Privacy Policy

This Privacy Policy ("Policy") describes how Score8 ("Score8", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("you", "User", "Player") who access or use the Score8 online gaming and sports betting platform accessible at https://score8.lat (the "Platform").

Score8 operates under an international online gaming licence and takes its obligations in relation to personal data protection seriously. We are committed to handling your data with transparency, integrity, and in accordance with applicable data protection standards. This Policy applies to all players registered on the Platform, including those accessing from Malaysia and other supported territories.

By registering an Account on the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read in conjunction with Score8's Terms and Conditions, which govern your use of the Platform and are incorporated herein by reference. If you do not agree with the terms of this Policy, you must not use the Platform.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject") — that is, a person who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Controller" means Score8, which determines the purposes and means of processing personal data collected through the Platform.
• "Processor" means any third party that processes personal data on behalf of Score8 under a data processing agreement.
• "KYC Data" means identity verification documentation collected as part of Know Your Customer procedures, including copies of government-issued ID, proof of address, and source of funds documentation.
• "Cookies" means small data files placed on a User's device by the Platform for the purposes set out in Section 10 of this Policy.
• "Sensitive Data" means special categories of personal data attracting enhanced protection, such as health data or financial crime-related information collected during enhanced due diligence reviews.

Score8 collects personal data across several categories depending on how you interact with the Platform. The table below provides a structured overview of the categories of data we collect and the primary source of that data.

Score8 does not deliberately collect sensitive personal data such as racial or ethnic origin, religious beliefs, or biometric data beyond the minimum necessary for identity verification. We collect only what is genuinely necessary for the purposes described in this Policy.

Score8 collects personal data through the following channels:

• Direct provision: When you complete the registration form, submit KYC documentation, contact customer support, or update your account profile, you directly provide us with personal data.
• Automated collection: When you use the Platform, our systems automatically record technical and usage data including your IP address, session duration, pages visited, and actions taken. This collection is facilitated in part through cookies and similar tracking technologies.
• Payment processors: When you make a deposit or withdrawal using Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong — transaction confirmation data is passed to us by the relevant payment processor to reconcile your account balance.
• Third-party verification services: For KYC purposes, we may use third-party identity verification providers who process your documentation on our behalf and return a verification outcome to us.
• Publicly available sources: In limited circumstances — particularly for enhanced due diligence on high-value accounts — we may supplement account information with data from publicly available sources such as sanctions lists or politically exposed person (PEP) databases.

Score8 processes personal data for the following specific and legitimate purposes:

5.1 Account Management & Platform Operation

We process registration data to create and manage your player account, authenticate your identity at login, maintain your account balance, process deposits and withdrawals in MYR, and ensure the continuity and accuracy of your gaming activity records.

5.2 Regulatory Compliance & KYC

As an internationally licensed gaming operator, Score8 is obligated to conduct Know Your Customer (KYC) verification to confirm player identity, age (minimum 21 years), and source of funds. This processing is required to comply with our licensing conditions and applicable anti-money laundering (AML) obligations.

5.3 Fraud Prevention & Security

Technical and usage data — including IP addresses, device identifiers, and session patterns — is analysed to detect and prevent fraudulent activity, multi-accounting, money laundering, and other prohibited conduct described in our Terms and Conditions. This processing protects both Score8 and its legitimate players.

5.4 Responsible Gambling

Gaming activity data and account behaviour are monitored to identify patterns that may indicate problem gambling. This allows us to proactively offer support tools, apply cooling-off periods, and — where necessary — intervene to protect a player's wellbeing. This processing is a core component of our responsible gambling programme.

5.5 Customer Support

Communication data from live chat, email, and support ticket interactions is retained to manage and resolve your queries, maintain records of previous interactions for continuity, and improve the quality of our support services.

5.6 Marketing & Personalisation

Where you have given your consent, we may use your preference data and gaming activity to personalise your Platform experience, send promotional communications about relevant bonuses, and present game recommendations. You may withdraw consent for marketing communications at any time via your account settings.

5.7 Platform Improvement & Analytics

Aggregated and anonymised technical and usage data helps us understand how players interact with the Platform, identify areas for improvement, test new features, and monitor platform performance. Where possible, this analytics processing uses anonymised or pseudonymised data.

Score8 relies on the following legal bases for processing personal data, as applicable to each processing purpose:

• Contractual necessity: Processing required to fulfil our obligations under the account agreement with you — including account management, transaction processing, and the delivery of gaming services.
• Legal obligation: Processing required to comply with our licensing obligations, AML requirements, KYC verification mandates, and other applicable regulatory requirements.
• Legitimate interests: Processing carried out in pursuit of Score8's legitimate business interests — including fraud detection, platform security, and service improvement — where those interests do not override your fundamental data protection rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily marketing communications and optional personalisation features. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Score8 does not sell, rent, or commercially trade personal data with third parties. We may, however, share personal data with the following categories of recipients in the circumstances described below:

• Payment processors: We share necessary transaction data with Malaysian payment service providers — including those operating Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong payment rails — solely to facilitate deposit and withdrawal processing on your behalf.
• Identity verification providers: Third-party KYC and AML screening services process your identification documents under a data processing agreement with Score8. These providers are bound by strict confidentiality obligations and may not use your data for any purpose other than verification services provided to Score8.
• Game content providers: Certain technical data (such as session tokens and account identifiers) is shared with our licensed game content and live dealer providers to enable seamless gameplay. These providers do not receive your full personal profile.
• Regulatory and law enforcement authorities: We will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to prevent imminent harm, fraud, or financial crime.
• Professional advisers: Our legal, audit, and compliance advisers may have access to personal data on a need-to-know basis in the course of providing professional services to Score8, subject to professional confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of all or a substantial portion of Score8's business, personal data held by Score8 may be transferred to the acquiring entity subject to equivalent data protection commitments.

Score8 operates as an internationally licensed online gaming platform, and your personal data may be processed in jurisdictions outside Malaysia. This may include the jurisdiction in which Score8 holds its operating licence, as well as locations where our technology providers, game content partners, and KYC service providers maintain their infrastructure.

Where personal data is transferred outside the country in which it was collected, Score8 takes reasonable steps to ensure that appropriate safeguards are in place to protect the data in a manner consistent with applicable data protection standards. This may include contractual safeguards, the use of processors located in jurisdictions with recognised data protection frameworks, or other appropriate mechanisms.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries other than Malaysia. Score8 will always handle such transfers with appropriate care and in accordance with this Policy.

Score8 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the minimum retention periods required by our licensing obligations and applicable law.

• Account and registration data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in accordance with our AML and KYC retention obligations.
• KYC documentation: Retained for a minimum of five (5) years following the date of verification, or such longer period as may be required by applicable compliance obligations.
• Financial and transaction records: Retained for a minimum of five (5) years following the relevant transaction, in accordance with financial record-keeping obligations.
• Gaming activity logs: Retained for a period of two (2) years following account closure for operational and audit purposes, and then archived or deleted.
• Customer support communications: Retained for a period of two (2) years from the date of the last interaction, or longer where related to an ongoing dispute or regulatory matter.
• Marketing preference data: Retained until you withdraw consent for marketing, at which point your data will be suppressed rather than deleted to prevent inadvertent re-contact.

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data subject's identity.

Score8 uses cookies and similar tracking technologies on the Platform to provide core functionality, enhance your experience, and collect usage analytics. By continuing to use the Platform, you consent to the use of cookies in accordance with this section.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing access to the Platform.
• Functional Cookies: Enable the Platform to remember your preferences — such as language settings, display options, and responsible gambling tool configurations — to provide a more personalised experience across sessions.
• Analytical Cookies: Used to collect aggregated, anonymised information about how players interact with the Platform. This data helps us understand which features are most used, where players encounter difficulties, and how to improve the overall experience.
• Security Cookies: Used to detect and prevent fraudulent activity, multi-accounting, and unauthorised access attempts by analysing device fingerprint and behavioural patterns.

