CM8Play Privacy Policy

1 Introduction

This Privacy Policy ("Policy") issued by CM8Play ("we", "us", "our", "the Company", "the Platform") and applies to all personal data collected, processed, and stored in connection with your use of the CM8Play online gaming platform, accessible at https://cm8play.cam, including any associated mobile applications or platforms (collectively, "the Platform").

We are committed to protecting the privacy and security of your personal information. This Policy is intended to give you a clear, transparent account of what personal data we collect, the purposes for which we use it, the legal basis on which we process it, the circumstances under which we may share it, and the rights you have in relation to your data.

This Policy should be read alongside our Terms & Conditions, which govern the overall relationship between CM8Play and registered players. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including name, email address, date of birth, financial data, device identifiers, and betting history.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, and deletion.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. CM8Play acts as the Data Controller in respect of player personal data.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, under a contractual data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "Sensitive Personal Data" — a subset of personal data attracting heightened protection, including financial information, health data, and government-issued identification details.
• "Retention Period" — the period for which personal data is stored by CM8Play before it is deleted or anonymised.
• "Third Party" — any natural or legal person, public authority, agency, or body other than the data subject, CM8Play, and persons who are authorised to process personal data under the direct authority of CM8Play.

3 Personal Data We Collect

CM8Play collects personal data through the following means: data you provide directly, data collected automatically through your use of the Platform, and data received from third-party sources in limited circumstances.

3.1 Data You Provide Directly

• Registration data: full legal name, date of birth, email address, mobile number, and country of residence.
• Identity verification (KYC) data: government-issued photo identification (Malaysian MyKad, passport), proof of address, and payment method ownership documentation.
• Payment data: bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), FPX banking credentials (processed via third-party payment gateways; CM8Play does not store full banking passwords), and transaction history.
• Communications data: content of live chat sessions, emails sent to support, and any feedback or complaints submitted to CM8Play.
• Responsible gambling data: self-exclusion requests, deposit limit settings, and session limit preferences you configure through Account settings.

3.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage data: pages visited, time spent on the Platform, game sessions played, bets placed, deposit and withdrawal actions, and navigation paths.
• Cookie and tracking data: session cookies, preference cookies, analytics identifiers, and marketing attribution data. See Section 7 for full cookie details.
• Geolocation data: approximate location inferred from your IP address, used to verify jurisdictional eligibility and enforce geographic restrictions.

3.3 Data from Third Parties

In limited circumstances, CM8Play may receive personal data from third parties, including: identity verification service providers (for KYC processing), payment processors and banking partners, fraud prevention agencies, and our licensing regulatory authority. Such data is handled in accordance with this Policy and applicable data protection requirements.

4 How We Use Your Personal Data

The table below summarises the primary purposes for which CM8Play processes your personal data:

5 Lawful Basis for Processing

CM8Play processes personal data on the following lawful grounds:

• Contractual necessity: Processing required to enter into or perform the contract with you — i.e., operating your Account, processing bets, and handling deposits and withdrawals.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering legislation, age verification requirements, and licensing conditions imposed by our regulatory authority.
• Legitimate interests: Processing carried out to pursue our legitimate business interests, including fraud prevention, platform security, and improving the quality of our services — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we process your data for optional purposes such as direct marketing communications or non-essential cookies, we will obtain your prior consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

CM8Play does not sell, rent, or trade your personal data to third parties. We share personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

6.1 Service Providers and Data Processors

We engage third-party service providers to assist in operating the Platform. These providers act as Data Processors under contractual data processing agreements that require them to process personal data only on our instructions and to implement appropriate security measures. Categories of processors include: payment gateway and banking partners (including providers of Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go, Boost, GrabPay, DuitNow, and FPX integrations), identity verification and KYC providers, fraud detection and cybersecurity services, cloud hosting and data storage providers, and customer support platform operators.

6.2 Regulatory and Legal Disclosure

CM8Play may disclose personal data to competent regulatory authorities, law enforcement agencies, courts, or other public bodies where required to do so by applicable law, court order, or as part of our licensing obligations. We will only disclose the minimum information necessary to comply with such requirements.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of CM8Play's business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected users before personal data is transferred and becomes subject to a different privacy policy.

7 Cookies & Tracking Technologies

CM8Play uses cookies and similar tracking technologies (including web beacons, pixels, and local storage) on the Platform. Cookies are small text files placed on your device that help us operate the Platform efficiently, remember your preferences, and understand how you use our services.

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that blocking strictly necessary cookies may impair the functionality of the Platform. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

8 Data Retention

CM8Play retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Account and registration data: Retained for the duration of the active account relationship, plus a minimum of 5 years following account closure, in compliance with anti-money laundering (AML) record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of submission, consistent with AML and licensing obligations.
• Transaction and financial records: Retained for a minimum of 7 years to comply with financial record-keeping legislation.
• Customer communications: Live chat logs and support email correspondence retained for 2 years from the date of the interaction.
• Technical and usage logs: Retained for 12 months for security monitoring and fraud prevention purposes.
• Marketing consent records: Retained for the duration of the consent plus 3 years as evidence of compliance.

At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

9 Data Security

CM8Play implements a comprehensive suite of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest, including payment credentials and identity documents.
• Strict access controls: only authorised personnel with a legitimate business need can access player personal data, governed by role-based access control (RBAC) policies.
• Two-factor authentication (2FA) available for player accounts and mandatory for all internal administrative access.
• Regular third-party penetration testing and security audits of the Platform infrastructure.
• Segregated player funds: your deposited funds are held separately from CM8Play's operational capital.
• Incident response procedures: in the event of a personal data breach, CM8Play will notify affected players and relevant regulatory authorities within the timeframes required by applicable law.

10 Your Data Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by CM8Play. To exercise any of these rights, please contact our support team via live chat or at [email protected] (plain text — not a clickable link). We will respond to verified requests within 30 calendar days.

• Right of access: You may request a copy of the personal data CM8Play holds about you, along with information about how it is processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction of processing: You may request that we restrict processing of your data in certain circumstances, such as while the accuracy of your data is being contested.
• Right to data portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing your data for that purpose immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Please note that certain rights may be limited or subject to conditions under applicable law. For example, we may be required to retain certain data to comply with AML legislation even if you request erasure. We will explain any applicable limitations in our response to your request.

11 Minors & Age Verification Policy

CM8Play strictly prohibits the use of the Platform by individuals under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory step in our KYC process, and all Accounts are subject to documentary age verification before withdrawal is permitted.

If CM8Play becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and permanently close the associated Account. If you believe that a minor has registered an Account on CM8Play, please contact us immediately via live chat or at [email protected].

12 International Data Transfers

CM8Play operates internationally, and your personal data may be transferred to and processed in countries outside Malaysia, including countries where CM8Play's servers, data centres, or third-party service providers are located. Not all such countries may provide the same level of data protection as Malaysia under its Personal Data Protection Act 2010.

Where personal data is transferred internationally, CM8Play takes steps to ensure that such transfers are subject to appropriate safeguards, which may include: contractual clauses that impose data protection obligations equivalent to those applicable in the originating jurisdiction; data processing agreements with certified third-party processors; and transfers only to jurisdictions with adequate data protection laws as recognised by applicable regulatory guidance.

13 Third-Party References

This Privacy Policy applies solely to the CM8Play Platform. The Platform may contain references to third-party brands, payment providers (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go, Boost, GrabPay, DuitNow, and FPX), and sports organisations (including Liga Super Malaysia and the English Premier League) for descriptive and operational purposes only.

CM8Play is not responsible for the privacy practices of any third-party organisation. References to third-party brands on this Platform do not imply affiliation, endorsement, or sponsorship. Please review the privacy policies of any third-party services you interact with independently.

14 Amendments to This Policy

CM8Play reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes will be communicated to registered players via email notification or a prominent notice on the Platform at least 7 days before the revised policy takes effect, except where immediate changes are required by law or for security reasons.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of and agreement to the revised Privacy Policy. We recommend that you review this Policy periodically. The "Last Updated" date at the top of this page indicates when the most recent changes were made.

15 Contact Us & Data Enquiries

If you have questions, concerns, or requests relating to this Privacy Policy or to the personal data CM8Play holds about you, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the CM8Play Platform — the fastest way to reach us.
• Email: [email protected] — for data rights requests, please include "Privacy Request" in the subject line and provide your registered Account email address to assist verification.
• Support Hours: 24 hours a day, 7 days a week, Malaysia Time (MYT, UTC+8).

We aim to acknowledge all written data rights requests within 5 business days and to provide a substantive response within 30 calendar days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.