OYO288 Privacy Policy —
Members' Personal Data Protection

1Introduction and Scope of This Privacy Policy

This Privacy Policy explains how OYO288 ("we", "Platform", or "OYO288") collects, uses, stores, discloses, and protects your personal information when you use our website, mobile app, and services.

By registering as an OYO288 member or using any of our services, you agree to the collection and use of your personal information as described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform and contact our support team to close your account.

This Privacy Policy applies to all OYO288 platform users regardless of how they access our services — whether via desktop web browser, smartphone, tablet, or our official mobile app. We encourage you to read this document carefully and refer back to it from time to time as we may update it to reflect changes in our practices or legal requirements.

2Personal Information We Collect

Oyo288 only collects personal information that is strictly necessary to provide a safe, fair, and regulatory-compliant service. The following are the categories of information we collect:

We may also collect information you voluntarily provide when contacting our customer support team, filling out feedback forms, or participating in customer satisfaction surveys we conduct from time to time.

3How We Use Your Information

Every piece of information we collect is used for a clear and lawful purpose. oyo288 uses your personal data for the following purposes:

• Process account registration and verify your identity through our established KYC process
• Process deposits, withdrawals, and all financial transactions securely and accurately
• Detect and prevent fraud, money laundering, and other illegal activities on the platform
• Send important notifications related to your account — such as transaction confirmations and security alerts
• Provide efficient and effective customer support whenever you need assistance
• Personalise your gaming experience based on your preferences and usage history
• Comply with legal obligations and requirements from relevant regulatory authorities
• Analyse platform usage patterns for the purpose of continuous service improvement
• Send personalised promotions and offers, which you may unsubscribe from at any time

4Data Sharing and Disclosure

Oyo288 takes your privacy seriously. We do not sell, rent, or trade your personal information to any third party. However, in limited and specific circumstances, we may share your data with the following parties:

• Payment Service Providers — banks and digital wallet providers that process your financial transactions, subject to strict confidentiality agreements
• Technology Service Providers — cloud computing and cybersecurity companies that help us operate the platform securely
• Regulatory Bodies and Law Enforcement — when required by law, court order, or official request from the relevant authorities
• Identity Verification Services — third-party providers who assist us in conducting KYC and AML (Anti-Money Laundering) checks

All third parties we work with are required to sign strict data protection agreements, ensuring they handle your information with the same level of security and confidentiality as we do. They are only permitted to use your data for the specific purposes defined in those agreements.

5Data Security and Protection Measures

The security of your personal data is the absolute top priority for OYO288. We continually invest in the latest security technologies and processes to ensure your information is always protected against today's increasingly sophisticated cyber threats.

The security measures we employ include:

• 256-bit SSL encryption for all data transmitted between you and our servers
• Data-at-rest encryption using AES-256 for all stored data
• Two-factor authentication (2FA) available for all member accounts
• Round-the-clock security monitoring and anomaly detection, 24 hours a day, 7 days a week
• Regular penetration testing conducted by certified independent security firms
• Role-based access control (RBAC) ensuring only authorised personnel can access sensitive data
• Comprehensive audit logs for every access and modification of personal data
• A comprehensive incident response plan to address any data breaches swiftly

While we take all reasonable precautions, no security system can guarantee absolute one-hundred-percent protection. In the event of a data breach affecting your information, we are committed to notifying you within 72 hours of becoming aware of the incident, in line with international data protection best practices.

6Data Retention Period

Oyo288 does not retain your personal data longer than necessary for the purpose for which it was collected. Our data retention periods are as follows:

• Active Account Data — retained for the duration your account is active and up to 5 years after account closure for legal compliance purposes
• Financial Transaction Records — retained for 7 years in accordance with Malaysia's accounting and tax legal requirements
• KYC Documents — retained for a minimum of 5 years after the end of the business relationship, or longer if required by law
• Security and Technical Logs — retained for 12 months for security investigation and troubleshooting purposes
• Support Communication Records — retained for 2 years after case resolution

Once the specified retention period expires, your personal data will be securely deleted or anonymized so that it can no longer be associated with you. This deletion process is carried out automatically and periodically by our data management system.

7Your Privacy Rights as a Member

As an oyo288 member, you have clearly defined privacy rights, and we are fully committed to respecting them. You may exercise these rights by contacting our privacy team via our official support email.

All privacy rights requests will be processed within 30 business days. In more complex cases, this period may be extended to 60 days with prior notice. oyo288 does not charge any fees for handling reasonable privacy rights requests.

8Cookies and Tracking Technologies

Oyo288 uses cookies and similar tracking technologies to enhance the user experience, ensure platform security, and understand how members use our services. The following are the types of cookies we use:

• Essential Cookies — required for core platform functions such as login session verification and account security. These cookies cannot be disabled.
• Performance Cookies — collects information on how you use the platform to help us identify and resolve technical issues.
• Functional Cookies — stores your preferences such as language, display settings, and game preferences for a more personalised experience.
• Analytics Cookies — helps us understand overall platform usage patterns for continuous improvement purposes.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect the functionality and security of your account on the OYO288 platform. We recommend keeping essential cookies active for a smooth and secure gaming experience.

9Cross-Border Data Transfers

In operating the OYO288 platform, your personal data may be transferred to and stored on servers located outside Malaysia. Such transfers are carried out solely for technical operations and platform security purposes.

Oyo288 ensures that all cross-border data transfers are carried out with adequate safeguards, including the use of internationally recognised standard contractual clauses, data protection assessments prior to transfer approval, and ongoing monitoring of overseas service providers to ensure they maintain the required security standards.

10Privacy Policy Updates

Oyo288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements, or service improvements. Each update will be accompanied by a new "Updated" date at the top of this document.

For material changes — meaning changes that significantly affect how we handle your personal data — we will notify you via your registered email at least 14 days before those changes take effect. Continued use of the OYO288 platform after the effective date constitutes your acceptance of the changes.

We encourage you to review this Privacy Policy periodically so you remain informed about how we protect your personal information. Previous versions of the Privacy Policy are available upon request.