Privacy Policy Shell888 – Personal Data Protection for Malaysian Players

This Privacy Policy sets out Shell888's privacy practices regarding the collection and processing of personal data of players who use the online casino, Sports Betting, Live Casino, virtual sports, slots, and all other services available on shell888.click. This Policy forms part of the overarching agreement between you and Shell888, together with Terms & Conditions and Responsible Gaming.

Shell888 acts as the data controller under Malaysia's Personal Data Protection Act 2010 — meaning we determine the purposes and means by which your personal data is processed. In certain cases, our third-party service providers may act as data processors, operating solely on Shell888's instructions.

Shell888 collects your personal data through several means — directly when you register or interact with the platform, and automatically via standard tracking technologies as you use our website. The following are the categories of data we collect:

Shell888 does not collect sensitive data such as medical information, religious beliefs, or political affiliations unless specifically required by law. We also do not store players' full credit card numbers or internet banking passwords — all financial transactions are processed through secure, certified payment gateways.

Shell888 collects and processes your personal data for the following purposes, which are lawful, fair, and limited to what is necessary for delivering our services to you:

• Account Management: To create, verify, and manage your Shell888 account — including registration, login, password recovery, and identity verification as required by law.
• Financial Transaction Processing: To process deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX Maybank2u or CIMB Clicks, as well as to process winnings withdrawals into your registered account within the stipulated timeframe.
• Game Service Delivery: To provide access to all Shell888 games — including Live Casino, EPL and Liga Super Malaysia Sports Betting, Virtual Sports, slots, and table games — and to record gaming history for dispute resolution purposes.
• Legal Compliance & Risk Controls: To fulfil legal compliance obligations including anti-money laundering (AML), age verification (KYC), and reporting to regulatory authorities as required under Malaysian law.
• Customer Support: To address enquiries, complaints, and support requests submitted to the Shell888 support team via email or live chat, and to record such interactions for quality control purposes.
• Platform Security: To detect and prevent fraud, hacking, account abuse, or other security threats to the Shell888 platform and its players.
• Product Improvement: To analyse aggregated (not individual) usage patterns for the purpose of improving the interface, selecting new games, and enhancing the overall player experience at Shell888.
• Important Communications: To send account-related notifications, changes to terms or policies, security information, and important Shell888 service updates that cannot be opted out of, as they form part of our core service.

Shell888 uses your personal data only for the purposes stated above, or for other purposes that are directly compatible with them. If we intend to use your data for a materially different new purpose, we will obtain your consent beforehand.

Shell888 does not sell, rent, or trade your personal data to any third party for their own commercial or marketing purposes. This is an absolute principle that has never been compromised since Shell888 began operations. However, in order to provide services to you, Shell888 does need to share certain data with selected parties under specific circumstances:

• Payment Providers: Transaction data required for processing is shared with the payment gateway providers we use — including Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX service providers — solely for the purpose of processing your transactions. All such providers are bound by strict data protection agreements with Shell888.
• Game Software Providers: Certain game details may be processed by third-party game software providers that supply Shell888 with live casino, slots, or virtual sports platforms. All such providers are bound by strict data confidentiality agreements.
• Legal Authorities: Shell888 will disclose personal data to regulatory authorities, law enforcement agencies, courts, or Malaysian government bodies when required by law, a valid court order, or legitimate investigative necessity.
• Technical Service Providers: Server infrastructure providers, email service providers, and analytics tools used by Shell888 may have limited access to certain data solely to deliver their technical services to Shell888. They are not permitted to use this data for their own purposes.
• Business Transfer: In the event of a merger, acquisition, or asset transfer involving a change of ownership of Shell888, player data may be transferred to the new owner, provided the new owner agrees to comply with this Privacy Policy or an equivalent or stricter policy.

Shell888 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Shell888's security infrastructure is designed to banking and financial industry standards, ensuring a level of protection comparable to that of Malaysia's leading financial institutions.

• 256-bit SSL Encryption: All data transmitted between your browser and Shell888's servers is encrypted using TLS 1.3 with 256-bit encryption — the same security standard used by Maybank2u and CIMB Clicks.
• Data-at-Rest Encryption: Sensitive personal data stored in Shell888's databases is encrypted using industry-recognised encryption algorithms. Player account passwords are stored as one-way hashes that cannot be decrypted.
• Strict Access Controls: Access to players' personal data at Shell888 is strictly limited to staff who require it to carry out their job responsibilities. All access is logged and continuously monitored.
• 24/7 Security Monitoring: Shell888's security monitoring system operates around the clock to detect suspicious activity, intrusion attempts, and other security threats in real time.
• Two-Factor Authentication: Shell888 offers two-factor authentication (2FA) to protect player account logins from unauthorized access, even if your password has been compromised.
• Periodic Security Audits: Shell888 conducts regular security assessments and penetration testing carried out by independent third parties to identify and address vulnerabilities before they can be exploited.

While Shell888 takes all reasonable steps to protect your data, no security system can guarantee absolute 100% protection against all threats. In the event of an unexpected data breach, Shell888 will notify affected players and the relevant authorities in accordance with Malaysian legal requirements within the stipulated timeframe.

Shell888 uses cookies and similar tracking technologies to enhance the user experience, ensure platform features function correctly, and gather usage analytics that help us improve the platform. We use several types of cookies:

• Essential Cookies (Required): These cookies are required for the Shell888 platform to function properly — including session cookies that maintain your login state, security cookies that protect against CSRF attacks, and language preference cookies. Disabling them will affect core platform functionality.
• Performance & Analytics Cookies: These cookies help Shell888 understand how players interact with the platform — which pages are visited most frequently, how long sessions last, and where players encounter difficulties. All data collected is aggregated and does not identify any individual specifically.
• Functional Cookies: This cookie saves your personal preferences on Shell888 — such as your chosen language, display settings, and notification preferences — so you don't have to reconfigure them every time you visit the platform.

You may manage or disable cookies through your web browser settings at any time. However, disabling essential cookies may affect Shell888 platform functionality, and you may be unable to log in or use all platform features properly. Please refer to your browser's documentation for instructions on managing cookies.

Shell888 retains your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, or as required by Malaysian law. Retention periods vary depending on the type of data and applicable legal requirements:

• Active Account Data: While your Shell888 account remains active, all account-related personal data is retained in full to enable us to deliver our services to you.
• Financial & Transaction Data: Financial transaction records are retained for a minimum of 7 years from the date of the transaction, in line with Malaysia's anti-money laundering and tax record-keeping requirements.
• Identity Verification (KYC) Data: Identity verification documents submitted to Shell888 are retained for a minimum of 5 years after account closure, in accordance with applicable legal compliance requirements.
• Data After Account Closure: Once your Shell888 account is closed at your request, personal data that is no longer required for legal compliance will be deleted or anonymised within 90 days, unless a legal basis requires longer retention.

Shell888's server infrastructure is hosted in data centres that meet international security standards. Where data needs to be transferred outside Malaysia for operational purposes, Shell888 ensures adequate protections are in place in accordance with Malaysia's PDPA requirements, including appropriate data transfer agreements with recipients outside Malaysia.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA) and Shell888's Privacy Policy, you have the following rights regarding your personal data held by Shell888. All requests relating to these rights may be submitted to Shell888's support team via email at support@shell888.click:

• Right of Access: You have the right to request and receive a copy of the personal data Shell888 holds about you. Such requests will be processed within 21 working days from the date a complete request is received.
• Right to Rectification: If you find that any personal data Shell888 holds about you is inaccurate, incomplete, or out of date, you have the right to request a correction. Much of your basic profile information can be updated directly through your account settings page.
• Right to Restrict Processing: Under specific circumstances provided for by Malaysia's PDPA — such as when you dispute the accuracy of your data or when processing is unlawful — you have the right to request that Shell888 temporarily restrict the processing of your data.
• Right to Object: You have the right to object to the processing of your data where it is carried out on the basis of Shell888's legitimate interests or for direct marketing purposes. Objections to direct marketing will be acted upon immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.
• Right to Complain: If you believe Shell888 has not complied with this Privacy Policy or the PDPA 2010, you have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP).

Shell888 may use your personal data to send marketing communications about products, promotions, bonuses, and new games that we believe may interest you — including information on EPL sports promotions, Malaysia Super League campaigns, deposit bonus offers, and new virtual sports launches. All Shell888 marketing communications are based on your consent.

• During Shell888 account registration, you may choose whether or not to receive marketing communications via email, SMS, or in-platform notifications.
• You may opt out of marketing emails at any time by clicking the "Unsubscribe" link found at the bottom of every Shell888 marketing email.
• To stop receiving marketing communications through other channels (SMS or in-platform notifications), please update your notification preferences in your Shell888 account settings or contact our support team.
• Please note that opting out of marketing communications will not stop important account-related communications — such as transaction notifications, security verifications, or critical terms updates.

Shell888 does not share your contact information (email, phone number) with third-party advertisers for their own marketing purposes. Any marketing communications you receive will always come from Shell888 alone through our official channels.

Shell888 is an online gambling platform strictly restricted to users aged 18 and above. Shell888 does not knowingly collect, process, or store the personal data of individuals under the age of 18 under any circumstances.

• Shell888 implements age verification measures during the registration process and may request verification documents such as a copy of your MyKad to confirm that a player meets the required age before granting full access to the platform.
• If Shell888 discovers that personal data belonging to an individual under the age of 18 has been inadvertently collected, we will take immediate steps to delete that data and close the associated account without any refund of funds.
• Parents or guardians who suspect their minor child has registered a Shell888 account may contact our support team immediately at support@shell888.click for immediate action.

Shell888 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements in Malaysia, or changes to Shell888's platform operations. All updates will be published on this page with a revised effective date.

When material changes are made to this Privacy Policy — such as changes to the types of data collected, significant new processing purposes, or changes to player rights — Shell888 will notify you by email to your registered address at least 14 days before those changes take effect. Continued use of the Shell888 platform after the effective date of any changes will be deemed acceptance of the amended Privacy Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how Shell888 handles your personal data, please do not hesitate to reach out. Shell888's Bahasa Malaysia-speaking data protection team is ready to assist you:

• Email: support@shell888.click — please state "Privacy Enquiry" in your email subject line for faster processing.
• Live Chat: Via the live chat button available on all pages of the Shell888 platform — we are available 24 hours a day, 7 days a week, including public holidays.
• Response Time: We are committed to acknowledging all privacy enquiries within 24 hours and providing a full response within 14 business days for formal data rights requests.

For formal personal data protection complaints in Malaysia that cannot be resolved directly with Shell888, you may contact the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP) Malaysia, the regulatory body responsible for enforcing the PDPA 2010.