Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how JM8 ("JM8", "we", "us", "our"), the operator of the online gambling platform accessible at https://jm8.cam (the "Platform"), collects, uses, stores, shares, and protects the personal data of individuals who access or use our services ("Player", "User", "you").

JM8 takes its obligations under applicable data protection legislation seriously. We process personal data lawfully, fairly, and transparently. We collect data for specified, explicit, and legitimate purposes and do not further process it in a manner incompatible with those purposes. We take reasonable steps to ensure that personal data is accurate, kept up to date, and retained only for as long as necessary.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which are incorporated herein by reference. By registering an account on JM8 and using our Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Data Controller

JM8 is the data controller responsible for personal data collected through the Platform. As data controller, JM8 determines the purposes and means of processing your personal data in connection with the provision of online casino and sports betting services to players across Malaysia and other permitted jurisdictions.

Where JM8 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, and game software suppliers — those parties act as data processors under written agreements that bind them to process personal data only on JM8's documented instructions and in accordance with applicable data protection law.

3. Definitions

The following definitions apply throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, email address, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Subject" — the identified or identifiable natural person whose personal data is being processed. In the context of JM8, this refers primarily to registered Players.
• "Data Processor" — a natural or legal person that processes personal data on behalf of JM8 as data controller.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "Sensitive Data" — a category of personal data warranting heightened protection, including data relating to racial or ethnic origin, health, financial details, or identity documents.
• "Cookie" — a small text file placed on your device by the Platform, used to store session information, preferences, and analytics data.

4. Data We Collect

JM8 collects personal data through the following channels and in the following categories:

4.1 — Data You Provide Directly

• Full legal name and date of birth;
• Email address and phone number;
• Residential address;
• Username and encrypted account password;
• Identity documents submitted for KYC verification (e.g. Malaysian MyKad, passport);
• Payment method details (e.g. bank account number, e-wallet account identifiers for Touch 'n Go eWallet, Boost, GrabPay);
• Communications you send to our support team via live chat or email.

4.2 — Data Collected Automatically

• IP address and approximate geolocation;
• Device type, operating system, and browser version;
• Session timestamps, pages visited, and clickstream data;
• Game activity logs including bets placed, results, and session durations;
• Deposit and withdrawal transaction records;
• Cookie and tracking technology data (see Section 11).

4.3 — Data from Third Parties

• Identity and age verification results from third-party KYC providers;
• Payment transaction status and fraud screening results from payment processors including FPX, DuitNow, and e-wallet operators;
• Anti-money laundering (AML) screening results from third-party compliance databases.

5. How We Use Your Data

JM8 processes your personal data for the following specific purposes:

6. Legal Basis for Processing

JM8 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: processing is necessary to perform the contract between JM8 and the Player — namely, to operate your account, process payments, and deliver the services described in our Terms & Conditions;
• Legal obligation: processing is necessary for JM8 to comply with applicable legal requirements, including anti-money laundering regulations, age verification requirements, and record-keeping obligations imposed by our regulators;
• Legitimate interests: processing is necessary for JM8's legitimate interests in fraud prevention, platform security, responsible gambling monitoring, and business analytics — provided those interests are not overridden by your fundamental rights;
• Consent: where JM8 relies on consent as a legal basis — primarily for direct marketing communications — you may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

JM8 does not sell your personal data to third parties. We may share your personal data with the following categories of recipient, strictly for the purposes described in this Policy:

• Payment processors: Malaysian payment providers including FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong Connect), DuitNow operators, and e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay), solely to process your deposits and withdrawals;
• KYC and identity verification providers: third-party services engaged to verify the authenticity of identity documents and confirm age eligibility (21+);
• AML and fraud screening services: third-party compliance platforms used to screen transactions against sanctions lists and fraud databases;
• Game software providers: certified game developers whose software is integrated into the JM8 platform, who may receive anonymised session data required for game delivery and RNG certification;
• IT infrastructure and hosting providers: cloud and data centre operators providing the technical infrastructure on which the JM8 Platform operates, bound by contractual data processing agreements;
• Regulatory and law enforcement authorities: where JM8 is required by applicable law, court order, or lawful regulatory instruction to disclose personal data to competent authorities;
• Professional advisors: lawyers, auditors, and accountants acting for JM8 in connection with legitimate legal, compliance, or financial matters, under confidentiality obligations.

In all cases where personal data is shared with third-party data processors, JM8 maintains written data processing agreements requiring those parties to process data only on JM8's instructions, implement appropriate technical and organisational security measures, and not further sub-process data without JM8's prior written approval.

