Privacy Policy

This Privacy Policy ("Policy") is published by juta8 ("the Platform", "we", "us", or "our") and applies to all persons ("you", "your", or "the Player") who access, register on, or interact with the juta8 Platform accessible at juta8.cam, including all associated features, payment interfaces, live chat channels, and customer support services.

juta8 is a Malaysia-facing online gaming platform offering sports betting, live casino, slot games, lottery, crash games, and related entertainment services. In the course of providing these services, juta8 collects, processes, and stores certain categories of personal data about its registered Players. This Policy sets out in full how that data is handled, the legal grounds on which processing takes place, and the rights available to you as a data subject.

This Policy should be read in conjunction with juta8's Terms & Conditions and Responsible Gambling Policy, each of which forms part of the overall framework governing your relationship with the Platform.

The following terms carry the meanings set out below wherever they appear in this Policy:

For the purposes of this Privacy Policy, juta8 acts as the Data Controller in respect of the Personal Data collected from Players who access the Platform at juta8.cam. As Data Controller, juta8 determines the purposes and means of processing your Personal Data and is responsible for ensuring that such processing is carried out in accordance with applicable data protection principles.

All data subject requests, privacy complaints, and enquiries regarding this Policy should be directed to the juta8 Data Protection contact point via our customer support channels, details of which are provided in Section 15 of this Policy.

juta8 collects Personal Data across several categories depending on the nature of your interaction with the Platform. The following table sets out the principal categories of data collected and relevant examples within each category:

juta8 collects Personal Data through the following channels and mechanisms:

• Direct Submission: Data you actively provide during account registration, KYC document upload, deposit or withdrawal requests, support enquiries, and promotional opt-ins;
• Automated Collection: Technical and device data collected automatically via server logs, cookies, session tracking, and analytics tools when you access the Platform;
• Payment Processors: Financial transaction data received from payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank), and cryptocurrency network confirmations;
• Identity Verification Services: Where juta8 uses third-party KYC or age verification services to validate identity documents submitted during the verification process;
• Fraud Prevention & Security Agencies: Data received from fraud prevention databases and risk screening tools used to protect the integrity of the Platform and its Players;
• Publicly Available Sources: In limited circumstances relevant to fraud prevention or AML compliance, data from publicly available registers or databases.

juta8 processes your Personal Data only where a lawful basis exists for doing so. The following table sets out the primary purposes of processing and the corresponding legal basis applied:

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your notification preferences within your Account settings or contact support.

juta8 does not sell, rent, or transfer your Personal Data to third parties for their own marketing purposes. We may share your data with third parties only in the circumstances described below:

• Payment Service Providers: Personal and financial data is shared with payment processors (including Touch 'n Go, Boost, GrabPay, DuitNow, FPX member banks, and cryptocurrency network validators) as strictly required to process your deposit or withdrawal transaction;
• Identity Verification Providers: KYC documents and identity data may be processed by third-party identity verification service providers engaged by juta8 to conduct age and identity checks in compliance with our verification obligations;
• Fraud Prevention & AML Agencies: Certain data may be disclosed to fraud screening and anti-money laundering compliance services used to protect the Platform and its players from financial crime;
• Game Studios and Content Providers: Anonymised or pseudonymised gaming session data may be shared with licensed game content providers for the purpose of game performance analytics and responsible gambling monitoring;
• Regulatory and Law Enforcement Authorities: juta8 may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction;
• Professional Advisors: Accountants, legal counsel, auditors, and other professional advisors engaged by juta8 may access Personal Data on a confidential basis where required for the provision of their professional services.

All third parties to whom juta8 discloses Personal Data are required to maintain appropriate technical and organisational security measures and to process the data solely for the purpose for which it was disclosed.

juta8 retains Personal Data for no longer than is necessary for the purpose for which it was collected, subject to any longer retention period required by applicable law or regulation. The following general retention parameters apply:

• Account and Identity Data: Retained for the duration of your active Account and for a period of five (5) years following account closure, to satisfy anti-money laundering, fraud prevention, and regulatory record-keeping obligations;
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial record-keeping requirements;
• KYC Documents: Retained for a period consistent with AML regulatory requirements, typically five (5) years from the date of the most recent transaction or account closure, whichever is later;
• Gaming Activity Logs: Retained for up to five (5) years to support dispute resolution, responsible gambling monitoring, and platform integrity functions;
• Customer Support Communications: Retained for three (3) years from the date of the interaction to support dispute resolution and service quality monitoring;
• Marketing Preference Data: Retained until you withdraw consent or request erasure, subject to the retention periods applicable to associated account data.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised data (which can no longer be linked to an identifiable individual) may be retained for statistical and analytical purposes without a defined retention limit.

As a Data Subject, you hold the following rights in respect of your Personal Data held by juta8. To exercise any of these rights, please contact us through the channels described in Section 15. juta8 will respond to all valid data subject requests within thirty (30) calendar days of receipt.

juta8 uses cookies and similar tracking technologies on its Platform to enable core functionality, improve user experience, and support platform security and analytics. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly — including maintaining your login session, processing transactions, and preserving security settings. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Used to remember your preferences, such as language settings, game display options, and notification preferences, to personalise your experience;
• Analytics Cookies: Used to collect anonymised data about how Players interact with the Platform, enabling juta8 to identify technical issues and improve the overall user experience. Data collected via analytics cookies does not identify individual users;
• Security Cookies: Used to detect and prevent fraudulent account activity, session hijacking, and other security threats.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. juta8 does not use third-party advertising or tracking cookies.

The juta8 Platform is strictly intended for persons aged 21 years and above. juta8 does not knowingly collect, process, or store Personal Data from persons under the age of 21. Account registration requires age verification, and KYC procedures are in place to detect and prevent underage access.

In the event that juta8 becomes aware that Personal Data has been collected from a person under 21 years of age, we will take immediate steps to close the associated Account, delete the personal data collected, and return any deposited funds to the source payment method where technically possible.

juta8 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS 1.2+) with 256-bit AES encryption for all data transmitted between your device and juta8 servers;
• Encryption of Personal Data and financial records stored within juta8's database infrastructure;
• Multi-factor authentication requirements for staff access to systems containing Personal Data;
• Role-based access controls limiting data access to personnel with a documented operational need;
• Continuous server and network monitoring with automated alerting for anomalous activity;
• Regular internal security assessments and penetration testing of Platform infrastructure;
• Formal data breach response procedures, including notification obligations to affected Players where required by applicable law.

While juta8 takes all reasonable steps to protect your Personal Data, no internet-based transmission or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your Account password and for notifying juta8 immediately if you suspect any unauthorised access to your Account.

The juta8 Platform may contain references to third-party payment providers and services (including Touch 'n Go eWallet, Boost, Maybank, CIMB, and other FPX member banks) in the context of payment method descriptions. Where you are redirected to a third-party platform (such as your banking app or e-wallet interface) to authorise a transaction, your interaction with that third-party service is governed by that party's own privacy policy.

juta8 has no control over, and accepts no responsibility for, the privacy practices of third-party services. We recommend that you review the privacy policies of any third-party service you interact with in connection with your juta8 account activity.

juta8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. The effective date displayed at the top of this page will be updated upon each revision.

Where amendments are material, juta8 will notify registered Players via email or an in-Platform notification prior to the effective date of the change. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically. If you have questions about any change, please contact us using the details in Section 15 before continuing to use the Platform.

If you wish to exercise any of your data subject rights, raise a privacy concern, request clarification on any aspect of this Policy, or submit a formal data protection complaint, please contact juta8 through the following channels:

juta8 aims to resolve all data protection enquiries and formal complaints promptly and within thirty (30) calendar days of receipt. For complex matters, we may require up to an additional thirty (30) days and will inform you of any extension within the initial response period.

If you are not satisfied with juta8's response to your privacy complaint, you may have the right to escalate the matter to the data protection supervisory authority in your jurisdiction of residence.