Privacy Policy — How kis918 Protects Your Personal Data

This Privacy Policy ("Policy") is published by kis918 ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://kis918.cam ("Platform"). This Policy describes how we collect, use, store, disclose, and otherwise process personal data about individuals ("Players", "Users", "you") who access or use our Platform.

At kis918, we recognise that privacy is a fundamental right. Our Platform serves players across Malaysia — including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam — and we are committed to handling your personal information with the care, transparency, and respect it deserves.

By accessing the Platform, creating an Account, making a deposit, or otherwise engaging with our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern the overall use of the Platform.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, directly or indirectly — including name, email address, date of birth, payment details, and IP address.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means kis918, the entity that determines the purposes and means of processing personal data collected via the Platform.
• "Data Processor" means any third-party entity that processes personal data on behalf of kis918, including payment processors, KYC verification providers, and customer support software vendors.
• "Cookie" means a small text file placed on your device by the Platform to store preferences, session information, and analytics data.
• "KYC" (Know Your Customer) refers to the identity verification process required under international anti-money laundering (AML) regulations and Company policy.
• "MYR" means Malaysian Ringgit, the primary currency in which financial transactions on the Platform are conducted.

The personal data we collect depends on how you interact with the Platform. The following categories of data may be collected:

3.1 Registration & Account Data

• Full legal name and preferred display name
• Email address and mobile phone number
• Date of birth (required to verify minimum age of 21)
• Username and encrypted password
• Country of residence and city (e.g., Kuala Lumpur, Penang, Johor Bahru)

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued identification (MyKad, Passport, Driver's Licence)
• Proof of residential address (utility bill, bank statement, or official correspondence dated within 3 months)
• Selfie photographs for liveness and document verification checks
• Payment method ownership documentation (e.g., e-wallet account confirmation, bank account statement)

3.3 Financial Transaction Data

• Deposit and withdrawal records, including amounts in MYR and transaction timestamps
• Payment method identifiers (masked card numbers, e-wallet account identifiers for Touch 'n Go eWallet, Boost, GrabPay, and bank account references for Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect)
• DuitNow and FPX transaction reference numbers

3.4 Gaming Activity Data

• Wager history, game types played, session durations, and game outcomes
• Bonus and promotion participation records
• Responsible gambling tool usage (deposit limits, self-exclusion, cooling-off periods)

3.5 Technical & Device Data

• IP address, device type, operating system, and browser type
• Session login timestamps and geographic location data (city-level, derived from IP)
• Cookie identifiers and Platform usage analytics

We use the personal data we collect for the following specific purposes:

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. Where profiling is used (for example, to identify potential problem gambling patterns or unusual account activity), it is used to protect Players and comply with responsible gambling obligations — not for commercial targeting.

The Company processes personal data on the following legal grounds, as applicable to the specific processing activity:

• Contractual Necessity: Processing is required to fulfil our contractual obligations to you as a registered Platform user — including account management, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable anti-money laundering (AML) regulations, licensing conditions, and record-keeping obligations imposed on the Company under its international gaming licence.
• Legitimate Interests: Processing is necessary for the Company's legitimate interests in preventing fraud, ensuring platform security, and improving the quality of our services — where those interests are not overridden by your privacy rights.
• Consent: Where processing is not covered by the above grounds — for example, sending you promotional communications or non-essential cookies — we rely on your explicit consent, which you may withdraw at any time without affecting prior processing.

kis918 does not sell or commercially transfer your personal data to third parties. We may share your data with carefully vetted third parties only in the following limited circumstances:

• Payment Processors: We share financial transaction data with payment service providers — including the operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Connect — solely for the purpose of processing your requested transactions. These providers are independently regulated and operate under their own privacy frameworks.
• KYC Verification Providers: Identity documents submitted for KYC purposes may be processed by accredited third-party verification service providers operating under strict data processing agreements with the Company.
• Customer Support Platforms: Our live chat and support ticketing infrastructure may be provided by third-party software vendors. These processors operate under data processing agreements that restrict their use of your data to support delivery only.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to competent authorities — including licensing regulators, financial intelligence units, and law enforcement agencies — where required by law, court order, or regulatory direction.
• Fraud Prevention Networks: In cases of suspected fraud or financial crime, we may share relevant account and transaction data with third-party fraud prevention agencies as part of our AML obligations.

