ap8 Privacy Policy

1. Introduction

ap8 ("we", "us", "our") is committed to protecting the privacy of all users ("you", "your") of the ap8 online gaming platform accessible at ap8.bio and any associated subdomains or mobile interfaces (collectively, the "Platform"). This Privacy Policy describes our practices regarding the collection, use, disclosure, storage, and protection of personal data in connection with your use of the Platform.

By registering for an ap8 account or otherwise using the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Privacy Policy. If you do not agree, please do not access or use the ap8 Platform.

This Privacy Policy should be read alongside the ap8 Terms & Conditions, which govern your use of the Platform. Capitalised terms used but not defined herein have the meanings given in the Terms & Conditions.

2. Personal Data We Collect

ap8 collects personal data through several channels. The categories of data we collect include:

ap8 does not collect special categories of sensitive personal data (such as racial or ethnic origin, health data, or biometric data beyond what is strictly required for age and identity verification) unless required by applicable law or with your explicit consent.

3. How We Use Your Personal Data

ap8 uses your personal data for the following purposes:

• Account management: To create, maintain, and administer your ap8 account, including verifying your identity and eligibility to use the Platform.
• Service delivery: To process bets, settle winnings, handle deposits and withdrawals, and provide access to all ap8 Platform features.
• Regulatory compliance: To fulfil ap8's obligations under its gaming licence, including KYC verification, age verification, anti-money laundering screening, and responsible gaming requirements.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, and other prohibited conduct on the ap8 Platform.
• Customer support: To respond to your enquiries, resolve complaints, and improve the quality of ap8's customer service.
• Platform improvement: To analyse aggregate usage data and platform performance in order to improve ap8's products, user interface, and gaming experience.
• Marketing communications: To send you information about ap8 promotions, bonuses, and new products, where you have consented to receive such communications or where ap8 has a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Responsible gaming: To monitor your gaming activity and, where ap8 identifies indicators of problem gambling, to reach out with responsible gaming information and to apply any account restrictions you have requested.

4. Legal Basis for Processing

ap8 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform our contract with you, including account creation, bet processing, payments, and customer support.
• Legal obligation: Processing required to comply with applicable laws and our gaming licence obligations, including KYC, AML, and responsible gaming requirements.
• Legitimate interests: Processing necessary for ap8's legitimate business interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given consent, including marketing communications and optional data sharing. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Sharing Your Personal Data

ap8 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment processors and e-wallet providers: Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and other payment providers, solely to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party services that assist ap8 in verifying your identity and age as required by our licensing obligations.
• Game content providers: Licensed game studios (such as Pragmatic Play, PG Soft, Evolution Gaming) receive the minimum data necessary to deliver game content and settle game outcomes.
• Regulatory authorities: ap8's licensing authority and relevant law enforcement or government agencies where disclosure is required by law, court order, or our licensing obligations.
• IT and infrastructure providers: Cloud hosting and data processing providers who process data on ap8's behalf under strict data processing agreements that prohibit independent use of your data.

All third-party service providers engaged by ap8 are contractually required to implement appropriate technical and organisational security measures and to process personal data solely for the purposes specified by ap8.

6. Cookies & Tracking Technologies

ap8 uses cookies and similar tracking technologies to operate and improve the Platform. The cookies ap8 uses fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function, including session management, login state, and security tokens. These cannot be disabled.
• Performance and analytics cookies: Collect aggregated, anonymised data about how users interact with the ap8 Platform. This helps ap8 identify performance issues and improve the user experience.
• Functional cookies: Remember your preferences such as language settings and responsible gaming limits to provide a more personalised experience on ap8.

You may adjust your browser settings to block or delete non-essential cookies at any time. Please note that disabling certain cookies may affect the functionality of the ap8 Platform. ap8 does not use third-party advertising or tracking cookies to serve behavioural advertising to you across other websites.

7. Data Retention

ap8 retains your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, and for as long as required to comply with applicable legal and regulatory obligations. Specific retention periods include:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, or longer where required by ap8's gaming licence obligations or applicable AML legislation.
• Transaction records: Financial transaction data is retained for a minimum of five (5) years in accordance with gaming regulatory requirements.
• Support and communications data: Retained for three (3) years from the date of the interaction, unless the data is relevant to an ongoing dispute or legal matter.
• Marketing preference data: Retained until you opt out of marketing communications, after which a suppression record is kept to ensure your opt-out is respected.

At the expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with ap8's internal data governance procedures.

8. Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by ap8:

• Right of access: You may request a copy of the personal data ap8 holds about you.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ap8's regulatory retention obligations.
• Right to restrict processing: You may request that ap8 restricts its processing of your personal data in certain circumstances.
• Right to data portability: Where processing is based on your consent or on a contract, you may request a structured, machine-readable copy of the personal data you have provided to ap8.
• Right to object: You may object to processing based on ap8's legitimate interests, including direct marketing communications.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact ap8's support team via live chat on the Platform or by emailing support@ap8.bio. ap8 will respond to all data rights requests within thirty (30) calendar days.

9. Data Security

ap8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the ap8 Platform;
• Encryption of sensitive data fields (including financial data and identity documents) at rest;
• Role-based access controls ensuring ap8 staff can only access personal data necessary for their specific function;
• Regular internal security audits and penetration testing of the ap8 Platform infrastructure;
• Incident response procedures for timely detection and notification of any personal data breach.

While ap8 takes all reasonable steps to secure your data, no system is completely immune to risk. You are responsible for maintaining the security of your ap8 account credentials and for notifying ap8 immediately if you suspect any unauthorised access to your account.

10. Children and Minors

The ap8 Platform is strictly for adults aged 21 years and above. ap8 does not knowingly collect personal data from any individual under 21 years of age. If ap8 becomes aware that it has inadvertently collected data from a minor, that account will be suspended immediately, all associated data will be deleted, and any deposits will be refunded through the original payment method.

If you believe a minor has created an ap8 account, please contact our support team immediately at support@ap8.bio or via live chat so we can investigate and take appropriate action promptly.

11. International Data Transfers

ap8's Platform infrastructure and certain third-party service providers may be located in jurisdictions outside Malaysia. Where ap8 transfers your personal data internationally, it does so only to countries or recipients that provide an adequate level of data protection, or under contractual safeguards (such as standard contractual clauses) that ensure your data receives equivalent protection regardless of where it is processed.

ap8 ensures that all international data transfers involving your personal data comply with applicable data protection requirements and that your rights as a data subject are not diminished as a result of such transfers.

12. Changes to This Privacy Policy

ap8 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform functionality. Where changes are material, ap8 will notify you via email to your registered address or through a prominent notice on the Platform at least seven (7) days before the changes take effect.

Your continued use of the ap8 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically. The "Last updated" date at the top of this Policy indicates when it was most recently revised.

13. Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or ap8's handling of your personal data, please contact us through the following channels:

• 24/7 Live Chat: Available on every page of the ap8 Platform — click the chat icon in the bottom corner.
• Email: support@ap8.bio — plain text only; not a clickable link. Please copy and paste this address into your email client.

ap8 aims to acknowledge all data-related enquiries within two (2) business days. Formal data rights requests will be fully responded to within thirty (30) calendar days. For unresolved privacy concerns, you may also contact the relevant data protection authority in your jurisdiction or ap8's licensing authority.

This Privacy Policy was last updated in June 2026. ap8 © 2026. All rights reserved.