Privacy Policy kiss8 — Protection of Your Personal Data

1. Introduction and Scope of This Policy

Kiss8 ("Company", "We") is committed to protecting and respecting the privacy of all users on our platform. This Privacy Policy explains how we collect, use, store, share, and safeguard your personal information when you use the kiss8 website, our mobile app, or any related services.

This policy is prepared in accordance with the provisions of Malaysia's Personal Data Protection Act 2010 (PDPA) and aims to give you a clear and comprehensive understanding of how your personal data is managed by us. We encourage you to read this document carefully before using our platform.

If there are any material changes to this Privacy Policy, we will notify you via your registered email or a prominent notice displayed on our platform before the changes take effect.

2. What Personal Data We Collect

We collect various types of personal information depending on your interactions with the kiss8 platform. Generally, the data we collect can be grouped into the following categories:

Data You Provide Directly:

• Account registration information: full name, date of birth, email address, mobile number and your chosen username.
• Address information: residential address, city, state and postcode for identity verification purposes.
• Identity verification documents (KYC): copies of your identity card, passport, or other travel documents requested during the verification process.
• Financial information: bank account details or payment methods registered for deposit and withdrawal purposes.
• Support team communications: records of Live Chat conversations, emails and any feedback you send us.

Data Collected Automatically:

• Technical data: IP address, device type, operating system, browser version, and screen resolution.
• Usage data: pages visited, time spent on the platform, games played, and other behavioural patterns that help us improve your experience.
• Cookie and tracking data: information collected through cookies, web pixels, and similar tracking technologies for analytics and platform improvement purposes.
• Transaction data: a full history of deposits, withdrawals, wagering, and wins that have occurred on your account.

3. How We Use Your Data

Every piece of information we collect is used for lawful and transparent purposes. We do not use your data for purposes other than those stated below without obtaining your additional consent:

4. Data Sharing with Third Parties

Kiss8 does not sell or rent your personal data to any third party. However, we share certain information with selected third parties only in the following circumstances:

• Service Providers: Technical and operational partners who help us run the platform, process payments and provide customer support. All service providers are bound by strict confidentiality agreements and may only use your data for specified purposes.
• Regulatory Authority: We will disclose your data to regulatory bodies, law enforcement agencies, or courts when required to do so by applicable law.
• Fraud Prevention: We share certain information with industry partners and regulatory bodies to detect and prevent fraud, money laundering, and other financial crimes.
• Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred to the receiving entity as part of the business transaction. You will be notified in advance should this occur.

5. Data Retention Period

We retain your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable law. In general, our retention guidelines are as follows:

• Active account data is retained for as long as your account remains active and for a defined period following account closure.
• Financial transaction records are retained for a minimum of seven years to meet financial reporting and tax requirements.
• Customer support communication records are retained for three years from the date of the last interaction.
• Analytics and usage data is retained in aggregated form without personal identifiers after a period of 24 months.

When your data is no longer needed, we will delete or anonymise it securely and irreversibly using industry-recognised data destruction methods.

6. Your Rights as a Data Subject

As a kiss8 user, you have the following rights regarding your personal data, and we are committed to making it easy for you to exercise them:

To exercise any of the above rights, please contact the kiss8 customer support team via 24/7 Live Chat or submit a written request to us. We will process your request within 30 business days of receipt.

7. Data Security and Protective Measures

We implement multiple layers of technical and organisational security to protect your personal data from unauthorised access, disclosure, alteration, or unintentional destruction:

• Data Encryption: All data transmitted between your device and kiss8 servers is protected by 256-bit SSL/TLS encryption. Sensitive data stored in our databases is also encrypted using industry-approved encryption algorithms.
• Access Controls: Our role-based access control (RBAC) system ensures that only staff with a legitimate business need can access your personal data. Every access is logged and actively monitored.
• Two-Factor Authentication: The kiss8 platform supports two-factor authentication (2FA) for an additional layer of security on your account.
• Regular Security Audits: We conduct regular penetration testing and security audits by independent third parties to identify and address any potential vulnerabilities.
• Incident Response Plan: We have clearly defined incident response procedures. In the event of a data breach affecting your rights, we will notify you within the timeframe required by applicable law.

8. Cross-Border Data Transfers

In the course of global operations, your personal data may be transferred to, stored in, or processed in countries other than Malaysia. When this occurs, we ensure such transfers are carried out with adequate safeguards, including through recognised standard data transfer agreements or by ensuring the recipient country maintains data protection standards equivalent to or higher than those of Malaysia.

9. Children's Privacy

Kiss8 services are intended solely for individuals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If we discover that we have inadvertently collected data from a minor, we will take immediate steps to delete that information and close the relevant account.

10. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, technological requirements, or legal obligations. When we make material changes, we will provide clear notice through our platform or via email to the address registered on your account.

The "Last Updated" date at the top of this document will always reflect the most recent revision of this Privacy Policy. We encourage you to review this page periodically to stay informed about how we protect your information.

11. Contact Us About Privacy

If you have any questions, concerns, or complaints regarding how we manage your personal data, or if you wish to exercise any of your rights as a data subject, please contact our data protection team via:

• Live Chat: Available 24 hours a day, 7 days a week via the kiss8 platform.
• Email: [email protected] — We aim to respond to all privacy enquiries within 3 business days.

We take every privacy-related query and complaint very seriously and will make every effort to resolve any issue you experience in a fair and timely manner.