01
Introduction
This Privacy Policy ("Policy") is published by VG98 ("VG98", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at vg98.casa and its associated subdomains ("Platform"). This Policy governs the collection, storage, processing, use, and disclosure of personal data relating to individuals ("Players", "Users", "you") who register for or use the Platform's services.
VG98 acts as the data controller in respect of all personal data processed under this Policy, except where expressly stated otherwise. We are committed to handling your personal data with transparency, fairness, and in accordance with the applicable data protection laws and regulations under which we operate.
By creating an account on VG98, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. This Policy should be read alongside our Terms and Conditions, which govern the broader contractual relationship between you and VG98.
Note for Malaysian Players: VG98 welcomes players from across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and all other regions. This Policy applies equally to all registered players regardless of their location within Malaysia.
02
Definitions
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
- "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
- "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
- "Data Controller" — the entity that determines the purposes and means of processing Personal Data. VG98 is the Data Controller for all data processed under this Policy.
- "Data Processor" — a third party that processes Personal Data on behalf of VG98 under a written data processing agreement.
- "KYC Data" — identity and verification documents including MyKad, passport, selfie photographs, proof of address, and payment method documentation.
- "Cookies" — small text files placed on your device by the Platform for the purpose of session management, analytics, and personalisation.
- "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
03
Personal Data We Collect
VG98 collects the minimum personal data necessary to operate the Platform, verify player identity, process payments, prevent fraud, and meet our regulatory obligations. The categories of data we collect are set out in the table below:
| Data Category |
Specific Data Points |
Collection Method |
| Registration Data |
Full name, date of birth, email address, phone number, username, password (hashed) |
Provided by Player at registration |
| Identity Verification (KYC) |
MyKad or passport copy, selfie photograph, proof of address (utility bill / bank statement) |
Uploaded by Player upon request |
| Financial Data |
Bank account details (last 4 digits), e-wallet registration details (TnG, Boost, GrabPay phone number), transaction history, deposit/withdrawal amounts in MYR |
Collected during payment processing via FPX, DuitNow, e-walets, crypto |
| Gameplay Data |
Game session history, bet amounts, game outcomes, wagering activity, sports betting selections (EPL, Liga Super Malaysia, UFC, etc.) |
Automatically recorded by Platform systems |
| Technical Data |
IP address, device type, browser type and version, operating system, session timestamps, referal URLs |
Automatically collected via server logs and cookies |
| Communications Data |
Live chat transcripts, email correspondence, support ticket content |
Generated during Player support interactions |
| Responsible Gambling Data |
Self-exclusion requests, deposit limit settings, cooling-off period activations |
Recorded when Player activates responsible gambling tools |
VG98 does not collect special categories of sensitive personal data (such as racial or ethnic origin, health data, or biometric data) except where strictly required for KYC identity verification — in which case, the data is used solely for that purpose and retained only for the legally mandated period.
04
Lawful Basis for Processing
VG98 processes your personal data only where we have a valid lawful basis. The primary lawful bases applicable to our data processing activities are:
- Contractual Necessity: Processing required to fulfil the contract with you — including account creation, payment processing, game provision, and withdrawal requests. Without this processing, we cannot deliver our services.
- Legal Obligation: Processing required to comply with applicable law, including KYC identity verification under anti-money laundering (AML) regulations, age verification requirements, and tax reporting obligations.
- Legitimate Interests: Processing required for VG98's legitimate business interests, including fraud detection, security monitoring, platform maintenance, and improving service quality — provided such interests do not override your fundamental rights.
- Consent: Where VG98 relies on your consent as the lawful basis, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
05
How We Use Your Personal Data
VG98 uses your personal data for the following purposes, each tied to a lawful basis as described in Section 4:
- Account Management: Creating, maintaining, and administering your VG98 account; processing login and authentication; managing account settings and preferences.
- Payment Processing: Processing deposits and withdrawals via FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency channels.
- Identity Verification: Performing KYC checks to verify your identity, age (21+ requirement), and source of funds, as required by our regulatory obligations.
