umg8 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") sets out how umg8 ("the Company", "we", "us", "our") collects, processes, stores, discloses, and protects the personal data of individuals ("you", "your", "the User") who register for or use the umg8 online gaming platform accessible at umg8.app.

umg8 operates under international gaming licensing frameworks and is subject to data protection obligations as a condition of that licensing. This Policy has been prepared to give umg8 users — including those accessing the platform from Kuala Lumpur, Penang, Johor Bahru, and elsewhere in Malaysia — a clear understanding of how their personal information is handled.

This Policy should be read alongside the umg8 Terms & Conditions, which govern the overall agreement between you and umg8. In the event of any inconsistency between this Policy and the Terms & Conditions on a data privacy matter, this Policy shall prevail.

2. Data We Collect

umg8 collects personal data through several channels: directly from you during registration and account use; automatically through your interaction with the platform; and, in limited circumstances, from third-party sources such as payment processors and identity verification providers. The categories of data we collect include:

• Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identification documents provided during KYC verification.
• Contact Data: Email address, phone number, and residential address.
• Account Data: Username, encrypted password, account preferences, responsible gaming settings, and communication preferences.
• Financial Data: Payment method details (e.g., Touch n Go eWallet account reference, bank account name and number for withdrawals), transaction history, deposit records, withdrawal requests, and balance information. umg8 does not store full card numbers or sensitive payment credentials — these are handled by PCI-DSS-compliant third-party processors.
• Gaming Activity Data: Bet history, game session data, wager amounts, winnings, losses, and bonus redemption history.
• Technical Data: IP address, device type, browser type and version, operating system, session duration, pages visited, and referring URLs. This data is collected automatically when you access the umg8 platform.
• Communications Data: Records of your correspondence with umg8 support, including chat logs, email exchanges, and support ticket content.

umg8 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data unless required for identity verification purposes under our KYC obligations, in which case the minimum necessary data will be collected.

3. How We Use Your Data

umg8 uses the personal data we collect for the following purposes:

• Account Management: To create, verify, maintain, and secure your umg8 account, including processing login authentication and implementing account security features such as two-factor authentication.
• Service Delivery: To process bets, settle wagers, credit winnings, and provide access to all umg8 platform features including Sportsbook, Live Casino, Slots, and Jackpot products.
• Payment Processing: To process deposits and withdrawals via your chosen payment method (Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, or Crypto) and to maintain accurate financial records.
• KYC & Compliance: To verify your identity and age, comply with anti-money laundering (AML) obligations, and fulfil reporting requirements under umg8's international gaming licence.
• Responsible Gaming: To monitor gaming behaviour for signs of problem gambling, enforce self-imposed limits and self-exclusion requests, and administer responsible gaming tools.
• Customer Support: To respond to your queries, complaints, and requests submitted through the umg8 support channels.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the performance, security, and user experience of the umg8 platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have consented to receive such communications. You may withdraw this consent at any time through your account settings.
• Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and abuse of platform features or promotional offers.
• Legal Obligations: To comply with applicable laws, regulatory requirements, court orders, and requests from competent authorities.

4. Legal Basis for Processing

umg8 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions, including account management, bet settlement, and payment processing.
• Legal Obligation: Processing required to comply with KYC, AML, and other regulatory requirements under umg8's gaming licence and applicable data protection law.
• Legitimate Interests: Processing carried out in umg8's legitimate business interests, including fraud prevention, platform security, and internal analytics, where those interests are not overridden by your rights and interests.
• Consent: Processing based on your explicit consent, including the sending of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

5. Data Sharing & Disclosure

umg8 does not sell your personal data to any third party. We may share your data in the following limited circumstances:

• Service Providers: Third-party companies that provide services on our behalf, including payment processors, KYC/identity verification providers, cloud hosting providers, customer support software providers, and fraud detection services. These providers are contractually bound to process your data only on umg8's instructions and to maintain appropriate security standards.
• Game Providers: Where necessary for game delivery and dispute resolution, limited technical session data may be shared with the certified game studios whose content is integrated into the umg8 platform.
• Regulatory Authorities: umg8 may be required to disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or other government bodies where required by law or as directed by our licensing authority.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets of umg8, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections being maintained.
• With Your Consent: In any other circumstances where you have given explicit consent to the specific sharing arrangement.

