Privacy Policy

This Privacy Policy ("Policy") describes the practices of orange88 ("the Platform", "we", "us", "our") with respect to the collection, use, storage, disclosure, and protection of personal information provided by or collected from users ("you", "your") of the orange88 website and online gaming platform accessible athttps://orange88.cam and any associated subdomains.

orange88 is an online casino and sports betting platform offering real-money gaming services — including live dealer tables, slot games, fishing games, and sports betting markets covering Liga Super Malaysia, the English Premier League, UFC, and other domestic and international events — primarily to players based in Malaysia. All transactions on the Platform are conducted in Malaysian Ringgit (MYR/RM).

We are committed to processing personal data responsibly, transparently, and in compliance with applicable data protection principles. This Policy is incorporated into and forms part of our Terms & Conditions. By creating an Account, making a deposit, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

The following terms are used throughout this Policy with the meanings ascribed below:

orange88 acts as the Data Controller for all personal data collected and processed through the Platform. As Data Controller, orange88 is responsible for determining the purposes for which personal data is processed and for ensuring that appropriate technical and organisational measures are in place to protect that data.

orange88 operates the Platform under an international online gaming licence. The Platform is administered and operated by orange88's operating entity, which may be incorporated in a jurisdiction outside Malaysia. Notwithstanding this, orange88 processes personal data relating to Malaysian users in accordance with the principles set out in this Policy and with awareness of obligations applicable to the processing of data about Malaysian residents.

Contact details for data-related enquiries are provided in Section 17 of this Policy.

orange88 collects personal data across several categories depending on the nature of your interaction with the Platform. The following table summarises the categories of data we collect and the context in which they arise:

orange88 collects personal data through the following mechanisms:

• Direct provision by you: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact our support team, or respond to any survey or promotional communication from orange88.
• Automated collection during Platform use: When you access the Platform, our servers and tracking technologies (including cookies, web beacons, and similar tools) automatically collect technical and usage data such as your IP address, device identifiers, session timestamps, pages visited, and games played. See Section 10 for full details on cookies.
• Third-party payment processors: When you deposit or withdraw using Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, or any other supported payment method, relevant transaction data is shared between orange88 and the payment processor to facilitate the transaction and support fraud prevention.
• Identity verification service providers: Where orange88 uses third-party identity verification tools assist with KYC processing, relevant personal data may be shared with and processed by those providers solely for verification purposes.
• Fraud and risk management tools: Automated risk scoring and fraud detection systems may process certain behavioural and technical data to identify suspicious activity patterns.

orange88 processes personal data only where we have a legitimate purpose and a lawful basis for doing so. The following table identifies our primary processing purposes and their corresponding legal bases:

orange88 does not sell personal data. We may disclose your personal data to third parties only in the following defined circumstances and only to the extent necessary for each purpose:

• Payment Service Providers: We share transaction data with Malaysian payment processors — including FPX system operators, DuitNow infrastructure providers, and e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay) — to facilitate deposits and withdrawals. These providers process data under their own privacy policies and are contractually prohibited from using your data for any purpose other than the transaction itself.
• Identity Verification Partners: Where third-party KYC verification tools are used, we share relevant identity documents with those service providers solely for the purpose of completing your account verification.
• Game Content Providers: Game studios and content providers that supply games to the Platform may receive limited technical and gameplay data necessary to operate game sessions (e.g., session tokens, bet amounts). These providers do not receive your full personal profile.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to competent authorities — including regulatory bodies under our operating licence, financial intelligence authorities, and law enforcement agencies — where we are legally required to do so, or where disclosure is necessary to investigate suspected fraud, money laundering, or other unlawful activity.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by orange88 may have access to personal data on a strictly need-to-know basis for the purpose of providing their professional services.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of orange88's assets, personal data held by the Platform may be transferred to the acquiring entity, subject to equivalent data protection commitments.

As an internationally licensed online gaming platform, orange88's operations involve data processing infrastructure that may be located in jurisdictions outside Malaysia. Personal data collected from Malaysian users may therefore be transferred to, stored in, and processed in countries other than Malaysia.

Where personal data is transferred internationally, orange88 takes appropriate steps to ensure that an adequate level of protection is applied to that data, including through the use of standard contractual clauses, data processing agreements, and technical security controls equivalent to those applied data processed within Malaysia.

By using the Platform and providing your personal data, you consent to the international transfer of your data in accordance with this Policy. If you have concerns about international data transfers, please contact our support team using the details in Section 17.

orange88 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law, regulation, and our licensing obligations. The following general retention periods apply:

• Account Data and Transaction History: Retained for a minimum of five (5) years from the date of Account closure, as required by our AML/CTF compliance obligations and international gaming licence conditions.
• KYC Verification Documents: Retained for a minimum of five (5) years following completion of the verification procedure or from the date of Account closure, whichever is later.
• Customer Support Communications: Retained for three (3) years from the date of the relevant interaction, unless the subject matter relates to a dispute that remains unresolved, in which case records are retained until final resolution plus one (1) year.
• Technical and Usage Data (Cookies, Logs): Session cookies expire at the end of the browser session. Persistent cookies and server log data are typically retained for 12 to 24 months.
• Marketing Consent Records: Retained for the duration of your Account plus two (2) years following account closure or withdrawal of consent, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in manner that prevents re-identification. Where deletion is not immediately practicable (e.g., data stored in backup systems), we ensure the data is isolated from active processing until it can be deleted.

