Privacy Policy — e28asia

e28asia ("we", "us", "our", "the Company") operates the online gaming platform accessible at e28asia.cam (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who access or use our services, including registered account holders and website visitors.

This Privacy Policy ("Policy") describes how e28asia collects, processes, stores, discloses, and protects personal information in connection with the operation of the Platform. It applies to all users of the Platform regardless of location, including players accessing our services from Kuala Lumpur, Penang, Johor Bahru, Shah Alam, Petaling Jaya, and all other regions of Malaysia.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform. By accessing the Platform or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform immediately.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including name, contact details, financial information, device identifiers, and behavioural data collected through use of the Platform.
• "Processing" means any operation or set of operations performed on personal data, including collection, storage, use, disclosure, transmission, alteration, and deletion.
• "Data Controller" means e28asia, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party that processes personal data on behalf of e28asia pursuant to a formal data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data for a stated purpose.
• "KYC" means Know Your Customer — the identity verification process conducted in accordance with applicable anti-money laundering (AML) and regulatory requirements.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, preference storage, analytics, and fraud detection.
• "MYR" means Malaysian Ringgit, the primary transaction currency used on the Platform.

e28asia collects personal data through multiple channels in the ordinary course of operating the Platform. The categories of data we collect and the circumstances in which they are collected are set out below.

3.1 Data Provided Directly by You

When you register an account, complete KYC verification, contact our support team, or participate in a promotion, you may provide us with:

• Full legal name
• Date of birth (used to verify the 21+ age eligibility requirement)
• Residential address (including city, state, and postcode)
• Email address and mobile phone number
• Government-issued identification documents (Malaysian IC, passport, or driver's licence)
• Payment account details, including bank account numbers for Maybank, CIMB, Public Bank, Hong Leong, and e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX
• Source of funds declarations, where required for compliance purposes

3.2 Data Collected Automatically

When you access and use the Platform, certain data is collected automatically through technical means:

• IP address and approximate geolocation data
• Device type, operating system, and browser information
• Session data, login timestamps, and page navigation patterns
• Wagering history, game session data, deposit and withdrawal records
• Cookie identifiers and tracking pixel data (see Section 9)
• Communication logs where you contact our support team via live chat or email

e28asia uses your personal data for the following specific purposes, each of which is supported by a lawful basis as detailed in Section 5:

• Account Registration and Management: To create and maintain your e28asia account, verify your identity, and provide access to the Platform's services.
• Age and Identity Verification: To confirm that you meet the minimum age requirement of 21 years and that all registration information is accurate and complete.
• Payment Processing: To process deposits via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong, and to process withdrawal requests to your registered payment method.
• Regulatory Compliance and AML Obligations: To meet the identity verification, transaction monitoring, and record-keeping requirements imposed by the regulatory framework under which e28asia operates.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct described in our Terms & Conditions.
• Customer Support: To respond to your enquiries, resolve disputes, and improve the quality of our support services.
• Responsible Gambling: To monitor gameplay patterns that may indicate problem gambling behaviour and to give effect to deposit limit, loss limit, cooling-off, and self-exclusion requests.
• Service Improvement: To analyse Platform usage patterns and improve the functionality, design, and content of the e28asia service.
• Direct Marketing: Where you have provided consent or where we have a legitimate interest and you have not opted out, to send you information about promotions, bonuses, and new features relevant to your account activity. You may opt out of marketing communications at any time.
• Legal Compliance: To comply with applicable laws, court orders, and regulatory instructions, and to establish, exercise, or defend legal claims.

e28asia processes your personal data on the following legal bases, which are applied as appropriate to each specific processing activity:

• Contractual Necessity: Processing required to perform our contract with you, including account registration, payment processing, and provision of gaming services.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including AML obligations, KYC requirements, and gaming licence conditions.
• Legitimate Interests: Processing for purposes of fraud prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies — where you have provided clear, freely given consent and retain the right to withdraw that consent at any time without detriment.

e28asia does not sell, rent, or commercially transfer your personal data to third parties. We may share your data with the following categories of recipients strictly for the purposes described in this Policy:

6.1 Authorised Service Providers

We engage third-party data processors to provide services that support the operation of the Platform, including payment processing infrastructure (FPX, DuitNow, e-wallet providers), identity verification and KYC service providers, cloud hosting and infrastructure services, customer support platforms, and fraud detection systems. All such processors are bound by formal data processing agreements that prohibit the use of your data for any purpose beyond what is necessary to provide the contracted service.

6.2 Regulatory and Law Enforcement Authorities

We may disclose personal data to regulatory authorities, gaming commissions, financial intelligence units, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory instruction. Such disclosures are made only to the extent required by the applicable legal obligation and are not subject to prior notice to the data subject where prohibited by law.

6.3 Game Content Providers

Our game studios and content providers may receive limited technical data (such as session tokens and game result records) necessary to facilitate the delivery and proper function of their games on the Platform. No unnecessary personal data is shared with game providers beyond what is required for legitimate operational purposes.

6.4 Business Transfers

In the event that e28asia undergoes a merger, acquisition, restructuring, or sale of all or part of its business, personal data held by the Company may be transferred to the acquiring entity as part of that transaction. We will provide reasonable prior notice of any such transfer and ensure that the receiving entity provides equivalent data protection commitments.

