MS
ENThis Data Protection Policy sets out how DK88 Casino Malaysia collects, uses, and protects your personal information across your account, cashier activity, gameplay, and support interactions. It sits alongside the Terms of Use and the Bonus Policy referenced in the site footer, and it applies from the moment you register through to the closure of your account and beyond, for as long as legal retention requires.
What Data We Collect
The platform collects a defined set of personal data categories, each with a clear operational purpose. No unnecessary information is requested, and no data is collected for advertising resale or third-party marketing pools.
- Identity data: legal first and last name, date of birth, city, MyKad or passport (during verification)
- Contact data: Malaysian +60 phone number, email address
- Financial data: deposit and withdrawal history, payment method identifiers (not full card numbers)
- Gameplay data: game rounds, wager amounts, bonus activity, session timestamps
- Technical data: IP address, device type, browser version, session cookies for login continuity
Every category is stored in encrypted form and separated by access role, so payment processors see only what payment processing needs, KYC verifiers see only what identity checks need, and support agents see only what the specific ticket requires.
How We Use Your Data
Personal data is processed for specific operational purposes, each with a defined legal basis under Malaysia’s PDPA 2010 (Personal Data Protection Act). Data is never sold, and it is never shared with third parties for their own marketing.
- Account operation: registration, login, cashier, gameplay — legal basis: contract performance
- KYC and AML compliance: identity verification, source-of-funds checks — legal basis: legal obligation
- Fraud prevention: transaction monitoring, at-risk behaviour markers — legal basis: legitimate interest
- Responsible gambling: proactive check-ins on unusual patterns — legal basis: legitimate interest
- Marketing communications: promo notifications, product updates — legal basis: consent (opt-in / opt-out)
KYC and AML Documentation
KYC (Know Your Customer) and AML (Anti-Money Laundering) checks require specific document types at defined stages of your account lifecycle. The standard baseline is a two-step verification (OTP + profile completion) unlocked at withdrawal; higher-value or unusual-pattern accounts trigger a deeper document check.
Typical KYC documents include MyKad or a valid passport for identity, a recent utility bill or bank statement within the last 3 months for residence, and — for higher-value payouts — documentation of the source of funds. These documents are stored in encrypted form for 7 years from account closure, in line with AML retention requirements.
Your Rights
Under Malaysia’s PDPA 2010, you have a defined set of rights regarding your personal data. Every right is exercised through a written request to the platform’s Data Protection contact channel, and the standard response window is 21 working days.
- Access: receive a copy of the personal data held about you
- Rectification: correct inaccurate or outdated information on your record
- Erasure: delete data no longer required (subject to legal retention obligations)
- Restriction: limit processing of specific data categories
- Withdraw consent: opt out of marketing communications at any time
How long is my data kept after I close my account?
Retention periods vary by category and legal obligation. Registration and account records are typically kept for 5 years, KYC and AML documentation for 7 years (a legal AML requirement), and gameplay logs for 12 months from creation. After each retention period expires, the data is deleted or anonymised.
Can I opt out of marketing without closing my account?
Yes — marketing communications sit on a separate consent layer from the account itself. Open Account Settings, tap the Notifications tile, and toggle off the marketing channel you want to leave. The account continues to operate normally on all other functions.
Who can access my personal data on the platform side?
Access is role-based and audit-logged. Payment processors see only what payment processing requires; KYC verifiers see only what identity checks require; support agents see only the specific ticket context. No account holds full-catalogue access to every data category by default.
How do I contact the platform about a data protection question?
Send a written request through the Contact channel in the site footer, or through live chat with a note that you are exercising a PDPA right. The standard response window is 21 working days from receipt of a complete request.