Privacy Policy – candy918 Online Casino Malaysia

1. Who We Are

candy918 is an online casino and sports betting platform operated under a licence issued by an internationally recognised gaming authority. The candy918 Platform is accessible at candy918.org and serves registered Members primarily in Malaysia, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and other cities across the peninsula.

For the purposes of this Privacy Policy, candy918 acts as the data controller in respect of personal data collected from Members and visitors to the Platform. "Personal data" means any information relating to an identified or identifiable natural person, as defined under applicable data protection legislation.

Questions, requests, or complaints regarding this Privacy Policy should be directed to our data protection contact at [email protected].

2. Personal Data We Collect

candy918 collects the following categories of personal data from Members and, in certain cases, from visitors to the Platform:

• Identity Data: Full legal name, date of birth, gender, and nationality as provided during registration or KYC verification.
• Contact Data: Email address, Malaysian mobile phone number, and residential address.
• Identity Verification Documents: Copies of government-issued identification (e.g., MyKad, passport), proof of address, and source of funds documentation where required under our KYC obligations.
• Financial Data: Payment method details (e.g., Touch n Go eWallet account reference, Boost account reference, bank account number for FPX transactions, Maybank/CIMB/Public Bank account identifiers), deposit and withdrawal history, and MYR wallet balance records.
• Transaction Data: Records of all bets placed, games played, winnings, and promotional bonuses credited and redeemed on the candy918 Platform.
• Technical Data: IP address, browser type and version, device type and operating system, session duration, pages visited, and referring URLs collected automatically when you access the Platform.
• Usage Data: Information about how you use the candy918 Platform, including game preferences, betting patterns, frequency of play, and session timing data.
• Communications Data: Records of your communications with candy918 customer support via live chat, email, or any other channel.
• Responsible Gaming Data: Records of any deposit limits, loss limits, session time limits, or self-exclusion requests submitted by a Member.

candy918 does not collect or store full payment card numbers. All payment processing is handled by third-party payment service providers who are independently certified to applicable payment security standards.

3. How We Collect Your Data

candy918 collects personal data through the following means:

• Direct submission: Data you provide when registering for a candy918 account, completing identity verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and similar tracking technologies when you access the Platform. See Section 7 (Cookies & Tracking) for details.
• Third-party sources: Identity verification and fraud screening data from third-party KYC and anti-fraud service providers; payment data from payment processors; marketing interaction data from analytics providers where applicable.

4. How We Use Your Personal Data

candy918 uses personal data for the following purposes:

• Account management: To create and maintain your candy918 account, authenticate your identity at login, and manage account settings.
• Service delivery: To process your bets, settle winnings, process deposits and withdrawals in MYR, and provide access to all candy918 Platform features.
• Regulatory compliance: To fulfil our obligations under our gaming licence, including age verification, KYC, anti-money laundering (AML), and counter-terrorism financing (CTF) requirements.
• Fraud prevention & security: To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, and other prohibited conduct.
• Responsible gaming: To monitor player activity for indicators of problem gambling, to enforce deposit and self-exclusion limits set by Members, and to contact Members where we have concerns about their gambling behaviour.
• Customer support: To respond to enquiries, resolve disputes, and provide assistance via live chat and email.
• Platform improvement: To analyse usage patterns, test new features, and improve the candy918 Platform's performance and user experience.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to Members who have opted in to receive such communications. Members may opt out at any time.
• Legal obligations: To comply with applicable laws, court orders, or requests from regulatory and law enforcement authorities.

5. Legal Basis for Processing

candy918 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the candy918 Member agreement, including account management, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with gaming licence conditions, AML/CTF regulations, and applicable data protection law.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where these interests are not overridden by the Member's data protection rights.
• Consent: Where candy918 relies on your consent (e.g., for optional marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

candy918 does not sell personal data to third parties. candy918 may share personal data with the following categories of recipients in the circumstances described:

• Payment service providers: Touch n Go eWallet, Boost, DuitNow operators, FPX, and participating Malaysian banks (Maybank, CIMB, Public Bank, RHB) for the purpose of processing deposits and withdrawals.
• Identity verification and KYC providers: Third-party services engaged to verify Member identity and screen against sanctions lists and politically exposed persons (PEP) databases.
• Fraud prevention and AML screening providers: External services used to identify suspicious activity, prevent multi-accounting, and comply with AML obligations.
• Game software providers: Where game providers operate their own servers, limited transaction and gameplay data may be shared to facilitate game delivery and result logging.
• Regulatory and law enforcement authorities: candy918 will disclose personal data to competent authorities where required by Applicable Law, court order, or as part of cooperation with investigations into criminal activity.
• Professional advisers: Legal counsel, auditors, and compliance consultants bound by professional confidentiality obligations.