10.2 Managing Cookies

You may control non-essential cookies through your browser settings or our cookie preferences interface. Note that disabling certain cookies may impair Platform functionality. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

Depending on the applicable data protection framework governing your use of the Platform, you may have some or all of the following rights in relation to your personal data:

• Right of Access: You have the right to request confirmation of whether Score8 processes personal data about you, and to receive a copy of that data together with supporting information about how and why it is processed.
• Right to Rectification: You have the right to request correction of any personal data held about you that is inaccurate or incomplete. You may update basic profile information directly via your account settings at any time.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that we may be required to retain certain data to fulfil our legal and licensing obligations even where you request erasure.
• Right to Restrict Processing: You may request that we restrict processing of your data in certain circumstances — for example, while the accuracy of the data is being contested, or where you have objected to processing pending verification of legitimate grounds.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling. You also have the absolute right to object to processing for direct marketing purposes at any time.
• Rights Related to Automated Decision-Making: Where Score8 makes decisions affecting you solely through automated processing — including profiling — that produce significant effects, you have the right to request human review of such decisions.

To exercise any of the above rights, please contact our Data Protection team as described in Section 16 of this Policy. We will respond to valid requests within thirty (30) days. We may require you to verify your identity before actioning a data rights request.

Score8 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• TLS 1.3 encryption on all data transmitted between your device and the Platform, equivalent to the standard used by major Malaysian banking institutions.
• Encryption at rest for sensitive data including KYC documents, financial records, and account credentials stored in our systems.
• Access controls and least-privilege principles ensuring that Score8 personnel can only access personal data that is strictly necessary for their role.
• Regular security audits and penetration testing conducted by independent security professionals to identify and remediate vulnerabilities.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Incident response procedures including breach notification processes to alert affected players and regulatory bodies where required in the event of a security incident affecting personal data.

While Score8 takes all reasonable precautions, no online platform can guarantee absolute security against all threats. You are responsible for maintaining the security of your own account credentials and for notifying Score8 immediately if you suspect any unauthorised access to your Account.

The Platform may contain references to third-party services — such as licensed payment gateways, game content providers, or responsible gambling support resources — that operate their own privacy policies and data practices. Score8 is not responsible for the privacy practices or content of such third-party services.

Where you interact with a payment processor — such as when completing a transaction via Touch 'n Go eWallet, DuitNow, FPX, or any supported Malaysian bank — that interaction is governed by the payment provider's own terms and privacy policy. Score8 receives only the transaction confirmation data necessary to update your account balance.

The Score8 Platform is strictly restricted to individuals aged 21 years and above. Score8 does not knowingly collect personal data from individuals under the age of 21. Our KYC verification process is specifically designed to enforce this age restriction and prevent underage access to real-money gambling services.

Score8 reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data practices, applicable legal requirements, or the services we offer. Material changes to this Policy will be communicated to registered players via a notice on the Platform homepage and/or by email to the registered account address at least seven (7) days before the changes take effect.

Minor or non-material updates — such as clarifications of existing practices, corrections of typographical errors, or restructuring of content for readability — may be implemented without advance notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you should discontinue use of the Platform and may request withdrawal of your available balance through the standard process.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Score8, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the Platform interface. For privacy and data rights queries, please state the nature of your request at the start of the conversation so you can be connected to the appropriate team.
• Email: [email protected] — for formal data subject access requests, erasure requests, objection requests, or any complaint relating to the handling of your personal data. Please include your registered account username and a clear description of your request in the email subject line.

Score8 will acknowledge all privacy-related requests within 48 hours and will provide a substantive response or request for further information within thirty (30) calendar days. Where a request is complex or involves a high volume of data, we will notify you within the initial 30-day period if an extension of up to an additional sixty (60) days is required.