1 Introduction
This Privacy Policy (hereinafter referred to as "the Policy") sets out how ong88 (hereinafter referred to as "ong88", "the Platform", "we", "us", or "our"), the operator of the online gaming platform accessible atong88.cam, collects, processes, stores, uses, and protects the personal data of individuals who access or use the Platform.
ong88 is an internationally licensed online gaming platform serving players across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. The protection of our users' personal data is a matter we take seriously, and we are committed to ensuring that all personal data in our possession is handled responsibly, securely, and in accordance with applicable data protection principles.
By registering an Account, accessing the Platform, making a deposit via any of our supported Malaysian payment methods (including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong Connect), or otherwise using anyong88 service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.
This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the ong88 Platform.
This Policy applies to all personal data collected from registered Players, prospective users, and visitors to ong88.cam, regardless of the device or method through which the Platform is accessed.
2 Definitions
For the purposes of this Policy, the following definitions shall apply:
- "Personal Data" means any information that identifies or can be used to identify a natural person, directly or indirectly, including but not limited to name, identification number, contact details, location data, and online identifiers.
- "Data Subject" means the individual to whom Personal Data relates — in the context of this Policy, the registered Player or Platform visitor.
- "Processing" means any operation performed on Personal Data, including collection, recording, storage, alteration, disclosure, erasure, or destruction.
- "Data Controller" means ong88, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
- "Data Processor" means a third-party entity that processes Personal Data on behalf of ong88 under a binding data processing agreement.
- "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data.
- "Cookie" means a small text file placed on a user's device by a website, used to store preferences and track browsing activity.
- "KYC" means Know Your Customer — the identity and address verification process required by applicable regulatory standards.
3 Data We Collect
ong88 collects Personal Data in the following categories:
| Category | Data Types Collected | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (MyKad, Passport, or Driver's Licence) | Account registration; KYC verification; age verification (21+ requirement) |
| Contact Data | Email address, mobile phone number, residential address (city, state, postcode) | Account communication; KYC; support correspondence; transaction notifications |
| Financial Data | Payment method identifiers (e-wallet IDs, bank account last four digits), transaction amounts, transaction timestamps | Deposit and withdrawal processing; financial fraud prevention; regulatory reporting |
| Technical Data | IP address, browser type and version, device type and operating system, session duration, login timestamps | Platform security; fraud detection; service optimisation |
| Gaming Activity Data | Game history, bet amounts, win/loss records, bonus usage, VIP tier status, session duration | Account management; responsible gambling monitoring; VIP programme administration; regulatory compliance |
| KYC Document Data | Scanned copies or photographs of government-issued ID, proof of address documents, selfie photographs | Identity verification; regulatory KYC compliance; fraud prevention |
| Communication Data | Records of live chat interactions, email correspondence, support tickets | Customer service quality; dispute resolution; compliance records |
ong88 does not deliberately collect sensitive personal data categories (such as health, political opinions, or biometric data) beyond what is strictly necessary for KYC compliance. Where KYC documents contain such information incidentally, it is processed solely for verification purposes and not used for any other purpose.
4 How We Collect Data
ong88 collects Personal Data through the following means:
4.1 Direct Collection. Data provided directly by the Player during Account registration, profile updates, KYC document submissions, contact form submissions, live chat interactions, and email correspondence with theong88 support team.
4.2 Automated Collection. Technical Data collected automatically when a Player accesses the Platform, including IP address, browser characteristics, device identifiers, and session logs. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 10.
4.3 Payment Processing. Financial Data transmitted to ong88 by payment service providers (including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and Malaysian banking institutions) in the course of processing deposit and withdrawal transactions.
4.4 Third-Party Sources. In certain circumstances, ong88 may receive Personal Data from third-party sources including identity verification service providers, fraud detection agencies, and gaming analytics platforms, where such processing is necessary for compliance or security purposes and is conducted under appropriate data processing agreements.
