Privacy Policy

This Privacy Policy ("Policy") describes how Rafi88 ("we", "us", "our", "the Platform", "the Operator") collects, processes, stores, shares, and protects the personal data of individuals ("you", "User", "Member") who access or use the services available at rafi88.click.

Rafi88 is committed to protecting the privacy and confidentiality of your personal information. This Policy has been prepared in accordance with applicable data protection principles and reflects our obligations as an operator serving Members including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

If you have questions about how we handle your personal data, or if you wish to exercise any of your data subject rights, please contact us using the details set out in Section 16 of this Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, or online identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, alteration, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, Rafi88.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under a written agreement.
• "KYC" means the Know Your Customer identity and age verification process conducted by Rafi88 prior to allowing withdrawals.
• "Cookies" means small data files placed on your device when you visit the Platform, used for functionality, analytics, and session management.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of your personal data.
• "Data Breach" means a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Rafi88 acts as the Data Controller in respect of the personal data collected from users of the Platform. As Data Controller, Rafi88 is responsible for determining the purposes for which personal data is collected and the means by which it is processed.

Where Rafi88 engages third-party service providers (such as payment processors, KYC verification providers, and analytics platforms) to process personal data on its behalf, those third parties act as Data Processors under contractual arrangements that require them to handle your data securely and only for the purposes specified by Rafi88.

For all data protection enquiries, requests, or complaints, please contact Rafi88 using the contact details provided in Section 16 of this Policy.

Rafi88 collects personal data through several channels: directly from you when you register or use the Platform, automatically when you access our services, and from third parties in connection with verification and payment processing. The categories of data we collect include:

4.1 Registration & Account Data

• Full legal name and date of birth.
• Email address and mobile telephone number.
• Username and encrypted password hash.
• Preferred language and currency settings (MYR).
• Residential address and postcode (where required for KYC).

4.2 Identity Verification (KYC) Data

• Government-issued identity document (e.g., Malaysian MyKad — front and back image).
• Selfie photograph for biometric matching.
• Proof of address documentation (where required for enhanced verification).
• Proof of payment method ownership.

4.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method references.
• Payment method identifiers (e-wallet account number, bank account last four digits, or cryptocurrency wallet address).
• Bonus and promotional redemption history.
• VIP tier and loyalty point balance history.

4.4 Usage & Technical Data

• IP address and approximate geolocation derived from IP lookup.
• Device type, operating system, and browser version.
• Session duration, pages visited, and features used.
• Betting history, game session data, and wagering records.
• Communication records — live chat transcripts, email correspondence, and support ticket history.

Rafi88 processes your personal data for the following purposes:

Rafi88 processes your personal data on the following legal bases, depending on the specific purpose and nature of the data involved:

• Contractual Necessity: Processing that is required to fulfil our obligations under the Terms & Conditions, including account creation, payment processing, and game access.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC verification, anti-money-laundering checks, and age verification obligations.
• Legitimate Interests: Processing necessary for the pursuit of Rafi88's legitimate business interests — specifically, fraud prevention, platform security, and responsible gambling monitoring — where these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given consent, such as sending marketing communications and promotional notifications. You may withdraw this consent at any time by updating your account preferences or contacting support.

Rafi88 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process personal data on our behalf under written data processing agreements. These include: KYC and identity verification providers; payment processors facilitating transactions via Touch 'n Go eWallet, Boost, DuitNow, FPX, and banking partners including Maybank, CIMB, Public Bank, and Hong Leong Bank; analytics platforms; and customer support technology providers.

7.2 Regulatory & Law Enforcement Authorities

Rafi88 may be required to disclose personal data to regulatory bodies, law enforcement agencies, courts, or other public authorities where required by applicable law, legal process, or regulatory obligation. We will notify affected users of such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Rafi88's business, personal data may be transferred to the relevant successor entity as part of that transaction. Users will be notified of any such transfer and their rights in relation to it.

Financial data collected in connection with deposits and withdrawals — including e-wallet account references, bank account details, and cryptocurrency wallet addresses — is handled with the highest level of security. Rafi88 does not store full payment card numbers or full bank account numbers on its servers. Payment tokenisation is used where applicable.

Payment transaction records (amounts, timestamps, method used) are retained for a minimum of five (5) years from the date of the transaction to comply with anti-money-laundering and financial record-keeping obligations under applicable law.

All payment data transmitted between your device and the Rafi88 platform is encrypted using Transport Layer Security (TLS) protocols. Payment processing on behalf of Rafi88 is conducted by certified third-party payment processors who maintain their own security certifications.

Rafi88 uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

You can manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair the functionality of the Platform. Disabling analytics or marketing cookies will not affect your ability to use core Rafi88 services.

Rafi88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

• Active account data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure.
• KYC documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in compliance with anti-money-laundering regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support records: Retained for three (3) years from the date of the last interaction.
• Marketing opt-in records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of consent management.
• Technical logs (access, security): Retained for twelve (12) months on a rolling basis.

Where personal data is no longer required for any lawful purpose, Rafi88 will securely delete or irreversibly anonymise it. In the case of anonymised data, there is no further retention obligation as it can no longer be attributed to an identifiable individual.

Rafi88 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption at rest: AES-256 encryption applied to all personal data stored on Rafi88 servers.
• Encryption in transit: TLS 1.2+ applied to all data transmitted between your device and the Platform.
• Access controls: Role-based access control (RBAC) ensures staff can access only the personal data necessary for their specific function.
• Two-factor authentication: Available for all user accounts and mandatory for internal administrative access.
• Regular security testing: The Platform undergoes periodic vulnerability assessments and penetration testing.
• Staff training: All Rafi88 personnel with access to personal data complete mandatory data protection and security training.
• Incident response: Rafi88 maintains a documented data breach response procedure, including user notification obligations.

Subject to applicable data protection law, you have the following rights in respect of the personal data Rafi88 holds about you:

• Right of Access: You may request a copy of all personal data Rafi88 holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to Rafi88's legal retention obligations.
• Right to Restrict Processing: You may request that Rafi88 restrict the processing of your data in certain circumstances, such as where you contest its accuracy.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact Rafi88 using the details in Section 16. We will respond to all valid requests within thirty (30) days. In complex or multiple-request situations, this period may be extended by a further sixty (60) days, in which case we will notify you of the extension and the reason.

Rafi88 does not knowingly collect personal data from individuals under the age of 21. The Platform is strictly intended for use by adults aged 21 years and above only. Age verification is a mandatory requirement of the KYC process and is enforced before any withdrawal is permitted.

If Rafi88 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will promptly suspend the account, void any associated transactions, and delete the personal data concerned in accordance with applicable law, subject to any mandatory retention obligations.

Rafi88 and some of its third-party service providers operate infrastructure in jurisdictions outside of Malaysia. Where personal data is transferred outside Malaysia to a jurisdiction that may not offer the same level of data protection, Rafi88 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by competent data protection authorities.
• Binding corporate rules applicable to corporate group transfers.
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection.

By using the Rafi88 Platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia for the purposes described in this Policy, subject to the safeguards described above.

Rafi88 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The effective date of the current version is displayed at the top of this page.

Where changes are material — meaning they significantly affect your rights or how we use your personal data — Rafi88 will provide at least fourteen (14) days' advance notice via email to the address registered to your account, and by posting a prominent notice on the Platform.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the revised Policy, you must cease using the Platform and may close your account in accordance with the Terms & Conditions.

For all data protection queries, requests to exercise your data subject rights, or privacy-related complaints, please contact Rafi88 through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the Platform — the fastest channel for urgent privacy enquiries.
• Email: [email protected] (plain text — not a clickable link)
• Coverage: We serve all of Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond.

When submitting a data subject access request or erasure request, please include your registered email address and a brief description of the request so that we can verify your identity and respond efficiently.