All third-party service providers engaged by candy918 are contractually required to process personal data only for the purposes specified by candy918 and to maintain appropriate technical and organisational security measures.

7. Cookies & Tracking Technologies

candy918 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help the Platform function correctly and allow candy918 to analyse usage patterns.

candy918 uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function — including session management, login state, and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, display settings) to improve your experience on the candy918 Platform.
• Analytics cookies: Collect anonymised usage data to help candy918 understand how Members interact with the Platform and identify areas for improvement.
• Marketing cookies: Used where you have consented to receive targeted promotional content. You may opt out of marketing cookies via your browser settings or account preferences.

You can control cookie settings through your browser. Disabling strictly necessary cookies may impair your ability to use the candy918 Platform, including the candy918 login and account management features.

8. Data Retention

candy918 retains personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy, subject to the following minimum retention periods required by our gaming licence and applicable law:

• Account and transaction records: Minimum 5 years from the date of the last transaction or account closure, whichever is later, in compliance with AML record-keeping obligations.
• KYC documents: Minimum 5 years from the date of verification or account closure.
• Customer support communications: 2 years from the date of the communication, or longer where the communication relates to an open dispute.
• Technical and log data: Up to 12 months, unless retention is required for security investigation purposes.
• Responsible gaming records: Duration of any active self-exclusion period plus 5 years, to prevent re-registration during exclusion periods.

Upon expiry of the applicable retention period, candy918 will securely delete or anonymise personal data in accordance with its data destruction procedures.

9. Data Security

candy918 implements a range of technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the candy918 Platform;
• Encrypted storage of sensitive personal data at rest;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing;
• Two-factor authentication for internal administrative systems;
• Incident response procedures for detecting and responding to data breaches.

In the event of a personal data breach that poses a risk to the rights and freedoms of affected Members, candy918 will notify the relevant supervisory authority and, where required, affected Members in accordance with applicable data protection law.

10. Your Data Protection Rights

Subject to applicable data protection law, candy918 Members have the following rights in relation to their personal data:

• Right of access: You may request a copy of the personal data candy918 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where candy918 no longer has a lawful basis to retain it, subject to our legal retention obligations.
• Right to restriction: You may request that candy918 restrict processing of your personal data in certain circumstances.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of your personal data.
• Right to object: You may object to processing based on legitimate interests, including profiling, and to direct marketing communications at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact candy918 at [email protected] from your registered email address. candy918 will respond within 30 calendar days of receiving a verified request.

11. Children's Privacy

The candy918 Platform is strictly for adults aged 21 and above. candy918 does not knowingly collect personal data from individuals under the age of 21. If candy918 becomes aware that it has inadvertently collected personal data from a person under 21, it will immediately delete that data and close the associated account. If you believe a person under 21 has registered on the candy918 Platform, please contact us at [email protected].

12. International Data Transfers

candy918 may transfer personal data to third-party service providers located outside Malaysia, including in jurisdictions where the candy918 gaming licence authority is based. Where such transfers occur, candy918 ensures that appropriate safeguards are in place — including contractual protections equivalent to applicable data protection standards — to protect the personal data of Malaysian Members throughout the transfer.

13. Changes to This Privacy Policy

candy918 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our Platform's features. The "Last Updated" date at the top of this page will be revised accordingly. candy918 will use commercially reasonable efforts to notify Members of material changes via email or in-platform notification. Continued use of the candy918 Platform following publication of any updated Privacy Policy constitutes acceptance of the revised terms.

14. Contact & Complaints

For questions, requests, or complaints relating to this Privacy Policy or candy918's data practices, please contact:

• Email: [email protected] (response within 2 hours)
• Live Chat: Available 24/7 via the candy918 Platform

All data-related requests must be submitted from the email address registered to your candy918 account to allow identity verification before we act on your request. If you are unsatisfied with candy918's response, you have the right to lodge a complaint with the competent data protection supervisory authority in the jurisdiction of candy918's gaming licence.