evo888 Privacy Policy

1.Who We Are

evo888 is the operator of the online gaming platform accessible at evo888.one and its associated subdomains (the "Platform"). In this Privacy Policy, references to "evo888", "we", "us", or "our" are references to the Platform operator in its capacity as data controller in respect of the personal data described in this Policy.

evo888 is committed to protecting the privacy of all persons who interact with the Platform, including registered players, prospective players who browse without registering, and individuals who contact our support team. This Policy is intended to be read alongside the evo888 Terms & Conditions, which govern your use of the Platform generally.

2.Data We Collect

evo888 collects personal data through several channels, including account registration, use of the Platform, payment transactions, customer support interactions, and automated technical means. The categories of personal data we collect include:

2.1 Data You Provide Voluntarily. The majority of personal data evo888 holds about you is provided by you directly, either during account registration, in the course of transacting on the Platform, or when you contact our support team. You are not obligated to provide this data, but certain data is necessary for evo888 to provide the Platform services and to comply with legal obligations. Failure to provide required data may mean we are unable to open or maintain your Account.

2.2 Data Collected Automatically. When you access the Platform, our servers automatically collect Technical Data, including your IP address, device identifiers, and browsing behaviour within the Platform. This data is collected via server logs, cookies, and similar technologies as further described in Section 5.

2.3 Data from Third Parties. evo888 may receive personal data about you from third parties, including payment processors (transaction verification data), identity verification service providers (KYC data), fraud prevention databases, and our gaming software providers (game history data from third-party game servers).

3.How We Use Your Data

evo888 uses the personal data it collects for the following purposes:

• Account Management: To create, maintain, and administer your evo888 Account, including verifying your identity and age, processing your login credentials securely, and enabling access to Platform features.
• Service Delivery: To process your deposits and withdrawals, settle your wagers, apply applicable bonuses, and provide the full range of casino and sportsbook services available on the Platform.
• Legal and Regulatory Compliance: To fulfil evo888's obligations under applicable anti-money laundering (AML) laws, responsible gaming regulations, licensing conditions, and tax reporting requirements. This includes conducting Know Your Customer (KYC) verification and filing regulatory reports where legally required.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, cheating, account takeovers, and other security threats. This includes automated analysis of gaming patterns, transaction anomalies, and login behaviour.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling, to apply self-imposed limits you have set, and to flag accounts that may require responsible gaming interventions.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance through live chat, email, and WhatsApp.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw consent at any time through your Account Settings or by contacting support.
• Platform Improvement: To analyse usage patterns, game performance data, and user experience metrics to improve the Platform's features, stability, and content offering.

4.Legal Basis for Processing

evo888 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between evo888 and you (the Account Terms), including account administration, transaction processing, and game settlement.
• Legal Obligation: Processing required for evo888 to comply with applicable laws, including AML regulations, KYC requirements, and licensing conditions imposed by regulatory authorities.
• Legitimate Interests: Processing necessary for evo888's legitimate interests, including fraud detection and prevention, platform security, responsible gaming monitoring, and business analytics, where those interests are not overridden by your data protection rights.
• Consent: For marketing communications and non-essential cookie usage, where we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

5.Cookies & Tracking Technologies

5.1 What Cookies We Use. The evo888 Platform uses cookies and similar tracking technologies to enable core Platform functionality, remember your session, and analyse how the Platform is used. The categories of cookies deployed include:

• Strictly Necessary Cookies: Essential for login session management, security tokens, and core Platform functionality. These cannot be disabled without breaking Platform access.
• Functional Cookies: Remember your preferences such as language, display settings, and game lobby filters between sessions.
• Analytical Cookies: Collect anonymised data about how users navigate the Platform, which pages are visited most frequently, and where users encounter errors. Used to improve Platform performance.
• Marketing Cookies: Used to track the source of traffic to the Platform (e.g., which promotional channel referred you) to measure campaign effectiveness. Only deployed with your consent.

5.2 Cookie Management. You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. A cookie preference centre is accessible from the Platform footer where applicable.

6.Data Sharing & Disclosure

evo888 does not sell your personal data to third parties. We share personal data only in the following circumstances:

• Payment Processors: Financial data is shared with payment service providers (including e-wallet operators such as Touch n Go eWallet and Boost, and banking partners such as Maybank, CIMB, and Public Bank) solely to process your transactions.
• Identity Verification Providers: Identity Data is shared with KYC/AML service providers to verify your identity and age in accordance with regulatory requirements.
• Game Software Providers: Gaming Data is shared with third-party game studios and platform providers to enable game delivery, session logging, and jackpot network participation.
• Fraud Prevention Services: Technical Data and transaction patterns may be shared with specialist fraud detection services to identify and prevent fraudulent activity.
• Regulatory Authorities: evo888 is required to disclose certain personal data to licensing regulators, financial intelligence units, and law enforcement agencies upon lawful request or as required by applicable law.
• Group Companies: evo888 may share data with affiliated entities within its corporate group for operational, compliance, and administrative purposes, subject to equivalent data protection obligations.

