Privacy Policy

This Privacy Policy (hereinafter "the Policy") sets out how kaya86 (hereinafter "the Company", "we", "us", or "our"), the operator of the online gaming and sports wagering platform accessible at kaya86.cam, collects, processes, stores, and protects the personal data of individuals who access or use the Platform.

kaya86 is a premium online casino and sports betting service built specifically for the Malaysian market. Our platform is available to registered members throughout Malaysia, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other states and federal territories. All financial transactions are denominated in Malaysian Ringgit (MYR) and processed via locally integrated payment channels including Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank.

The Company is committed to processing personal data responsibly, transparently, and in accordance with applicable data protection laws and principles. This Policy should be read in conjunction with the kaya86 Terms and Conditions and our Responsible Gambling Policy, both of which are accessible via the navigation menu.

The following definitions apply throughout this Policy:

kaya86 collects personal data from you through several channels: directly when you register an account or interact with our support team, automatically through your use of the Platform, and from third parties in the course of payment processing and identity verification.

kaya86 applies the principle of data minimisation: we collect only the data that is strictly necessary for the purposes described in this Policy. We do not collect sensitive personal data beyond what is required for KYC compliance and responsible gambling obligations.

The personal data we hold about you is used for the following purposes:

• Account Management: To create and maintain your kaya86 account, including processing registrations, managing authentication, and facilitating password recovery;
• Payment Processing: To process deposits and withdrawals via your selected MYR payment method, including Touch 'n Go eWallet, DuitNow, FPX, Boost, GrabPay, and bank transfers to Maybank, CIMB, Public Bank, and Hong Leong Bank accounts;
• Identity Verification (KYC): To verify your identity and age in compliance with our anti-money-laundering (AML) obligations and our minimum age requirement of 21 years;
• Service Delivery: To provide access to all Platform features including slot games, live casino tables, sports betting, live football wagering, lottery, and arcade games;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account abuse, bonus misuse, and any other activity prohibited under our Terms and Conditions;
• Responsible Gambling: To monitor gaming behaviour and apply responsible gambling controls where a Player has set deposit limits, session reminders, or self-exclusion restrictions;
• Legal and Regulatory Compliance: To fulfil our obligations under applicable anti-money-laundering regulations, licensing requirements, and any lawful requests from competent authorities;
• Customer Support: To respond to account enquiries, process complaints, and provide assistance via live chat or email;
• Platform Improvement: To analyse aggregate, anonymised usage data for the purpose of improving Platform performance, user experience, and feature development. This analysis does not involve individually identifiable data.

kaya86 processes personal data only where a valid legal basis exists. The applicable legal bases are as follows:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered Player, including account management, payment processing, and service delivery;
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC/AML obligations, age verification requirements, and responses to lawful authority requests;
• Legitimate Interests: Processing carried out in the pursuit of the Company's legitimate business interests where those interests are not overridden by your data protection rights — including fraud detection, platform security, and aggregate analytics;
• Consent: Where you have provided specific, informed consent to a particular processing activity — for example, opting into promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

kaya86 does not sell, trade, or rent your personal data to any third party. We may share your personal data with the following categories of recipients only where strictly necessary:

• Payment Service Providers: Financial institutions and payment gateway operators (including those supporting Touch 'n Go eWallet, DuitNow, FPX, Boost, and GrabPay) require transaction data to process deposits and withdrawals. These providers operate under their own data protection obligations and are not authorised by kaya86 to use your data for any other purpose;
• KYC / Identity Verification Partners: Third-party identity verification service providers engaged by kaya86 to assist in processing KYC submissions. These providers act as Data Processors under binding data processing agreements;
• Game Content Providers: Licensed international game studios whose titles are hosted on the kaya86 Platform may receive anonymised session and outcome data for RNG auditing and technical support purposes. No personally identifiable Player data is shared with game studios;
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement, regulatory bodies, or courts where required by applicable law, a valid court order, or a lawful directive from a competent authority. We will notify affected Players of such disclosures where legally permitted to do so;
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by the Company may access personal data on a confidential, need-to-know basis.

All third-party recipients of personal data are required to maintain the confidentiality and security of any data provided to them and to process it only for the specific purpose for which it was disclosed.

