Privacy Policy Aztec88 – Personal Data Protection for Malaysian Users

Aztec88 is an online betting and gaming platform operating in Malaysia, providing Sports Betting, live casino, lottery, and various other online entertainment services to registered members. In delivering these services, we necessarily collect and process personal data relating to our members.

This Privacy Policy applies to all personal data collected through the Aztec88 website at aztec88.run, including all sub-domains, mobile applications (if any), email and SMS communications, and any interactions between you and the Aztec88 support team. This Policy does not apply to third-party websites that may be linked from our platform.

Aztec88 acts as data controller for personal data you provide to us directly. In certain situations where we process data on behalf of third-party service providers, we may act as a data processor. In both cases, protecting your privacy remains our priority.

Aztec88 collects various types of personal data depending on the level of your interaction with our platform. The following are the categories of data we collect:

Your personal data is collected by Aztec88 through the following channels:

• Account Registration: When you register an Aztec88 account, you provide identity and contact information directly through our platform's registration form.
• Identity Verification (KYC): When identity verification is required to meet legal obligations or before processing larger withdrawals, you may be asked to submit a copy of your MyKad and any supporting documents.
• Financial Transactions: Every time you make a deposit using Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, or submit a withdrawal request, the relevant transaction details are automatically recorded in our system.
• Platform Usage: Technical data and activity data are collected automatically when you use the Aztec88 platform, via cookies, web trackers, server logs, and similar technologies.
• Support Communications: All interactions with the Aztec88 support team via live chat, email, or any other communication channel are recorded for quality control and security purposes.
• Third-Party Sources: In cases involving identity verification or risk assessment, we may receive information from credit reference agencies, recognised identification databases, or approved KYC service providers.

Aztec88 uses collected personal data solely for the following legitimate and reasonable purposes:

• Account Management: Creating and managing your Aztec88 account, processing registrations, verifying identity, and enabling secure access to the platform.
• Service Provision: Grants you full access to all platform features, including Sports Betting on Malaysia Super League and EPL football, badminton, live casino, lottery, and e-sports.
• Financial Transaction Processing: Processes your deposits and withdrawals in MYR via your chosen local payment methods, verifies transactions, and maintains accurate financial records.
• Security & Fraud Prevention: Identifying, investigating, and preventing fraudulent activity, money laundering, platform abuse, and other security threats.
• Legal Compliance: To fulfil the legal and regulatory obligations applicable to Aztec88's operations, including anti-money laundering (AML) and know your customer (KYC) requirements.
• Customer Support: Responding to enquiries, resolving complaints, and providing technical assistance to members via live chat, email, and other support channels.
• Responsible Gaming: Monitoring betting activity patterns to identify signs of potential problem gambling and to activate the responsible gambling tools you have set up.
• Platform Improvements: Analysing usage patterns in aggregate (not at an individual level) to improve the design, features, and performance of the Aztec88 platform.
• Marketing Communications: Sending you promotions, bonus offers and service-related information from Aztec88 – subject to your communication preferences and your right to unsubscribe at any time.
• VIP Programme: Calculating eligibility and VIP tier status, crediting daily cash rebates, and managing the benefits under your Aztec88 VIP Rewards programme.

Aztec88 processes your personal data on one or more of the following legal bases under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent: You provide explicit consent during account registration and through your communication preference settings. Consent for marketing communications may be withdrawn at any time without affecting your access to the platform's core services.
• Contract Performance: Data processing necessary to provide you with Aztec88's services, pursuant to the agreement formed when you accept our Terms & Conditions.
• Legitimate Interests: Processing for fraud prevention, platform security, service improvement, and business risk management that does not unreasonably impact your rights and freedoms.
• Legal Obligation: Processing required to comply with legal and regulatory obligations applicable to Aztec88, including AML and KYC requirements.

Aztec88 does not sell members' personal data to any third party. However, in the course of operating the platform, we may share your personal data with the following categories of third parties:

• Payment Service Providers: Payment processors that facilitate transactions via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, and CIMB Clicks are required to receive the transaction information necessary to process your payments. All such providers are bound by strict confidentiality agreements.
• Game Software Providers: Live casino game providers, slots providers, and Sports Betting platform providers integrated into Aztec88 may receive session data necessary to run the games. Data shared is kept to a minimum and limited strictly to technical requirements.
• KYC & Verification Services: Third-party identity verification service providers used for KYC processes receive the identity data required to carry out those checks.
• Regulatory Authorities: Aztec88 will disclose personal data to government authorities, law enforcement, or regulatory bodies when required by law or a valid court order.
• Professional Advisors: Lawyers, accountants, auditors, and other professional advisors involved in Aztec88's operations may access certain personal data within the scope of their professional services, subject to applicable confidentiality obligations.

Aztec88 retains your personal data only for as long as necessary for the purposes stated in this Privacy Policy or as required by law. Our general data retention guidelines are as follows:

• Active Account Data: Personal and financial data is retained for as long as your account remains active, plus any additional period required by law following account closure.
• Financial Transaction Records: In accordance with Malaysian legal requirements, financial transaction records in MYR are retained for a minimum of 7 years after the transaction takes place.
• KYC & Identity Data: Identity verification documents such as MyKad copies are retained for a minimum of 5 years after the business relationship ends, in accordance with AML requirements.
• Communication & Support Logs: Live chat records, support tickets, and email communications are retained for 2 years for quality control and dispute resolution purposes.
• Marketing Data: Data used solely for marketing communications will be deleted within 30 days of you withdrawing your marketing consent.
• Technical Data & Logs: Server logs and technical data are typically retained for 12 months before being deleted or anonymised.

Aztec88 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or unauthorised disclosure:

• Data Encryption in Transit: All data transmitted between your device and Aztec88's servers is protected with 256-bit TLS/SSL encryption.
• Encryption of Stored Data: Sensitive data such as passwords and payment information is encrypted at rest using industry-recognised encryption algorithms.
• Role-Based Access Control: Access to member data is restricted to staff who require it to perform their duties, based on the principle of least privilege.
• Regular Security Audits: Aztec88's security infrastructure and procedures undergo regular audits by both internal teams and independent third parties to identify and address any vulnerabilities.
• 24/7 Monitoring: Automated monitoring systems operate around the clock to detect and alert the security team to suspicious activity or unauthorised access attempts.
• Staff Training: All Aztec88 staff with access to member data receive regular data protection training and are bound by confidentiality agreements.
• Incident Response Procedures: Aztec88 maintains documented security incident response procedures. In the event of a data breach that may affect your rights, we will notify you within a reasonable timeframe in accordance with applicable legal requirements.

The Aztec88 platform uses cookies and similar tracking technologies to enhance the user experience, analyse platform usage and maintain the security of your session. Types of cookies we use:

• Essential Cookies (Required): Required for core platform functions such as login session authentication, security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Saves your preferences such as display settings, odds preferences, and personal settings to improve your experience on the Aztec88 platform.
• Analytics Cookies: Collects aggregated, anonymised information about how you use the Aztec88 platform to help us understand usage patterns and improve our services.
• Security Cookies: Used to detect suspicious activity, prevent fraud, and maintain the integrity of user sessions on the platform.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect your ability to use some or all features of the Aztec88 platform.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights with respect to your personal data held by Aztec88:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information on how it is being used.
• Right to Rectification: You have the right to request corrections to any personal data we hold that is inaccurate or incomplete.
• Right to Erasure: You have the right to request deletion of your personal data under certain circumstances, subject to our legal data retention obligations.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain circumstances.
• Data Portability Right: You have the right to receive your personal data in a structured, machine-readable format for transfer to another data controller.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of any processing carried out prior to the withdrawal.

To exercise any of the rights above, please submit a written request to support@aztec88.run including your full name, Aztec88 account number, and details of your request. We will acknowledge your request within 3 business days and resolve it within 14 business days.

Aztec88 Platform unsuitable and not permitted for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

If you believe a minor has registered an account on Aztec88 or provided us with personal data without parental or guardian consent, please contact us immediately at support@aztec88.run. We will investigate the matter and take immediate action, including closing the account in question and deleting all related data.

In the course of operating the platform, Aztec88 may need to transfer your personal data to servers or service providers located outside Malaysia. Such transfers only take place under the following circumstances:

• The recipient country maintains a level of data protection comparable to Malaysia's, or
• The transfer is protected by a contract or appropriate safeguards ensuring your data is protected to a standard comparable to Malaysia's PDPA, or
• The transfer is necessary for the performance of a contract between you and Aztec88, or for pre-contractual measures taken at your request.

Aztec88 prioritises the use of local Malaysian service providers or those with regional ASEAN operations wherever possible, to minimise the need for cross-border data transfers.

Aztec88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data management practices, applicable legal requirements or platform service improvements. The date of the most recent update is always displayed at the top of this document.

For material amendments that significantly affect how we process your personal data, Aztec88 will endeavour to provide reasonable notice via in-platform notifications or an email to the address registered on your account before the changes take effect.

Your continued use of the Aztec88 platform after any amendments to this Privacy Policy are published will be considered your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

For any questions, concerns, or requests regarding this Privacy Policy or how Aztec88 handles your personal data, please reach out to us through the following channels:

• Data Privacy Email: support@aztec88.run – Please include "Data Privacy Enquiry" in your subject line. Response time is under 4 hours on business days.
• 24/7 Live Chat: Available directly on the Aztec88 platform for general privacy enquiries and account management.

We encourage you to contact us first if you have any concerns about how we handle your data. Our support team and data protection officer are ready to help resolve any issues directly and amicably.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia or the relevant data protection authority under applicable law.