5 Data Processing & Use
ong88 processes Personal Data for the following purposes:
- Account Administration: Creating, managing, and maintaining Player Accounts, including processing deposits and withdrawals in MYR through supported Malaysian payment methods.
- Identity Verification: Conducting KYC verification to confirm the identity, age (21+ requirement), and address of all Players prior to enabling withdrawal functionality.
- Service Delivery: Providing access to casino games, live dealer tables, sports betting markets (including Liga Super Malaysia, EPL, and UFC), lottery, and all other gaming products offered on the Platform.
- Regulatory Compliance: Meeting obligations imposed by our international gaming licence and applicable anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
- Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
- Customer Support: Handling Player queries, complaints, and disputes through live chat and email channels.
- Responsible Gambling Monitoring: Monitoring gaming activity patterns to identify Players who may exhibit signs of problem gambling and to administer player-protection tools including deposit limits, session reminders, and self-exclusion.
- VIP Programme Administration: Tracking gaming activity turnover and activity to calculate VIP tier eligibility, cashback rates, and loyalty benefits.
- Marketing Communications: Where a Player has explicitly opted in, sending promotional notifications regarding bonuses, offers, and Platform updates. Players may opt out at any time.
- Platform Improvement: Analysing aggregated, anonymised usage data to improve the Platform's performance, user interface, and game offering.
6 Legal Basis for Processing
ong88 processes Personal Data on the following legal bases:
6.1 Contractual Necessity. Processing required to fulfil our contractual obligations to the Player under the Terms & Conditions — including Account management, payment processing, and game access.
6.2 Legal Obligation. Processing required to comply with applicable legal and regulatory requirements, including KYC, AML/CTF obligations, and the requirements of our gaming licence.
6.3 Legitimate Interests. Processing conducted on the basis of ong88's legitimate business interests, including fraud prevention, Platform security, responsible gambling monitoring, and service optimisation — where such interests are not overridden by the rights and interests of the Data Subject.
6.4 Consent. Processing based on the Data Subject's freely given, informed consent — most notably for optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
7 Data Sharing
ong88 does not sell, rent, or trade Personal Data to third parties for commercial purposes. We may share Personal Data in the following limited circumstances:
- Payment Service Providers: Financial Data is shared with payment processors (including DuitNow network operators, FPX participating banks, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong) solely to the extent necessary to process deposit and withdrawal transactions.
- KYC and Identity Verification Providers: Identity Data and KYC documents may be shared with contracted third-party identity verification providers operating under binding data processing agreements with ong88.
- Game Software Providers: Limited Gaming Activity Data may be shared with third-party game studios and RNG providers for game provision, integrity verification, and RTP auditing purposes.
- Fraud Prevention and Analytics Platforms: Technical Data and limited transaction data may be processed by contracted fraud detection and analytics service providers under strict data processing agreements.
- Regulatory and Law Enforcement Authorities: ong88 will disclose Personal Data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, court order, or the requirements of our gaming licence authority.
- Corporate Transactions: In the event of a merger, acquisition, or corporate restructuring involving ong88, Personal Data held by the Platform may be transferred to the acquiring entity, subject to equivalent data protection commitments.
All third-party recipients of Personal Data are required to process such data only for the specified purpose, under confidentiality obligations, and in accordance with data protection standards no less protective than those applied byong88. We do not share Personal Data for the commercial benefit of third parties.
8 Data Retention
ong88 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. The following general retention periods apply:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | AML/KYC regulatory requirements; dispute resolution |
| Financial Transaction Data | 7 years from transaction date | Financial record-keeping; AML compliance; tax obligations |
| Gaming Activity Data | Duration of account + 3 years post-closure | Responsible gambling monitoring; regulatory compliance; dispute resolution |
| KYC Documents | Duration of account + 5 years post-closure | Regulatory retention requirements; fraud investigation |
| Customer Support Records | 3 years from last interaction | Dispute resolution; quality assurance; regulatory evidence |
| Technical / Log Data | 12 months from collection | Security monitoring; fraud detection |
| Marketing Preferences | Until opt-out or account closure + 1 year | Evidence of consent; suppression list management |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with ong88's data disposal procedures.
