Privacy Policy — trf88

trf88 ("the Platform", "we", "us", "our") operates the online casino and sports betting website accessible at https://trf88.cam. In the course of providing our services to players in Malaysia and other permitted jurisdictions, we necessarily collect and process personal data relating to our registered users.

This Privacy Policy ("Policy") sets out, in clear and transparent terms, how trf88 collects, uses, stores, shares, and protects personal data provided by or generated through the use of our platform. It also explains the rights that data subjects hold in relation to their personal data and how those rights may be exercised.

This Policy applies to all personal data processed by trf88 in connection with the use of our website, mobile interface, live chat system, email communications, and any other channel through which you interact with us. It should be read together with our Terms & Conditions and our Responsible Gambling Policy.

By registering an account on trf88, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing activities described herein. If you do not consent to this Policy, you should not use the trf88 platform.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, phone number, financial account details, IP address, and device identifiers.
• "Processing" — Any operation or set of operations performed on personal data, including collection, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is trf88.
• "Data Processor" — Any third party engaged by trf88 to process personal data on its behalf, such as KYC verification providers, payment processors, and IT infrastructure suppliers.
• "Data Subject" — The identified or identifiable individual to whom personal data relates — in this context, you as a registered player or website visitor.
• "Sensitive Data" — A subset of personal data afforded heightened protection, including identity document details, biometric data submitted for KYC purposes, and financial account information.
• "Consent" — A freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their personal data.

trf88 collects personal data that is necessary to provide its services, maintain account security, comply with regulatory obligations, and prevent fraud and financial crime. We operate on a data minimisation principle — we do not collect data that is unnecessary for a defined, lawful purpose.

The categories of personal data we collect include:

trf88 does not collect sensitive personal data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data (other than voluntary responsible gambling disclosures), or sexual orientation.

trf88 collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact support via live chat or email, or participate in a promotion.
• Automatically during platform use — through server logs, session management systems, and standard web technologies that record your interactions with the trf88 website, including pages visited, games played, and transaction activity.
• From third-party service providers — where trf88 engages licensed KYC verification providers, payment processing partners (including Malaysian payment providers such as DuitNow/FPX operators and e-wallet platforms), or fraud screening services that provide data points necessary for compliance.
• From publicly available sources — including sanctions lists, politically exposed persons (PEP) databases, and adverse media sources, which trf88 checks as part of its anti-money laundering (AML) compliance programme.

trf88 processes personal data on the following legal bases, each of which applies to different categories of processing activity:

• Contractual Necessity: Processing required to fulfil the contract between trf88 and the player, including account creation, deposits, withdrawals, and game participation.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, regulatory reporting obligations, and law enforcement requests made under lawful authority.
• Legitimate Interests: Processing carried out in pursuit of trf88's legitimate business interests where these do not override the data subject's fundamental rights — including fraud prevention, platform security, abuse detection, and business analytics.
• Consent: Where trf88 relies on consent as the legal basis for processing — for example, for optional marketing communications — that consent is collected at the point of the relevant interaction and may be withdrawn at any time without affecting the legality of prior processing.

trf88 uses collected personal data for the following defined purposes. Data is not used for any purpose inconsistent with those listed below without prior notification and, where required, renewed consent:

• Creating and managing your player account, including authentication and access control
• Processing deposits made via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or cryptocurrency methods
• Processing withdrawal requests to verified player payment accounts in MYR
• Verifying player identity and age (21+ requirement) in accordance with our KYC obligations
• Monitoring player activity to identify potential money laundering, fraud, or collusion
• Providing customer support via live chat and email, and maintaining records of support interactions
• Administering bonuses, promotions, VIP tier benefits, birthday bonuses, and referal rewards in accordance with applicable terms
• Monitoring betting and gaming activity to identify signs of problem gambling and applying responsible gambling tools where appropriate
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) to the registered email and phone number
• Sending promotional communications where the player has opted in to receive such communications
• Improving platform performance, game offering, and user experience based on aggregated usage analytics
• Complying with regulatory reporting and audit requirements under applicable gaming and financial crime legislation

trf88 does not sell, rent, or trade personal data to third parties for commercial gain. We share personal data only in the circumstances described below, and only to the minimum extent necessary for the defined purpose:

• Payment Processors: Data necessary to facilitate deposits and withdrawals is shared with licensed payment service providers including DuitNow/FPX operators, e-wallet platforms, banking partners (Maybank, CIMB, Public Bank, RHB, Hong Leong Bank), and cryptocurrency settlement providers. These partners are bound by contractual data protection obligations.
• KYC & AML Compliance Providers: Identity verification data is shared with licensed third-party KYC service providers for document verification, sanctions screening, and PEP checks. These providers act as Data Processors under trf88's instruction.
• IT Infrastructure Providers: Hosting, server management, and security services are provided by third-party infrastructure partners operating under confidentiality agreements and applicable data protection requirements.
• Regulatory Authorities: trf88 is obligated to disclose player data to relevant regulatory bodies, licensing authorities, financial intelligence units, or law enforcement agencies when required by a lawful order, subpoena, or regulatory reporting obligation.
• Group Entities: Where trf88 operates within a group of related entities, data may be shared internally for consolidated compliance monitoring, fraud prevention, and risk management purposes, subject to equivalent data protection safeguards.

Any third party receiving personal data from trf88 is required to process that data only for the specified purpose and to implement appropriate technical and organisational security measures.

trf88 uses cookies and similar technologies to operate and improve the platform. Cookies are small text files stored on your device that enable trf88 to recognise your browser session, maintain login state, and collect anonymised usage statistics.

The cookies used by trf88 fall into the following categories:

• Strictly Necessary Cookies: Required for core platform functionality including login sessions, deposit flow management, and security token validation. These cookies cannot be disabled without preventing access to core platform features.
• Performance and Analytics Cookies: Used to collect anonymised data on how players navigate the platform, which games they access most frequently, and where technical errors occur. This data is used to improve platform performance and is not linked to individual player identities.
• Functional Cookies: Used to remember player preferences such as selected language, preferred game categories, and interface display settings.

trf88 does not use cross-site tracking cookies, behavioural advertising cookies, or social media tracking pixels. Players may manage cookie preferences through their browser settings, noting that disabling strictly necessary cookies will affect platform functionality.

trf88 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to mandatory retention periods required by applicable law and regulation. The following retention periods apply as a general framework:

• Active Account Data: Retained for the duration of the player's account registration and for minimum period of five (5) years following account closure, to meet anti-money laundering record-keeping obligations.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later, in accordance with AML legislation applicable to trf88's operating jurisdiction.
• Transaction Records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years following the date of the transaction.
• Support Correspondence: Live chat transcripts and email records are retained for two (2) years from the date of the interaction, or longer where records relate to an open dispute or investigation.
• Marketing Data: Where a player has opted in to marketing communications, associated preference data is retained until the player opts out, following which it is archived for suppression list purposes.

trf88 implements a layered set of technical and organisational security measures designed to protect personal data from unauthorised access, disclosure, alteration, or destruction. Key security controls include:

• Encryption: All data in transit between your device and trf88 servers is protected using TLS 1.2 or higher (256-bit encryption). All data at rest on trf88 servers is encrypted using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted to authorisedrf88 personnel on a need-to-know basis. All internal data access is logged and subject to periodic access reviews.
• Network Security: trf88 infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and continuous security monitoring.
• Authentication: All player accounts support two-factor authentication (2FA). Administrative access to trf88 backend systems requires multi-factor authentication as a mandatory control.
• Vulnerability Management: trf88 conducts periodic penetration testing and vulnerability assessments of its platform and infrastructure. Critical vulnerabilities are remediated within defined timeframes.

Notwithstanding these measures, no transmission of data over the internet is entirely risk-free. In the event of a confirmed personal data breach that is likely to result in a risk to the rights and freedoms of affected players, trf88 will notify affected individuals promptly and, where applicable, report the breach to relevant supervisory authorities within the timeframes prescribed by applicable data protection regulation.

trf88's primary data processing operations are conducted within the jurisdiction of its operating licence. Where personal data is transferred to, or accessed from, countries outside the player's country of residence (including for the purpose of using cloud infrastructure providers or KYC service partners), trf88 ensures that appropriate safeguards are in place to protect data to a standard equivalent to that applicable in the primary operating jurisdiction.

Such safeguards may include contractual clauses between trf88 and its data processors that impose equivalent data protection obligations, or reliance on the receiving jurisdiction's recognition as providing an adequate level of data protection.

Players who have questions about specific international transfer arrangements may submit an inquiry to our data protection contact as set out in Section 15 of this Policy.

As a data subject whose personal data is processed by trf88, you hold the following rights.rf88 will respond to valid requests within 30 calendar days of receipt, subject to identity verification: