Privacy Policy —
How to288 Protects Your Data

1.1 to288 is an online gaming and sports betting platform operated at https://to288.asia and serving players primarily in Malaysia. The Platform is designed and operated in English and handles all financial transactions in Malaysian Ringgit (MYR), with additional support for cryptocurrency (BTC / USDT).

1.2 to288 recognises the importance of personal data privacy and is committed to handling all personal information responsibly, transparently, and in accordance with internationally recognised data protection principles. This Policy has been prepared with particular regard to players located in Malaysia, though it applies globally to all users of the Platform.

1.3 This Policy should be read alongside the to288 Terms & Conditions and Responsible Gambling Policy, both of which form part of the overarching agreement between you and to288. In the event of any conflict between this Policy and the Terms & Conditions regarding the handling of personal data, this Policy shall take precedence.

1.4 to288 acts as the data controller in respect of personal data collected through the Platform. Where third-party service providers process data on our behalf (for example, payment processors and identity verification services), they act as data processors subject to contractual data protection obligations.

The following terms are used consistently throughout this Policy:

3.1 to288 collects the following categories of personal data in the course of providing its Services:

3.2 to288 does not intentionally collect special categories of personal data (sometimes called sensitive personal data), which include data revealing racial or ethnic origin, political opinions, religious beliefs, health information, or criminal record data, except where required by applicable anti-money laundering or compliance obligations.

4.1 Directly from You. The majority of personal data is collected directly from you when you: (a) register an account on the Platform; (b) complete the KYC identity verification process; (c) make a deposit or withdrawal using supported payment method (including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency); (d) contact our customer support team; or (e) participate in promotional programmes, loyalty schemes, or surveys.

4.2 Automatically. When you access the to288 Platform, certain technical data is collected automatically through the operation of our systems, including cookies, server logs, and session management tools. This data is necessary for the secure and functional operation of the Platform and cannot be disabled without affecting core service functionality.

4.3 From Third Parties. to288 may receive personal data from third-party sources in limited circumstances, including: (a) identity verification service providers used to validate KYC documents; (b) payment processors who confirm transaction status and account ownership; and (c) fraud prevention and AML screening databases where required by our compliance obligations.

5.1 to288 processes personal data only for specific, legitimate purposes. The principal purposes and corresponding legal bases are as follows:

5.2 Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for promotional communications does not affect your ability to maintain and use your account.

6.1 Account Operations. to288 processes your Identity Data and Contact Data to create, maintain, and manage your account. This includes authentication at login, account verification, customer support interactions, and compliance with account-related obligations under the Terms & Conditions.

6.2 Financial Transactions. Financial Data is processed to facilitate deposits and withdrawals through your chosen payment method. For Malaysian players, this includes transactions processed via FPX, DuitNow, Maybank internet banking, CIMB internet banking, Public Bank internet banking, Hong Leong internet banking, Touch 'n Go eWallet, Boost, and GrabPay. All financial data processing involving third-party payment providers is governed by the payment provider's applicable data terms.

6.3 Responsible Gambling Processing. Gaming Activity Data is analysed by to288's responsible gambling systems to identify patterns that may indicate problem gambling behaviour — for example, rapidly escalating deposits, extended uninterupted session durations, or repeated self-exclusion requests. Where such patterns are detected, to288 may proactively reach out to the Player with responsible gambling resources. This processing is conducted in the legitimate interest of player welfare.

6.4 Compliance Processing. to288 is required by its licensing obligations to retain certain transaction and identity records for audit purposes. This processing is carried out under a legal obligation and cannot be refused by the Player without affecting the ability to maintain an account.

7.1 to288 does not sell, rent, or commercially share your personal data with any third party. Data may be disclosed to the following categories of recipient only to the extent strictly necessary:

• Payment Processors: Regulated third-party payment service providers (including those operating Touch 'n Go, Boost, GrabPay, DuitNow, FPX integrations, and banking partners such as Maybank, CIMB, Public Bank, and Hong Leong) receive transaction-specific financial data necessary to execute deposits and withdrawals.
• KYC & Identity Verification Providers: Authorised identity verification services receive copies of submitted identity documents to confirm player identity and age (21+) compliance.
• AML & Fraud Screening Services: Personal data may be cross-referenced with fraud prevention and sanctions screening databases as required by our compliance framework.
• Game Software Providers: Gaming activity data may be shared with our licensed game software providers to the extent required to operate, audit, and support the games made available on the Platform.
• Legal and Regulatory Authorities: to288 will disclose personal data to law enforcement agencies, courts, regulatory bodies, or other governmental authorities when legally compelled to do so by valid legal process, court order, or applicable regulatory obligation.
• Professional Advisors: Legal, accounting, and auditing professionals retained by to288 may access personal data under strict confidentiality obligations as necessary to perform their professional services.

7.2 All third-party recipients listed above are required to handle personal data in accordance with applicable data protection standards. to288 does not enter into commercial arrangements with third parties that involve the processing of Player personal data for the third party's own marketing or commercial purposes.

8.1 to288 operates under international online gambling licensing, and its infrastructure, personnel, and third-party service providers may be located in jurisdictions outside Malaysia. As a result, your personal data may be transferred to and processed in countries other than Malaysia.