All third-party service providers with whom evo888 shares personal data are required to process that data only for the specified purpose, maintain appropriate security standards, and comply with applicable data protection laws.

7.International Data Transfers

evo888 operates globally and some of its service providers, game software vendors, and infrastructure partners are located outside Malaysia. Where personal data is transferred outside Malaysia or the jurisdiction in which the Platform is licensed, evo888 ensures that appropriate safeguards are in place, including standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms recognised under applicable data protection law. By using the Platform, you acknowledge that your personal data may be transferred, stored, and processed in countries outside Malaysia, subject to these safeguards.

8.Data Retention

evo888 retains personal data for as long as is necessary for the purposes described in this Policy and to fulfil applicable legal and regulatory retention obligations. Specific retention periods include:

• Account and Identity Data: Retained for the duration of your Account plus a minimum of five (5) years following Account closure, in accordance with AML regulatory requirements.
• Transaction and Financial Data: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial record-keeping obligations.
• Gaming Data: Retained for a minimum of five (5) years from the date of each gaming session.
• Communications Data: Live chat and email correspondence retained for three (3) years from the date of the interaction.
• Marketing Data: Retained until you withdraw your marketing consent or for two (2) years of inactivity, whichever is earlier.
• Technical and Log Data: Retained for twelve (12) months from collection.

Where data is no longer required for any lawful purpose, evo888 will securely delete or anonymise it.

9.Your Data Protection Rights

Subject to applicable law, you have the following rights in relation to your personal data held by evo888:

• Right of Access: You may request a copy of the personal data evo888 holds about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Some corrections (e.g., legal name) require supporting documentation.
• Right to Erasure: You may request deletion of your personal data in certain circumstances. This right is subject to evo888's legal retention obligations — data that must be retained for regulatory compliance cannot be deleted on request during the mandatory retention period.
• Right to Restrict Processing: You may request that evo888 restrict certain processing activities while a dispute is resolved or a rectification request is pending.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a machine-readable copy of your personal data.
• Right to Object: You may object to processing based on legitimate interests (including profiling for responsible gaming purposes) where you believe your rights override evo888's interests in that processing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, contact the evo888 support team via the details in Section 14. evo888 will respond to valid requests within thirty (30) calendar days. In complex cases, the response period may be extended by a further sixty (60) days with prior notice.

10.Children's Privacy

The evo888 Platform is strictly intended for persons aged 21 years and above. evo888 does not knowingly collect or process personal data from any individual under the age of 21. Age verification is conducted as part of the account registration and KYC process. If evo888 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the associated Account permanently closed without return of any balance.

If you believe that evo888 may have inadvertently collected data from a person under 21, please contact us immediately via the details in Section 14.

11.Data Security

evo888 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and evo888 servers;
• Encryption at rest for sensitive personal and financial data stored in evo888 databases;
• Role-based access controls limiting internal access to personal data to staff with a legitimate operational need;
• Multi-factor authentication for evo888 staff accessing administrative systems;
• Regular penetration testing and vulnerability assessments of Platform infrastructure;
• Incident response procedures for notifying affected players and relevant authorities in the event of a data breach.

While evo888 employs robust security measures, no digital platform is entirely immune from security risks. You are responsible for maintaining the security of your own Account credentials and for notifying evo888 promptly if you suspect unauthorised access to your Account.

12.Third-Party Links

The evo888 Platform may contain links to third-party websites or services (for example, payment processor portals accessed during deposit or withdrawal). evo888 is not responsible for the privacy practices of those third-party sites. We encourage you to read the privacy policies of any third-party services you access through the Platform. evo888's Privacy Policy applies solely to data collected through the evo888 Platform.

13.Changes to This Privacy Policy

evo888 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via the Platform and/or by email to the registered address at least seven (7) days before the changes take effect, except where immediate changes are required by law. The "Last Updated" date at the top of this Policy will be revised accordingly. Your continued use of the Platform after the effective date of any update constitutes your acknowledgement of the revised Policy.

14.Contact Us

For questions, concerns, or to exercise any of your data protection rights, please contact the evo888 data protection team through the following channels:

• Live Chat: Available on the Platform daily from 8AM to 2AM MYT. Ask to speak with a Data Protection representative for privacy-related matters.
• Email: [email protected] — include "Privacy Request" in the subject line.

evo888 will acknowledge privacy-related requests within five (5) business days and provide a substantive response within thirty (30) calendar days.