- Fraud Prevention & AML: Detecting, investigating, and preventing fraudulent transactions, money laundering, bonus abuse, multi-accounting, and other prohibited activities.
- Customer Support: Responding to enquiries, resolving disputes, managing complaints, and providing technical assistance via live chat and email.
- Responsible Gambling: Monitoring gameplay for signs of problem gambling; enforcing self-exclusion, deposit limits, cooling-off periods, and other responsible gambling tools activated by the Player.
- Platform Security: Maintaining the security and integrity of the Platform; conducting internal audits; managing incident response.
- Service Improvement: Analysing aggregated, anonymised usage data to identify trends, improve platform performance, and develop new features.
- Legal Compliance: Meeting obligations imposed by applicable law, regulatory bodies, or court orders, including record-keeping and reporting requirements.
- Marketing Communications: Sending promotional emails, bonus offers, and platform updates where you have expressly opted in to receive such communications. You may opt out at any time.
VG98 does not use your personal data to make automated decisions that produce significant legal or similarly significant effects on you without human oversight, except where required by legal obligation.
06
Data Sharing & Third Parties
VG98 does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Your data may be shared with the following categories of recipients only a need-to-know basis and under strict contractual data protection obligations:
- Payment Service Providers: FPX gateway operators, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency processing partners — for the sole purpose of processing your financial transactions.
- KYC & Identity Verification Services: Authorised identity verification technology providers engaged to assist with document authentication and age verification.
- Gaming Platform Providers: Third-party casino game studios and sports data providers engaged to deliver game content to the Platform. These providers may process minimal technical data (session IDs, IP addresses) as necessary to deliver game streams.
- Cloud Infrastructure & Hosting Providers: Secure cloud service providers on whose infrastructure VG98's Platform and data systems are hosted, subject to data processing agreements.
- Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory instruction, VG98 will disclose personal data to competent authorities without prior notice to the Player.
- Fraud Prevention Networks: Shared fraud databases used to identify and prevent cross-platform fraud, money laundering, and abuse — data shared on anonymised or pseudonymised basis where operationally possible.
All third-party service providers engaged by VG98 are contractually bound to process personal data only for the purposes for which it was shared, to maintain appropriate security standards, and to comply with applicable data protection law.
07
Data Retention
VG98 retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The retention schedules applied to the primary data categories are as follows:
| Data Category |
Retention Period |
| Account Registration Data |
Duration of account + 5 years post-closure |
| KYC / Identity Documents |
Duration of account + 7 years (AML legal requirement) |
| Financial Transaction Records |
7 years from transaction date |
| Gameplay Session Data |
3 years from session date |
| Customer Support Records |
3 years from last interaction |
| Technical / Log Data |
12 months from collection |
| Marketing Preferences |
Until opt-out or account closure |
| Responsible Gambling Records |
Duration of account + 5 years |
Following expiry of the applicable retention period, data is securely deleted or permanently anonymised such that it can no longer be attributed to an individual. Where legal obligations require extended retention, data is held in a restricted-access archive and not used for operational purposes.
08
Data Security
VG98 implements technical and organisational security measures comensurate with the risks associated with processing personal data in an online gambling environment. Our security framework includes:
- Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your device and VG98's servers.
- Access Controls: Role-based access control (RBAC) ensures that staff members access only the personal data required for their specific function. All access is logged and subject to periodic audit.
- Two-Factor Authentication: All administrative access to VG98's internal systems requires multi-factor authentication. Players are encouraged to enable 2FA on their accounts.
- Penetration Testing: Regular third-party penetration testing and vulnerability assessments are conducted to identify and remediate security weaknesses.
- Incident Response: VG98 maintains a documented data breach response procedure. In the event of a breach affecting Player data, affected individuals will be notified in accordance with applicable legal requirements.
While VG98 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security against all threats. Players are encouraged to use strong, unique passwords for their VG98 accounts and to enable two-factor authentication.
09
Cookies & Tracking Technologies
VG98 uses cookies and similar technologies to operate the Platform effectively, maintain session continuity, and collect anonymised usage analytics. Cookies used by VG98 are categorised as follows:
ESSENTIAL
Strictly necessary for the Platform to function. Includes session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without preventing access to the Platform.
ANALYTICS
Used to collect anonymised data on Platform usage patterns, page performance, error rates, and feature engagement. Data collected is aggregated and cannot be used to identify individual Players. Used to improve Platform quality and stability.
FUNCTIONAL
Used to remember your preferences and settings, such as language preference, game display settings, and responsible gambling tool configurations. Disabling functional cookies may result in loss of personalisation features.
You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent access to the Platform. VG98 does not use third-party advertising cookies or behavioural profiling technologies.
10
Your Rights as a Data Subject
Subject to applicable data protection law, you hold the following rights in respect of your personal data held by VG98. To exercise any of these rights, contact our support team via live chat or email [email protected]. VG98 will respond to all valid data subject requests within 30 calendar days.
RIGHT OF ACCESS
You may request a copy of the personal data VG98 holds about you, together with information about how it is processed and on what lawful basis.
RIGHT TO RECTIFICATION
You may request correction of inaccurate or incomplete personal data. Players may update basic account information directly via account settings.
RIGHT TO ERASURE
You may request deletion of your personal data where it is no longer necessary for the purpose collected, subject to legal retention obligations (e.g., AML records cannot be deleted early).
RIGHT TO RESTRICTION
You may request that VG98 restricts processing of your personal data in certain circumstances, such as where accuracy is contested or where processing is unlawful.
RIGHT TO PORTABILITY
You may request a machine-readable copy of personal data you have provided to VG98, for transfer to another data controller where technically feasible.
RIGHT TO OBJECT
You may object to processing based on legitimate interests or for direct marketing purposes. VG98 will cease such processing unless compelling legitimate grounds override your interests.
Certain rights cannot be fully exercised where VG98 is legally required to retain or process data — for example, AML-mandated retention periods for KYC and transaction records. VG98 will notify you where a legal exception applies to your request.
11
Minors & Age Verification Policy
VG98's services are strictly intended for individuals who are 21 years of age or older. VG98 does not knowingly collect, store, or process personal data from individuals under the age of 21. Age verification is a mandatory component of the KYC process, and VG98 employs both automated and manual procedures to verify player age before granting full account access.
Where VG98 discovers that an account has been registered by or on behalf of an individual under the age of 21, the account will be immediately suspended. All personal data associated with the account will be deleted to the extent permitted by legal obligations, and any funds in the account will be handled in accordance with our Terms and Conditions and applicable regulatory requirements.
If you become aware that a minor has registered an account on VG98 using false information, please contact our support team immediately via live chat. VG98 takes underage gambling extremely seriously and will act promptly on any report of a suspected underage account. For players aged 21 and above only.
12
International Data Transfers
VG98 operates internationally and may transfer your personal data to countries outside of Malaysia in order to engage with service providers, cloud infrastructure, and gaming platform partners. Where such transfers occur, VG98 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or exceeding the protections afforded under applicable Malaysian data protection requirements.
Safeguards for international data transfers include contractual data processing agreements incorporating standard data protection clauses, and in some cases, adequacy determinations where the receiving jurisdiction offers an equivalent level of protection. VG98 does not transfer personal data to jurisdictions that do not offer adequate protections without having first put appropriate contractual or technical safeguards in place.
13
Changes to This Privacy Policy
VG98 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or operational structure. Material changes will be communicated to registered Players via the email address on file and/or through a prominent notice on the Platform, at least seven (7) calendar days before the changes take effect.
Non-material updates (such as typographical corrections or clarifications that do not alter the substance of the Policy) may be made without advance notice. The "Last Updated" date at the top of this document reflects the most recent revision. We encourage Players to review this Policy periodically to stay informed of how VG98 handles their personal data.
Your continued use of VG98's services following notification of a Policy update constitutes your acceptance of the revised terms. If you do not agree with any change to this Policy, you should cease using the Platform and request account closure before the effective date of the change.