6. Cookies & Tracking Technologies

umg8 uses cookies and similar tracking technologies on the platform for the following purposes:

• Essential Cookies: Required for the platform to function correctly, including session management, login authentication, and security features. These cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to understand how users interact with the platform — which pages are visited most frequently, how long sessions last, and where users encounter difficulties. This data is used in aggregate and anonymised form to improve the platform.
• Preference Cookies: Used to remember your account preferences and settings between sessions, such as language or display preferences.
• Marketing Cookies: Used to deliver relevant promotional content where you have consented to receive marketing communications. These may track your activity across the platform to assess the effectiveness of promotional campaigns.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the umg8 platform, though some features may function differently.

7. Data Retention

umg8 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, and as required by our legal and regulatory obligations. Specific retention periods apply as follows:

• Active Accounts: Personal data associated with an active umg8 account is retained for the duration of the account's existence plus a minimum of five (5) years following account closure, to comply with AML and gaming licence record-keeping requirements.
• Transaction Records: Financial transaction data including deposit and withdrawal records are retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• Support Communications: Records of support interactions are retained for a minimum of three (3) years following the resolution of the relevant query.
• Marketing Data: Where processing is based on consent, marketing data is retained until consent is withdrawn. Following withdrawal, data will be deleted within thirty (30) days, except where retention is required for legal compliance.

At the end of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be linked to any individual.

8. Data Security

umg8 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• TLS/HTTPS encryption for all data transmitted between your device and umg8's servers.
• Encryption at rest for stored personal and financial data.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Regular security assessments and penetration testing of the platform infrastructure.
• Industry-standard password hashing — plaintext passwords are never stored.
• Two-factor authentication available to users and required for administrative access.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, umg8 will notify you and the relevant authorities in accordance with applicable legal requirements. You are encouraged to report any suspected security vulnerabilities or unauthorised access to your account to umg8 support immediately.

9. Your Rights

Subject to applicable data protection law, you have the following rights with respect to your personal data held by umg8:

• Right of Access: You may request a copy of the personal data umg8 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Some data can be corrected directly within your account settings; others require a support request.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to umg8's legal retention obligations. Erasure requests cannot override mandatory regulatory record-keeping requirements.
• Right to Restrict Processing: You may request that umg8 restrict processing of your personal data in certain circumstances, for example while a rectification request is pending.
• Right to Data Portability: You may request that personal data you have provided to umg8 be transmitted to you or a third party in a structured, commonly used, machine-readable format, where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time through your account settings or by contacting umg8 support.
• Right to Object: You may object to processing of your personal data based on legitimate interests, including profiling for direct marketing purposes.

To exercise any of these rights, contact umg8 support at the address provided in Section 13. We will respond to verified requests within a reasonable timeframe and in accordance with applicable law.

10. Children & Minors

The umg8 platform is strictly intended for use by adults aged 21 years and above. umg8 does not knowingly collect personal data from any person under the age of 21. Age verification is conducted as part of the registration and KYC process.

If umg8 becomes aware that personal data has been collected from a person under 21 without proper age verification, the account will be immediately suspended, any balance will be held pending review, and all personal data associated with the underage account will be deleted as promptly as permitted by our legal and regulatory obligations.

If you believe that a minor has gained access to the umg8 platform, please notify us immediately so that appropriate action can be taken.

11. International Data Transfers

umg8 operates under international gaming licensing and may process or store your personal data in jurisdictions outside Malaysia. Where such transfers occur, umg8 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under the data protection obligations of our licensing framework.

By registering and using the umg8 platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions outside your country of residence. Where required by applicable law, umg8 will implement standard contractual clauses or equivalent transfer mechanisms to legitimise such transfers.

12. Changes to This Privacy Policy

umg8 reserves the right to update this Privacy Policy at any time. The most recent version of the Policy will always be published on this page, with the "Last Updated" date clearly indicated at the top.

Where changes are material — for example, where we introduce a new category of data collection or a new processing purpose — umg8 will use reasonable efforts to notify affected users via the email address on file or through a notification displayed upon login to the platform.

Your continued use of the umg8 platform following publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must cease using the platform and may request account closure in accordance with the Terms & Conditions.

13. Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or to the personal data umg8 holds about you — including access requests, deletion requests, consent withdrawal, or data breach reports — please contact the umg8 Data Privacy team: