Privacy Policy — candy918 Information Platform

Introduction

This Privacy Policy ("Policy") is issued by candy918 ("the Platform", "we", "us" or "our") and applies to all individuals ("User", "you" or "your") who access or interact with the website at https://candy918.cam and any related pages or services.

candy918 is an English-language casino and sports betting information platform serving Malaysian adults aged 21 and above. The Platform publishes educational content on casino games, sports betting markets, Malaysian payment methods, responsible gambling resources and related topics. candy918 does not operate as a licensed casino, bookmaker or financial institution.

This Policy describes the types of personal data we may collect, the purposes for which it is processed, the conditions under which it may be shared, the security measures we apply, your rights as a data subject and how to contact us about privacy matters.

By continuing to use the candy918 Platform you acknowledge that you have read and understood this Policy. This document should be read alongside the Terms and Conditions, which form part of the overall agreement governing your use of the Platform.

Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" means any information that identifies or can reasonably identify a living individual, either alone or in combination with other information, including name, email address, IP address and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
• "Data Subject" means an identified or identifiable individual to whom Personal Data relates — in this context, any User of the candy918 Platform.
• "Data Controller" means candy918, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Third Party" means any person or organisation other than the Data Subject and candy918, including service providers, analytics partners and payment channel operators.
• "Cookies" means small data files stored on a User's device by a web browser upon visiting the Platform, used to retain session information and support analytics.
• "KYC" means Know Your Customer — the identity verification process that may be required before certain account actions such as withdrawals are approved.

Data We Collect

candy918 may collect the following categories of Personal Data, depending on how a User interacts with the Platform:

candy918 does not intentionally collect sensitive data categories such as racial or ethnic origin, political opinions, religious beliefs, health data or biometric identifiers. If such data appears in a support communication, it will be handled with additional care and will not be retained beyond the resolution of the relevant enquiry.

How We Collect Data

candy918 collects Personal Data through the following methods:

1. Direct submission: When a User creates an account, completes a registration form, submits a support request or communicates with candy918 via email. Information provided in these interactions is collected directly from the User.
2. Automated technical collection: When a User visits the candy918 website, certain Technical Data and Usage Data is automatically recorded by web servers and, where implemented, analytics tools. This includes IP address, referring page, session duration and device characteristics.
3. Cookies and local storage: The candy918 Platform may use cookies and similar browser storage mechanisms to maintain session state, remember user preferences and support anonymised traffic analytics. Details of cookie types and management options are provided in Section 8.
4. Third-party service providers: Where candy918 engages third-party services for hosting, analytics, fraud prevention or customer support, those providers may collect or process Technical Data on the Platform's behalf under appropriate data processing agreements.

Legal Basis for Processing

candy918 processes Personal Data only where a lawful basis exists for doing so. The applicable legal bases are as follows:

• Performance of a contract: Where processing is necessary to fulfil the obligations associated with an account registration or service agreement between candy918 and the User, including account administration, KYC verification and the processing of deposit or withdrawal-related guidance.
• Legitimate interests: Where processing is necessary for the legitimate interests of candy918, provided those interests are not overridden by the rights and freedoms of the User. This includes fraud prevention, platform security, analytics for service improvement and maintaining accurate support records.
• Compliance with a legal obligation: Where processing is required to comply with applicable laws, regulatory requirements or lawful requests from competent authorities, including anti-money laundering and age-verification obligations.
• Consent: Where the User has provided a specific, informed and freely given consent to a particular processing activity, such as receiving optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

How We Use Your Data

Personal Data collected through the candy918 Platform is used exclusively for the following purposes:

• Account administration: Creating and maintaining user accounts, verifying eligibility, managing login credentials and processing account-level settings including responsible gambling limits.
• Identity and age verification: Confirming that a User meets the 21+ age requirement and, where applicable, processing KYC documentation to support payment and withdrawal operations.
• Payment guidance: Providing accurate and contextually appropriate information about Malaysian payment channels including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX, in connection with deposit and withdrawal guidance.
• Customer support: Responding to enquiries, resolving account issues, investigating complaints and maintaining records of support interactions for quality and compliance purposes.
• Platform security and fraud prevention: Monitoring access patterns, detecting suspicious activity, investigating security incidents and protecting Users and the Platform from fraudulent behaviour.
• Analytics and improvement: Analysing Usage Data in aggregate to understand how the Platform is used, identify areas for content improvement and optimise navigation and performance for Malaysian users.
• Legal and regulatory compliance: Meeting obligations imposed by applicable laws, responding to lawful requests from authorities and maintaining records required by regulation.

candy918 does not use Personal Data for automated individual decision-making or profiling that produces significant legal effects on Users.

Disclosure to Third Parties

candy918 does not sell, rent or disclose Personal Data to third parties for their own commercial purposes. Limited disclosure may occur in the following circumstances:

1. Service providers: candy918 may engage trusted third-party service providers to support Platform operations, including hosting, server management, analytics processing, fraud detection and customer support tooling. These providers act as data processors and are contractually required to handle Personal Data only on candy918's instructions and in accordance with this Policy.
2. Payment channel operators: Where a User's interaction with the Platform involves a payment transaction or withdrawal request, certain relevant information may be shared with the applicable Malaysian payment provider — such as Maybank, CIMB, DuitNow or Touch 'n Go eWallet — to the extent necessary to process that transaction.
3. Legal requirements: candy918 may disclose Personal Data to competent authorities, law enforcement agencies or regulatory bodies where required to do so by applicable law, court order or regulatory directive. Such disclosure will be limited to what is strictly required.
4. Business reorganisation: In the event of a merger, acquisition, restructuring or sale of the candy918 business or its assets, Personal Data may be transferred to the succeeding entity, subject to equivalent data protection commitments being maintained.
5. Consent-based sharing: Where a User has given specific informed consent to a particular sharing arrangement, Personal Data may be disclosed accordingly. Such consent may be withdrawn at any time.

Cookies and Tracking

The candy918 Platform may use cookies and similar browser-based storage mechanisms to support its operation. The following cookie categories may be in use:

• Strictly necessary cookies: These cookies are required for the Platform to function correctly, including maintaining session state and enabling secure login. They cannot be disabled without impairing Platform functionality.
• Performance and analytics cookies: These cookies collect anonymised data about how Users navigate the Platform, which pages are visited most frequently and where errors occur. This information is used in aggregate form to improve the Platform. Individual Users are not identified from this data.
• Functional cookies: These cookies remember choices made by Users — such as preferred language or region settings — to provide a more consistent experience across sessions.
• Third-party analytics: Where a third-party analytics provider is used, that provider may set its own cookies subject to its own privacy policy. candy918 uses such data only in anonymised aggregate form and does not permit third-party analytics providers to use this data for their own commercial purposes.

Users may manage cookie preferences through their browser settings at any time. Disabling certain cookies may affect the functionality of some Platform features. Most modern browsers provide cookie management options under privacy or security settings.

Data Retention

candy918 retains Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention principles apply:

• Account data: Retained for the duration of an active account and for a reasonable period after account closure, to support post-closure enquiries, dispute resolution and compliance obligations.
• KYC and identity verification records: Retained for the period required by applicable anti-money laundering and financial crime regulations, typically a minimum of five years from the date of verification or last transaction.
• Support communications: Retained for a reasonable period after resolution of the relevant enquiry, to support quality assurance, regulatory compliance and follow-up communications.
• Technical and usage logs: Retained for a limited period sufficient for security monitoring, fraud investigation and analytics purposes, after which logs are anonymised or deleted.
• Consent records: Where processing is based on consent, records of that consent are retained for as long as the processing continues and for a period thereafter sufficient to demonstrate compliance.

When Personal Data is no longer required for its stated purpose and no legal obligation requires its continued retention, candy918 will securely delete or anonymise it in a manner that prevents re-identification.

Data Security

candy918 implements appropriate technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures are reviewed and updated on a regular basis to reflect changes in technology, regulatory guidance and identified risks.

Security measures in place include, but are not limited to, encrypted data transmission where applicable, access controls limiting data access to authorised personnel, secure hosting environments, and monitoring for unusual access patterns that may indicate a security incident.

Users also play an important role in account security. candy918 recommends the following practices:

• Use a strong, unique password for your candy918 account and change it regularly.
• Never share your password, one-time password (OTP) or banking PIN with any third party, including customer support staff.
• Log out of your account when using a shared or public device.
• Report any suspected unauthorised access to your account to candy918 support promptly.

Your Rights

Users whose Personal Data is processed by candy918 hold the following rights, subject to applicable legal conditions and exemptions:

1. Right of access: You may request a copy of the Personal Data held about you, together with information about how it is processed and the purposes for which it is used.
2. Right of rectification: You may request that inaccurate or incomplete Personal Data be corrected without undue delay.
3. Right of erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn and no other legal basis applies, or where processing is unlawful. Erasure may be declined where retention is required by law.
4. Right to restrict processing: You may request that processing of your data be restricted while a dispute about accuracy or lawfulness is resolved, or where you have objected to processing pending a determination of legitimate grounds.
5. Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. candy918 will cease such processing unless compelling legitimate grounds can be demonstrated that override your interests.
6. Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7. Right to complain: You have the right to lodge a complaint with the relevant data protection authority in your jurisdiction if you believe your Personal Data has been processed unlawfully.

To exercise any of these rights, please contact candy918 using the details in Section 14. Requests will be acknowledged and processed within a reasonable timeframe. Where a request cannot be fulfilled — for example, because legal retention obligations apply — candy918 will explain the reason.

Minors and Age Policy

The candy918 Platform is not directed at, and must not be used by, individuals under the age of 21. This reflects the minimum age requirement applicable to casino-style gambling and sports betting information services in the Malaysian context. candy918 does not knowingly collect or process Personal Data from individuals below this age threshold.

Where candy918 becomes aware that Personal Data has been submitted by a person under the age of 21 — whether through direct submission, account registration or any other channel — that data will be promptly deleted and the associated account will be suspended. candy918 reserves the right to request proof of age at any stage of the account lifecycle.

Parents, guardians and household members who are aware of a minor accessing the candy918 Platform are requested to contact support immediately using the contact information in Section 14. Appropriate parental control tools are available through most internet service providers and device manufacturers to assist with restricting access to adult content.

Changes to This Policy

candy918 reserves the right to update or amend this Privacy Policy at any time to reflect changes in legal requirements, regulatory guidance, Platform functionality or data processing practices. When material changes are made, the "Last Reviewed" date at the top of this page will be updated accordingly.

Users are responsible for reviewing this Policy periodically to remain informed of current data handling practices. Continued use of the candy918 Platform following publication of a revised Policy constitutes acceptance of those changes. Where a revision materially affects how Personal Data is used, candy918 will make reasonable efforts to notify registered Users via their registered email address or through a visible in-platform notice.

If you do not accept the revised Privacy Policy, you must discontinue your use of the Platform and may request erasure of your Personal Data as described in Section 11.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to report a privacy concern, please contact candy918 using the information below. Contact details are provided as plain text only — please copy them manually to your email or phone application.

When contacting us about a privacy matter, please include your registered account name or email address, a clear description of your request or concern, and any relevant reference numbers so that your enquiry can be handled efficiently and without unnecessary delay.

candy918 is committed to responding to all privacy-related requests within a reasonable period. Where a request is complex or involves multiple individuals, we will inform you of the expected timeline as early as practicable.