8. International Data Transfers

Some of JM8's service providers and game platform partners operate from jurisdictions outside Malaysia. Where personal data is transferred to a third country, JM8 takes appropriate safeguards to ensure an adequate level of data protection, including:

• Transfers to countries recognised as providing an adequate level of data protection by applicable data protection authorities;
• Implementation of standard contractual clauses or equivalent mechanisms approved under applicable data protection law;
• Transfers subject to binding corporate rules where the recipient is part of the same corporate group.

You may request further information about the specific safeguards in place for international transfers by contacting our data protection contact at the address listed in Section 15.

9. Data Retention

JM8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where data is required to be retained for longer periods by a specific legal obligation, that obligation takes precedence.

10. Security Measures

JM8 implements a range of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Key measures include:

• Encryption in transit: all data transmitted between your browser or app and JM8 servers is encrypted using TLS 1.2 or higher with 256-bit SSL certificates;
• Encryption at rest: sensitive personal data stored in JM8 databases is encrypted at rest using industry-standard algorithms;
• Password security: account passwords are stored as salted hashes — JM8 never stores passwords in plain text and cannot retrieve your password;
• Two-factor authentication (2FA): optional 2FA is available for all Player accounts and is strongly recommended;
• Access controls: access to personal data within JM8 is restricted on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations;
• Regular security audits: JM8's platform infrastructure undergoes periodic security assessments and penetration testing;
• Incident response: JM8 maintains a data breach response procedure. In the event of a breach likely to result in a high risk to your rights, we will notify affected individuals without undue delay.

Despite these measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorised access to your JM8 account, contact our support team immediately via live chat.

11. Cookies & Tracking Technologies

JM8 uses cookies and similar technologies (including local storage and session storage) to operate and improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: essential to platform functionality, including session authentication, security tokens, and load balancing. These cannot be disabled without affecting core functionality;
• Functional cookies: remember your preferences such as language settings, display options, and recently viewed games to provide a personalised experience;
• Analytical cookies: collect anonymised data about how you navigate the Platform — pages visited, session duration, error events — to help us improve performance and user experience;
• Session replay cookies: may record anonymised interaction patterns (mouse movement, clicks) to identify usability issues. No personally identifiable information is captured in session replays.

JM8 does not use third-party advertising or behavioural tracking cookies that share your data with external advertising networks. You can manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use core platform features.

12. Your Rights

Subject to applicable law and certain exceptions, you have the following rights in relation to your personal data held by JM8. To exercise any of these rights, contact our data protection team as described in Section 15:

JM8 will respond to all data rights requests within 30 calendar days of receipt of a verified request. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason within the initial 30-day period.

We may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to an unauthorised third party. Where identity verification is required, the 30-day response period begins from the date your identity is confirmed.

13. Minors & Age Policy

The JM8 Platform is strictly restricted to individuals aged 21 years and above. JM8 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the account registration and KYC process.

If JM8 becomes aware that personal data has been collected from a person under 21, the relevant account will be suspended immediately, all associated data will be deleted in accordance with our retention procedures, and any funds held in the account will be returned to the verified payment source where technically feasible.

If you are a parent or guardian and believe your child may have registered an account on JM8, please contact our support team immediately via live chat or email at [email protected]. We will investigate and act promptly.

14. Policy Amendments

JM8 reviews this Privacy Policy periodically and reserves the right to update it to reflect changes in applicable law, our data processing practices, or the services we offer. Material changes will be communicated to registered Players via a prominent notice on the Platform or by email to the address registered on your Account, at least 14 days prior to the changes taking effect.

The current version of this Policy is always accessible at https://jm8.cam/privacy-policy and is identified by the effective date at the top of this document. Your continued use of the JM8 Platform following the effective date of any amendment constitutes acceptance of the updated Policy.

If you do not agree with material changes to this Policy, you have the right to close your Account in accordance with the process set out in our Terms & Conditions. Closing your account will not affect the lawfulness of any prior processing carried out under previous versions of this Policy.

15. Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or JM8's handling of your personal data, please contact our data protection team through the following channels:

JM8 is committed to resolving privacy concerns directly and promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. JM8 will cooperate fully with any such regulatory inquiry.

When submitting a data rights request, please include your registered username and a clear description of your request. We may need to verify your identity before processing your request. Full details of the data rights process are set out in Section 12 of this Policy.