Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is published by 198rich ("Company", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://198rich.cam ("Platform"). It applies to all individuals ("User", "you", "your") who access, register on, or otherwise interact with the Platform or any associated service.

198rich is committed to the responsible handling of personal data in accordance with applicable data protection legislation, including but not limited to the Personal Data Protection Act 2010 of Malaysia (PDPA 2010) and any relevant international data protection frameworks applicable to cross-border processing activities.

We operate with transparency as a core value. This Policy is written in plain English so that all of our players — whether based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere in Malaysia — fully understand how their information is handled. Where technical or legal language is unavoidable, we provide plain-language explanations alongside.

2 Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a living individual, whether directly (e.g., full name, NRIC number) or indirectly (e.g., IP address in combination with other data).
• "Processing" — Any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or any other form of handling.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, the Data Controller is 198rich.
• "Data Processor" — A third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement.
• "Sensitive Personal Data" — A category of data requiring heightened protection, including identity document numbers, financial account details, and information relating to health or criminal history.
• "Cookie" — A small text file placed on a User's device by the Platform for the purposes of functionality, analytics, or personalisation.
• "KYC" — Know Your Customer: the identity verification process required by 198rich before processing withdrawals or at other compliance checkpoints.

3 Personal Data We Collect

198rich collects the minimum data necessary to operate the Platform, process transactions, comply with legal obligations, and deliver a secure and personalised user experience. The categories of data we collect include:

We do not collect Sensitive Personal Data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, or biometric data for the purpose of uniquely identifying a natural person, except where required by mandatory KYC regulation.

4 How We Collect Your Data

We collect personal data through the following channels:

4.1 Direct Collection

Data you provide voluntarily when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to surveys and promotions. This includes all form fields completed on the Platform and documents uploaded during the verification process.

4.2 Automated Collection

Technical and usage data collected automatically when you access the Platform, through server logs, cookies, web beacons, pixel tags, and similar tracking technologies. This data is collected regardless of whether you are a registered User or an anonymous visitor.

4.3 Third-Party Sources

Data received from third-party service providers in connection with payment processing (e.g., transaction confirmation from Maybank, CIMB, Public Bank, DuitNow, FPX), identity verification services, fraud prevention tools, and analytics providers. We ensure all third-party data sources are bound by appropriate data processing agreements.

5 Purposes of Data Processing

198rich processes your personal data for the following specific, legitimate purposes:

• Account Management: Creating, maintaining, and administering your Account, including authentication, security monitoring, and settings management.
• Transaction Processing: Processing deposits and withdrawals via your selected payment methods, including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow QR, FPX, and cryptocurrency channels.
• Identity Verification (KYC): Confirming your identity, age (21+), and residence to comply with applicable regulations and prevent underage gambling.
• Anti-Fraud and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, account takeover, and other security threats.
• Legal and Regulatory Compliance: Meeting obligations imposed by applicable law, including record-keeping, regulatory reporting, and responding to lawful requests from competent authorities.
• Customer Support: Responding to your queries, resolving disputes, and providing technical assistance through live chat, email, and other support channels.
• Service Improvement: Analysing usage patterns and game preferences to improve Platform features, user interface, and gaming content selection.
• Responsible Gambling: Monitoring gaming behaviour to identify at-risk patterns, administering self-exclusion or deposit limit requests, and supporting player protection obligations.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates where you have provided consent, with the option to opt out at any time.

6 Legal Basis for Processing

Where applicable data protection law requires a lawful basis for processing personal data, 198rich relies on the following grounds:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you have agreed to, including Account management, payment processing, and game provision.
• Legal Obligation: Processing necessary to comply with applicable laws, including KYC requirements, anti-money laundering regulations, and tax reporting obligations.
• Legitimate Interests: Processing for purposes such as fraud prevention, platform security, service improvement, and responsible gambling monitoring — where these interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications, personalised offers, and optional analytics, where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Third-Party Disclosure

198rich does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share data only in the following limited circumstances:

7.1 Service Providers

We engage third-party processors to assist with payment processing (e.g., banks and e-wallet operators), identity verification, fraud detection, cloud infrastructure, customer support platforms, and analytics. These processors are contractually bound to process your data only for the specified purpose and to maintain appropriate security standards.

7.2 Regulatory and Law Enforcement

We may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or where we believe disclosure is necessary to protect the legal rights of the Company or to prevent imminent harm.

7.3 Corporate Transactions

In the event of a merger, acquisition, business restructuring, or sale of assets, personal data held by 198rich may be transferred to the acquiring entity, subject to that entity assuming equivalent or stronger data protection obligations. Affected Users will be notified in advance where practicable.

8 Cookies & Tracking Technologies

198rich uses cookies and similar tracking technologies to operate the Platform effectively, maintain session security, and gather aggregate analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies, authentication tokens, and security cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Store your preferences such as language settings, layout preferences, and saved payment methods to improve your experience across sessions.
• Analytics Cookies: Collect anonymised data about how visitors interact with the Platform — such as pages visited, session duration, and device type — to help us improve the user experience.
• Performance Cookies: Monitor platform performance, error rates, and load times to help our technical team maintain service quality.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. We do not use third-party advertising or retargeting cookies.

9 Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specific retention periods are as follows:

• Account Data: Retained for the duration of your Account plus a minimum of five (5) years following Account closure, as required for legal and regulatory compliance.
• Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with financial record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later.
• Support Communications: Retained for three (3) years from the date of the interaction.
• Technical and Usage Logs: Typically retained for twelve (12) months, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.

10 Data Security

198rich implements a comprehensive set of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive data fields at rest within our databases, including payment credentials and identity document references.
• Two-factor authentication (2FA) available to all registered Users and mandatory for administrative access.
• Automated threat detection and intrusion prevention systems monitoring Platform activity in real time.
• Role-based access controls ensuring staff access to personal data only on a strict need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing by qualified third-party specialists.
• Staff training on data protection obligations, phishing awareness, and incident response procedures.

While we apply industry-standard security measures, no digital system can be guaranteed absolutely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and, where required by law, the relevant supervisory authority within the timeframes prescribed by applicable regulation.

11 International Data Transfers

The 198rich Platform and its supporting infrastructure may operate across multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries other than Malaysia. Where such transfers occur, 198rich ensures that adequate safeguards are in place to protect your data to a standard equivalent to or greater than that required under Malaysian law and applicable international frameworks.

Safeguards may include contractual clauses, adequacy decisions, binding corporate rules, or other lawful transfer mechanisms as appropriate to the specific transfer. You may request further information about the safeguards applicable to a specific international transfer by contacting us at the details provided in Section 15.

12 Your Data Rights

Subject to applicable law and verification of your identity, you hold the following rights with respect to your personal data held by 198rich. To exercise any of these rights, please contact our support team using the details in Section 15. We will respond within thirty (30) days of receiving a valid request.