Privacy Policy

Introduction

qr88 ("we", "us", "our", "the Platform") is an English-language entertainment information website operated for the benefit of Malaysian adults aged 21 and above. This Privacy Policy ("Policy") sets out the manner in which qr88 collects, processes, stores, protects and discloses personal data obtained from users ("you", "User", "Member") who access the qr88 website located at https://qr88.click and all associated services.

By registering an account, using any feature of the Platform or submitting any personal information through the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the practices described herein. If you do not agree with this Policy, please discontinue use of the Platform immediately.

This Policy should be read alongside qr88's Terms & Conditions and Responsible Gambling guide, which together form the full framework governing use of the qr88 Platform.

Definitions

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, directly or indirectly.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — qr88, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — any third party engaged by qr88 to process Personal Data on qr88's behalf, including payment partners, analytics providers and identity verification services.
• "KYC" — Know Your Customer; the identity and age verification process required prior to account activation and withdrawal processing.
• "Cookies" — small text files placed on a user's device by the Platform for session management, authentication, analytics and personalisation purposes.
• "Third Party" — any entity other than qr88 and the individual User, including payment processors, analytics platforms and regulatory bodies.

Data We Collect

qr88 collects the following categories of personal data in the ordinary course of operating the Platform. Collection is limited to what is reasonably necessary for the purposes described in this Policy.

Category	Examples	Purpose
Identity Data	Full legal name, date of birth, NRIC or passport number	KYC verification, age confirmation, fraud prevention
Contact Data	Email address, Malaysian mobile number, residential address	Account communication, support, security alerts
Financial Data	Bank account details, e-wallet identifiers, transaction records in MYR	Deposit and withdrawal processing, AML compliance
Account Data	Username, hashed password, account status, session history	Account management, security, access control
Usage Data	Pages visited, games played, session duration, device and browser type	Platform improvement, responsible gaming monitoring
Technical Data	IP address, device identifiers, operating system, cookie data	Security, fraud detection, geographic access controls

qr88 does not knowingly collect special categories of sensitive personal data (such as health, biometric or genetic data) unless explicitly required for specific regulatory compliance purposes, in which case separate notice will be provided.

How We Collect Data

qr88 collects personal data through the following means:

4.1 Direct Submission

Information you provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or responding to any survey or feedback mechanism on the Platform.

4.2 Automated Technical Collection

When you visit the Platform, qr88's systems automatically record technical data such as your IP address, browser type, device identifiers, session timestamps and pages accessed. This data is collected through server logs, cookies and similar technologies as described in the Cookies section of this Policy.

4.3 Third-Party Sources

qr88 may receive data from third-party identity verification providers, payment partners (including Malaysian payment infrastructure providers such as DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost and GrabPay) and fraud prevention services in connection with the processing of transactions and account compliance activities.

Data Processing & Use

qr88 processes personal data strictly for the following lawful purposes. Data will not be used in ways that are incompatible with the purposes for which it was originally collected.

• Account administration: Creating, maintaining and managing your registered account, including password resets, access controls and communication of account-related information.
• Identity and age verification: Conducting KYC checks to confirm that users are aged 21 and above and are legally permitted to participate in online gambling activities.
• Payment processing: Facilitating deposits and withdrawals in MYR through verified Malaysian payment channels, reconciling transactions and complying with financial reporting obligations.
• Anti-money laundering (AML) and fraud prevention: Monitoring account activity for unusual patterns, investigating suspicious transactions and complying with applicable financial crime prevention regulations.
• Platform security: Detecting, preventing and responding to security threats, unauthorised access attempts and breaches of qr88's Terms & Conditions.
• Responsible gaming monitoring: Tracking usage patterns to identify potentially problematic gambling behaviour and, where applicable, facilitating self-exclusion, deposit limits or cooling-off periods.
• Service improvement and analytics: Analysing aggregated, anonymised usage data to improve the Platform's functionality, content and user experience.
• Legal and regulatory compliance: Meeting obligations imposed by applicable law, regulatory guidance or court orders.
• Support and communications: Responding to enquiries, processing complaints and providing service-related notifications.

Legal Basis for Processing

qr88 processes personal data on the following legal bases, as applicable to each specific processing activity:

• Contractual necessity: Processing required to perform the contract between qr88 and the Member, including account creation, payment processing and service delivery.
• Legal obligation: Processing necessary to comply with applicable legal and regulatory requirements, including KYC, AML and financial crime obligations.
• Legitimate interests: Processing for fraud prevention, Platform security, abuse detection and aggregate analytics, where such interests are not overridden by the rights and freedoms of data subjects.
• Consent: Where qr88 relies on consent as the legal basis for processing — such as for certain marketing communications — you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Data Sharing & Disclosure

qr88 does not sell personal data to third parties. Personal data may be shared only in the following limited circumstances:

7.1 Payment Processors

Financial data is shared with Malaysian payment infrastructure providers — including but not limited to DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank and Hong Leong — solely to facilitate transaction processing. Each provider operates under its own data protection and security framework.

