Cyl8 Privacy Policy – Personal Data Protection for Members of Malaysia's Platform

This Privacy Policy is issued by cyl8 ("we", "the platform") and applies to all registered members and visitors of cyl8.xyz and all related services operated under the cyl8 brand. This Policy clearly explains how we collect, process, store, protect, and share your personal data in the context of your use of our live casino, Sports Betting, e-sports, poker, and all other online entertainment services we offer to Malaysian players.

Cyl8 takes its responsibilities as a data controller seriously. We understand that your trust in how we handle your personal data is the foundation of the long-term relationship we aim to build with Malaysia's player community. Every decision involving personal data is therefore made with your interests and privacy rights as the top priority.

Cyl8 collects several categories of personal data from members depending on how you interact with our platform. Below is a detailed table of the data categories collected, along with their purposes and legal basis:

Cyl8 never collects sensitive category data such as medical information, religious beliefs, or political views, unless required by law and with your explicit consent. Biometric information is also not collected by the cyl8 platform.

Cyl8 collects personal data through the following channels:

• Account Registration: When you complete the registration form on cyl8, you provide your identity and contact data directly to us. Please ensure all information submitted is accurate and up to date.
• Financial Transactions: Each time you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u or CIMB Clicks), our system records the transaction details required for payment processing and financial record-keeping.
• Platform Usage: Your activity on the platform — including bets placed on Malaysia Super League or EPL football, live casino baccarat games, MLBB esports betting, and all other interactions — is automatically recorded as part of normal platform operations.
• Identity Verification (KYC): When you submit identity documents such as your MyKad or passport for account verification or withdrawal purposes, we process those documents in accordance with strict security procedures.
• Support Communications: When you contact the cyl8 support team via live chat or email at support@cyl8.xyz, records of those communications are retained for service quality and dispute resolution purposes.
• Tracking Technologies: Cookies, web pixels, and similar technologies are used to automatically collect technical data and preferences when you visit the cyl8 website. Further details are provided in Section 8.

Cyl8 uses collected personal data solely for legitimate and transparent purposes. The following are the primary purposes for which member personal data is used:

• Account Management: Creating, maintaining, and managing your cyl8 account, including login authentication, password resets, and profile information updates.
• Transaction Processing: Processing all deposits and withdrawals in Malaysian Ringgit (RM) via registered local Malaysian payment methods, including transaction verification and financial dispute management.
• KYC & Anti-Money Laundering Compliance: Conducting the "Know Your Customer" (KYC) checks required by law to prevent fraud, money laundering, and other illicit financial activities.
• Service Delivery: Enabling access to all cyl8 services, including Live Casino, Sports Betting, e-sports, poker, live matches, and all other platform features.
• Platform Security: Detecting and preventing fraud, multi-account activity, bonus abuse, hacking, and other security threats to the platform and its members.
• Service Communications: Sending you important notifications about your account, changes to our terms, security information, and relevant service updates.
• Personalise Your Experience: Customising the platform's interface and content based on your preferences and usage habits to deliver a more relevant experience.
• Responsible Gambling: Monitoring gameplay patterns to identify early signs of problem gambling and providing appropriate intervention through our programme Responsible Gambling us.

Cyl8 does not sell or rent your personal data to any third party for their own commercial purposes. However, in the course of operating the platform, cyl8 may share your personal data with a limited set of third-party categories as outlined below, and only to the extent necessary:

• Payment Service Providers: Payment gateways that process your transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks) require only the transaction information strictly necessary to process your payment securely.
• Live Casino Studio Providers: Live casino studio operators such as Evolution Gaming and Pragmatic Play Live require limited access to your game session data for the purposes of dispute resolution and game fairness auditing.
• Technology Service Providers: Cloud service, IT infrastructure, and cybersecurity providers that help us operate and protect the cyl8 platform may process your data as data processors on our behalf, under strict confidentiality agreements.
• Regulatory Bodies and Authorities: cyl8 will disclose personal data to the relevant authorities when required by Malaysian law or a valid court order. We have no discretion to refuse such legally valid requests.
• Fraud Prevention Agencies: In cases of suspected fraud or money laundering, cyl8 reserves the right to share relevant information with recognised fraud prevention agencies in order to protect the integrity of the platform and all other members.

All third parties we engage are required to handle your personal data with a level of protection at least equivalent to our own standards, and may only use it for the specific authorised purposes.

Protecting your personal data from unauthorised access, loss, misuse, or disclosure is cyl8's highest priority. We implement multiple layers of comprehensive technical and organisational security controls:

• In-Transit Encryption: All communications between your browser or app and cyl8's servers are encrypted using TLS 1.3 with 256-bit SSL certificates. This ensures that data in transit cannot be intercepted or read by third parties.
• Storage Encryption: Sensitive data such as passwords (stored as non-reversible bcrypt hashes), financial information, and KYC documents are stored in encrypted form within cyl8's databases.
• Layered Access Control: Access to member personal data within cyl8 is strictly limited on a need-to-know basis. Staff may only access data that is necessary to carry out their specific duties.
• Continuous Monitoring: cyl8's security systems monitor all platform activity around the clock to detect any unauthorised access attempts, suspicious activity patterns, or other security threats in real time.
• Regular Security Assessments: cyl8 conducts regular penetration testing and independent security audits to identify and address vulnerabilities before they can be exploited.
• Staff Training: All cyl8 staff with access to member personal data undergo comprehensive privacy awareness and data security training on a regular basis.