8.2 Where personal data is transferred internationally, to288 takes reasonable steps to ensure that appropriate safeguards are in place, including contractual data protection obligations with receiving parties that reflect internationally recognised data protection standards.

8.3 By using the to288 Platform, you acknowledge and consent to the international transfer of your personal data for the purposes described in this Policy.

9.1 to288 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention principles apply:

• Account Data: Retained for the duration of the active account relationship and for a period of five (5) years following account closure, unless a longer retention period is required by applicable AML or compliance regulations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later, in compliance with anti-money laundering recordkeeping obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Records: Retained for three (3) years from the date of the interaction, unless the matter relates to an unresolved dispute or legal proceedings.
• Technical and Log Data: Retained for up to twelve (12) months for fraud detection and security purposes, after which it is anonymised or deleted.

9.2 Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

10.1 to288 uses cookies and similar tracking technologies (collectively "cookies") to operate the Platform effectively. Cookies are small text files stored on your device by your browser when you access a website.

10.2 The following categories of cookies are used on the to288 Platform:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, authentication, and security. These cannot be disabled without impairing core functionality.
• Functional Cookies: Enable the Platform to remember your preferences, such as language settings and previously selected payment methods.
• Analytics Cookies: Collect anonymised or aggregated data about how Players navigate the Platform, used to improve Platform performance and user experience. No individual Player is identified through analytics processing.
• Fraud Prevention Cookies: Assist in detecting unusual login patterns, duplicate accounts, and bot activity to protect the security of all players on the Platform.

10.3 to288 does not use advertising cookies or deploy third-party behavioural tracking technologies that profile Players for marketing purposes unrelated to to288's own promotional communications.

10.4 You may manage cookie preferences through your browser settings. Please note that disabling cookies beyond strictly necessary categories may affect your ability to use certain Platform features.

11.1 Subject to applicable law and the conditions described below, Players have the following rights with respect to their personal data held by to288:

11.2 How to Exercise Your Rights. To exercise any of the above rights, submit a written request to our support team via the contact details in Section 15. to288 will verify your identity before processing any data subject request and will respond within thirty (30) days. Complex requests may be extended by a further sixty (60) days with prior notification.

11.3 Limitations. Certain rights are not absolute. to288 may decline or limit a request where fulfilling it would conflict with legal retention obligations, ongoing fraud investigations, court orders, or the rights and freedoms of third parties. Where a request is declined, you will be informed of the reason.

12.1 to288 strictly prohibits use of the Platform by any person under the age of twenty-one (21) years. The Platform is designed exclusively for adults and actively enforces age verification through mandatory KYC procedures.

12.2 to288 does not knowingly collect, process, or retain personal data from persons under the age of 21. If to288 becomes aware that a registered account belongs to a person under 21, the account will be suspended immediately, all associated data will be reviewed for compliance purposes, and the account will be closed in accordance with the Terms & Conditions.

12.3 If you are the parent or guardian of a minor who has registered on the Platform without authorisation, please contact us immediately at the details set out in Section 15 so that appropriate steps can be taken to close the account and handle any associated data in a compliant manner.

13.1 to288 implements a range of technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Key measures include:

• Encryption in Transit: All data transmissions between your device and the to288 Platform are encrypted using 256-bit SSL/TLS protocols.
• Encryption at Rest: Sensitive personal data and identity documents stored on to288 systems are encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Personnel with access to sensitive data undergo background screening and receive data protection training.
• Two-Factor Authentication: Players are able to enable two-factor authentication (2FA) on their accounts to provide an additional layer of login security.
• Security Monitoring: to288 employs continuous monitoring of its systems for anomalous activity, unauthorised access attempts, and known attack vectors.
• Incident Response: to288 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in risk to Players, to288 will notify affected individuals as required by applicable data protection obligations.

13.2 Notwithstanding the security measures described above, no data transmission over the internet or electronic storage system is one hundred percent secure. to288 cannot guarantee absolute security but commits to industry-standard best practices and continuous improvement of its security posture.

14.1 to288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or operational requirements.

14.2 The effective date displayed at the top of this Policy reflects the date of most recent revision. Where amendments are material — for example, where new categories of data are collected or the basis for processing changes — to288 will provide not less than fourteen (14) days' advance notice by email to registered account holders prior to the revised Policy taking effect.

14.3 Continued use of the Platform following notification of a Policy amendment constitutes acceptance of the revised terms. If you do not agree with the amended Policy, you should cease using the Platform and may request account closure in accordance with the Terms & Conditions.

15.1 For all privacy and data protection enquiries — including data subject access requests, rectification requests, consent withdrawal, and formal privacy complaints — please contact the to288 data team using the details below:

15.2 All formal data subject requests must be submitted in writing by email and must include: (a) your registered username; (b) a description of the right you wish to exercise and the data concerned; and (c) a copy of a valid identity document so that to288 can verify your identity before disclosing, amending, or deleting any personal data.

15.3 For general account support, bonus queries, or responsible gambling assistance, please contact our 24/7 live chat team directly through the Platform or by email at the address above. For responsible gambling tools and resources, visit the Responsible Gambling page at /responsible-gambling.