Last updated: May 2026. This policy applies to kk8-my.my, the KK8 Android APK application, the KK8 H5 web version, and all KK8 Malaysia services. “We”, “us”, and “KK8” refer to the platform operator licensed under the Gaming Curacao jurisdiction.
Privacy policies exist primarily to inform players about how their data is used. This one is written to be read and understood, not to be scanned for the absence of obviously bad clauses. We collect personal data to operate a licensed gaming platform. We collect the minimum data necessary to do that. This policy explains what that data is, why we collect it, who sees it outside of KK8, how long we keep it after your account closes, and what you can do if you want to know more, correct something, or have data removed.
KK8 uses a UID (Unique Identifier) registration system. When you create an account, you choose a UID and password and provide a phone number for OTP verification. Email addresses are not required for registration at KK8. Your UID and phone number are your primary account identifiers for all login and account recovery purposes. This differs from email-based registration systems and is common among Asian gaming platforms that prioritise phone-based identity verification.
| Category | Data Included | Purpose | Legal Basis |
|---|---|---|---|
| Registration | UID, phone number, date of birth, password (hashed, never stored in plain text) | Account creation and authentication | Contract performance |
| Identity (KYC) | Government ID photo (MyKad, passport, or driving licence), selfie photograph | Withdrawal verification, AML compliance, fraud prevention | Legal obligation |
| Financial | Bank account numbers, e-wallet identifiers, crypto wallet addresses, full transaction history | Payment processing, withdrawal fulfilment, fraud detection | Contract performance |
| Usage and Gameplay | Games played, bet amounts and outcomes, session duration, login timestamps, product navigation | Responsible gaming monitoring, fraud detection, product improvement | Legitimate interests |
| Device and Technical | IP address, device type, OS version, browser or APK version, unique device identifier | Security, fraud prevention (iovation), technical performance | Legitimate interests |
| Communications | Live chat, Telegram, and WhatsApp message content and metadata | Support delivery, dispute resolution, compliance records | Legitimate interests |
Identity verification is required when cumulative withdrawals from your account exceed a defined threshold, or when our fraud detection system flags unusual account activity. KYC involves submitting a photograph of a valid government-issued ID and a selfie confirming the person in the ID is the account holder. The threshold for automatic KYC triggering is set in accordance with Curacao gaming licence anti-money laundering requirements and is not disclosed publicly to prevent deliberate structuring of transactions to stay below it.
KYC documents are stored in an encrypted database. Access is restricted to compliance team members with a specific, logged business reason to view any individual’s documents. KYC data is never shared with game providers. When you open a game at KK8, only an anonymous session token is passed to that provider’s servers. The provider receives no identity information, no UID, no phone number, and no payment data. This separation is enforced technically, not merely by policy.
The legal obligation to collect KYC data arises from the anti-money laundering requirements of KK8’s Curacao gaming licence. This requirement applies to all Curacao-licensed gaming operators regardless of the markets they serve. KK8 cannot waive KYC requirements for any account or circumstance. If KYC triggers during a withdrawal request, the withdrawal is held until verification completes. Verification typically processes within 24 hours of document submission.
KK8 does not sell personal data. We do not share it with advertising networks, data brokers, or any third party for commercial purposes unrelated to platform operation. The following categories of sharing are necessary for the platform to function and are each limited to the minimum data required for that specific purpose.
Payment processors receive the transaction-specific data necessary to process each deposit or withdrawal: your bank account number or e-wallet identifier and the transaction amount. Payment processors for KK8 include EaziePay, Help2Pay, and the gateway operators behind FPX, Touch’n Go, and GrabPay. Each processor is contractually prohibited from using transaction data for any purpose other than processing that specific transaction. Crypto transactions pass through blockchain networks where transaction data is inherently public on the distributed ledger, but your KK8 account identity is not linked to your wallet address in any public record.
Game providers receive only an anonymous session token when you open a game. This token allows the provider’s servers to run a game session but contains no personal information. If a provider’s servers are breached, the breach exposes session data but not your UID, phone number, payment details, or any other personal information held by KK8. This is a deliberate architectural decision, not a byproduct of how the integration was built.
Regulatory authorities including Gaming Curacao and, where legally required, Malaysian regulatory bodies may request account data. KK8 complies with valid legal requests. Where the law permits notification, KK8 informs the affected account holder that a request was received and what data was provided. Gaming Curacao’s formal complaints and regulatory contact process is available through their official channels.
Fraud prevention is handled through iovation, a specialist fraud detection service used by major online gaming operators globally. KK8 shares anonymised behavioural data with iovation: device fingerprinting signals, session behaviour patterns, and timing information. This data is not linked to your UID or any personal identifier in the data shared with iovation. The service uses it to identify patterns associated with account takeover, payment fraud, and multi-account abuse.
We retain personal data for the minimum period necessary to fulfil the purpose it was collected for and to comply with regulatory retention requirements. After each retention period expires, data is securely deleted using irreversible methods or anonymised so that it can no longer be linked to any individual account.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data (UID, phone, DOB) | 5 years after account closure | Curacao gaming licence requirement |
| KYC documents (ID photos, selfies) | 5 years after account closure | AML compliance obligation |
| Financial transaction records | 7 years from transaction date | Financial records legal obligation |
| Support communications (chat, Telegram, WhatsApp) | 2 years from last communication | Dispute resolution capability |
| Gameplay and betting history | 2 years from session date | Fraud investigation, RG monitoring |
| Device and login data | 1 year from collection date | Security monitoring and fraud investigation |
All data transmitted between your device and KK8 servers is encrypted using 256-bit SSL. This applies to APK sessions, H5 web sessions, live chat, and all payment gateway communications. Data stored on KK8 servers is encrypted at rest for all sensitive categories: KYC documents, payment identifiers, and authentication credentials including hashed passwords. Role-based access controls prevent any team member from accessing personal data without a specific logged reason. Access logs are reviewed regularly and anomalous access patterns trigger automated alerts.
Regular independent penetration testing is conducted to identify and address security vulnerabilities before they can be exploited. In the event of a data breach that poses a risk to your personal information, KK8 will notify affected accounts within 72 hours of becoming aware of the breach, including a description of what data was exposed, what was done to contain it, and what steps you can take. If you believe your KK8 account has been compromised, contact live chat immediately to request an emergency account freeze while the situation is investigated.
KK8 uses cookies for four operational purposes: session management to keep you logged in across pages and between the APK and H5 web version, preference storage for language and display settings, analytics to understand which features and games are most used, and fraud detection via the iovation integration described in section 3. KK8 does not use cookies to build advertising profiles or to share your browsing data with any advertising network. Cookies can be managed through your device browser settings. Disabling session cookies will prevent persistent login and is likely to disrupt normal platform use.
Material changes to this policy, meaning changes that affect what data we collect, who we share it with, or what your rights are, are communicated to all registered accounts via in-app notification and, where email addresses are registered, by email, at least 14 days before the changes take effect. Minor clarifications are reflected in the updated policy with a revised date at the top of this page without individual notification. The current policy version date is always shown at the top of this page.
For all privacy queries: contact KK8 live chat and request to speak with the data privacy team, or email [email protected] with your UID and a description of your query. We respond within 5 business days. For regulatory escalation, Gaming Curacao as the governing jurisdiction is available through their official regulatory contact channels. KK8’s licence number (N.V. #365/JAZ) is verifiable through the Curacao Gaming Control Board’s public records.
