Privacy Policy

1 Introduction

Rally918 ("we", "us", "our", "the Company") operates the online gaming platform accessible at https://rally918.cam and any associated subdomains or mobile interfaces (collectively, "the Platform"). We provide online casino games, sports betting, and related services to registered players in Malaysia and other permitted jurisdictions.

This Privacy Policy ("Policy") explains how Rally918 collects, uses, stores, shares, and protects the personal data of individuals who visit or register on our Platform ("you", "the Player", "the User"). It also sets out the rights you hold in respect of your personal data and how you may exercise those rights.

Rally918 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection principles. We recognise that players across Malaysia — in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions — entrust us with sensitive information, and we take that responsibility seriously.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which govern your use of the Platform and are incorporated by reference.

2 Definitions

The following terms are used throughout this Privacy Policy with the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and behavioural data associated with a specific individual.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, transmission, amendment, or deletion.
• "Data Controller" — Rally918, which determines the purposes and means of processing Personal Data collected via the Platform.
• "Data Processor" — any third-party service provider that processes Personal Data on behalf of Rally918 pursuant to a written data processing agreement.
• "KYC" — Know Your Customer verification procedures, comprising identity verification (name, date of birth, identification document) and proof-of-address checks required before withdrawal processing.
• "Cookie" — a small text file placed on a user's device by a website to store session information, preferences, and behavioural data.
• "Special Categories of Data" — personal data that is particularly sensitive in nature, such as health information, financial vulnerability indicators, or data relating to problem gambling patterns.

3 Personal Data We Collect

Rally918 collects personal data across several categories depending on the nature of your interaction with the Platform:

When you create a Rally918 account, we collect: full legal name, date of birth, residential address, email address, mobile phone number, username, and your chosen security credentials (passwords are stored in hashed form and are never accessible in plain text by Rally918 staff).

To comply with anti-money laundering obligations and to verify your age (minimum 21 years for Malaysian players), we collect copies of government-issued identity documents such as your Malaysian National Registration Identity Card (NRIC / MyKad) or passport, and where applicable a proof-of-address document such as a recent utility bill or bank statement.

We collect records of all deposits, withdrawals, and bonus transactions conducted through your Rally918 account. This includes the payment method used (e.g., Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Boost, GrabPay, BTC, USDT), transaction amounts in Malaysian Ringgit (MYR), timestamps, and transaction reference numbers. We do not store full bank account numbers or full e-wallet credentials — only the minimum necessary to process and verify transactions.

We collect records of all gaming sessions, game titles played, bet amounts, outcomes, wagering history, and sports betting selections. This data is used for account management, bonus eligibility calculations, responsible gambling monitoring, and dispute resolution.

We automatically collect certain technical data when you access the Platform, including: IP address, browser type and version, operating system, device type, screen resolution, referring URL, pages visited, session duration, and time stamps. This data helps us detect fraud, manage platform security, and improve user experience.

When you contact Rally918 via live chat, email, or any other support channel, we retain records of those communications — including your queries, complaints, and the responses provided by our support team — for quality assurance, training, and dispute resolution purposes.

4 How We Collect Personal Data

Rally918 collects personal data through the following channels:

• Directly from you — during account registration, KYC document submission, deposit and withdrawal transactions, support communications, and the completion of any promotional or survey forms;
• Automatically — through cookies, web beacons, server logs, and platform analytics tools when you access and interact with the Platform;
• From third-party payment processors — transaction verification data returned by payment service providers processing your deposits or withdrawals (e.g., DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and banking partners such as Maybank, CIMB, Public Bank, and Hong Leong);
• From identity verification services — confirmation data returned by KYC verification service providers during the identity and age verification process;
• From fraud prevention services — risk signals and device fingerprint data from third-party fraud detection tools that help protect the Platform and its players.

5 Purpose of Data Processing

Rally918 processes your personal data for the following purposes:

• Account Management — to create, maintain, and administer your Rally918 account, including processing your login credentials and account preferences;
• Identity & Age Verification — to comply with our mandatory KYC obligations and to confirm that all players are at least 21 years of age, as required by responsible gambling standards;
• Payment Processing — to process deposits and withdrawals via Malaysian payment methods including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and approved cryptocurrency channels;
• Regulatory Compliance — to meet anti-money laundering (AML) obligations, maintain records required by applicable international gaming regulations, and respond to lawful requests from competent authorities;
• Responsible Gambling Monitoring — to identify indicators of problem gambling behaviour, enforce self-exclusion and deposit limit settings, and provide appropriate interventions where necessary;
• Fraud Prevention & Security — to detect and prevent unauthorised account access, bonus abuse, money laundering, and other fraudulent activities;
• Customer Support — to respond to your queries, resolve disputes, and improve the quality of our support services;
• Platform Improvement — to analyse aggregated, anonymised usage patterns to improve game offerings, user interface design, payment flows, and overall platform performance;
• Marketing Communications — to send you promotional offers, bonus notifications, and platform updates, where you have provided consent and in accordance with applicable marketing regulations. You may withdraw this consent at any time.

