.
• Fraud prevention and risk systems — Third-party risk analysis tools used to detect payment fraud, duplicate accounts, and automated behaviour on the platform.
• Technology and infrastructure providers — Hosting, cloud storage, content delivery, game platform, and security technology providers engaged under data processing agreements that restrict further use of the data.
• Regulatory and legal authorities — Where atas88 is required by applicable law, court order, or regulatory direction to disclose information to an enforcement body, licensing authority, or judicial proceeding.
• Professional advisers — Legal counsel, accountants, and auditors acting under professional confidentiality obligations.
• Business transfers — In the event of a merger, acquisition, or transfer of platform operations, player data may be included subject to written commitments that the receiving entity respects this Policy or an equivalent standard.

6. Data Retention

atas88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:

• Active account records — Retained for the duration of the account relationship and for a minimum of five years following account closure, consistent with anti-money laundering record-keeping requirements.
• Transaction and payment records — Retained for a minimum of five years to satisfy financial reporting and audit obligations. Individual records involving disputes may be kept until the dispute is fully resolved.
• KYC and identity documents — Retained for at least five years from the date of verification or from the date of account closure, whichever is later.
• Support communications — Retained for two years from the date of the communication unless the matter involves an ongoing dispute or regulatory inquiry.
• Technical and usage logs — Retained for up to twelve months and then aggregated or deleted, unless required for an active security investigation.
• Responsible gambling records — Self-exclusion requests, limit settings, and related correspondence are retained for the duration of the exclusion period plus five years.

Where retention beyond these periods is required by law, regulation, or ongoing proceedings, data will be kept for the minimum additional period necessary and then securely deleted or anonymised.

7. Cookies and Tracking Technologies

atas88 uses cookies and similar tracking technologies to operate the website, maintain secure sessions, remember player preferences, and analyse platform usage. The main categories in use are:

• Strictly necessary cookies — Required for the website to function. These enable login sessions, security checks, and cashier operations. They cannot be disabled without affecting core functionality.
• Performance and analytics cookies — Used to measure page load times, navigation paths, error rates, and game load performance to improve the user experience.
• Functional cookies — Store preferences such as language settings, display options, and previously used payment methods to reduce repetitive input.

Most browsers allow cookies to be managed through browser settings. Disabling strictly necessary cookies may prevent the platform from functioning correctly. Continued use of the atas88 website with standard browser cookie settings indicates acceptance of the cookie practices described above.

8. Data Security

atas88 implements technical and organisational measures proportionate to the sensitivity of the data processed and the risks posed by unauthorised access, alteration, disclosure, or destruction. Measures include but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between the player's device and the atas88 platform.
• Encrypted storage of sensitive account credentials and payment reference data.
• Role-based internal access controls that limit employee access to personal data on a need-to-know basis.
• Security logging, anomaly detection, and periodic reviews of access to account and payment records.
• Contractual requirements on data processors to maintain security standards equivalent to those applied internally by atas88.

No method of electronic transmission or storage provides absolute guarantees. Players should also take reasonable precautions on their own devices, including using strong unique passwords, enabling two-factor authentication where available, and avoiding access over unsecured public networks.

If atas88 becomes aware of a personal data breach that is likely to affect player rights or interests, we will act promptly to contain the incident and, where applicable law requires, notify affected individuals and relevant authorities within the prescribed timeframe.

9. International Data Transfers

atas88 is an internationally operating platform. Personal data may be stored on or accessed from servers located in jurisdictions outside Malaysia. Where data is transferred to a country that may not provide the same level of data protection as applicable Malaysian law, atas88 implements appropriate safeguards through contractual obligations on the receiving party, restricting that party to processing the data only for permitted purposes and to the standard set out in this Policy.

Players who have questions about where their personal data may be processed or stored may contact support at the details provided in Section 12 of this Policy.

10. Your Rights as a Data Subject

Subject to applicable data protection law and the operational requirements of the atas88 platform, registered players hold the following rights in respect of their personal data:

• Right of Access — You may request confirmation of whether atas88 processes your personal data and, if so, a copy of the data held together with information about how it is used.
• Right to Rectification — You may ask for inaccurate or incomplete personal data to be corrected or completed without undue delay.
• Right to Erasure — You may request deletion of personal data where it is no longer necessary for the original purpose, where consent has been withdrawn, or where processing was unlawful. This right is subject to overriding legal obligations that require continued retention, such as anti-money laundering record-keeping duties.
• Right to Restrict Processing — You may ask atas88 to pause processing of your data in specific circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability — Where processing is based on contract or consent and is carried out by automated means, you may request a copy of data you provided in a structured, machine-readable format.
• Right to Object — You may object to processing based on legitimate interests where your particular circumstances justify doing so. We will assess the objection and respond accordingly.
• Rights Related to Automated Decision-Making — Where automated processes produce decisions that significantly affect you, you may request human review of those decisions.

Requests under this section should be submitted to atas88 support in writing, including sufficient detail to identify the account and the specific right being exercised. We will acknowledge receipt and respond within a reasonable timeframe. Verification of identity may be required before processing certain requests.

11. Children and Minors

The atas88 platform is strictly restricted to individuals aged 21 and above. We do not knowingly collect or process personal data from anyone under the age of 21. Where an account is discovered to have been created by a person below the minimum age, the account will be closed, all balances suspended pending review, and associated personal data removed in accordance with the retention obligations set out in Section 6.

Adults who share devices with minors are responsible for safeguarding access to the atas88 website, stored passwords, and payment methods. Parents and guardians should use device-level parental control features where available.

12. Policy Updates and Contact

atas88 may amend this Privacy Policy to reflect changes in processing activities, applicable law, regulatory guidance, or platform functionality. The current version will always be published on this page with the effective date clearly stated. Continued use of atas88 after an updated Policy is published constitutes acceptance of the revised terms to the extent permitted by applicable law.

For questions about this Policy, to exercise your rights, or to report a concern about data handling, please contact the atas88 support team. Our team is available 24 hours a day, 365 days a year via live chat on the platform.