Privacy Policy

This Privacy Policy ("Policy") is issued by okta388, the operator of the online sports betting and casino platform accessible at https://okta388.cam ("the Platform"). It applies to all personal data collected from individuals who access, register on, or otherwise interact with the Platform, including users from Malaysia and other jurisdictions.

okta388 is committed to handling personal data responsibly, transparently, and in accordance with the principles of applicable data protection frameworks. This Policy describes, in plain and precise terms, what personal data we collect, why we collect it, how long we hold it, under what circumstances we may share it, and what rights you have as the data subject.

By creating an account or using any part of the Platform, you acknowledge that you have read and understood this Policy and consent to the data processing practices described herein. This Policy should be read alongside the Terms & Conditions, which govern the overall use of the Platform.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including but not limited to a name, email address, identification number, IP address, location data, or any factor specific to the physical, economic, or online identity of that person.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" means okta388 as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party engaged by okta388 to process personal data on its behalf under a contractual arrangement that imposes appropriate data protection obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the data subject that they agree to the processing of their personal data for a stated purpose.
• "KYC" (Know Your Customer) means the identity and age verification procedures mandated under okta388's licensing obligations and anti-money laundering compliance framework.
• "Cookie" means a small text file placed on a user's device by a web server, used to identify the device and retain session or preference information.

The categories of personal data collected by okta388 are set out in the table below. We collect only what is necessary to achieve the stated processing purposes described in Section 5.

okta388 collects personal data through the following channels:

• Direct Submission: Data you voluntarily provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or participating in promotions.
• Automated Technical Collection: Device and technical data automatically collected when you access the Platform, including IP address, browser information, and session activity logs. This data is collected via standard web server logs and analytics tools.
• Payment Processing Partners: Transaction reference data received from Malaysian payment processors — including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect — when you initiate a deposit or withdrawal. okta388 receives transaction confirmation references and masked payment identifiers; we do not receive or store full bank account numbers or card numbers.
• Cryptocurrency Networks: Publicly visible blockchain transaction data (wallet addresses and transaction hashes) when you use BTC, ETH, USDT, or LTC for deposits or withdrawals.
• Cookies & Similar Technologies: As described in Section 8 of this Policy.

okta388 processes personal data for the following defined purposes only. Data will not be processed for any purpose incompatible with those listed below without renewed consent or a new legal basis:

Where international data protection principles apply, okta388 relies on one or more of the following legal bases to process personal data:

• Contractual Necessity: Processing necessary to perform the contract between okta388 and the user (i.e., the Terms & Conditions accepted at registration), including account management, deposit processing, withdrawal execution, and provision of betting and gaming services.
• Legal Obligation: Processing required to comply with applicable laws and licensing conditions, including KYC identity verification, AML transaction monitoring, underage gambling prevention, and regulatory reporting obligations.
• Legitimate Interests: Processing necessary for okta388's legitimate interests, including fraud prevention, platform security, and aggregated analytics for service improvement — provided such interests are not overridden by the data subject's fundamental rights and freedoms.
• Consent: Processing based on freely given consent for optional data uses. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

okta388 does not sell, rent, or exchange personal data with third parties for marketing purposes. Personal data may be disclosed to third parties only in the following circumstances:

• Payment Processors: Transaction data shared with Malaysian payment service providers (including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and cryptocurrency network processors) solely to execute deposit and withdrawal transactions.
• KYC and Identity Verification Providers: Identity and verification document data shared with third-party identity verification services engaged by okta388 to fulfil KYC obligations under its licensing framework. These providers operate under contractual data processing agreements with okta388.
• Fraud Prevention and AML Services: Transaction and device data may be shared with specialist fraud detection and AML compliance service providers under strict confidentiality obligations.
• Cloud Infrastructure Providers: Personal data is stored on servers managed by cloud infrastructure providers operating under data processing agreements that impose equivalent data protection standards.
• Legal and Regulatory Authorities: okta388 will disclose personal data to competent governmental, regulatory, or law enforcement authorities where required by a valid legal obligation, court order, or formal regulatory request. Where permissible, okta388 will notify affected users of such disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of the Platform's assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

okta388 uses cookies and similar tracking technologies to operate the Platform effectively and to improve user experience. The categories of cookies deployed are as follows:

• Strictly Necessary Cookies: These are essential for the Platform to function. They maintain your login session, remember your account settings, and ensure security features operate correctly. These cookies cannot be disabled without rendering the Platform unusable.
• Functional Cookies: These cookies remember your preferences — such as language settings, preferred odds format, and device type — to personalise your experience. They do not track your activity across external websites.
• Analytics Cookies: okta388 uses anonymised analytics data to understand how users interact with the Platform, which pages are most visited, and where technical errors occur. This information is used solely to improve Platform performance and user experience.

okta388 does not deploy advertising cookies, cross-site tracking pixels, or behavioural profiling technologies for third-party advertising purposes.

