Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by PG368 ("PG368", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the PG368 online casino and sports betting platform accessible at pg368.lat, including any associated mobile interfaces or subdomains.

PG368 takes the privacy and security of your personal data seriously. This Policy describes in detail the categories of personal information we collect from players and visitors, the purposes for which that data is processed, the legal bases that justify our processing activities, and the rights available to you as a data subject.

By registering an account with PG368 or by continuing to use our platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read together with our Terms & Conditions, which govern your use of the PG368 platform and are incorporated by reference.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

3 Data We Collect

PG368 collects personal data from players and visitors through multiple touchpoints. The categories of data we process are described below:

3.1 Registration Data

When you open a PG368 account, we collect:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (used to verify that you are aged 21 or above).
• Email address (used as your primary account identifier and communication channel).
• Mobile phone number (used for account verification and security alerts).
• Residential address, including city and postcode — for players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other Malaysian cities.
• Chosen username and encrypted password hash.

3.2 Identity Verification (KYC) Data

To comply with our anti-money-laundering obligations and to process withdrawals, we may require:

• A copy of your national identity card (MyKad), passport, or other government-issued photo ID.
• Proof of residential address (e.g., a utility bill or bank statement dated within the last three months).
• Source-of-funds documentation for high-value transactions, where applicable.

3.3 Financial & Transaction Data

When you make deposits or withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT, or BTC, we retain transaction records including:

• Payment method type and masked payment identifier (e.g., last four digits of a bank account).
• Transaction amounts in MYR or applicable cryptocurrency.
• Transaction timestamps and reference numbers.
• Deposit and withdrawal history associated with your account.

PG368 does not store complete bank account numbers, full card numbers, or online banking passwords. These are processed exclusively by PCI-DSS-compliant third-party payment processors.

3.4 Technical & Usage Data

Automatically collected when you access the PG368 platform:

• IP address and approximate geolocation (used for fraud detection and jurisdictional compliance).
• Device type, operating system, and browser version.
• Session duration, pages visited, game titles accessed, and betting history.
• Referral source (how you arrived at the PG368 platform).
• Cookie identifiers and local storage data (see Section 9).

3.5 Communications Data

Records of your communications with PG368 support via live chat and email, including the content of those communications, timestamps, and outcomes, are retained for quality assurance and dispute resolution purposes.

4 Legal Basis for Processing

PG368 processes your personal data on the following legal bases, depending on the specific processing activity:

5 How We Use Your Personal Data

PG368 uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, and administering your PG368 player account, including processing login authentication, account updates, and password resets.
• Identity Verification: Confirming that you meet our eligibility requirements — including the minimum age of 21 — and verifying your identity in accordance with our KYC and anti-money-laundering obligations.
• Payment Processing: Facilitating MYR deposits and withdrawals through your chosen payment method, reconciling transactions, and managing refunds where applicable.
• Platform Security: Detecting and preventing fraudulent activity, unauthorised account access, multi-accounting, collusion, and money laundering — including through automated monitoring systems.
• Customer Support: Responding to enquiries, resolving disputes, processing complaints, and delivering follow-up assistance in connection with your account or transactions.
• Responsible Gambling: Monitoring account activity for indicators of problem gambling behaviour and facilitating the implementation of player-requested limits, cooling-off periods, and self-exclusion arrangements.
• Legal Compliance: Meeting our obligations under applicable gaming licensing regulations and responding to lawful requests from law enforcement or regulatory bodies.
• Service Improvement: Analysing aggregated and anonymised usage data to improve platform performance, game selection, and user experience.
• Marketing Communications: Where you have given explicit consent, sending you personalised promotional content, bonus offers, and event notifications relevant to your interests as a PG368 player.

6 Data Sharing & Disclosure

PG368 does not sell, rent, or trade your personal data to third-party marketers. However, we may disclose personal data to carefully selected third parties in the following circumstances:

• Payment Processors: We share transaction-relevant data with our licensed payment gateway partners — including providers that process Touch 'n Go eWallet, DuitNow, FPX, and cryptocurrency transactions — strictly for the purpose of executing financial transactions you have initiated.
• KYC & Identity Verification Providers: We engage regulated third-party identity verification services to assist in fulfilling our KYC obligations. These providers process identity documents and confirmation data on our behalf under strict data processing agreements.
• Technology & Hosting Providers: Our platform is hosted on enterprise-grade cloud infrastructure. Hosting and technical service providers may access personal data as part of platform operation but are contractually prohibited from using that data for any purpose other than providing services to PG368.
• Gaming Software Providers: Game results and session data may be shared with the relevant game studio or live dealer studio for the purpose of resolving disputes or investigating technical incidents.
• Regulatory & Law Enforcement Authorities: PG368 will disclose personal data to law enforcement agencies, regulatory authorities, or courts of competent jurisdiction where required to do so by applicable law, court order, or our gaming licence conditions.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of PG368, personal data may be disclosed to prospective or actual acquirers, subject to equivalent privacy protections being maintained.

7 Data Retention

PG368 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law or our gaming licence conditions. Specific retention periods are summarised below:

• Active Account Data: Retained for the duration of your active account relationship with PG368, plus a minimum of five (5) years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• Transaction Records: Financial transaction history is retained for a minimum of seven (7) years from the date of each transaction, as required by standard financial record-keeping obligations applicable to licensed gaming operators.
• KYC Documentation: Identity verification documents are retained for five (5) years from the date of collection or from the date of account closure, whichever is later.
• Support Communications: Customer support correspondence is retained for three (3) years from the date of the interaction, unless a longer period is required for an ongoing dispute or legal matter.
• Marketing Consent Records: Records of your marketing consent (or withdrawal of consent) are retained for as long as they remain relevant to demonstrate compliance, typically a minimum of three (3) years.

Upon expiry of applicable retention periods, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

8 Data Security

PG368 implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These include:

• Transport Encryption: All data transmitted between your browser or device and PG368 servers is encrypted using 256-bit TLS/SSL protocols.
• Access Controls: Personal data is accessible only to authorised PG368 personnel on a strict need-to-know basis. Access is logged and audited.
• Password Security: Account passwords are stored as salted cryptographic hashes. PG368 does not store passwords in plain text or reversible form.
• Infrastructure Security: PG368 operates on enterprise cloud infrastructure with network-level firewalls, intrusion detection systems, and regular third-party security assessments.
• Incident Response: PG368 maintains a documented data breach response procedure. In the event of a personal data breach affecting player rights and freedoms, we will notify affected individuals and relevant authorities within timeframes required by applicable regulations.

While PG368 takes all reasonable precautions to protect your personal data, no internet-based service can guarantee absolute security. You are responsible for maintaining the security of your own login credentials and for ensuring that your device is adequately protected.

9 Cookies & Tracking Technologies

PG368 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how the platform is used. The categories of cookies we use are:

• Strictly Necessary Cookies: Essential for the platform to function correctly — including session authentication, security tokens, and load-balancing identifiers. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and display options to personalise your experience on return visits.
• Analytical Cookies: Collect aggregated, anonymised data about how players navigate the platform — including which pages are visited, session durations, and error events — to help us improve performance and usability.
• Fraud Prevention Cookies: Used to identify and flag suspicious activity patterns, multiple account attempts from the same device, and other security-relevant signals.

You can manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies; however, disabling strictly necessary cookies may prevent you from accessing certain platform features. PG368 does not use cookies to deliver third-party advertising or to track you across websites that we do not operate.

10 Your Data Rights

Subject to applicable law and regulatory obligations, you have the following rights in relation to the personal data PG368 holds about you:

To exercise any of these rights, contact our Data Privacy team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within five (5) business days and aim to fulfil it within thirty (30) days. In complex cases, we may extend this period by an additional thirty (30) days with notice.

11 International Data Transfers

As an internationally licensed gaming operator, PG368 may process or store personal data in countries outside of Malaysia. This may occur in connection with our cloud hosting infrastructure, third-party payment processors, or KYC verification partners operating in various jurisdictions.

Where personal data is transferred internationally, PG368 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required by applicable privacy legislation. These safeguards may include:

• Contractual clauses in data processing agreements with third-party processors, requiring them to maintain data protection standards consistent with internationally recognised frameworks.
• Selection of processors operating in jurisdictions with adequate data protection laws or frameworks.
• Technical security measures such as encryption at rest and in transit, applied regardless of the processing location.

12 Minors & Age Policy

PG368 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes an age declaration requirement, and we conduct KYC age verification on all accounts prior to processing any withdrawal.

If PG368 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant account, delete the associated personal data, and return any deposited funds to the originating payment method where technically possible.

If you are a parent or guardian and believe that a minor in your care has accessed or registered on PG368, please contact us immediately at [email protected] so that we can take prompt action.

13 Amendments to This Policy

PG368 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. The "Last Updated" date at the top of this page will be revised accordingly whenever material changes are made.

Where amendments are material — meaning they significantly affect how we process your personal data or the rights available to you — PG368 will provide advance notice through one or more of the following channels:

• A notification displayed prominently on the PG368 platform when you next log in.
• An email notification to the address registered on your account.

Your continued use of the PG368 platform after the publication of any amended Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree to the amended Policy, you should discontinue use of the platform and may request account closure in accordance with Section 10.

14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact the PG368 Data Privacy team using the details below. When making a data rights request, please include sufficient information to allow us to identify your account and verify your identity.