u388 Privacy Policy

1. Introduction

u388 is committed to protecting the privacy and security of all personal data entrusted to us by Users of the Platform. We take our data protection obligations seriously, not merely as a matter of regulatory compliance under our international gaming licence, but because we recognise that Users place genuine trust in us when they share their personal information. This Policy sets out, in plain and transparent terms, exactly what data we collect, why we collect it, how we use it, and what rights you have over it.

We do not sell, rent, or trade personal data to third parties for their marketing purposes. Personal data shared with u388 is used solely for the purposes described in this Policy, in connection with the delivery, improvement, and protection of the u388 Platform and its Users.

2. Data Controller

u388 acts as the data controller in respect of personal data collected through the Platform. As data controller, u388 determines the purposes and means of processing personal data. For all data protection enquiries, Users may contact us at [email protected]. We will respond to all privacy-related requests within 30 days of receipt.

3. Personal Data We Collect

u388 collects the following categories of personal data in connection with the operation of the Platform:

3.1 Identity & Contact Data

• Full legal name;
• Date of birth (used to verify compliance with the 21+ age requirement);
• Residential address, including postcode and country;
• Email address;
• Mobile phone number (where provided).

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (e.g., MyKad, passport, driving licence);
• Proof of address documentation (e.g., utility bill, bank statement issued within three months);
• Selfie or liveness check image where required under enhanced due diligence procedures.

3.3 Financial & Transaction Data

• Deposit and withdrawal amounts and dates;
• Payment method identifiers (e.g., partial account number, e-wallet identifier – full card or account numbers are not stored by u388);
• Transaction reference numbers;
• Account balance history.

3.4 Gaming & Betting Activity Data

• Wagers placed, games accessed, bet amounts, and outcomes;
• Session durations and login timestamps;
• Responsible gaming tool selections (deposit limits, self-exclusion requests, session reminders).

3.5 Technical & Usage Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser version;
• Pages visited, click paths, and interaction data collected via cookies and similar tracking technologies;
• Error logs and Platform performance data.

3.6 Communications Data

• Records of communications between you and u388 customer support, including live chat transcripts and support emails.

4. How We Collect Your Data

u388 collects personal data through the following mechanisms:

• Direct provision: Data you submit when registering an Account, completing KYC, making deposits or withdrawals, contacting support, or completing any form on the Platform;
• Automated collection: Data collected automatically when you access the Platform, including via cookies, web beacons, and server logs;
• Third-party sources: Identity verification data returned by third-party KYC service providers; fraud screening data from anti-fraud platforms; payment processing data from licensed payment service providers;
• Gaming platform providers: Aggregated bet and game activity data passed from licensed game studios integrated into the u388 Platform.

5. Purposes & Legal Basis for Processing

u388 processes personal data for the following purposes and on the following legal bases:

• Contract performance: Processing necessary to create and manage your Account, process deposits and withdrawals, and deliver gaming and betting services as agreed in the Terms & Conditions;
• Legal obligation: Processing required to comply with u388's obligations under its international gaming licence, including Know Your Customer (KYC) identity verification, anti-money laundering (AML) checks, age verification (21+), and transaction monitoring;
• Legitimate interests: Fraud detection and prevention; Platform security and integrity; improving user experience; responsible gaming monitoring; and internal analytics to optimise Platform performance;
• Consent: Marketing communications sent by email or other channels, where you have provided explicit consent. You may withdraw consent at any time by contacting [email protected].

6. Sharing Your Personal Data

u388 does not sell personal data. We share personal data only in the following circumstances and with the following categories of recipient:

• Licensed game providers and platform software suppliers, solely to the extent required to deliver the gaming services requested by you;
• Payment service providers (including processors of Touch n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency payment rails), solely for the purpose of processing your transactions;
• KYC and identity verification service providers, to enable verification of your identity and age in compliance with our licensing obligations;
• Fraud prevention and AML screening platforms, to detect and prevent fraudulent activity and financial crime;
• Regulatory and law enforcement authorities, where we are required to disclose data by law, court order, or in connection with our licensing obligations;
• Professional advisers (legal, audit, compliance), bound by confidentiality obligations, where required for legitimate business purposes.

All third-party recipients are required to implement appropriate technical and organisational security measures and to process personal data only for the specified purpose.