The kaya86 Platform uses cookies and similar technologies including local storage and session tokens to deliver and maintain core Platform functionality. The following categories of cookies are in use:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication tokens, CSRF protection cookies, and load-balancing identifiers. These cookies cannot be disabled without preventing access to the Platform;
• Functional Cookies: Used to remember your preferences such as language settings, game display options, and saved deposit method selections. Disabling these cookies may result in a degraded user experience;
• Security Cookies: Used by our fraud detection systems to identify anomalous login patterns, detect credential stuffing attempts, and flag suspicious account activity;
• Analytics Cookies: Used to collect aggregate, anonymised data about Platform usage patterns — including pages visited, time on site, and feature interactions — for the purpose of Platform improvement. Individual Users are not identified in these reports.

kaya86 does not use third-party advertising cookies, social media tracking pixels, or any cookie technology designed to track your behaviour across websites unrelated to kaya86.cam. You may manage cookie preferences through your browser settings, noting that disabling essential cookies will impair Platform functionality.

kaya86 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply:

• Account Data (active accounts): Retained for the duration of the account relationship plus five (5) years following account closure, in compliance with our AML record-keeping obligations;
• KYC Documents: Retained for five (5) years from the date of verification, as required by applicable anti-money-laundering regulations;
• Transaction Records: Retained for five (5) years from the date of each transaction. Financial records may be retained for longer where required by a specific regulatory obligation or ongoing legal proceeding;
• Support Communications: Retained for two (2) years from the date of the final communication in each support thread, or longer where the communication forms part of an ongoing complaint or dispute;
• Technical and Usage Data: Aggregated and anonymised after ninety (90) days. Raw session logs are retained for up to twelve (12) months for fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identified individual.

kaya86 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between end-user devices and Platform servers;
• AES-256 encryption for sensitive personal data and financial records stored at rest;
• Role-based access control (RBAC) ensuring that only authorised personnel with a documented business need can access personally identifiable data;
• Comprehensive audit logging of all access to personal data, with regular review of access logs for anomalous activity;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Multi-factor authentication (MFA) requirements for all staff with access to production systems containing personal data;
• Formal incident response procedures including notification protocols for data breaches that may affect Player rights.

As a data subject whose personal data is processed by kaya86, you are entitled to exercise the following rights at any time by contacting our support team:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed. We will provide this within 30 calendar days of receiving a valid request;
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request correction. Account details such as name and contact information can be updated by contacting support;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations. Note that data required for AML compliance cannot be deleted prior to the statutory retention period;
• Right to Restriction: You may request that processing of your personal data be restricted in certain circumstances, such as while a rectification request is being assessed;
• Right to Data Portability: You may request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format;
• Right to Object: You may object to processing carried out on the basis of legitimate interests where you believe that your own rights and interests override the Company's grounds for processing;
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, contact our support team at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing any data rights request and respond within 30 calendar days.

In the course of providing our services, personal data may be transferred to and processed in countries outside Malaysia, including jurisdictions where our server infrastructure, KYC service providers, or game content partners are located. Where such international transfers occur, kaya86 ensures that adequate safeguards are in place to protect the transferred data, including:

• Data processing agreements with recipient entities that impose equivalent data protection obligations to those described in this Policy;
• Transfer only to jurisdictions that maintain an adequate standard of data protection as assessed by recognised international frameworks;
• Contractual clauses that bind recipient processors to the Company's data protection standards regardless of the destination jurisdiction.

Players with concerns about international data transfers may contact our support team for further information about the specific safeguards applied to their data.

The kaya86 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of our mandatory KYC process.

If the Company becomes aware that personal data has been inadvertently collected from an individual under the minimum age threshold, that data will be permanently deleted without delay and the associated account will be closed. Any funds deposited by an underage individual will be returned to the original payment method.

If you believe that a minor has registered or attempted to register on kaya86, please contact our support team immediately at [email protected]. We take underage gambling prevention extremely seriously and respond to all such reports as a priority matter.

kaya86 reserves the right to update or amend this Privacy Policy at any time. Changes may be required to reflect updates in our data processing practices, new legal or regulatory obligations, changes in the services we offer, or improvements in our privacy practices.

Material changes to this Policy will be communicated to registered Players via email notification to the address registered on your account, or via a prominent in-platform notification, at least fourteen (14) days prior to the effective date of the change. Minor amendments that do not materially affect your rights may be implemented with immediate effect and will be reflected in the "Effective Date" stated at the top of this page.

Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree to the amended Policy, you should cease use of the Platform and may request account closure by contacting our support team.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by kaya86, please contact our Data Protection team via the following channels:

We aim to acknowledge all privacy-related enquiries within 24 hours and to resolve data rights requests within 30 calendar days. Complex requests may require additional time; in such cases, we will notify you of the expected resolution timeline within the initial response.