328i Malaysia Privacy Policy – Our Commitment to Protecting the Data and Privacy of Every Platform Member

1 Information We Collect

328i collects personal data from members through several different channels. Understanding what data we collect and how it is obtained is essential to maintaining a transparent relationship between 328i and every Malaysian player who is part of our community.

a) Information You Provide Directly

• During Registration: Username, active Malaysian phone number, encrypted password, and your acceptance of 328i's Terms & Conditions and Privacy Policy.
• During Identity Verification (KYC): Full name, national identity card or passport number, date of birth, current residential address, and an image of your identification document for legally mandated verification purposes.
• During Financial Transactions: E-wallet or banking account details used for deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, or CIMB Clicks. 328i does not store your full card or bank account details — this information is processed directly by licensed payment providers.
• During Support Communications: Any information you share with the 328i customer support team via live chat, email, or other communication channels provided by us.

b) Information Collected Automatically

• Device & Connection Data: Your IP address, web browser type and version, device operating system, screen resolution, and preferred device language.
• Platform Activity Data: Pages visited, games played, session duration, buttons clicked, and navigation paths within the 328i platform.
• Transaction Data: Deposit, withdrawal, betting, winnings, and loss history occurring on the 328i platform.
• Cookie Data & Tracking Technologies: Information collected through session cookies, preference cookies, and similar technologies to improve user experience and platform security.

2 How We Use Your Personal Data

Every piece of data collected by 328i has a clear and legitimate purpose. We do not use your data in ways you would not expect or have not consented to. Below is a comprehensive list of how 328i uses members' personal data:

With respect to marketing specifically — 328i will only send you marketing communications, bonus promotions, or notifications about new games if you have given explicit consent at the time of registration or subsequently through the communication preference settings in your account. You may opt out of marketing communications at any time with no effect on your ability to continue using 328i's services.

3 Data Flow & Third-Party Sharing

328i does not sell, rent, or transfer members' personal data to third parties for their own commercial purposes. However, to operate the 328i service effectively, we do need to share limited data with the following categories of third parties, all of whom are bound by strict data protection agreements:

4 Data Security & Protection Measures

328i continually invests in security infrastructure to ensure every member's personal and financial data is protected to the highest possible standard. The key security measures we employ are as follows:

• 256-bit SSL Encryption: All communication between your browser and 328i's servers is encrypted using 256-bit TLS/SSL protocol — rendering any transmitted data unreadable to any party attempting to intercept the connection.
• Data-at-Rest Encryption: Sensitive data stored in the 328i database — including hashed passwords, identification numbers, and financial information — is encrypted using current-generation cryptographic algorithms.
• Layered Access Control: Only 328i staff who require access to specific data in order to carry out their duties are permitted to do so, and this access is audited on a regular basis. Our role-based access control (RBAC) system ensures no individual has broader access than their role requires.
• Real-Time Threat Monitoring: 328i's security team monitors all platform activity around the clock to detect suspicious patterns — including unusual login attempts, irregular transactions, or unauthorised access.
• Regular Penetration Testing: Third-party cybersecurity specialists conduct regular penetration testing on 328i's infrastructure to identify and address vulnerabilities before they can be exploited.
• Incident Response Plan: 328i has a tested incident response procedure in place to ensure we can act swiftly and effectively in the event of any security threat, minimising the impact on members' data.

While we take every reasonable precaution, no system is 100% immune to cyber threats. We therefore also encourage members to help safeguard their own accounts by using a strong, unique password, enabling two-factor authentication in their 328i account settings, and never sharing login credentials with anyone.

5 Data Retention Period

328i retains members' personal data only for as long as necessary for the purposes stated in this policy, or as required by applicable Malaysian law. The following are general guidelines on the data retention periods we observe:

• Active Account Data: Personal data of members with active accounts is retained for as long as the account remains active and for the required period following account closure.
• Financial Transaction Records: Deposit, withdrawal, and wagering records are retained for a minimum of 7 years in accordance with applicable Malaysian financial and tax legislation.
• KYC Records: Identity verification documents are retained for a minimum of 5 years following account closure or the end of the business relationship, in accordance with Malaysia's Anti-Money Laundering Act.
• Support Communication Logs: Records of interactions with the 328i customer support team are retained for 2 years for quality control purposes and historical reference when required.
• Marketing Data: Data used for marketing communications is retained until you withdraw consent or request deletion, whichever comes first.
• Technical Log Data: System logs and technical activity data are retained for a maximum of 12 months for security and technical troubleshooting purposes.

When data is no longer needed and the mandatory retention period has expired, 328i will securely delete or anonymise that data using industry-approved procedures — ensuring that deleted data cannot be recovered or misused.

6 Use of Cookies & Tracking Technologies

328i uses cookies and similar technologies to enhance the user experience, maintain session security, and understand how members interact with our platform. The following are the types of cookies we use:

You can manage your cookie settings through your web browser or via the privacy settings panel within your 328i account. Please note that disabling mandatory cookies may affect the functionality of the 328i platform and could prevent you from logging in or using certain features effectively.

7 Your Rights Regarding Personal Data

As a 328i member and as an individual protected under Malaysian data protection law, you have clearly defined rights regarding your personal data. 328i fully respects and supports the exercise of these rights:

To exercise any of the above rights, you may contact 328i by email at [email protected] with the subject line "Data Privacy Rights Request". Please specify the type of right you wish to exercise and provide sufficient identifying information for us to verify your identity before processing your request. 328i is committed to responding to all privacy rights requests within 30 business days of receipt.

8 International Data Transfers

In operating the 328i platform, there may be situations where members' personal data is transferred to or processed in another country — for example, when using cloud infrastructure or international technical service providers. 328i ensures that all such data transfers are carried out in compliance with Malaysian legal requirements and with adequate safeguards in place.

Measures taken by 328i to protect data during international transfers include:

• Ensuring that data recipient partners maintain data protection standards equivalent to or exceeding the requirements of Malaysian law
• Signing Data Processing Agreements that are binding on all third parties involved
• Using approved standard contractual clauses that mandate appropriate data protection standards
• Selecting infrastructure providers that hold internationally recognised security certifications such as ISO 27001

Core 328i member data — such as account information and financial transaction history — is stored on servers that meet Malaysia's data protection requirements. Transaction data transferred to game provider systems is handled securely and uses only the minimum data necessary to operate the relevant game.

9 Children's Privacy & Protection of Young Persons

328i's services are strictly for individuals aged 18 and above. 328i does not knowingly collect or process personal data from individuals under the age of 18. Should we discover that data belonging to someone under 18 has been collected inadvertently, we will promptly take steps to delete that data and close the relevant account.

Parents and guardians who believe their child or dependent may have registered an account on 328i using false information about their age are requested to contact us immediately at [email protected]. We will investigate and take appropriate action promptly, including deleting all related data and refunding any funds that may have been deposited.

328i applies age verification procedures during registration and throughout the KYC process to minimise the risk of underage sign-ups. However, we acknowledge that no system is perfect and rely on the cooperation of parents, guardians, and the wider community to report any suspicious cases to us.

10 Privacy Policy Updates

328i may update this Privacy Policy from time to time to reflect changes in how we handle data, changes in Malaysian privacy law, or changes in the technologies we use. Each new version of the Privacy Policy will carry a clear effective date at the top of this document.

When we make material changes to this Privacy Policy — meaning changes that significantly affect how we use or share your personal data — we will notify you through:

• Notification emails sent to the email address registered to your account
• In-platform 328i notifications displayed upon your next login
• A direct link to the new version of the Privacy Policy, along with a summary of the key changes

If you disagree with material changes to the Privacy Policy, you have the right to close your 328i account and request deletion of your personal data (subject to mandatory legal data retention requirements). Continued use of the 328i platform after the updated Privacy Policy's effective date will be considered acceptance of those changes.

11 How to Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how 328i handles your personal data, we strongly encourage you to get in touch with us. The 328i privacy team is ready to help you understand your rights and ensure your data is handled in accordance with your preferences.

We also welcome feedback on how we can improve our privacy practices. If you believe 328i is not handling your data in accordance with this Privacy Policy or applicable Malaysian data protection law, you have the right to lodge a complaint with the Department of Personal Data Protection, Ministry of Communications and Digital Malaysia. However, we encourage you to contact us first so we can resolve any issues directly and promptly.