1. Introduction
SCR88 ("we", "us", "the Platform", or "SCR88") is committed to protecting the privacy and personal data of every player who registers or interacts with our online gaming and sports betting platform at scr88.cam. This Privacy Policy ("Policy") sets out, in clear and formal terms, our practices regarding the collection, use, storage, disclosure, and protection of your personal information.
This Policy applies to all personal data processed in connection with your use of the SCR88 platform, including account registration, deposits and withdrawals, live chat interactions, KYC (Know Your Customer) verification, bonus participation, and any other activity that involves the submission or generation of personal data.
By registering an account with SCR88 or by continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy.
Malaysian Players: SCR88 processes the data of a significant number of players based in Malaysia, including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. While Malaysia's Personal Data Protection Act 2010 (PDPA) applies to data processors operating within Malaysia, players should note that SCR88 operates under international licensing and processes data in accordance with the laws of its licensing jurisdiction.
2. Definitions
The following defined terms are used throughout this Privacy Policy:
- "Personal Data"
- Any information relating to an identified or identifiable natural person ("data subject"), including name, identification number, email address, IP address, payment data, or any combination of data that could identify a person.
- "Processing"
- Any operation performed on personal data, including collection, storage, use, transmission, erasure, or any other form of handling, whether automated or manual.
- "Data Controller"
- SCR88, as the entity that determines the purposes and means of processing personal data collected via the platform.
- "Data Processor"
- Any third party that processes personal data on behalf of SCR88 under a data processing agreement, including payment processors, KYC verification providers, and cloud infrastructure providers.
- "Consent"
- A freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their personal data for specified purposes.
- "KYC" (Know Your Customer)
- The identity and age verification process required prior to first withdrawal, involving submission of government-issued photo identification, proof of address, and, where required, a selfie.
3. Personal Data We Collect
SCR88 collects only the data that is necessary for the operation of the platform, compliance with legal obligations, and the delivery of services to our players. The categories of personal data we collect are set out below.
| Data Category | Examples of Data Collected | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number | Registration and KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, state, postcode) | Registration and account updates |
| Financial Data | Payment method identifiers (e.g., e-wallet account reference, bank account last digits), transaction amounts, deposit and withdrawal history | Deposits, withdrawals, KYC |
| Technical Data | IP address, browser type and version, device type and operating system, session duration, login timestamps | Automatically on platform access |
| Gameplay Data | Games played, bets placed, wager amounts, win/loss history, bonus usage records | During active platform use |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | When contacting support |
| Verification Data | Copies of government-issued ID, proof of address documents, selfie photographs | KYC verification process |
| Marketing Preferences | Opt-in or opt-out status for promotional communications, preferred contact channel | Registration or account settings |
SCR88 does not collect full payment card numbers, CVV codes, or full bank account numbers. Financial transactions are processed via certified third-party payment gateways including Touch 'n Go, Boost, GrabPay, DuitNow, and FPX — SCR88 receives only tokenised or reference identifiers from these processors.
4. How We Collect Personal Data
SCR88 collects personal data through the following channels and mechanisms:
4.1 Directly From You
- When you complete the account registration form on the platform
- When you submit identity and address documents during the KYC verification process
- When you initiate or complete a financial transaction (deposit or withdrawal)
- When you contact our support team via live chat or email
- When you update your account profile or adjust your responsible gambling settings
- When you respond to a survey or provide feedback about the platform
4.2 Automatically Through Platform Use
When you access and use the SCR88 platform, certain technical and behavioural data is collected automatically through server logs, session management systems, and analytics tools. This includes your IP address, browser fingerprint, device information, pages visited, session duration, and in-platform navigation patterns.
4.3 From Third Parties
- Payment processors: Transaction status, payment method identifiers, and fraud risk signals from providers such as Touch 'n Go, FPX, DuitNow, and cryptocurrency networks
- KYC verification providers: Identity verification results, document authenticity assessments, and age confirmation outcomes from our contracted KYC service providers
- Fraud prevention services: Device reputation data, IP reputation scores, and cross-platform fraud indicators from contracted third-party services
- Analytics providers: Aggregated, anonymised behavioural data used to improve platform performance and user experience
5. Purpose & Legal Basis for Processing
SCR88 processes your personal data only where there is a clear lawful basis for doing so. The primary purposes and corresponding legal bases for our processing activities are as follows:
| Processing Purpose | Legal Basis |
|---|---|
| Account registration and management | Performance of contract (agreement to Terms & Conditions) |
| Processing deposits and withdrawals | Performance of contract; legal obligation (AML compliance) |
| KYC identity and age verification | Legal obligation; protection of vulnerable persons (21+ enforcement) |
| Fraud detection and prevention | Legitimate interests (protecting platform integrity and other players) |
| Responsible gambling monitoring | Legal obligation; legitimate interests (player protection) |
| Customer support delivery | Performance of contract; legitimate interests |
| Sending promotional communications | Consent (you may withdraw at any time via account settings or by contacting support) |
| Platform analytics and improvement | Legitimate interests (service improvement, anonymised data only) |
| Compliance with legal and regulatory obligations | Legal obligation |
Where consent is the stated legal basis (e.g., for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, update your preferences in Account Settings or contact support.
6. Data Sharing with Third Parties
SCR88 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data only in the following circumstances and with the following categories of recipients:
6.1 Service Providers (Data Processors)
We engage carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include:
- Payment processors: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX participating banks (Maybank, CIMB, Public Bank, Hong Leong Bank), and cryptocurrency network operators — for the purpose of processing your financial transactions
- KYC verification providers: For identity document verification, facial matching, and age confirmation prior to first withdrawal
- Cloud infrastructure and hosting providers: For secure storage and processing of platform data
- Customer support tools: For the delivery of live chat and email support services
- Fraud prevention providers: For real-time risk assessment and detection of suspicious activity
6.2 Legal and Regulatory Disclosure
SCR88 may disclose personal data to competent authorities, law enforcement bodies, regulatory authorities, or courts where we are legally required or permitted to do so, including in connection with:
- Anti-money laundering (AML) investigations or reporting obligations
- Court orders, subpoenas, or legally binding governmental requests
- Prevention, detection, or prosecution of criminal activity
- Enforcement of our Terms & Conditions where legally permissible
6.3 Business Transfers
In the event of a merger, acquisition, asset sale, or restructuring of SCR88's business, personal data held by SCR88 may be transferred to the acquiring or successor entity. In such cases, players will be notified via the email address associated with their account prior to data transfer, and the receiving entity will be bound by privacy obligations no less protective than those set out in this Policy.
7. International Data Transfers
SCR88 operates internationally, and your personal data may be processed in countries other than your country of residence. This includes transfer to jurisdictions where SCR88's servers, payment infrastructure, or third-party processors are located.
Where personal data is transferred internationally, SCR88 ensures that appropriate safeguards are in place to protect the data, including:
- Contractual obligations on recipient entities that require them to maintain data protection standards consistent with this Policy
- Use of third-party processors that are certified under recognised international data security frameworks
- Encryption of data in transit between jurisdictions using industry-standard protocols
By using the SCR88 platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia where our operational and technical infrastructure is located.
8. Data Retention
SCR88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including the satisfaction of legal, regulatory, audit, and dispute-resolution obligations.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Legal obligation; audit requirements |
| KYC documents | Duration of account + 5 years post-closure | AML / regulatory compliance |
| Financial transaction records | 7 years from transaction date | Anti-money laundering legal obligation |
| Support communications | 3 years from last interaction | Dispute resolution; service improvement |
| Gameplay and wagering records | 5 years from date of activity | Regulatory compliance; dispute resolution |
| Marketing preference records | Until consent is withdrawn + 1 year | Evidence of consent basis |
| Technical / server log data | 12 months from generation | Security monitoring; fraud detection |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes.
9. Security Measures
SCR88 implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data against unauthorised access, disclosure, alteration, or destruction.
9.1 Technical Controls
- 256-bit SSL/TLS encryption for all data transmitted between your browser or device and our platform servers
- Encryption at rest for sensitive data categories including KYC documents and financial identifiers stored on our infrastructure
- Two-factor authentication (2FA) available for all player accounts and mandatory for administrative platform access
- Intrusion detection and prevention systems (IDS/IPS) monitoring network traffic in real time
- Regular penetration testing conducted by independent third-party security firms
9.2 Organisational Controls
- Access to personal data is restricted on a strict need-to-know basis; staff access is role-scoped and logged
- All staff with access to personal data are subject to confidentiality obligations and regular data protection training
- Third-party data processors are subject to due diligence assessment and contractual data protection obligations before engagement
Player funds are held in segregated accounts — entirely separate from SCR88's operational funds. This structural separation protects your Real Money Balance from any business-side financial event affecting SCR88.
9.3 Data Breach Response
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, SCR88 will notify affected players via their registered email address without undue delay. We will also notify the relevant supervisory authority where required by applicable law. Our incident response plan is tested and updated regularly.
10. Cookies & Tracking Technologies
SCR88 uses cookies and similar tracking technologies to enable platform functionality, improve user experience, maintain session security, and conduct analytics. The following categories of cookies are used:
10.1 Strictly Necessary Cookies
These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens, anti-CSRF security tokens, load balancer identifiers, and language preference cookies. No personal data is shared with third parties through strictly necessary cookies.
10.2 Functional Cookies
Functional cookies remember your preferences (such as display settings and responsible gambling reminders) to personalise your experience on return visits. These cookies do not track your activity across external websites.
10.3 Analytics Cookies
SCR88 uses anonymised analytics tools to understand how players interact with the platform — which game categories are most popular, where players encounter friction, and how support journeys unfold. Analytics data is aggregated and does not identify individual players.
10.4 Managing Cookies
You may control cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair platform functionality, including the ability to log in and maintain a session. For detailed cookie management instructions, refer to the help documentation of your browser (Chrome, Safari, Firefox, Edge, or others).
11. Minors & Age Policy
The SCR88 platform is strictly intended for players aged 21 years and above. SCR88 does not knowingly collect personal data from individuals under the age of 21. Mandatory KYC age verification is conducted prior to first withdrawal, and SCR88 reserves the right to conduct age verification checks at any point during an account's lifecycle.
If SCR88 discovers or is informed that an account belongs to a player under the age of 21, the following actions will be taken immediately:
- The account will be permanently suspended
- All personal data associated with the account will be erased, except where retention is required by law
- Any deposited funds will be returned to the source payment method
- All gameplay history and bonus activity during the account's active period will be voided
If you are a parent or legal guardian and believe that your child under the age of 21 has registered an account with SCR88, please contact us immediately at [email protected].
12. Your Data Protection Rights
As a data subject, you hold a number of rights in relation to the personal data that SCR88 holds about you. These rights are set out below. To exercise any of these rights, contact us as described in Section 15.
Right of Access
Request a copy of the personal data SCR88 holds about you (a Subject Access Request).
Right to Rectification
Request correction of inaccurate or incomplete personal data held on your account.
Right to Erasure
Request deletion of your personal data where there is no longer a lawful basis for processing it.
Right to Restrict Processing
Request that SCR88 restricts processing of your data while accuracy or lawfulness is under review.
Right to Portability
Receive a structured, machine-readable copy of data you have provided to SCR88 for transfer to another service.
Right to Object
Object to processing based on legitimate interests, including processing for direct marketing purposes.
Some rights are subject to limitations. For example, the right to erasure cannot override SCR88's legal obligations to retain financial transaction data for anti-money laundering compliance. Where a right cannot be fulfilled in full, SCR88 will explain why and outline what partial action can be taken.
SCR88 will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or where SCR88 receives a high volume of requests, this period may be extended by a further 60 days, with notification to the requesting player within the initial 30-day window.
13. Privacy Complaints
If you believe that SCR88 has processed your personal data unlawfully or in breach of this Privacy Policy, we encourage you to first raise the issue directly with our support team, who will investigate and respond within 10 business days.
If you are not satisfied with SCR88's response to your complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. Malaysian players may contact the Department of Personal Data Protection (JPDP), which oversees enforcement of Malaysia's Personal Data Protection Act 2010 (PDPA).
14. Changes to This Privacy Policy
SCR88 reserves the right to update or amend this Privacy Policy at any time in response to changes in applicable law, regulatory requirements, or our data processing practices. When material changes are made, we will:
- Update the "Last Updated" date at the top of this page
- Notify registered players via their registered email address
- Display an in-platform notification upon next login for a period of at least 14 days
Your continued use of the SCR88 platform after a revised Privacy Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any revision, you may request account closure as described in our Terms & Conditions.
15. Contact Us
For all privacy-related queries, data subject rights requests, or complaints regarding this Privacy Policy, please contact SCR88 through the following channels:
