kiss198 Privacy Policy

1. Who We Are

This Privacy Policy is published by kiss198 ("kiss198", "we", "us", "our"), the operator of the online betting and gaming platform accessible at kiss198.co. kiss198 operates under an international gaming authority licence and serves registered members in Malaysia and other permitted jurisdictions.

For the purposes of data protection law, kiss198 is the data controller in respect of personal data collected from Members and visitors to the kiss198 platform. Any reference to "the Platform" in this Policy includes kiss198.co and all associated mobile-optimised interfaces.

If you have questions about this Privacy Policy or wish to exercise any of your data rights, please contact our Data Protection team using the details set out in Section 13.

2. Personal Data We Collect

kiss198 collects personal data through the following channels: (a) information provided directly by you at registration and during account use; (b) information generated automatically through your use of the Platform; and (c) information received from third-party verification and payment providers.

2.1 Data Provided by You

• Identity data: Full legal name, date of birth, gender, nationality, and government-issued identification number (e.g., MyKad number or passport number).
• Contact data: Email address, mobile telephone number, and residential address.
• Financial data: Payment method details including bank account numbers, FPX-linked bank identifiers, and e-wallet account identifiers (Touch 'n Go, Boost). kiss198 does not store full card numbers; payment tokenisation is applied where card methods are used.
• Verification documents: Copies of government-issued identification, proof of address, and payment method ownership documents submitted as part of KYC verification.
• Communication data: Records of correspondence with kiss198 support, including live chat transcripts, email exchanges, and any complaints submitted.

2.2 Data Generated Automatically

• Usage data: Pages visited, features accessed, session duration, bet history, game activity, and navigation paths within the Platform.
• Device and technical data: IP address, browser type and version, operating system, device type and model, screen resolution, and time zone.
• Transaction data: Deposit amounts, withdrawal requests, transaction timestamps, payment method used, and transaction status logs.
• Cookie data: Session identifiers and preference settings stored via cookies as described in Section 6.

2.3 Data from Third Parties

Where you use a Malaysian payment method (such as Maybank FPX, CIMB, or Touch 'n Go), kiss198 receives transaction confirmation data including transaction reference numbers and masked account identifiers from the relevant payment provider. kiss198 may also receive identity verification results from licensed third-party KYC service providers, including pass/fail status and confidence scores.

3. How We Use Your Personal Data

kiss198 uses your personal data only for specified, lawful purposes. The table below summarises our primary processing activities:

kiss198 does not use your personal data for the purpose of selling advertising to third parties, and we do not build advertising profiles derived from your betting or gaming behaviour for sale to external parties.

4. Legal Bases for Processing

kiss198 processes personal data on the following legal bases, as applicable to each processing activity:

• Contractual necessity: Processing necessary to perform the Member Agreement, including account operation, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with AML legislation, KYC regulations imposed by our international gaming authority licence, and applicable data retention obligations.
• Legitimate interests: Processing for fraud prevention, platform security, and aggregate analytics, where such interests are not overridden by your data protection rights.
• Consent: Where we send optional promotional communications, we will obtain your prior consent and provide a straightforward means to withdraw it at any time.

5. Data Sharing with Third Parties

kiss198 does not sell or rent personal data to third parties. We share personal data only in the following circumstances:

5.1 Service Providers

We engage third-party service providers to support platform operations, including payment processors (FPX, Touch 'n Go, Boost), KYC verification providers, cloud infrastructure providers, and customer support tooling vendors. All service providers are contractually bound to process Member data only on kiss198's instructions and in accordance with this Policy.

5.2 Regulatory Authorities

kiss198 will disclose personal data to regulators, law enforcement agencies, and licensing authorities where required by law or where we are under a binding legal obligation to do so. We will notify affected Members of such disclosures where legally permitted.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all assets of kiss198, Member personal data may be transferred to the acquiring entity as part of the transaction. Affected Members will be notified prior to their data becoming subject to a materially different privacy policy.

6. Cookies & Tracking Technologies

kiss198 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for session authentication, security tokens, and load balancing. These cannot be disabled without preventing core Platform functionality.
• Functional cookies: Used to remember your language preferences, display settings, and last-used payment method to improve your experience on subsequent visits.
• Analytics cookies: Aggregate, anonymised data on page performance, user flow, and feature usage — used internally to improve the kiss198 Platform. No personally identifiable information is included in analytics data shared with third-party tools.

kiss198 does not deploy advertising cookies, retargeting pixels, or third-party social media tracking scripts on the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the Service.

7. Data Retention

kiss198 retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to longer retention periods required by applicable law and regulatory obligation:

• Account and KYC documentation is retained for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements under our international gaming authority licence.
• Transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications are retained for three (3) years from the date of the interaction.
• Where a legal dispute is pending or reasonably foreseeable, relevant data may be retained until the dispute is resolved, regardless of the standard retention period.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

8. Your Data Rights

As a kiss198 Member, you have the following rights in relation to your personal data. To exercise any of these rights, contact our Data Protection team using the details in Section 13. We will respond within 30 calendar days of receipt of a verifiable request.

• Right of access: You may request a copy of the personal data kiss198 holds about you and information about how it is used.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Some data corrections may require re-verification of identity documents.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restrict processing: You may request that we limit the processing of your data while a correction or objection request is being assessed.
• Right to data portability: You may request a copy of personal data you have provided to kiss198 in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests. Where the objection concerns direct marketing communications, we will cease such communications immediately upon receipt of your objection.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

9. Data Security

kiss198 implements a layered security framework to protect Member personal data from unauthorised access, disclosure, alteration, and destruction:

• All data in transit between your device and kiss198 servers is encrypted using TLS 1.2 or higher.
• Sensitive data at rest — including identity documents and financial records — is encrypted using AES-256 encryption.
• Access to production databases containing Member personal data is restricted to a small number of authorised personnel and requires multi-factor authentication.
• All access to Member data is logged and subject to regular security audit review.
• kiss198 conducts periodic penetration testing and vulnerability assessments on its platform infrastructure.

In the event of a personal data breach that is likely to result in a risk to Member rights and freedoms, kiss198 will notify affected Members and the relevant supervisory authority in accordance with applicable breach notification obligations under our licensing framework, without undue delay.

10. International Data Transfers

kiss198's infrastructure is hosted across data centres in jurisdictions selected for their security, reliability, and compliance with applicable data protection standards. Where personal data is transferred to a country outside your country of residence, kiss198 ensures that appropriate safeguards are in place — including contractual data processing agreements incorporating standard contractual clauses — to maintain a level of protection equivalent to that required under applicable law.

11. Children's Privacy

The kiss198 Platform is strictly prohibited for use by individuals below the age of 21 years. kiss198 does not knowingly collect personal data from individuals below this age. Where kiss198 becomes aware that personal data has been collected from an individual below 21 years of age without parental or guardian consent, we will take immediate steps to delete that data and permanently close the associated account.

If you are a parent or guardian and believe that a minor has registered on the kiss198 Platform, please contact our support team immediately through 24/7 live chat.

12. Amendments to This Policy

kiss198 may amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material amendments will be communicated to registered Members via email notification or a prominent notice on the Platform at least seven (7) days prior to the effective date of the amendment.

The date of the most recent revision to this Privacy Policy is displayed at the top of this page. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy.

13. Contact & Data Protection Enquiries

For questions, concerns, or data rights requests related to this Privacy Policy or kiss198's data processing practices, please contact our Data Protection team through any of the following channels:

• 24/7 Live Chat: Available within your logged-in kiss198 account session or on the Platform homepage.
• Email: [email protected]

We aim to acknowledge all data rights requests within 5 business days and to resolve them fully within 30 calendar days. Where a request is complex or where we receive a high volume of requests, the resolution period may be extended by a further 30 days — in which case we will inform you of the extension and the reasons for it.

If you are not satisfied with our response to a data rights request or complaint, you have the right to escalate the matter to the supervisory authority applicable under the terms of our international gaming authority licence.