7.2 Identity Verification Providers

Identity and age verification data may be shared with licensed KYC service providers engaged to support qr88's compliance obligations.

7.3 Legal and Regulatory Authorities

qr88 may disclose personal data to competent authorities where required by law, court order or regulatory direction, including in connection with AML investigations or law enforcement requests.

7.4 Platform Service Providers

Technical service providers — such as hosting infrastructure, security monitoring and analytics platforms — may process data on qr88's behalf under contractual obligations that include appropriate data protection safeguards.

Data Retention

qr88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected or to comply with applicable legal, regulatory or contractual obligations.

• Active accounts: Personal data is retained for the duration of the active account relationship.
• Closed accounts: Following account closure, qr88 retains identity, financial and transaction records for a minimum period as required by applicable anti-money laundering regulations. This period is typically five (5) to seven (7) years from the date of the last transaction.
• Usage and technical data: Aggregated or anonymised usage data may be retained for longer periods for analytical purposes, provided it can no longer be attributed to an identified individual.
• Legal holds: Where data is subject to a legal hold, investigation or regulatory inquiry, retention may be extended beyond standard periods until the matter is resolved.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with qr88's internal data disposal procedures.

Data Security

qr88 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures include:

• Encryption of data in transit and at rest using industry-standard protocols.
• Access controls ensuring that personal data is accessible only to authorised personnel with a legitimate need.
• Secure storage infrastructure subject to regular security review.
• Monitoring for suspicious access patterns and anomalous account activity.
• Staff awareness and data handling procedures aligned with applicable privacy principles.

Whilst qr88 applies robust security practices, no online platform can guarantee absolute security. Users are strongly encouraged to maintain strong, unique passwords and to report any suspected unauthorised access to their Account immediately via the contact details in Section 14.

Your Rights

Subject to applicable law and any overriding legal obligations, qr88 recognises the following rights in respect of your personal data:

• Right of access: You may request confirmation of whether qr88 holds personal data about you and, if so, receive a copy of that data.
• Right to rectification: You may request correction of inaccurate or incomplete personal data held by qr88.
• Right to erasure: In certain circumstances you may request deletion of your personal data, subject to qr88's legal obligations to retain specific records.
• Right to restriction of processing: You may request that qr88 restrict the processing of your data in certain defined circumstances.
• Right to data portability: Where technically feasible and legally applicable, you may request your personal data in a structured, commonly used and machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that occurred prior to withdrawal.

To exercise any of these rights, please contact qr88 using the details in Section 14. qr88 will endeavour to respond to verified requests within thirty (30) days. Identity verification may be required before a request can be actioned.

Cookies & Tracking

The qr88 Platform uses cookies and similar tracking technologies to support authentication, session management, security and analytics functions.

11.1 Types of Cookies Used

• Strictly necessary cookies: Required for the Platform to function correctly, including login session management and security tokens. These cannot be disabled without affecting Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how users interact with the Platform, enabling qr88 to identify areas for improvement.
• Preference cookies: Store user settings such as language preferences and display options to provide a more personalised experience on return visits.

11.2 Cookie Management

Most modern browsers allow users to control cookies through browser settings, including blocking or deleting cookies. Please note that disabling certain cookies may affect the functionality of the Platform. For specific browser instructions, refer to your browser's help documentation.

Minors & Age Restriction

The qr88 Platform is strictly intended for adults aged 21 and above. qr88 does not knowingly collect or process personal data relating to individuals under the age of 21. Registration by or on behalf of a person under the minimum age is strictly prohibited.

Where qr88 becomes aware that personal data has been collected from an individual under the minimum age, that data will be deleted promptly and the associated account closed. If you believe that a minor may have accessed the Platform using your Account or provided false age information, please contact qr88 immediately using the details in Section 14.

Policy Changes

qr88 reserves the right to revise this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, platform features or internal data practices. The effective date at the top of this Policy will be updated whenever material changes are made.

Where changes are significant, qr88 will endeavour to provide reasonable notice via the Platform or by email to the address registered on the Member's Account. Continued use of the Platform following the updated effective date constitutes acceptance of the revised Policy.

Users who do not agree with an updated Privacy Policy should cease use of the Platform and request account closure by contacting qr88 using the details below.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data subject right, need to report a suspected data security issue, or have any concerns about how qr88 processes your personal data, please contact us using the details below.

Website email: [email protected]

Email is provided as plain text only. Please copy the address and use your preferred email client to send your enquiry. qr88 aims to acknowledge all written data-related requests within five (5) business days and to resolve them within thirty (30) days where practicable.

For questions about account terms, visit the Terms & Conditions page. For responsible gaming support tools, visit the Responsible Gambling page.