6 Legal Basis for Processing

Rally918 processes your personal data on the following legal grounds:

• Contractual Necessity — processing required to perform our contract with you as a registered player, including account management, payment processing, and game delivery;
• Legal Obligation — processing required to comply with applicable laws and regulations, including KYC identity verification, AML record-keeping, and responses to lawful regulatory requests;
• Legitimate Interests — processing carried out for our legitimate business interests where those interests are not overridden by your fundamental rights, including fraud prevention, platform security, dispute resolution, and analytical improvement of our services;
• Consent — processing carried out on the basis of your freely given, specific, and informed consent, including marketing communications and certain categories of cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

Rally918 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may, however, share your personal data with the following categories of recipients where necessary and proportionate:

To process deposits and withdrawals, we share necessary transaction data with our payment partners, which include Malaysian e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), bank transfer systems (DuitNow, FPX), Malaysian commercial banks (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency processing services. Each payment partner operates under their own privacy frameworks and applicable regulatory obligations.

We share identity document data with certified KYC verification service providers for the purpose of confirming player identity and age. These providers are bound by strict data processing agreements and may not use your data for any purpose other than identity verification on Rally918's behalf.

We share limited technical data (such as IP addresses and device fingerprints) with anti-fraud and cybersecurity providers to protect the Platform and its players from fraudulent activity.

Rally918 may disclose personal data to competent regulatory, law enforcement, or governmental authorities where required to do so by applicable law, court order, or in response to a lawful regulatory request. We will notify affected players of such disclosures where legally permitted to do so.

8 Data Retention

Rally918 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods applicable to each category of data are set out in the table in Section 3 above.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents its reconstruction. Anonymised, aggregated analytical data (which cannot be used to identify any individual) may be retained indefinitely for statistical and business improvement purposes.

Where you request the deletion of your personal data before the expiry of the applicable retention period, Rally918 will action such requests subject to any overriding legal obligation to retain the data (for example, where retention is required for AML compliance or ongoing dispute resolution).

9 Data Security

Rally918 implements technical and organisational measures commensurate with the sensitivity of the personal data we process to protect against unauthorised access, accidental loss, destruction, or disclosure. Our key security measures include:

• AES-256 Encryption — all personal data is encrypted at rest using AES-256 and in transit using TLS 1.3 or higher;
• Password Hashing — player passwords are stored using bcrypt hashing and are never stored in plain text;
• Two-Factor Authentication (2FA) — available to all players to provide an additional layer of account access protection;
• Access Controls — personal data is accessible only to authorised Rally918 personnel on a strict need-to-know basis, with role-based access controls and audit logging;
• Regular Security Audits — Rally918 conducts regular penetration testing and security audits of its platform and data infrastructure;
• Incident Response Plan — Rally918 maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable obligations.

10 Cookies & Tracking Technologies

Rally918 uses cookies and similar tracking technologies to operate the Platform, analyse usage, and enhance your experience. The following categories of cookies are used:

• Strictly Necessary Cookies — required for the Platform to function correctly, including session authentication, security tokens, and payment flow continuity. These cookies cannot be disabled.
• Functional Cookies — used to remember your preferences such as language, display settings, and game lobby filters to personalise your experience.
• Analytical Cookies — used to collect anonymised data on how players navigate the Platform, which pages are most visited, and where technical errors occur. This data is used to improve the Platform's performance and usability.
• Security & Fraud Detection Cookies — used to identify suspicious device behaviour, detect automated bots, and protect the Platform and its players from fraud.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling functional or analytical cookies may affect certain features of the Platform experience. Strictly necessary cookies cannot be disabled as they are essential to the Platform's operation.

11 Your Data Rights

As a data subject, you hold the following rights in respect of your personal data held by Rally918. You may exercise any of these rights by contacting our support team via live chat or at [email protected].

Rally918 will respond to all data rights requests within 30 calendar days of receipt of a verified request. In cases of complexity or high volume, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

12 Children's Privacy & Age Policy

Rally918 strictly prohibits participation by individuals under the age of 21 years. The Platform is intended exclusively for adults aged 21 and above. We do not knowingly collect personal data from individuals under this age threshold.

13 Cross-Border Data Transfers

Rally918 operates as an international platform. In the course of providing services to Malaysian players, your personal data may be processed on servers or by service providers located outside of Malaysia. Where such cross-border transfers occur, Rally918 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Malaysian and international data protection principles.

Such safeguards include: data processing agreements incorporating standard contractual clauses; transfer only to countries or entities that provide an adequate level of data protection as assessed by Rally918; and ongoing monitoring of sub-processor compliance.

14 Amendments to This Policy

Rally918 reserves the right to update or amend this Privacy Policy at any time. Material changes to this Policy will be communicated to registered players via email notification to the address on file or through a prominent notice displayed on the Platform. The revised Policy will specify the date it takes effect.

We encourage you to review this Privacy Policy periodically to stay informed about how Rally918 handles your personal data. Your continued use of the Platform following notification of a revised Policy constitutes your acceptance of the changes. If you do not agree with any amendment, you should cease using the Platform and contact us to close your account.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Rally918, please contact our Data Protection team through one of the following channels: