Privacy Policy

Scrplay8 ("we", "us", "our", "the Platform") operates the online casino and sports betting platform accessible at https://scrplay8.cam. We recognise that when you create an Account and use our services, you are entrusting us with your personal information. We take that responsibility seriously.

This Privacy Policy ("Policy") sets out in plain terms how Scrplay8 collects, processes, stores, shares, and protects personal data provided by Members and visitors to the Platform. It also describes your rights as a data subject and explains how to exercise them.

This Policy applies to all personal data processed by Scrplay8 in connection with the Platform, including data collected during the registration process, identity verification (KYC), deposit and withdrawal transactions, gameplay activity, and communications with our support team.

This Policy should be read alongside our Terms & Conditions, which govern the contractual relationship between Scrplay8 and its Members.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

Scrplay8 collects only the personal data that is necessary to provide the Platform's services, comply with regulatory obligations, and maintain a safe and secure environment for all Members. The categories of personal data we collect are set out below.

Scrplay8 collects personal data through the following channels:

• Direct Collection: Information you provide when creating your Account, completing KYC verification, submitting a deposit or withdrawal request, or contacting our support team.
• Automated Collection: Technical data (IP address, device identifiers, browser metadata, session cookies) collected automatically when you access the Platform.
• Transaction Data: Financial information transmitted by your chosen payment provider (Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay) when processing deposits and withdrawals.
• Third-Party Sources: Identity verification data received from licensed KYC verification service providers during the account verification process.
• Gameplay Data: Betting and gaming activity data generated automatically by the Platform's game servers and sportsbook systems during active sessions.
• Communications: Data you provide voluntarily when you correspond with us via live chat or email at [email protected].

Scrplay8 processes your personal data for the following specific purposes. We do not process personal data for any purpose incompatible with those listed below without first obtaining your explicit consent.

• Account Creation and Management: Processing identity and contact data to establish, maintain, and administer your Scrplay8 Account, including enforcing the 21+ age requirement at registration.
• Identity Verification (KYC): Processing identity documents, proof of address, and selfie photographs to verify your identity in compliance with applicable anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• Payment Processing: Processing financial data to facilitate deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency channels, and to process withdrawal requests to Member-nominated accounts.
• Service Delivery: Processing gameplay and account activity data to provide the sports betting, live casino, slot, and e-sports services offered on the Platform.
• Regulatory Compliance: Processing identity, financial, and activity data to satisfy obligations under applicable gaming licence conditions, AML/CTF legislation, and reporting requirements to regulatory authorities.
• Fraud Prevention and Security: Processing technical and activity data to detect, investigate, and prevent fraudulent transactions, unauthorised account access, collusion, and other platform abuse.
• Responsible Gambling: Processing gameplay and activity data to monitor for indicators of problem gambling behaviour and to administer responsible gambling tools including deposit limits, session timers, and self-exclusion requests.
• Customer Support: Processing contact and communication data to respond to Member enquiries, resolve disputes, and maintain a record of support interactions.
• Marketing Communications: Where you have provided explicit consent, processing contact data to send promotional communications about Scrplay8's offers, bonuses, and updates. You may withdraw consent at any time.
• Platform Improvement: Processing aggregated, anonymised technical and activity data to analyse Platform performance, user experience, and feature usage patterns.

Scrplay8 processes personal data only where a valid legal basis exists. The primary legal bases upon which we rely are:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a Member, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including gaming licence conditions, AML/CTF obligations, and tax reporting requirements.
• Legitimate Interests: Processing carried out in pursuit of Scrplay8's legitimate business interests — including fraud prevention, platform security, and service improvement — where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in the context of marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Scrplay8 does not sell, rent, or trade your personal data to third-party marketers under any circumstances. We share personal data only in the following limited and controlled circumstances:

• Payment Service Providers: Financial data is shared with licensed payment processors (including FPX gateway operators, Touch 'n Go eWallet, Boost, GrabPay, and relevant Malaysian banking institutions) solely for the purpose of processing your transactions.
• KYC and Identity Verification Partners: Identity documents and verification data are shared with licensed KYC service providers for the purpose of fulfilling our identity verification obligations.
• Game Software Providers: Limited activity data (such as bet amounts and game session references) is shared with third-party game providers to facilitate game delivery and dispute resolution. These providers process data solely as data processors under contractual data processing agreements.
• Regulatory and Law Enforcement Authorities: We may disclose personal data to gaming regulators, tax authorities, financial intelligence units, or law enforcement agencies where we are legally required to do so, or where disclosure is necessary to prevent or investigate fraud, money laundering, or other serious criminal activity.
• Professional Advisers: Legal, financial, and compliance advisers engaged by Scrplay8 may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.
• Corporate Transactions: In the event of a merger, acquisition, or sale of Scrplay8 or its assets, personal data may be transferred to the acquirer, subject to equivalent data protection commitments.