Cyl8 retains your personal data only for as long as necessary to fulfil the original purpose for which it was collected, or as required by Malaysian law. Our data retention guidelines are as follows:

• Active Account Data: For as long as your cyl8 account remains active, we retain all data necessary to manage your account and provide our services to you.
• Financial Transaction Records: Records of deposits, withdrawals, and all financial transactions in Malaysian Ringgit (RM) are retained for a minimum of seven (7) years from the transaction date, in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• KYC Documents: Identity documents submitted for verification are retained for the duration of the active account and for at least five (5) years after account closure, in accordance with legal requirements.
• Security Logs: Platform activity and security logs are retained for one (1) to two (2) years for incident investigation and dispute resolution purposes.
• Support Communications: Correspondence records with the cyl8 support team are retained for three (3) years for service quality and dispute resolution purposes.
• Data After Account Closure: Once your account is closed, cyl8 will delete or anonymise any personal data that is no longer needed to fulfil its legal or legitimate business obligations within a reasonable timeframe.

Cyl8 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit the cyl8 website. The categories of cookies we use are as follows:

• Essential Cookies (Required): These cookies are required for core functions of the cyl8 platform, such as login session authentication, security monitoring, and language preferences. Without them, the platform will not work properly and they cannot be disabled.
• Functional Cookies: Stores your preferences such as display settings, favourite casino table selections, and interface language to enhance your overall experience.
• Performance & Analytics Cookies: Collects information on how visitors use the cyl8 website — including the most frequently visited pages, time spent on site, and navigation paths. This data is used in aggregate form to improve the platform.
• Security Cookies: Helping us detect suspicious activity, unauthorised login attempts, and usage patterns that may indicate fraud or bot activity.

You can manage your cookie settings through your browser at any time. However, disabling essential cookies may affect core functions of the cyl8 platform — you may not be able to log in or use certain features.

As a cyl8 member and data subject under Malaysia's PDPA, you have the following rights regarding the personal data we hold about you. We are committed to respecting and facilitating the exercise of these rights:

To exercise any of the rights above, contact us by email at support@cyl8.xyz, clearly stating the right you wish to exercise and providing sufficient information to verify your identity. We will respond within the timeframe prescribed by the PDPA and will not charge any fee for reasonable requests.

In operating the cyl8 platform and providing services to Malaysian members, some of your personal data may be processed or stored outside Malaysia — for example, by cloud service providers or international live casino studios that we work with.

When your personal data is transferred outside Malaysia, cyl8 ensures that adequate protections are in place through one or more of the following mechanisms:

• Transfers to countries formally recognised by Malaysia's Department of Personal Data Protection as providing adequate data protection
• Implementation of approved standard contractual clauses that bind data recipients to protection standards equivalent to Malaysia's PDPA
• Comprehensive data processing agreements that require third-party providers to comply with the privacy and security standards set by cyl8

Cyl8's services are intended solely for individuals aged 18 and above. cyl8 does not knowingly collect, process, or store personal data from anyone under the age of 18.

If we discover that personal data from an individual under the age of 18 has been collected inadvertently, we will take immediate steps to delete that data and close the associated account. Parents or guardians who believe their child has provided personal data to cyl8 without their knowledge are urged to contact us immediately at support@cyl8.xyz.

Cyl8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or changes to the services we offer. The "Updated" date at the top of this page will always reflect the date of the most current version of this policy.

For material amendments — meaning changes that significantly affect how we process your personal data or impact your rights — cyl8 will provide you with clear notice via your registered email or a prominent in-platform notification at least 14 days before the changes take effect. This gives you sufficient time to review the updates and make an informed decision about your continued use of the cyl8 platform.

Your continued use of the cyl8 platform after any amendments take effect will be considered your acceptance of the revised Privacy Policy. If you do not agree with any amendment, you have the right to stop using the platform and close your account by contacting support@cyl8.xyz.

If you have any questions or concerns, or wish to exercise your rights regarding personal data held by cyl8, please contact our data protection officer via:

• Email: support@cyl8.xyz – please include "Privacy Inquiry" in the subject line of your email
• Live Chat: Available directly within the cyl8 platform – 24 hours a day, 7 days a week
• Service Language: Bahasa Malaysia and English

We aim to acknowledge receipt of your request within 3 business days and provide a full response within 21 calendar days of receiving a valid request. For complex cases or those requiring further investigation, this period may be extended with notice to you.

If you are not satisfied with how we have handled your privacy request or complaint, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) or the relevant regulatory body under Malaysian law.

For related information that may be useful, please also refer to:

• cyl8 Terms & Conditions – terms governing the use of the platform as a whole
• Responsible Gambling – tools and guides for playing responsibly
• Frequently Asked Questions – answers to the most frequently asked questions