orange88 uses cookies and similar tracking technologies on the Platform to enhance your experience, maintain your logged-in session, and analyse how the Platform is used. The following types of cookies are employed:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged into your Account and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without breaking Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised or aggregated data about how Users navigate the Platform — which pages are visited most frequently, where Users encounter errors, and how different features are used. This data helps us improve the Platform's design and performance.
• Functionality Cookies: Store your Platform preferences such as language settings, display preferences, and notification choices, so you do not need to reconfigure them on each visit.
• Marketing & Retargeting Cookies: Used to identify you across sessions for the purpose of delivering relevant promotions and bonus offers. These cookies are only set with your consent and can be disabled through your Account notification preferences.

Most web browsers allow you to control cookie behaviour through your browser settings. You may your browser to refuse cookies or to alert you when cookies are being sent. However, disabling certain cookies may affect the functionality of the Platform and prevent you from accessing some features.

orange88 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes:

• 256-bit SSL/TLS encryption for all data transmitted between User devices and our servers.
• Encryption at rest for all stored personal data and financial transaction records.
• Role-based access controls ensuring that internal staff can only access personal data to the extent required for their specific job function.
• Two-factor authentication (2FA) options for User account access.
• Regular penetration testing and vulnerability assessments conducted by qualified third-party security specialists.
• Secure, segregated storage for KYC documents, with access restricted to authorised verification team members.
• Incident response procedures to detect, contain, and investigate any personal data breach, with defined notification timelines.

While orange88 takes all reasonable steps to protect your personal data, no system of data transmission or storage over the internet can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own Account credentials and for using secure internet connection when accessing the Platform.

As a Data Subject, you have a number of rights with respect to your personal data held by orange88. These rights are exercisable by submitting a written request to our support team at the contact address provided in Section 17. We will respond to all valid requests within 30 calendar days of receipt.

The orange88 Platform is strictly restricted to individuals who are at least 21 years of age. We do not knowingly collect personal data from any person under the age of 21. Age verification is conducted as part of the KYC process for all registered Accounts.

If orange88 discovers — whether through KYC verification, user-submitted information, or any other means — that a registered Account belongs to a person under 21 years of age, the Account will be immediately closed and any deposited funds will be returned to the originating payment method after deduction of any bonus amounts credited to the Account. The relevant incident may be reported to applicable authorities where required by our licensing obligations.

If you are a parent or guardian and have reason to believe that your child has registered an Account with orange88, please contact our support team immediately using the contact details in Section 17.

orange88 processes certain categories of personal and behavioural data as part of our responsible gambling programme. This processing is conducted in your legitimate interests as a player and in fulfilment of our obligations under our operating licence.

Responsible gambling-related data processing includes:

• Monitoring of account activity patterns to identify indicators of potential problem gambling behaviour (such as significant increases in deposit frequency or session duration).
• Recording and enforcing voluntary deposit limits, session time limits, and self-exclusion periods set by the User.
• Processing of self-exclusion requests and maintenance of exclusion registers to prevent re-registration during exclusion periods.
• Communication with Users who have been identified as potentially at-risk, in accordance with our responsible gaming intervention procedures.

Data collected and processed in connection with responsible gambling is treated with the highest level of confidentiality and is not used for marketing or commercial purposes. For full information on our responsible gaming tools and support resources, please visit our Responsible Gambling page.

The orange88 Platform may contain references to or integrations with third-party services, including payment processors such as Touch 'n Go eWallet, Boost, GrabPay, and the FPX banking network. When you interact with these third-party services — for example, by completing a deposit through Maybank2u or Touch 'n Go — you are subject to the privacy policy and terms of service of those third-party providers.

orange88 is not responsible for the privacy practices, data handling, or content of third-party platforms. We encourage you to review the privacy policies of any third-party payment provider you use in connection with your orange88 Account.

orange88 does not embed third-party social media tracking scripts on the Platform and does not share your gaming activity data with social media platforms.

orange88 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or licensing requirements. The current version of this Policy will always be available at https://orange88.cam/privacy-policy, and the "Last Updated" date at the top of this page will reflect the most recent revision date.

Where changes to this Policy are material — for example, changes to the categories of data collected, the purposes for which it is used, or the third parties with whom it is shared — orange88 will endeavour to notify registered Users via email or a prominent Platform notification at least seven (7) days before the changes take effect.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you should cease using the Platform and contact our support team to arrange Account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy — including requests to exercise your data rights under Section 12 — please contact the orange88 data protection team through the following channel:

Support Email (plain text — not a clickable link):

When submitting a data rights request, please include your full name, registered email address, and a clear description of the right you wish to exercise. Requests submitted without sufficient identifying information to verify the requestor's identity may be unable to be processed.

Our team will acknowledge receipt of your request within five (5) business days and will aim to fulfil all valid requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you accordingly.

Customer support is available daily during Malaysian Standard Time (MYT, UTC+8). For full details about our platform, please also refer to our FAQ page and Terms & Conditions.