The kis918 Platform uses cookies and similar tracking technologies to ensure the platform functions correctly, improve your experience, and gather aggregated analytics on Platform usage. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for core Platform functionality, including maintaining your login session, remembering your language and currency preferences, and ensuring secure page-to-page navigation. These cookies cannot be disabled without impacting platform functionality.
• Functional Cookies: Remember your preferences such as game display settings, notification preferences, and responsible gambling tool configurations set in your account.
• Analytics Cookies: Collect aggregated, anonymised data about how Players navigate and use the Platform — including page visit frequency, session duration, and feature engagement. This data helps us improve the Platform and user experience.
• Security Cookies: Support fraud detection and account security functions, including identifying unusual login patterns and potential account compromises.

You may manage non-essential cookie preferences through your browser settings. Please note that disabling certain cookies may affect Platform functionality. We do not use third-party advertising or tracking cookies that share your data with external advertisers.

The Company implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encrypted storage of sensitive personal data, including identity documents and financial records, using industry-standard encryption at rest.
• Role-based access controls ensuring that employee access to personal data is restricted to those with a legitimate operational need.
• Multi-factor authentication for all internal administrative systems that have access to player data.
• Regular security vulnerability assessments and penetration testing conducted by independent security professionals.
• Incident response procedures enabling rapid detection, containment, and notification of data security incidents.

While we take all reasonable precautions to protect your data, no online system is entirely immune to security risks. You are responsible for maintaining the confidentiality of your Account login credentials. Please contact our support team immediately if you suspect your Account has been compromised.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our data disposal procedures. Anonymised data — from which no individual can be identified — may be retained indefinitely for statistical and analytical purposes.

Subject to applicable law and certain limitations, you hold the following rights in relation to your personal data held by kis918:

To exercise any of the above rights, please contact the kis918 Data Privacy Team at [email protected] with your Account username and the specific right you wish to exercise. We will respond to validated requests within thirty (30) calendar days. We may request proof of identity before processing rights requests to prevent fraudulent or unauthorised access to personal data.

The kis918 Platform operates under an international gaming licence, and aspects of our data processing infrastructure — including server hosting and certain third-party service providers — may be located outside of Malaysia. Where personal data is transferred outside of Malaysia, we ensure that appropriate safeguards are in place to protect your data to a standard at least equivalent to that applicable under the jurisdiction of our licensing authority.

Such safeguards include the use of data processing agreements incorporating standard contractual clauses, transfer impact assessments where required, and engaging only with third-party processors in jurisdictions with adequate data protection frameworks.

The kis918 Platform is strictly intended for individuals aged twenty-one (21) years and above. We do not knowingly collect or process personal data relating to individuals below the age of 21. Age verification is a mandatory step in our KYC process, and we reserve the right to request documentary proof of age at any point.

If we discover that personal data has been collected from a person under the age of 21, we will immediately suspend the associated Account, delete the personal data in question, and, where applicable, return any deposited funds to the original payment source. If you believe that a minor has created an Account on our Platform, please contact us immediately at [email protected].

The Company reserves the right to amend or update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where changes are material, we will notify registered Players by email or via a prominent notice on the Platform prior to the changes taking effect.

The most current version of this Policy will always be accessible at https://kis918.cam/privacy-policy. The "Last Updated" date at the top of this document reflects the date on which the most recent changes were made. Your continued use of the Platform after any update constitutes acceptance of the revised Policy.

If you have any concerns about changes to this Policy, you may contact our support team or, if you do not accept the revised terms, close your Account in accordance with the procedure set out in our Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact the kis918 Data Privacy Team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week via the chat icon present on all Platform pages.
• Subject Line: Please use the subject "Privacy Request — [Your Account Username]" when emailing regarding data rights.
• Response Time: We will acknowledge privacy requests within five (5) business days and provide a substantive response within thirty (30) calendar days.

For questions specifically relating to responsible gambling tools, deposit limits, or self-exclusion, please visit our dedicated Responsible Gambling page. For general questions about Platform use and account rules, please refer to our FAQ page.