8fat Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by 8fat, the operator of the online casino and sports betting platform accessible at https://8fat.cam (the "Platform"). It describes how 8fat collects, uses, discloses, stores, and protects the personal data of individuals ("you", "your", "the Player", or "the User") who access or use the Platform.

8fat is committed to protecting the privacy and personal data of all players, including those based across Malaysia — in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond. This Policy has been drafted in accordance with applicable data protection principles and is intended to be transparent, comprehensive, and genuinely useful to you as a data subject.

By accessing the Platform, creating an account, or otherwise providing your personal data to 8fat, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue your use of the Platform.

The following defined terms are used throughout this Policy:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, 8fat.
• "Data Processor" means any entity that processes Personal Data on behalf of the Data Controller, including payment processors, KYC verification providers, and hosting service providers.
• "KYC" means Know Your Customer — the identity and age verification process required under 8fat's compliance obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for one or more specified purposes.
• "Cookie" means a small text file stored on your device by the Platform, used to facilitate functionality, analyse usage, and deliver relevant content.

8fat acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, 8fat determines the purposes for which your personal data is processed and the means by which such processing is conducted.

Where 8fat engages third-party service providers to process personal data on its behalf (for example, payment processors such as those facilitating Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, or Public Bank transactions, or identity verification providers), those third parties act as Data Processors under contractual obligations that require them to process data only in accordance with 8fat's instructions and to implement appropriate security measures.

For all privacy-related enquiries, requests, or complaints, the designated contact point is:

8fat collects the following categories of personal data in connection with the operation of the Platform:

4.1 Registration & Identity Data

• Full legal name
• Date of birth
• Gender
• Malaysian identity card number (MyKad) or passport number
• Nationality and country of residence
• Residential address (including postcode and state within Malaysia)

4.2 Contact Data

• Email address
• Mobile phone number
• Preferred language and communication preferences

4.3 Financial & Payment Data

• Bank account details (account number and bank name — e.g., Maybank, CIMB, Public Bank, Hong Leong)
• E-wallet account identifiers (Touch 'n Go, Boost, GrabPay, DuitNow)
• Cryptocurrency wallet addresses (where applicable)
• Transaction history — deposit and withdrawal records, amounts, timestamps, and payment method used
• Source of funds documentation (where requested)

4.4 KYC & Verification Data

• Copies of government-issued identity documents
• Proof of address documents
• Selfie or liveness verification images (where required by our verification provider)

4.5 Gaming & Behavioural Data

• Game play history — games played, bet amounts, outcomes, session duration
• Responsible gambling settings — deposit limits, loss limits, self-exclusion history
• Bonus and promotion history
• Sports betting selections — markets, odds, stake amounts, results

4.6 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session timestamps and login history
• Referral source and campaign attribution data

4.7 Communications Data

• Records of live chat conversations with 8fat support agents
• Email correspondence
• Customer feedback, complaints, and dispute records

8fat collects personal data through the following channels:

5.1 Directly from You

The majority of personal data 8fat holds is provided directly by you during the account registration process, KYC verification, deposit and withdrawal transactions, support interactions, and voluntary participation in promotions or surveys.

5.2 Automatically During Platform Use

When you access and use the Platform, certain technical and behavioural data is collected automatically through cookies, web beacons, server logs, and similar tracking technologies. This includes your IP address, device information, page navigation patterns, and session duration data. Please refer to Section 10 (Cookies & Tracking Technologies) for further detail.

5.3 From Third-Party Service Providers

8fat may receive personal data from third-party service providers in the following circumstances:

• From payment processors and e-wallet operators when you initiate a deposit or withdrawal transaction;
• From identity verification and KYC service providers confirming the outcome of document verification checks;
• From fraud prevention and AML screening services that flag high-risk transaction patterns;
• From referral partners where you have registered via a referral link and the referring party has provided limited identifying information.

The following table sets out the specific purposes for which 8fat processes your personal data and the legal basis for each category of processing:

8fat does not sell your personal data to any third party for commercial purposes. We may, however, share your personal data with the following categories of recipients where necessary and lawful:

7.1 Payment Service Providers

To process deposits and withdrawals, 8fat shares necessary transaction and identity data with licensed payment processors, including operators of local Malaysian payment services (such as FPX-connected banks including Maybank, CIMB, Public Bank, and Hong Leong), e-wallet platforms (Touch 'n Go, Boost, GrabPay, DuitNow), and cryptocurrency payment gateways. These parties process data only to the extent necessary to execute the relevant transaction.

7.2 Identity Verification & Compliance Providers

8fat engages third-party KYC and anti-money laundering (AML) screening providers to perform identity verification checks required by our compliance programme. Identity documents and biometric data shared with these providers are processed under strict contractual data processing agreements.

7.3 Technology & Infrastructure Providers

8fat utilises cloud hosting, content delivery, and software-as-a-service providers to operate the Platform. These providers may process certain categories of your data as Data Processors acting under 8fat's instructions. All such providers are contractually bound to implement appropriate technical and organisational security measures.

7.4 Game Studios & Content Providers

Where game studios and content providers integrate directly with the Platform and require session or account data to deliver their games, limited data may be shared for the purpose of game delivery and fairness verification. Such sharing is governed by data processing agreements.

7.5 Regulatory Authorities & Law Enforcement

8fat may disclose personal data to competent authorities, regulators, or law enforcement agencies where required by applicable law, court order, or regulatory direction, or where 8fat reasonably believes disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

7.6 Successors in Business

In the event of a merger, acquisition, or sale of all or part of 8fat's business, personal data held by 8fat may be transferred to the acquiring entity as part of the business assets, subject to equivalent data protection commitments.

8fat operates internationally and may transfer personal data to countries outside Malaysia for the purposes of delivering services, conducting compliance checks, and operating our technology infrastructure. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, 8fat ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses between 8fat and the receiving entity that require equivalent data protection standards;
• Binding corporate rules where data is transferred within a corporate group;
• The recipient country having been assessed as providing an adequate level of data protection;
• Your explicit consent to the specific transfer, where required.

If you wish to obtain further information about the specific safeguards in place for any international transfer of your personal data, please contact us at [email protected].

8fat retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory, and operational requirements. The following general retention principles apply:

• Account Data & KYC Documentation: Retained for the duration of the account relationship and for a minimum period of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years from the date of the transaction to comply with applicable financial regulations.
• Gaming History: Betting and game play records are retained for a period of up to three (3) years from the date of each gaming session, subject to legal hold requirements.
• Customer Support Records: Communications with our support team are retained for up to three (3) years from the date of the final communication, to facilitate dispute resolution and quality assurance.
• Marketing Consent Records: Records of consent to marketing communications are retained until consent is withdrawn and for a period of one (1) year thereafter as evidence of the consent history.
• Technical Logs: Server access logs and session data are retained for a period of up to twelve (12) months for security monitoring purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

The 8fat Platform uses cookies and similar tracking technologies to operate essential platform functions, improve user experience, and analyse Platform performance. The following categories of cookies may be deployed:

10.1 Strictly Necessary Cookies

These cookies are essential for the operation of the Platform and cannot be disabled. They enable core functions such as user authentication, session management, security, and fraud prevention. Without these cookies, the Platform cannot function correctly.

10.2 Functional Cookies

Functional cookies enable the Platform to remember your preferences and settings — such as language, currency display, and previously selected game categories — to provide a more personalised experience during your visit.

10.3 Analytical Cookies

Analytical cookies allow 8fat to understand how players interact with the Platform — which pages are visited most frequently, how long sessions last, and where players encounter difficulties. This data is used in aggregate, anonymised form to improve Platform performance and content. 8fat uses analytics tools provided by reputable technology vendors for this purpose.

10.4 Managing Cookies

You may control cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies, although doing so may impair the functionality of the Platform. Restricting strictly necessary cookies in particular may prevent you from accessing certain features, including account login. Please refer to your browser's help documentation for guidance on managing cookies.

As a data subject, you hold the following rights in respect of your personal data held by 8fat. These rights may be exercised by contacting us at [email protected]. We will respond to all verified requests within 30 calendar days.

8fat implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• Encryption in Transit: All data transmitted between your device and the 8fat Platform is encrypted using TLS 1.2 or higher (256-bit SSL encryption).
• Encryption at Rest: Sensitive personal data — including identity documents and financial account details — is encrypted when stored in 8fat's systems.
• Access Controls: Access to personal data within 8fat's organisation is restricted on a need-to-know basis. Staff with access to sensitive player data receive regular data protection training.
• Two-Factor Authentication: Two-factor authentication (2FA) is supported and encouraged for all player accounts to provide an additional layer of account security.
• Penetration Testing: 8fat conducts periodic security assessments and penetration testing of Platform infrastructure to identify and remediate vulnerabilities.
• Incident Response: In the event of a personal data breach that is likely to result in high risk to affected individuals, 8fat will notify affected data subjects without undue delay and will take all reasonable steps to contain and remediate the breach.

Whilst 8fat takes every reasonable precaution to protect your personal data, no data transmission over the internet or storage system can be guaranteed to be 100% secure. You play a role in your own security by maintaining a strong, unique password for your 8fat account and reporting any suspected unauthorised access immediately to our support team.

The 8fat Platform is strictly intended for individuals aged 21 years and above. 8fat does not knowingly collect personal data from persons under the age of 21. We conduct mandatory age verification during the KYC process to enforce this requirement.

If 8fat becomes aware that personal data has been collected from a person under the minimum age, that account will be immediately suspended, the relevant data will be deleted in accordance with applicable legal requirements, and any funds held in the account will be handled in accordance with applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account on 8fat, please contact us immediately at [email protected].

The 8fat Platform does not contain links to third-party websites or services beyond those necessary to deliver core gaming and payment functionality. Where third-party integrations exist (such as payment gateway portals), those services operate under their own privacy policies and terms of service.

8fat has no control over and accepts no responsibility for the content, privacy practices, or data processing activities of any third-party service accessed through the Platform. We encourage you to review the privacy policy of any third-party service before providing them with your personal data.

8fat reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date of the most recent revision is displayed at the top of this document.

Where a revision constitutes a material change to how we process your personal data, 8fat will notify you via email to your registered email address or through a prominent notice on the Platform, with a minimum of seven (7) days' notice prior to the change taking effect.

Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree to the revised Policy, you should discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by 8fat, please reach out through any of the following channels:

For responsible gambling-related enquiries, account self-exclusion requests, or information about our responsible gaming tools, please visit our dedicated Responsible Gambling page.