Privacy Policy

This Privacy Policy ("Policy") describes how SAR288 ("SAR288", "the Platform", "we", "us", "our") collects, uses, stores, shares, and protects personal data relating to individuals who access or use the SAR288 website at https://sar288.asia, including all sub-pages, services, games, betting markets, and associated features ("Platform").

SAR288 operates as Malaysia's premier VIP online casino and sports betting platform, serving registered players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout Malaysia. The processing of personal data is an inherent and necessary part of operating a regulated online gaming platform, particularly in relation to identity verification (KYC), payment processing, fraud prevention, and responsible gambling obligations.

By accessing the Platform, registering an account, or submitting personal information to SAR288 in any form, you acknowledge that you have read and understood this Policy and you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

This Policy should be read alongside SAR288's Terms & Conditions, which govern the overall terms of your use of the Platform. In the event of any conflict between the Terms & Conditions and this Policy on a privacy-specific matter, this Policy shall prevail.

For the purposes of this Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that relates to an identified or identifiable natural person — including but not limited to name, identification number, contact details, payment information, account activity, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, and deletion.
• "Data Subject" means the individual to whom Personal Data relates — in most cases, a registered SAR288 Player.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, SAR288.
• "Data Processor" means a third party that processes Personal Data on behalf of SAR288 under a binding data processing agreement.
• "KYC" means Know Your Customer — the identity verification process required by SAR288 prior to authorising withdrawals and certain account activities.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement by a Data Subject to the processing of their Personal Data for one or more specific purposes.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, and personalisation, as described in Clause 11.

SAR288 collects the following categories of personal data from registered Players and Platform visitors. Data is collected only where it is necessary for the stated purposes outlined in Clause 5.

In summary, the categories of data SAR288 may hold about you are:

SAR288 collects personal data through the following means:

• Directly from you: When you register an account, complete the KYC process, make a deposit, submit a withdrawal request, contact our support team, or respond to a promotional offer.
• Automatically through the Platform: Via cookies, server logs, and session tracking technologies that operate as you interact with the SAR288 website or mobile interface. This includes IP address, device information, and Platform usage data.
• From third-party service providers: Identity verification partners may provide confirmation of your identity or flag potential matches against watch-lists as required for KYC and anti-money laundering compliance. Payment processors may share transaction status and fraud indicators with SAR288.
• From public sources: Where necessary for fraud prevention or compliance purposes, SAR288 may access publicly available information relevant to confirming player identity or account legitimacy.

SAR288 processes personal data for the following clearly defined purposes. Data is not used for any purpose incompatible with those stated below without obtaining fresh consent from the Data Subject.

SAR288 processes personal data on the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered SAR288 Player — including account creation, payment processing, withdrawal fulfilment, and delivering the services you have requested.
• Legal Obligation: Processing required to comply with applicable laws — including KYC/AML obligations, gaming licence conditions, and lawful requests from regulatory authorities or law enforcement agencies.
• Legitimate Interests: Processing necessary to pursue SAR288's legitimate business interests in operating a safe, fair, and fraud-free gaming platform — where those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security, and responsible gambling monitoring.
• Consent: Processing based on your explicit, freely given consent — specifically for marketing communications. You may withdraw consent for marketing at any time without affecting the lawfulness of prior processing.

SAR288 does not sell, rent, or otherwise disclose your personal data to unaffiliated third parties for their own commercial purposes. Data may be shared with third parties only in the following strictly defined circumstances:

• Payment Service Providers: SAR288 shares necessary transaction data with payment processors and financial institutions — including DuitNow operators, FPX-participating banks (Maybank, CIMB, Public Bank, Hong Leong), and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay) — to facilitate deposits and withdrawals. Cryptocurrency transaction data may be shared with applicable blockchain network nodes as inherent to crypto payment processing.
• KYC & Identity Verification Partners: Approved third-party identity verification service providers receive copies of KYC documents (MyKad, passport, proof of address) solely for the purpose of completing the verification process on behalf of SAR288.
• Game Software Providers: Game studios and software suppliers integrated into the SAR288 platform may receive anonymised session and game-play data for RNG certification and RTP reporting purposes. No personally identifiable information is passed to game studios unless strictly required.
• Regulatory & Law Enforcement Authorities: SAR288 will disclose personal data to competent regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law or a valid legal order. SAR288 will endeavour to notify affected Players of such disclosure where legally permitted to do so.
• Fraud Prevention Networks: Where required, certain account flags or fraud indicators may be shared with industry-wide fraud prevention systems to protect the wider player community.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring involving SAR288, player data may be transferred to a successor entity, subject to equivalent data protection standards being maintained.

All third parties with whom SAR288 shares personal data are subject to binding data processing agreements requiring them to process data only for the stated purpose, maintain appropriate security measures, and comply with applicable data protection obligations.

As an online platform operating under an international gaming licence, SAR288 may process or store personal data on servers located outside of Malaysia. Where data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that available in Malaysia, SAR288 will implement appropriate safeguards to protect transferred data, which may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules where data is transferred within the SAR288 corporate group;
• Transfers to recipients in jurisdictions that have been assessed as providing an adequate level of data protection.

You may request further information about the specific safeguards in place for international data transfers applicable to your account by contacting our support team as described in Clause 15.

SAR288 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law, whichever is longer. The following general retention principles apply:

• Active Accounts: Personal data associated with a live SAR288 account is retained for the duration of the account's active status and for a minimum period of 5 years following account closure, in compliance with applicable anti-money laundering and gaming record-keeping obligations.
• KYC Documents: Identity verification documents are retained for the period required by the applicable licensing authority's record-keeping requirements — typically a minimum of 5 years from the date of verification or account closure, whichever is later.
• Transaction Records: Financial transaction records (deposits, withdrawals, bonus transactions) are retained for a minimum of 5 years from the date of each transaction.
• Support Communications: Records of customer support interactions are retained for up to 3 years from the date of the interaction.
• Marketing Consent Records: Records of consent for marketing communications are retained for the duration of the consent and for 1 year after consent is withdrawn, as evidence of prior consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual Data Subject.

SAR288 implements a multi-layered information security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Transport Encryption: All data transmitted between your device and SAR288's servers is encrypted using TLS/SSL with 256-bit encryption keys;
• At-Rest Encryption: Sensitive personal data stored on SAR288's servers — including KYC documents and payment information — is encrypted at rest using industry-standard encryption algorithms;
• Access Controls: Access to personal data is restricted on a strictly need-to-know basis. SAR288 staff and third-party processors are granted access only to the data required for their specific role;
• Secure Development Practices: The SAR288 Platform is developed and maintained in accordance with established secure coding standards, with regular security assessments and penetration testing conducted by independent specialists;
• Incident Response: SAR288 maintains a documented data breach response procedure. In the event of a security incident that is likely to result in a high risk to your rights and freedoms, SAR288 will notify affected individuals as required by applicable law.

SAR288 uses cookies and similar tracking technologies (collectively, "Cookies") to operate, maintain, and improve the Platform experience. Cookies are small text files stored on your device by your browser when you visit the SAR288 website.

The following categories of Cookies are used on the Platform:

• Strictly Necessary Cookies: Essential for the Platform to function correctly — including session authentication, security tokens, and load balancing. These Cookies cannot be disabled without significantly affecting Platform functionality.
• Functional Cookies: Used to remember your preferences and personalise your experience — such as your preferred language, display settings, and previously used payment methods.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players interact with the Platform — including page views, session duration, and navigation paths. This data is used solely to improve Platform performance and user experience.
• Marketing Cookies: Where you have provided explicit consent, marketing Cookies may be used to deliver relevant promotional content. These Cookies may be set by SAR288 or approved third-party advertising partners.

You may control non-essential Cookies through your browser's privacy settings. Please note that disabling Cookies may affect the functionality of certain Platform features. For most browsers, Cookie management options are available under Settings > Privacy & Security.

As a Data Subject, you hold the following rights in relation to the personal data SAR288 holds about you. These rights may be subject to certain limitations where SAR288 is required to retain data by applicable law, or where exercising a right would adversely affect the rights of others.

To exercise any of the rights listed above, please contact the SAR288 data team via our support channels as described in Clause 15. We will acknowledge your request within 5 business days and aim to fulfil all valid requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by up to an additional 60 days, in which case we will notify you of the extension and the reason for it.

Exercising your data rights will not result in any negative treatment of your player account for matters unrelated to the data request itself.

The SAR288 Platform is strictly restricted to individuals aged 21 years and above. SAR288 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of the SAR288 KYC process, and all new accounts are subject to age confirmation before full access is granted.

If SAR288 becomes aware that personal data has been collected from an individual under 21 years of age, the relevant account will be immediately suspended, all data associated with that account will be deleted, and any funds held will be returned to the originating payment method following verification.

If you believe that SAR288 may hold personal data relating to an individual under 21, please contact us immediately via the support channels described in Clause 15.

SAR288 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The most current version of this Policy will always be accessible at https://sar288.asia/privacy-policy, and the "Last Updated" date at the top of this document will be revised accordingly.

Where material changes are made to this Policy — particularly changes that may affect your rights or the manner in which your personal data is processed — SAR288 will take reasonable steps to notify registered Players, which may include displaying a prominent notice on the Platform or sending a communication to your registered email address.

Your continued use of the SAR288 Platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should cease use of the Platform and may request account closure in accordance with the Terms & Conditions.

If you have any questions, concerns, or formal requests relating to this Privacy Policy, the processing of your personal data, or the exercise of your data rights, please contact us through one of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, including Malaysian public holidays. Our support team can handle data rights queries directly and will escalate to our data compliance team where required. Average first response time is under 2 minutes.
• Support Email: [email protected] — please allow up to 4 hours for a response during peak periods. For formal data rights requests, please include "Data Rights Request" in the subject line and provide your registered username and a brief description of your request.

SAR288 treats all privacy-related communications with the highest level of confidentiality. Our support team and data compliance personnel are trained to handle personal data requests in a secure, respectful, and timely manner consistent with the standards set out in this Policy.

For players located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout Malaysia — we are committed to ensuring that your data rights are accessible and exercisable without friction, regardless of your account tier or transaction history with SAR288.