Privacy Policy

This Privacy Policy ("Policy") describes how Sambal88 ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects the personal data of users ("you", "Player", "User") who access or use the Sambal88 website located at https://sambal88.cam and all associated services.

Sambal88 operates as an online casino and sports betting platform serving Malaysian players and other eligible users. In the course of providing our services — which include online slot games, live casino tables, sports betting markets covering Liga Super Malaysia, the English Premier League, UFC, and other competitions, as well as payment processing and player account management — we necessarily collect and process certain categories of personal data.

We take our data protection obligations seriously. This Policy is written in plain, accessible English so that you can understand exactly what we do with your data and what choices you have. By creating a Sambal88 account, making a deposit, or accessing any part of our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing activities described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

Sambal88 collects personal data across several categories depending on how you interact with our platform. We collect only what is reasonably necessary to provide our services, maintain account security, and satisfy our legal obligations.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device type and model, screen resolution, and time zone settings.
• Usage Data: Pages visited, features accessed, search queries, session duration, click paths, and interaction events on the Sambal88 platform.
• Transactional Data: Details of all deposits, withdrawals, bets placed, games played, bonus activations, and account balance changes.
• Location Data: Approximate geographic location inferred from your IP address, used for fraud prevention and regulatory compliance purposes only.
• Cookie and Tracking Data: Session identifiers, preference cookies, analytical cookies, and security tokens. See Section 7 for full details.

Sambal88 processes your personal data only for defined, legitimate purposes. The table below sets out the primary purposes for which we use each category of data:

Sambal88 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to create and manage your account, process payments, and deliver gaming services.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including AML obligations, KYC requirements, and financial reporting duties.
• Legitimate Interests: Processing serves a legitimate interest of Sambal88 (or a third party) that is not overridden by your rights and freedoms — for example, fraud detection, platform security, and internal analytics.
• Consent: Where none of the above bases applies, we will ask for your explicit consent before processing — primarily for optional marketing communications and certain cookie categories.

Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment to confirm that our interests do not override your fundamental rights to privacy. You may request a summary of this assessment by contacting our support team.

Sambal88 does not sell, rent, or trade your personal data. We share data with third parties only where it is necessary to operate our platform, satisfy legal obligations, or protect the security of our systems. The categories of third parties with whom we may share your data are set out below:

6.1 Service Providers (Data Processors)

• Payment processors and eWallet providers — including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing partners — to facilitate deposits and withdrawals.
• KYC and identity verification providers — third-party services that assist with document verification and age confirmation as part of our regulatory compliance obligations.
• Game content providers — licensed game studios and platform providers (such as PG Soft, Pragmatic Play, Evolution Gaming, and JILI) who deliver game content; these providers receive only the transactional data necessary to operate the games.
• Cloud infrastructure and hosting providers — who store and process platform data on our behalf under strict data processing agreements.
• Customer support platform providers — who power our live chat and support ticketing infrastructure.

6.2 Legal and Regulatory Disclosures

Sambal88 may disclose your personal data to governmental authorities, regulatory bodies, or law enforcement agencies where we are legally required to do so, or where we determine in good faith that such disclosure is necessary to: comply with a legal obligation; protect the rights, property, or safety of Sambal88, its players, or third parties; or investigate suspected fraud or other criminal activity.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Sambal88's business assets, your personal data may be transferred to the acquiring or successor entity. We will notify affected players of any such transfer and the privacy implications in advance where reasonably practicable.

Sambal88 uses cookies and similar tracking technologies on our website to enable core functionality, improve user experience, and gather aggregated analytics data. The categories of cookies we use are described below:

You can manage your cookie preferences through your browser settings. Please note that disabling essential or security cookies may affect the functionality of the Sambal88 platform. Most browsers allow you to refuse third-party cookies while continuing to accept first-party cookies — we recommend reviewing your browser's help documentation for specific instructions.

Sambal88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Upon expiry of the applicable retention period, data is securely deleted or irreversibly anonymised.

Sambal88 has implemented a comprehensive set of technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. Our security framework includes, but is not limited to:

• Transport Layer Encryption: All data transmitted between your browser or device and our servers is encrypted using TLS 1.3 and 256-bit SSL certificates.
• Encryption at Rest: Sensitive personal data, KYC documents, and financial records are encrypted at rest using AES-256 encryption on our database infrastructure.
• Access Controls: Role-based access control (RBAC) limits internal access to personal data on a strict need-to-know basis, with all access events logged and auditable.
• Two-Factor Authentication: All internal administrative access to systems containing personal data requires multi-factor authentication.
• Vulnerability Management: We conduct regular vulnerability assessments and penetration testing of our platform and infrastructure. Critical vulnerabilities are patched on an expedited basis.
• Incident Response: Sambal88 maintains a documented data breach response procedure. In the event of a breach likely to result in a risk to player rights, we will notify affected players and, where required, relevant authorities within applicable statutory timeframes.

As a data subject, you have a number of rights in relation to the personal data we hold about you. Sambal88 is committed to honouring these rights in a timely and transparent manner. Your rights include:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how and why it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. For basic account details, you may update these directly within your account settings.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no other legal basis applies. Note that we may be legally required to retain certain data (e.g., AML records) even following a deletion request.
• Right to Restrict Processing: You may request that we limit our processing of your data in certain circumstances — for example, while we investigate a rectification request.
• Right to Data Portability: Where processing is based on consent or contractual necessity, you may request that we provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact our Data Protection team at the email address listed in Section 14. We will respond to all verifiable requests within 30 calendar days. We may need to verify your identity before processing a data rights request to protect against fraudulent access to another person's data.

The Sambal88 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals under the age of 21.

If we become aware that we have inadvertently collected personal data from a person under the minimum age, we will take immediate steps to delete all associated data and close the relevant account. All wagers and transactions associated with an underage account will be voided in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a minor in your care has registered an account with Sambal88, please contact our support team immediately so we can investigate and take appropriate action without delay.

The Sambal88 website does not include outbound links to third-party websites as a matter of policy. However, the payment processing and game delivery services we use may involve integrations with third-party systems. Once you interact with a third-party system — for example, completing a DuitNow or FPX payment through your bank's own portal — you are subject to that third party's own privacy policy and terms of service.

Sambal88 has no control over, and assumes no responsibility for, the privacy practices or content of third-party services accessed in connection with your use of our platform. We recommend reviewing the privacy notices of any third-party payment providers you use in connection with your Sambal88 account.

Sambal88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes — meaning changes that significantly affect your rights or the way we use your data — we will provide advance notice through one or more of the following channels: a prominent notice on the Sambal88 website, an email notification to your registered address, or a notification within your player account.

The effective date of the current version of this Policy is displayed at the top of the page. We encourage you to review this Policy periodically. Your continued use of the Sambal88 platform following the publication of an updated Policy constitutes acceptance of the revised terms.

Where an amendment involves a new category of processing that requires your consent, we will request that consent separately before commencing the new processing activity.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Sambal88 handles your personal data, please contact us through any of the following channels. All data rights requests and privacy enquiries should be directed to our support team with a clear description of your request:

We aim to acknowledge all privacy-related requests within two business days and to resolve them fully within 30 calendar days. Where a request is complex or involves a large volume of data, we may notify you of an extension to this timeline in accordance with applicable data protection obligations.

If you are not satisfied with our response to a data rights request or privacy complaint, you may escalate the matter through the formal channels described in our Terms and Conditions, or contact a relevant data protection authority in your jurisdiction.