7. International Data Transfers

As a platform operating under an international gaming licence, u388 may transfer personal data to recipients located outside Malaysia. Where such transfers occur, u388 takes steps to ensure that appropriate safeguards are in place, including contractual protections equivalent to those required under applicable data protection frameworks. Users who wish to obtain further information about international transfer safeguards may contact us at [email protected].

8. Data Retention

u388 retains personal data for as long as necessary to fulfil the purposes set out in this Policy, including for the duration of your Account and for a minimum period of five years following Account closure, in compliance with our anti-money laundering and gaming licence obligations. Transaction records and KYC documentation may be retained for longer periods where required by applicable law or regulatory instruction. Data retained solely for analytics purposes is anonymised or pseudonymised as soon as is reasonably practicable.

9. Cookies & Tracking Technologies

The u388 Platform uses cookies and similar tracking technologies to operate core Platform functions, maintain your login session, remember your preferences, and collect anonymised usage data for Platform improvement. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session management and security tokens. These cannot be disabled.
• Functional cookies: Enable personalised features such as language preference and remembered display settings.
• Analytics cookies: Collect anonymised data about how the Platform is used to help us identify areas for improvement. No personal identifying information is included in analytics data.

You may manage non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform. u388 does not use advertising tracking cookies or share cookie data with third-party advertising networks.

10. Security Measures

u388 implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage for sensitive personal and financial data at rest;
• Access controls and role-based permissions limiting staff access to personal data on a strict need-to-know basis;
• Regular security audits and vulnerability assessments;
• Automated anomaly detection for suspicious login and transaction activity;
• Secure password hashing – u388 staff cannot access Account passwords in plain text.

In the event of a personal data breach that is likely to result in risk to Users, u388 will notify affected Users and relevant authorities in accordance with applicable obligations within the timeframes required by our licensing framework.

11. Your Data Rights

Subject to applicable law and our licensing obligations, u388 Account holders have the following rights in respect of their personal data:

• Right of access: You may request a copy of the personal data we hold about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal and licensing retention obligations;
• Right to restriction: You may request that we restrict processing of your data in certain circumstances, such as while a dispute is being resolved;
• Right to data portability: You may request a machine-readable copy of personal data you have provided to u388, where processing is based on consent or contract performance;
• Right to object: You may object to processing based on legitimate interests where you believe your rights and freedoms override those interests;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact us at [email protected]. We will respond within 30 days of receipt of a verifiable request. We may ask for proof of identity before processing requests to protect against unauthorised access to Account data.

12. Children & Minors

The u388 Platform is strictly restricted to persons aged 21 years or older. u388 does not knowingly collect or process personal data relating to persons under this age. Where u388 becomes aware that personal data has been collected from an individual under 21 years of age, such data will be deleted and the associated Account will be closed without delay. If you believe that a minor has accessed or registered on the Platform, please contact us immediately at [email protected].

13. Responsible Gaming & Data Processing

u388 uses gaming activity and transaction data as part of its responsible gaming programme. This includes analysing patterns of betting behaviour, deposit frequency, session durations, and responses to responsible gaming prompts to identify Users who may be at risk of problem gambling. Where such indicators are identified, u388 may proactively reach out to the relevant User with information about responsible gaming tools including deposit limits, session reminders, and self-exclusion options.

This processing is conducted on the basis of u388's legitimate interest in protecting its Users' welfare and in compliance with responsible gaming obligations under its international gaming licence. Users who have questions about responsible gaming data processing may contact our dedicated responsible gaming team at [email protected]. Further information is available on our Responsible Gaming page.

14. Changes to This Policy

u388 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our licensing obligations. Where changes are material, we will notify Account holders via their registered email address at least 14 days before the revised Policy takes effect. Continued use of the Platform following the effective date of the updated Policy constitutes acceptance of the revised terms. The "last updated" date at the top of this Policy indicates when the most recent revision was made.

15. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data by u388, please contact our data protection team:

Email: [email protected]
Support hours: 24 hours a day, 7 days a week (Malaysian Standard Time, GMT+8)

Please include your registered Account email address and a description of your request in all correspondence. We will acknowledge receipt of all privacy requests within 48 hours and provide a substantive response within 30 days.