uo8 Privacy Policy

uo8 ("we", "us", "our") operates the online gaming and sports betting platform at uo8.org (the "Platform"). This Privacy Policy applies to all users of the Platform, including registered account holders, visitors browsing without an account, and individuals who contact uo8 support.

By registering an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside the uo8 Terms & Conditions, which govern the overall relationship between you and uo8.

uo8 is the data controller in respect of personal data collected through the Platform. We are committed to collecting only what is necessary, using it only for stated purposes, and protecting it with appropriate technical and organisational measures.

uo8 collects personal data in the following categories:

uo8 does not collect sensitive categories of personal data (such as racial or ethnic origin, religious beliefs, or health data) except where incidentally disclosed in the context of responsible gaming or self-exclusion requests, in which case such data is handled with heightened care.

uo8 uses the personal data we collect for the following purposes:

• Account management — to create, maintain, and secure your uo8 account;
• Identity verification (KYC) — to verify your identity and age as required by our operating standards;
• Payment processing — to process deposits and withdrawals via Touch n Go eWallet, Boost, FPX, and other accepted methods;
• Service delivery — to provide access to sportsbook, live casino, and slot products on the Platform;
• Customer support — to respond to your queries, complaints, and account issues;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent transactions and account abuse;
• Anti-money laundering (AML) — to comply with AML obligations, including transaction monitoring and suspicious activity reporting;
• Responsible gaming — to monitor for indicators of problem gambling and to apply responsible gaming measures including self-exclusion;
• Platform improvement — to analyse usage patterns and improve the Platform's features, performance, and user experience;
• Marketing communications — to send you promotional offers and platform updates where you have opted in to receive such communications.

uo8 processes your personal data on the following legal bases:

• Contractual necessity — processing required to fulfil the agreement between you and uo8, including account operation, payment processing, and bet settlement;
• Legal obligation — processing required to comply with applicable laws and regulations, including KYC, AML, and responsible gaming obligations;
• Legitimate interests — processing necessary for fraud prevention, platform security, and improving the Platform, where such interests are not overridden by your data protection rights;
• Consent — processing for marketing communications and optional platform features where you have given explicit consent.

uo8 does not sell your personal data to third parties under any circumstances. We share data only where necessary and with the following categories of recipients:

• Payment processors — to process deposits and withdrawals (e.g. FPX service providers, Touch n Go, Boost, GrabPay);
• KYC and identity verification providers — to perform age and identity checks as required;
• Fraud and AML service providers — to conduct transaction monitoring and suspicious activity screening;
• Game providers — game studios (such as Pragmatic Play, PG Soft, Evolution) receive only the minimum data required to operate their games on the Platform;
• Regulatory and law enforcement authorities — where required by applicable law, court order, or regulatory direction;
• Professional advisers — lawyers, auditors, and accountants acting in their professional capacity, subject to confidentiality obligations.

All third parties who process data on behalf of uo8 are bound by data processing agreements requiring them to handle your data securely, use it only for the agreed purpose, and not transfer it to further third parties without authorisation.

uo8 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies — required for the Platform to function, including session management and login state;
• Performance cookies — used to analyse how users interact with the Platform and to identify areas for improvement;
• Functional cookies — used to remember your preferences, such as language settings and display options;
• Security cookies — used to detect and prevent fraud and unauthorised account access.

uo8 does not deploy third-party advertising or behavioural tracking cookies. You may control cookie settings through your browser. Please note that disabling strictly necessary cookies may affect Platform functionality.

uo8 retains personal data for as long as necessary to fulfil the purposes outlined in this Policy, or as required by applicable law. The following general retention periods apply:

• Account data — retained for the duration of your account and for a minimum of five (5) years following account closure, to meet AML and regulatory obligations;
• Transaction records — retained for a minimum of five (5) years to comply with financial record-keeping requirements;
• KYC documents — retained for a minimum of five (5) years following the end of the customer relationship;
• Support correspondence — retained for three (3) years following resolution of the relevant matter;
• Technical and usage data — retained for up to twelve (12) months in identifiable form, after which it is aggregated and anonymised.

Where data is no longer required, uo8 will securely delete or anonymise it in accordance with our data disposal procedures.

uo8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the Platform;
• Encryption at rest for sensitive data including KYC documents and financial records;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Continuous security monitoring, intrusion detection, and vulnerability management;
• Regular third-party security audits and penetration testing;
• Staff training on data protection obligations and information security best practices.

In the event of a personal data breach that poses a risk to your rights and freedoms, uo8 will notify affected individuals and relevant authorities in accordance with applicable notification requirements.

Subject to applicable law, you have the following rights in respect of your personal data held by uo8:

• Right of access — to request a copy of the personal data uo8 holds about you;
• Right to rectification — to request correction of inaccurate or incomplete personal data;
• Right to erasure — to request deletion of your personal data, subject to legal retention requirements;
• Right to restriction — to request that uo8 restrict processing of your data in certain circumstances;
• Right to data portability — to receive your personal data in a structured, machine-readable format;
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent.

Parents and guardians who believe that a minor has registered an account or provided personal data to uo8 should contact support immediately. uo8 will take prompt action to close the account and remove the minor's data.

uo8's primary operations and data storage infrastructure are located in jurisdictions with established data protection frameworks. Where it is necessary to transfer personal data to a country outside Malaysia, uo8 will ensure that appropriate safeguards are in place, including:

• Transfers to countries with an adequate level of data protection as recognised by applicable authorities;
• Use of standard contractual clauses or equivalent legal mechanisms where transfers are made to countries without a formal adequacy determination;
• Data processing agreements with all recipients requiring equivalent data protection standards to those applied by uo8.

uo8 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Where changes are material, uo8 will provide notice to registered users via email or a prominent notice on the Platform. Continued use of the Platform following the effective date of any update constitutes your acknowledgement of the revised Policy.

The current version of this Privacy Policy is always available at uo8.org/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or uo8's handling of your personal data, please contact the uo8 data protection team: