Privacy Policy
waja888 respects your privacy. This Policy explains exactly what personal data we collect, why we collect it, how we use and protect it, and the rights you have over your information.
Last Updated: 1 January 2026Key privacy commitments at a glance — full policy details follow in the sections below.
Your Data Stays Secure
All personal data is stored using 256-bit SSL encryption. We apply industry-standard security controls across every layer of our infrastructure to protect your information from unauthorised access.
Never Sold to Third Parties
waja888 does not sell, rent, or trade your personal data to any third party for marketing purposes. Data shared with partners is limited strictly to what is necessary to operate the Platform's services.
You Control Your Data
You have the right to access, correct, export, and request deletion of your personal data at any time. Submit requests to our support team and we will respond within 30 days.
Transparent Cookie Use
We use cookies and similar technologies only for essential site functionality, session management, and aggregate analytics. We do not use third-party advertising cookies without your consent.
Marketing Opt-Out
Promotional communications are always opt-in. You may withdraw consent and unsubscribe from all marketing emails at any time by contacting our support team or updating your Account preferences.
Regulatory Compliance
Our data handling practices are designed in alignment with applicable personal data protection principles, including those consistent with Malaysia's Personal Data Protection Act (PDPA) framework.
Introduction
This Privacy Policy (the "Policy") sets out the basis on which waja888 ("waja888", "we", "us", "our") collects, processes, stores, and discloses personal data about individuals ("you", "your", "the Player") who access or use the waja888 online gaming and sports betting platform at https://waja888.cam (the "Platform"), and all associated services, features, and functionality.
waja888 is committed to protecting the privacy and personal data of every player on the Platform. We recognise that players in Malaysia — from Kuala Lumpur and Petaling Jaya to Penang, Shah Alam, and Johor Bahru — entrust us with sensitive personal and financial information when they register, deposit funds, and engage with our casino and sportsbook services. That trust is not taken lightly.
By registering an Account, accessing the Platform, or otherwise interacting with our services, you confirm that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.
Definitions
For the purposes of this Privacy Policy, the following definitions apply:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or any combination thereof. |
| "Data Subject" | The individual to whom the Personal Data relates — in the context of this Policy, the registered Player on the waja888 Platform. |
| "Data Controller" | waja888, the entity that determines the purposes and means of processing Personal Data collected through the Platform. |
| "Third Party" | Any individual, company, or organisation that is not waja888 or the Data Subject, including payment processors, KYC verification providers, and technology service suppliers. |
| "Cookies" | Small text files stored on a user's device by a web browser upon visiting a website, used to retain session information and preferences. |
| "KYC" | Know Your Customer — the identity and age verification process required by waja888 in accordance with its anti-money-laundering and responsible gambling obligations. |
Data We Collect
waja888 collects the following categories of personal data in connection with the operation of the Platform and delivery of its services:
3.1 Identity and Contact Data
- Full legal name as appearing on official identification documents;
- Date of birth (to verify 21+ age requirement);
- Residential address, including city, state, and postcode (Malaysian addresses accepted);
- Email address (used as primary Account identifier and communication channel);
- Mobile phone number (for account security and transaction notifications where applicable).
3.2 Identity Verification (KYC) Documents
- Government-issued Malaysian identification document — MyKad, Passport, or Driver's Licence — including the name, date of birth, and photograph fields;
- Proof of residential address — utility bill, bank statement, or equivalent document dated within three months of submission;
- Selfie photograph alongside the identity document, used for liveness verification purposes.
3.3 Financial Data
- Deposit and withdrawal transaction records, including amounts in MYR, timestamps, and payment method used;
- Payment method identifiers — such as masked bank account numbers, e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), and FPX transaction references;
- Cryptocurrency wallet addresses for transactions involving BTC, ETH, USDT, or other supported digital assets.
3.4 Account and Gaming Activity Data
- Account username, password (stored in hashed form), and authentication logs;
- Betting and wagering history across all Platform products — casino, sports, live dealer, and arcade;
- Bonus and promotional participation records;
- VIP tier status and loyalty points balance;
- Responsible gambling settings — deposit limits, session reminders, self-exclusion status.
3.5 Technical and Usage Data
- IP address and approximate geolocation data;
- Device type, operating system, and browser information;
- Session duration, pages visited, and navigation patterns within the Platform;
- Error logs and crash reports generated during Platform use.
3.6 Communications Data
- The content of communications submitted to customer support via live chat, email, or any other Platform messaging channel;
- Feedback, complaint submissions, and survey responses.
How We Collect Your Data
waja888 collects personal data through the following means:
- Direct provision: Information you provide when completing the registration form, submitting KYC documents, making deposits or withdrawals, contacting support, or participating in promotions;
- Automated collection: Technical and usage data collected automatically through cookies, server logs, and analytics tools when you interact with the Platform;
- Third-party sources: Identity and fraud-risk data received from KYC verification service providers and financial crime screening databases as part of our anti-money-laundering and responsible gambling processes;
- Payment processors: Transaction confirmation data received from payment processors including FPX network, e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay), and banking partners (Maybank, CIMB, Public Bank, Hong Leong).
How We Use Your Data
waja888 processes personal data for the following purposes:
| Purpose | Data Categories Used |
|---|---|
| Account registration and management | Identity, contact, authentication data |
| Age and identity verification (KYC) | Identity documents, selfie, date of birth |
| Processing deposits and withdrawals | Financial data, payment method identifiers |
| Delivering casino and sports betting services | Account data, gaming activity, session data |
| Anti-money-laundering and fraud prevention | Financial data, KYC documents, IP address, gaming patterns |
| Responsible gambling compliance | Gaming activity, deposit history, self-exclusion status |
| Customer support and complaint resolution | Communications data, account activity |
| VIP programme and loyalty management | Gaming activity, tier status, promotional history |
| Platform improvement and analytics | Technical and usage data (aggregated and anonymised where possible) |
| Promotional communications (with consent) | Contact data, promotional preferences |
| Legal and regulatory compliance | All categories, as required |
Legal Basis for Processing
waja888 processes personal data on the following legal bases, depending on the processing activity in question:
- Contractual necessity: Processing required to fulfil our obligations under the Account agreement — including identity verification, payment processing, and game delivery — is necessary to perform the contract with you;
- Legal obligation: Processing required to comply with anti-money-laundering regulations, age verification obligations, and other applicable legal requirements;
- Legitimate interests: Processing for fraud prevention, platform security, and improvement of our services, where such processing does not override your fundamental rights;
- Consent: Processing for optional marketing communications, which you may withdraw at any time.
Data Sharing
waja888 does not sell, rent, or transfer your personal data to third parties for their own marketing purposes. Personal data is shared with third parties only in the following circumstances and to the minimum extent necessary:
- Payment service providers: Financial data is shared with payment processors (including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency payment gateways) solely to facilitate deposit and withdrawal transactions;
- KYC and identity verification providers: Identity documents are shared with certified third-party KYC verification services for age and identity verification purposes;
- Fraud and AML screening services: Data may be shared with financial crime screening providers to meet our anti-money-laundering obligations;
- Game software providers: Pseudonymised gaming activity data may be shared with third-party game software providers for technical and support purposes;
- Regulatory and law enforcement authorities: Data will be disclosed to competent authorities where required by law, legal process, or governmental request;
- Business successors: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
All third-party service providers engaged by waja888 are required to process personal data only in accordance with our instructions and applicable data protection principles.
Data Retention
waja888 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
- Active Account data: Retained for the duration of the Account and for a minimum of five (5) years following Account closure, in compliance with anti-money-laundering record-keeping requirements;
- KYC documents: Retained for a minimum of five (5) years following the completion of the business relationship or the relevant transaction, as required by applicable regulations;
- Financial transaction records: Retained for a minimum of seven (7) years for tax and regulatory compliance purposes;
- Customer support communications: Retained for three (3) years from the date of the last communication, unless required longer for dispute resolution;
- Technical and usage data: Aggregated and anonymised analytics data may be retained indefinitely; raw session logs are retained for up to twelve (12) months.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.
Cookies & Tracking Technologies
9.1 What Are Cookies
Cookies are small text files placed on your device when you visit the Platform. They allow the Platform to recognise your device across page visits, retain your preferences, and ensure the secure operation of your session.
9.2 Types of Cookies We Use
- Strictly necessary cookies: Required for the Platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality;
- Functional cookies: Store your language and display preferences between sessions;
- Analytics cookies: Collect aggregated, anonymised data on how players navigate the Platform, used solely to improve service quality. No personally identifiable data is included in analytics reports;
- Session cookies: Temporary cookies that expire when you close your browser, used to maintain your login session and betting cart state.
9.3 Managing Cookies
You may configure your browser to refuse all cookies, accept only first-party cookies, or receive a notification before a cookie is stored. Please be aware that disabling strictly necessary cookies will impair or prevent your ability to use the Platform. Instructions for managing cookies are available in the help documentation of all major browsers.
Data Security
waja888 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include, but are not limited to:
- Encryption: All data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (HTTPS). Account passwords are stored using industry-standard one-way hashing algorithms and are never stored in plain text;
- Access controls: Personal data is accessible only to waja888 staff and contractors with a legitimate operational need. Access is controlled by role-based permission systems and regularly audited;
- Infrastructure security: Platform servers are hosted in access-controlled data centre environments with continuous monitoring, intrusion detection systems, and regular security patching;
- Two-factor authentication: Players are encouraged to enable two-factor authentication (2FA) on their Accounts for an additional layer of security against unauthorised login;
- Incident response: waja888 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights, we will notify affected players without undue delay.
Your Rights
Subject to applicable law, you have the following rights in relation to the personal data that waja888 holds about you. To exercise any of these rights, please contact our support team at [email protected]. We will respond within 30 days of receiving a valid request.
Right of Access
You have the right to request a copy of the personal data we hold about you, together with information about how it is processed. We will provide this in a structured, commonly used format.
Right of Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update most contact details directly through your Account settings.
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Please note that this right is subject to our legal retention obligations — financial and KYC records must be retained for regulatory compliance periods regardless of erasure requests.
Right to Restrict Processing
You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
Right to Data Portability
Where processing is based on your consent or on contractual necessity, you have the right to receive your personal data in a portable, machine-readable format and to request its transfer to another service provider where technically feasible.
Right to Object
You have the right to object to processing based on our legitimate interests, and to withdraw consent for any processing based solely on consent — including marketing communications — at any time without affecting the lawfulness of processing prior to withdrawal.
Minors
waja888 operates a strict minimum age of 21 years for all registered players. The Platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. All account registrations require confirmation of eligibility and are subject to KYC age verification.
If we become aware that personal data has been collected from an individual under the age of 21 without parental or guardian consent, we will promptly close the Account and delete the data in question. If you believe that a minor has provided their data to the Platform, please contact us immediately at [email protected].
International Data Transfers
waja888 operates as a platform serving the Malaysian market. Certain service providers and technology partners engaged by waja888 may process personal data in jurisdictions outside Malaysia. Where such transfers occur, waja888 takes appropriate steps to ensure that personal data is afforded a level of protection consistent with applicable data protection principles, including through contractual protections with data processors.
waja888 does not transfer personal data to any country or territory known to present materially inadequate data protection standards without implementing appropriate safeguards. Players may request information about the specific safeguards in place for any international transfer by contacting our support team.
Policy Updates
waja888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or the services we offer. Material changes will be communicated to registered players via email to their registered address or through a prominent notice on the Platform prior to the changes taking effect.
The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Policy periodically. Continued use of the Platform following the posting of an updated Policy constitutes your acceptance of the revised terms.
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the waja888 data protection team through the following channels:
- Email: [email protected] (plain text — not a clickable link)
- Subject Line: Please use "Privacy Request — [your username]" for data subject rights requests
- Response Time: We aim to acknowledge all privacy-related requests within 5 business days and resolve them within 30 days
- Live Chat: Available 24/7 through the Platform for general queries; formal data requests must be submitted via email
For information about your account, bonuses, or responsible gambling tools, please visit our FAQ page. To learn about responsible gaming support, please visit our Responsible Gambling page.
Play with Confidence on waja888
Your privacy and security are foundational to everything we build. Explore the Platform knowing that your personal data is handled with the care and transparency it deserves.