9 Security Measures
ong88 implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:
9.1 Encryption. All data transmitted between users and the Platform is protected by 256-bit SSL/TLS encryption. Sensitive data at rest (including KYC documents and financial records) is encrypted using industry-standard encryption protocols.
9.2 Access Controls. Access to Personal Data is restricted on a strict need-to-know basis. Internal staff access is governed by role-based access controls, and all access events are logged and audited.
9.3 Two-Factor Authentication. Two-factor authentication (2FA) is available for all Player Accounts and is mandatory for administrative access to Platform backend systems.
9.4 Vulnerability Management. ong88 conducts regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure. Identified vulnerabilities are remediated according to a documented risk-prioritised process.
9.5 Incident Response. ong88 maintains a documented data breach response plan. In the event of a data breach that poses a risk to Data Subjects' rights, ong88 will notify affected individuals and the relevant supervisory authority within the timeframe prescribed by applicable regulations.
While ong88 takes all reasonable measures to protect Personal Data, no online system can guarantee absolute security. Players are encouraged to use strong, unique passwords, enable 2FA on their Account, and report any suspected unauthorised Account activity to support immediately at [email protected].
10 Cookies Policy
ong88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:
- Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable session management, login authentication, and security features. They cannot be disabled without impairing Platform functionality.
- Performance and Analytics Cookies: Used to collect anonymised data about how users interact with the Platform — pages visited, session duration, error events — to help us improve the user experience. Data collected is aggregated and does not identify individual users.
- Functional Cookies: Used to remember user preferences such as language settings, preferred payment method, and display options, to provide a more personalised experience.
- Targeting and Marketing Cookies: Where a user has given consent, these cookies may be used to deliver relevant promotional content within the Platform. They are not used to track users across external third-party websites.
Players may manage cookie preferences through their browser settings. Disabling cookies may affect the functionality of certain Platform features. Strictly necessary cookies cannot be disabled via browser settings without impacting the ability to use the Platform.
11 Your Rights
Subject to applicable law and the legitimate processing requirements described in this Policy, Data Subjects have the following rights in respect of their Personal Data held by ong88:
- Right of Access: The right to request a copy of the Personal Data ong88 holds about you, together with information about how it is being used.
- Right to Rectification: The right to request correction of any inaccurate or incomplete Personal Data held about you.
- Right to Erasure: The right to request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to overiding legal or regulatory retention obligations.
- Right to Restrict Processing: The right to request that processing of your Personal Data be restricted in certain circumstances, for example while the accuracy of data is under dispute.
- Right to Data Portability: The right to receive your Personal Data in a structured, machine-readable format for transfer to another data controller, where technically feasible and where processing is based on consent or contract.
- Right to Object: The right to object to processing based on legitimate interests, including profiling for marketing purposes.
- Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of the above rights, please submit a written request to [email protected] with the subject line "Data Subject Rights Request".ong88 will acknowledge your request within five business days and aim to fulfil it within 30 calendar days of receipt, subject to identity verification.
To protect against fraudulent data access requests, ong88 reserves the right to verify the identity of any individual submitting a Data Subject Rights Request before fulfilling it. This may require submission of identification documentation consistent with the KYC process.
12 Third-Party Links
The ong88 Platform may contain references to or integrations with third-party services, including payment processors and game providers. This Policy applies solely to Personal Data processed by ong88 as Data Controller. ong88 is not responsible for the privacy practices of third-party services and recommends that users review the privacy policies of any third-party services they interact with.
Where ong88 engages Data Processors to handle Personal Data on its behalf, such processors operate under binding data processing agreements that require adherence to data protection standards consistent with this Policy.
13 Children & Minors
The ong88 Platform is strictly intended for adults aged 21 years and above. ong88 does not knowingly collect Personal Data from persons under the age of 21. Registration by underage individuals is a breach of our Terms & Conditions and is actively prevented through our age verification and KYC processes.
If ong88 becomes aware that Personal Data has been collected from a person under the age of 21, all data associated with that individual's Account will be deleted immediately and the Account closed. If you have reason to believe that an underage person has registered on the Platform, please notify us immediately at [email protected].
14 Amendments to This Policy
ong88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in legal requirements, regulatory obligations, operational practices, or the services offered on the Platform. The effective date at the top of this page indicates the version currently in force.
Where material changes are made to this Policy — particularly those that affect how Personal Data is used or shared — ong88 will notify registered Players by email at the address associated with their Account, or by displaying a prominent notice on the Platform. Continued use of the Platform following notification of material changes constitutes acceptance of the revised Policy.
Players are encouraged to review this Policy periodically. Prior versions of this Policy are available upon request from the support team.
15 Contact Us
For any questions, concerns, or requests relating to this Privacy Policy, the processing of your Personal Data, or the exercise of your Data Subject rights, please contact the ong88 data protection team through the following channels:
Email: [email protected]
(Subject line: "Privacy Policy Query" or "Data Subject Rights Request")
Live Chat: Available24/7 via the Platform. Request to speak with the Data Protection team.
Response Time: Written requests acknowledged within 5 business days; fulfilled within 30 calendar days of identity verification.
ong88 is committed to resolving all privacy-related queries and complaints promptly and transparently. If you are not satisfied with our response to a privacy complaint, you may have the right to escalate your concern to the relevant data protection supervisory authority in your jurisdiction.
This Privacy Policy was last reviewed and updated on 1 January 2026. ong88 is an internationally licensed online gaming platform. All rights reserved.
Your Data Rights at a Glance
A visual summary of what you can ask us to do with your personal data at any time.
Right of Access
Request a full copy of the personal data ong88 holds about you, plus details on how it is being used.
Right to Rectification
Ask us to correct any personal data that is inaccurate or incomplete — including contact details and address information.
Right to Erasure
Request deletion of your personal data where it is no longer needed, subject to legal retention requirements.
Right to Restrict Processing
Ask us to pause processing of your data in specific circumstances, such as while accuracy is being disputed.
Right to Data Portability
Receive your personal data in a structured, machine-readable format for transfer to another service provider.
Right to Withdraw Consent
Withdraw consent for marketing communications or any consent-based processing at any time, without penalty.
To exercise any of these rights, email [email protected] with subject "Data Subject Rights Request". We respond within 30 calendar days.
How ong88 Protects Your Privacy
Six pillars of our data protection approach — because trust is built through consistent practice, not policy documents alone.
256-bit SSL Encryption
All data transmitted between your device and the ong88 Platform is protected by bank-grade SSL/TLS encryption. Your login credentials, KYC documents, and financial data are never transmitted in plaintext.
Zero Data Selling Policy
ong88 operates a strict zero-data-selling policy. Your personal information — name, IC number, contact details, payment data — is never sold to advertisers, data brokers, or any commercial third parties. Full stop.
Strict Access Controls
Internal access to your personal data is controlled on a strict need-to-know basis. Every data access event is logged and audited. Staff who handle personal data are trained in data protection obligations and bound by confidentiality agreements.
KYC Data Handled Securely
MyKad, passport scans, and selfie documents submitted for KYC verification are stored in encrypted form, accessed only by the compliance team for verification purposes, and retained only as long as required by regulatory obligations.
Breach Notification Commitment
In the unlikely event of a data breach that could affect your rights, ong88 commits to notifying affected Players promptly, clearly explaining what happened, what data was involved, and what steps are being taken to remediate the situation.
Meaningful User Control
You can update your personal details, manage marketing preferences, set deposit limits, or request account self-exclusion at any time via Account settings or by contacting support. Your data, your control.
Questions About YourPrivacy?
Our support team is available 24/7. Whether you want to exercise your data rights, review your account settings, or simply understand how your data is used, we are here to help.
🔞 For players aged 21 and above only. | Terms & Conditions | Responsible Gambling