Privacy Policy

This Privacy Policy ("Policy") describes how Pavilion88 ("we", "us", "our", "the Platform") collects, processes, stores, uses, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the Pavilion88 platform at pavilion88.cam and any associated services.

Pavilion88 operates as an online casino and sports betting platform serving Malaysian players. In providing these services, we necessarily collect and process certain categories of personal data. We are committed to processing that data lawfully, fairly, and transparently — consistent with the principles of applicable data protection legislation and the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This Policy applies to all data collected through the Pavilion88 website, mobile interface, live chat system, payment processing flows, customer support interactions, and any other touchpoints where personal data is submitted to or generated by the Platform. By registering an account or continuing to use our services, you acknowledge that you have read and understood this Policy.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which form part of your overall agreement with Pavilion88.

The following terms carry the meanings ascribed to them below throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including names, identification numbers, contact details, financial data, behavioural data, and any combination thereof that could reasonably identify an individual.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — Pavilion88, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of Pavilion88 pursuant to a written data processing agreement (e.g., payment gateway operators, KYC verification providers).
• "Sensitive Personal Data" — personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or financial account details, which warrants a higher standard of protection.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data for one or more specified purposes.
• "KYC Data" — identity verification documentation including copies of government-issued identification (MyKad, passport), selfie photographs, proof of address, and proof of payment method ownership.
• "Cookie" — a small data file placed on your device by the Platform to enable certain functionality, session management, and analytics.

Pavilion88 collects personal data across the following categories, depending on the nature of your interaction with the Platform:

• Full legal name (as per government-issued identification)
• Date of birth (for age verification — players must be 21 or above)
• Email address
• Malaysian mobile phone number
• Chosen username and encrypted password
• Residential address (state, city — e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)

• Copies of Malaysian MyKad (front and back) or valid passport
• Selfie photograph for biometric liveness check (where applicable)
• Proof of address documentation (utility bill, bank statement)
• Proof of payment method ownership (e-wallet screenshot, bank statement)

• Deposit and withdrawal transaction records (amounts, dates, payment methods)
• Payment method identifiers: Touch 'n Go eWallet account number, Boost, GrabPay, DuitNow registered number, Maybank/CIMB/Public Bank account number (truncated, not full account numbers)
• Cryptocurrency wallet addresses (for USDT TRC20 and BTC transactions)
• Wagering history and game participation records
• Bonus and promotion redemption records

• IP address and approximate geolocation (country/state level)
• Device type, operating system, and browser version
• Session timestamps, login history, and access logs
• Cookie identifiers and session tokens

• Live chat transcripts and email correspondence with our support team
• Complaint records and resolution notes
• Survey responses and feedback submissions

• Game session data (games played, stakes, results, duration)
• Navigation patterns, page views, and feature usage within the Platform
• Responsible gambling tool usage (deposit limits set, self-exclusion requests)

Pavilion88 collects personal data through the following means:

When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, or interact with any feature that requires data entry, you provide personal data directly to us.

When you access the Platform, our systems automatically collect technical and behavioural data including IP address, device information, browser type, session duration, pages visited, and game activity. This data is collected through server logs, cookies, and similar tracking technologies.

With your consent (obtained during registration or payment initiation), we may receive identity verification results from our KYC partners, transaction confirmation data from payment processors (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking networks, Maybank, CIMB, Public Bank), and fraud signals from our risk management partners.

In limited circumstances related to fraud prevention and compliance, we may verify information you have provided against publicly available records or databases maintained by regulatory authorities.

Pavilion88 processes your personal data only where a lawful basis exists under applicable data protection law. The primary legal bases applicable to our processing activities are:

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Pavilion88 uses the personal data we collect for the following purposes:

• Account Creation & Management: To register your account, authenticate your identity on login, and maintain your player profile.
• Age Verification: To confirm that all players are aged 21 or above before granting access to real-money gaming services.
• KYC Compliance: To verify your identity and payment methods as required by applicable law and platform security standards.
• Payment Processing: To facilitate deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and cryptocurrency channels, and to process withdrawals to your verified payment method.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, multiple account abuse, money laundering, and other prohibited conduct.
• Responsible Gambling: To monitor gaming patterns that may indicate problem gambling behaviour and to ensure responsible gambling tools are effective.
• Customer Support: To respond to your enquiries, process complaints, and resolve account issues promptly.
• Bonus & Loyalty Administration: To track wagering requirements, issue cashback and loyalty rewards, and administer the Bronze/Silver/Gold tier programme.
• Platform Improvement: To analyse usage patterns and improve the design, performance, and feature set of the Pavilion88 platform.
• Marketing (with consent only): To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications.
• Legal & Regulatory Compliance: To meet our obligations under applicable law, respond to lawful requests from authorities, and maintain required records.

Pavilion88 does not sell, rent, or commercially trade your personal data. We share personal data only in the limited circumstances described below, and only to the extent necessary for the specified purpose:

To process deposits and withdrawals, we share necessary transaction data with our payment partners including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX network operators, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency processing partners. These providers act as data processors under binding agreements and are prohibited from using your data for any purpose other than facilitating your transaction.

KYC documentation is shared with our contracted identity verification service providers for the sole purpose of confirming your identity and age. These providers operate under strict data protection agreements and do not retain your data beyond the verification process.

We may share limited device and transaction data with fraud detection and risk management service providers to protect the Platform and our player community from fraudulent activity.

We may disclose personal data to government authorities, law enforcement agencies, or courts of law where required to do so by applicable law, court order, or regulatory directive. We will only comply with requests that are lawful and proportionate.

In the event of a merger, acquisition, or sale of substantially all of Pavilion88's assets, personal data held by Pavilion88 may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Affected players will be notified in advance of such a transfer.

Pavilion88 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to maintain your session, and to gather anonymised analytics data that helps us improve user experience. The categories of cookies we use are as follows:

Strictly necessary cookies cannot be disabled as they are essential to Platform operation. Functional and analytics cookies may be managed through your browser settings. Note that disabling certain cookies may impair the functionality of the Platform.

Pavilion88 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the duration of your account's active status plus a period thereafter sufficient for dispute resolution and regulatory compliance.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of each transaction, in accordance with applicable financial record-keeping regulations.
• KYC Documents: Retained for a minimum of 5 years following account closure or the completion of the transaction for which verification was required.
• Customer Support Records: Retained for 3 years from the date of the interaction, or longer where an unresolved dispute exists.
• Marketing Preference Records: Retained until consent is withdrawn, plus 1 year for audit trail purposes.
• Technical & Access Logs: Retained for 12 months in standard operation; longer where security investigation requires.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical purposes.

Pavilion88 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data in transit between your device and our servers is encrypted using the same standard as Malaysian banks.
• Encryption at Rest: Sensitive personal data and financial records stored on our servers are encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to Pavilion88 staff who genuinely need it for their role. Access is granted on a least-privilege basis and is logged.
• Two-Factor Authentication: Internal systems containing personal data require multi-factor authentication for staff access.
• Penetration Testing: Our security team conducts regular penetration tests and vulnerability assessments of all systems that process personal data.
• Incident Response Plan: We maintain a formal data breach incident response plan. In the event of a breach affecting your personal data, we will notify you promptly with details of the incident and recommended protective actions.
• Staff Training: All Pavilion88 employees who handle personal data receive mandatory training on data protection obligations and security best practices.

As a data subject under applicable data protection law, you hold the following rights in respect of your personal data processed by Pavilion88. To exercise any of these rights, please contact us via live chat or email (see Section 16). We will respond to all valid requests within 30 calendar days.

Please note that certain rights are subject to exceptions and may not apply in all circumstances — for example, the right to erasure is limited where we are legally required to retain certain records (such as financial transaction records under applicable law).

Pavilion88 strictly prohibits access by individuals under the age of 21. Our services are designed for and marketed exclusively to adults. We do not knowingly collect personal data from any person under the age of 21.

All registrations are subject to age verification during the KYC process. If we become aware that personal data has been collected from a person who is under 21 years of age, we will immediately suspend the associated account, delete or anonymise the personal data collected, and refuse any withdrawal request in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that your child may have registered an account on Pavilion88, please contact us immediately at [email protected] so that we can take prompt action.

Pavilion88 sends promotional communications — including bonus offers, reload promotions, sports betting highlights, and platform news — only to players who have opted in to receive such communications during registration or through their account settings.

Marketing communications may be sent via email or in-platform notification. We do not send unsolicited marketing text messages. All marketing emails include a clearly visible opt-out mechanism. You may also update your communication preferences at any time through your account settings or by contacting our support team.

Withdrawing consent from marketing communications does not affect your ability to use the Pavilion88 platform and will not result in any limitation of your account features or bonus eligibility. Opting out is processed within 5 business days.

Pavilion88 operates primarily within the Malaysian market and endeavours to keep personal data processing within jurisdictions that offer an adequate level of data protection. In circumstances where personal data is processed by third-party service providers located outside Malaysia (for example, game content providers, cloud infrastructure partners, or KYC verification services operating internationally), Pavilion88 ensures that appropriate safeguards are in place.

Safeguards for international transfers include: binding contractual clauses requiring the recipient to protect data to a standard equivalent to Malaysian law; data processing agreements with all international processors; and, where applicable, adequacy assessments to confirm recipient jurisdiction standards.

You may request details of any international transfers of your personal data and the safeguards applied by contacting us via the channels in Section 16.

Pavilion88 reserves the right to amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, our data processing activities, or operational requirements. All amendments will be published on this page with an updated effective date.

Where amendments are material — meaning they significantly affect how your data is processed or your rights as a data subject — Pavilion88 will provide not less than 14 calendar days' advance notice via registered email address prior to the changes taking effect.

For non-material amendments (such as typographical corrections or administrative updates), the Policy may be updated without advance notice. We encourage you to review this page periodically to remain informed of how your data is being handled.

Your continued use of the Pavilion88 platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated terms. If you do not accept the revised Policy, you should cease using the Platform and contact us to request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Pavilion88 Data Protection team through the following channels:

When submitting a data subject rights request, please provide: your full registered name, your account username, the specific right you wish to exercise, and any relevant context. We may need to verify your identity before processing the request to prevent unauthorised disclosure of your data.

This Privacy Policy was last reviewed and updated on 1 January 2026. Pavilion88 — Malaysia's trusted online casino and sports betting platform, serving players across Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and beyond.