All third-party processors engaged by Scrplay8 are required to process personal data only in accordance with Scrplay8's documented instructions and applicable data protection law. We maintain written data processing agreements with all processors.

Scrplay8 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations.

• Active Account Data: Personal data associated with an active Account is retained for the duration of the Account's existence plus a minimum post-closure retention period of five (5) years, in compliance with AML/CTF record-keeping requirements under applicable gaming regulations.
• KYC Verification Documents: Identity and address verification documents are retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later.
• Transaction Records: Financial transaction records, including deposit and withdrawal histories, are retained for a minimum of seven (7) years to satisfy accounting, AML, and regulatory audit requirements.
• Marketing Data: Contact data processed for marketing purposes is retained until you withdraw consent or request erasure, subject to any overriding legal retention obligation.
• Support Communications: Customer support records are retained for a minimum of three (3) years from the date of the final interaction.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

Scrplay8 implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the Scrplay8 Platform is encrypted using industry-standard SSL/TLS protocols. The HTTPS connection is enforced across all pages of the Platform.
• Access Controls: Access to systems containing personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Data Encryption at Rest: Sensitive personal data — including KYC documents, financial records, and authentication credentials — is encrypted at rest using AES-256 encryption.
• Intrusion Detection and Monitoring: The Platform's infrastructure is monitored 24/7 for suspicious activity, unauthorised access attempts, and potential data breaches.
• Regular Security Audits: Scrplay8 commissions regular independent security audits and penetration tests to identify and remediate vulnerabilities in the Platform's systems.
• Incident Response: In the event of a data security incident, Scrplay8 maintains a documented incident response procedure that includes notification to affected Data Subjects and relevant regulatory authorities within timeframes required by applicable law.

Whilst Scrplay8 takes all reasonable precautions to protect your personal data, no internet-based system is completely immune to security risk. Members are responsible for maintaining the confidentiality of their Account credentials and for ensuring that their personal devices are adequately secured.

The Scrplay8 Platform uses cookies and similar tracking technologies to support Platform functionality, maintain login sessions, and collect analytical data about how the Platform is used. By continuing to use the Platform, you consent to our use of cookies as described in this section.

You may control cookie settings through your browser preferences. Disabling essential cookies will impair Platform functionality, including the ability to maintain a logged-in session. Analytical cookies may be disabled without affecting core Platform use.

Subject to applicable data protection law — including the Malaysian Personal Data Protection Act 2010 (PDPA) — you have the following rights in respect of your personal data held by Scrplay8. To exercise any of these rights, please submit a written request to [email protected].

Scrplay8 will respond to data subject requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension within the initial 30-day period. We will not charge a fee for reasonable requests; however, we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

The Scrplay8 Platform is strictly intended for persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Our registration process incorporates age verification controls, and all Accounts are subject to KYC verification that confirms the Member's date of birth against documentary evidence.

If Scrplay8 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant Account, delete the associated personal data, and return any deposited funds to the source payment method.

If you are a parent or guardian and believe that your minor child has created an Account on the Scrplay8 Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

Scrplay8 may transfer personal data to third-party processors and service providers located outside Malaysia, including in jurisdictions where data protection laws may differ from those applicable in Malaysia. Such transfers occur in connection with payment processing, KYC verification, game software provision, and infrastructure hosting.

Where personal data is transferred outside Malaysia, Scrplay8 ensures that appropriate safeguards are in place to protect the data, including:

• Transferring to jurisdictions that have been assessed as providing an adequate level of data protection;
• Implementing standard contractual clauses approved by relevant data protection authorities;
• Ensuring that receiving parties are bound by contractual data processing obligations equivalent to those applicable in Malaysia under the PDPA.

For further information about the specific safeguards applicable to any international transfer of your personal data, please contact us at [email protected].

Scrplay8 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform features, or our data processing practices. The revised Policy will be published on this page with an updated "Last Reviewed" date.

Where an amendment is material — meaning it could significantly affect your rights or the manner in which we process your personal data — Scrplay8 will endeavour to notify you via email to your registered address at least 14 calendar days prior to the amendment taking effect. For minor or administrative amendments, the updated Policy will take effect upon publication.

Your continued use of the Scrplay8 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised Policy, please contact us to close your Account before the effective date.

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact Scrplay8's support team using the details below. We are committed to resolving privacy-related enquiries promptly and transparently.