As an internationally operated online gaming platform, e28asia may transfer personal data to servers or service providers located in jurisdictions outside Malaysia. Where such transfers occur, we take the following steps to ensure your data remains adequately protected:

• We only transfer data to countries or territories that provide an adequate level of data protection as assessed against international standards.
• Where an adequacy determination is not available, we implement appropriate safeguards such as standard contractual clauses, binding corporate rules, or equivalent approved transfer mechanisms.
• All third-party service providers receiving personal data from e28asia are contractually obligated to maintain data security standards no less stringent than those described in this Policy.

You have the right to obtain information about the specific safeguards applied to any international transfer of your personal data by submitting a request to our support team as described in Section 15.

e28asia retains personal data only for as long as necessary to fulfil the specific purposes for which it was collected, taking into account applicable regulatory, legal, and operational requirements. The general retention periods applicable to each category of data are set out in the table in Section 3.

Specifically:

• Account data and KYC documentation are retained for the duration of your account and for a minimum period of five (5) years following permanent account closure, in compliance with gaming regulatory requirements.
• Financial transaction records are retained for a minimum of seven (7) years from the date of the transaction, as required under standard AML record-keeping obligations applicable to licensed gaming operators.
• Marketing communication preferences are retained until you opt out or withdraw consent, after which we retain a minimal record of your opt-out solely to ensure the preference is honoured.
• Data collected for fraud prevention may be retained for up to five (5) years from the date of the relevant event or investigation, to support any future enforcement action.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is applied, the resulting data may be retained indefinitely for statistical and analytical purposes.

e28asia uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file placed on your device by the Platform's server when you visit the site. Cookies do not contain executable code and cannot directly access other data on your device.

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the Platform to function correctly. They enable session management, authentication, and basic security features. You cannot opt out of strictly necessary cookies without disabling core Platform functionality.
• Functional Cookies: These remember your preferences, such as language settings, account display options, and betting slip configurations, to provide a personalised and consistent experience across sessions.
• Analytics Cookies: These collect aggregated, anonymised data about how users interact with the Platform — including which pages are visited most frequently and how users navigate between sections. This data helps us improve the Platform's design and content.
• Fraud Prevention Cookies: These help detect and prevent fraudulent activity, multi-accounting, and bot-based interactions with the Platform.

9.2 Managing Cookies

You can control and manage cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored on your device. Please be aware that blocking certain cookies — particularly strictly necessary and functional cookies — may impair the performance or availability of certain Platform features.

For guidance on managing cookies in common browsers, please consult the help documentation for your specific browser application.

e28asia implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, destruction, or loss. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your device and e28asia servers is encrypted using Transport Layer Security (TLS) with a minimum of 256-bit AES encryption.
• Encryption at Rest: Personal data and financial records stored on our servers are encrypted using AES-256 at rest, ensuring that data remains protected even in the event of physical or logical server access.
• Access Controls: Access to personal data is restricted to authorised e28asia personnel whose roles specifically require such access. All access is logged and subject to regular audit review.
• Multi-Factor Authentication: Internal systems used to access personal data require multi-factor authentication for all authorised users.
• Penetration Testing and Security Audits: e28asia conducts regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a formal data breach incident response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities in accordance with applicable legal obligations and without undue delay.

Subject to applicable law and our legitimate regulatory obligations, you have the following rights in relation to the personal data we hold about you. These rights may be exercised by contacting our support team as described in Section 15:

We will respond to all valid rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further two months, in which case we will notify you of the extension and the reasons for it within the initial 30-day period. There is no charge for submitting a data subject rights request.

The e28asia Platform integrates services and content provided by third parties, including game studios, payment processors, and analytics providers. Each third-party service provider operates under its own privacy policy, and e28asia is not responsible for the data handling practices of third parties operating independently of our instructions.

Where a third party acts as a data processor on our behalf (i.e., processes your data solely to provide a contracted service to e28asia), that party is bound by a formal data processing agreement that restricts its use of your data to the specified service purpose. In contrast, where a third party acts as an independent data controller with respect to your personal data, you are encouraged to review that party's privacy policy directly.

The e28asia Platform does not contain links to third-party websites outside of our own domain network. Any reference to third-party payment brands (such as Maybank, CIMB, Touch 'n Go, or DuitNow) in our content is informational only and does not constitute a referral or endorsement of those entities' data practices.

The e28asia Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Where we have reason to believe that a registered account belongs to a person under the age of 21, that account will be immediately suspended, all personal data associated with it will be subject to our standard deletion procedures, and any deposits made will be returned via the original payment method.

If you are a parent or guardian and have reason to believe that a person under the age of 21 in your care has created an account on e28asia or provided us with personal data, please contact our support team immediately using the details in Section 15 so that we can take appropriate action without delay.

e28asia reserves the right to revise, update, or replace this Privacy Policy at any time. When we make changes, the updated Policy will be published on this page with a revised "Last Reviewed" date. Your continued use of the Platform after the publication of any amendment constitutes your acceptance of the revised Policy.

Where any amendment materially affects your rights or the manner in which we process your personal data, we will endeavour to notify you in advance via email to the address registered on your account. We recommend reviewing this page periodically to remain informed of our current data practices.

For historical versions of this Policy, or to understand what specific changes were made in any given revision, please contact our support team at the address in Section 15.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by e28asia, please contact our dedicated data privacy team using the details below. All communications should be made in English and include your registered account details for verification purposes.

If you are not satisfied with our handling of a data-related complaint, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. For users in Malaysia, the relevant authority is the Department of Personal Data Protection (JPDP), accessible through the official channels of the Malaysian Ministry of Digital.