You may manage cookie settings through your browser's built-in tools. Disabling strictly necessary cookies will impair Platform functionality. Disabling analytics cookies will not affect your ability to use the Platform.

okta388 implements a multi-layered security framework to protect personal data against unauthorised access, loss, destruction, or disclosure. Key security measures in place include:

• Transport Encryption: All data transmitted between your device and okta388's servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Data at Rest: Stored personal data and sensitive financial records are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within the Platform's operational environment is restricted on a strict need-to-know basis. All internal access is logged and subject to regular audit.
• Two-Factor Authentication: User accounts support two-factor authentication (2FA) to add an additional layer of security beyond the username and password.
• Infrastructure Security: Platform infrastructure is hosted in secure data centre environments with physical access controls, network intrusion detection, and 24/7 monitoring.
• Penetration Testing: Regular independent security assessments are conducted on the Platform's technical infrastructure.

While okta388 employs commercially reasonable security measures, no system is entirely immune to security incidents. In the unlikely event of a data breach affecting your personal data, okta388 will notify affected users in accordance with applicable notification obligations.

okta388 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and licensing obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with okta388's internal data lifecycle management procedures.

Depending on your jurisdiction of residence and the applicable data protection framework, you may be entitled to exercise the following rights in relation to your personal data held by okta388. To exercise any of these rights, please contact us as described in Section 16.

The Platform is strictly restricted to individuals aged 21 years and above. okta388 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If okta388 discovers or is notified that personal data has been collected from an individual who was under 21 at the time of collection, the relevant account will be immediately closed, the personal data will be deleted in accordance with our erasure procedures, and the matter may be reported to relevant authorities.

Parents or guardians who believe their minor child has accessed or registered on the Platform are encouraged to contact okta388 immediately via the support channels described in Section 16.

okta388 operates under an international gaming licence and may engage service providers — including cloud infrastructure, KYC verification, and fraud prevention providers — whose servers are located outside of Malaysia. Where personal data is transferred to countries not recognised as providing an equivalent level of data protection to the user's home jurisdiction, okta388 implements appropriate safeguards, including:

• Standard contractual clauses that impose equivalent data protection obligations on the recipient entity.
• Ensuring that recipients maintain information security standards consistent with those described in Section 9 of this Policy.
• Limiting the categories of data transferred to the minimum necessary for the specific processing purpose.

Malaysian users should be aware that Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data in commercial transactions. okta388 acknowledges the existence of this framework and handles Malaysian user data with appropriate care, notwithstanding that the Platform's licensing jurisdiction may differ from Malaysia.

The Platform may, from time to time, contain references or links to third-party websites or services (for example, payment provider portals accessed during a deposit or withdrawal flow). This Privacy Policy applies solely to data collected by okta388 through the Platform itself.

okta388 is not responsible for the privacy practices of any third-party website or service. When you leave the Platform to complete a payment transaction through a Malaysian banking interface such as Maybank2u or CIMB Clicks, you are subject to that institution's own privacy policies and data handling practices. We encourage you to review the privacy notices of any third-party services you use.

okta388 reserves the right to amend this Privacy Policy at any time. Material changes — such as the introduction of new categories of data collection, new processing purposes, or significant changes to data retention periods — will be communicated to registered users via email notification sent to the registered address on file, or via a prominent notice on the Platform, at least 14 days before the change takes effect.

Non-material amendments (such as typographical corrections, clarifications that do not alter the substance of any clause, or updates to contact details) may take effect immediately upon publication without advance notice.

The current version of this Policy, including the effective date, is always available at https://okta388.cam/privacy-policy. Continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

To exercise your data subject rights, submit a privacy query, or report a concern regarding okta388's data handling practices, please use the following contact channels:

If you are not satisfied with okta388's response to a privacy complaint, you may escalate the matter to the data protection authority or supervisory body applicable in your jurisdiction. Malaysian users may refer to the relevant authorities responsible for enforcing the Personal Data Protection Act 2010 in Malaysia.

Please also refer to our Responsible Gambling page and our Terms & Conditions for additional information governing your use of the Platform.