Kafe777 Privacy Policy – Personal Data Protection for Malaysian Players

1. Introduction

Kafe777 (operating under the domain kafe777.best) is fully committed to protecting the privacy and data security of all our players in Malaysia. This Privacy Policy transparently explains how we collect, use, store and protect your personal information when you use the kafe777 platform — whether through our website or mobile app.

This kafe777 Privacy Policy is prepared in accordance with the provisions of Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how organisations in Malaysia may collect and process individuals' personal data. As a kafe777 player who is a Malaysian citizen or resident, you have rights guaranteed under this legislation.

By registering an account or continuing to use the kafe777 platform, you acknowledge that you have read and understood this Privacy Policy, and that you consent to the collection and use of your personal data as described in this document. If you do not agree, please do not proceed with registration or use of the kafe777 platform.

Kafe777 acts as a "data processor" under Malaysia's PDPA. This means we are responsible for ensuring that all personal data we hold is processed lawfully, fairly, securely and in accordance with the purposes we have disclosed to you.

2. Types of Information Collected by kafe777

Kafe777 only collects data categories that are strictly necessary to operate our services safely and meet our legal obligations. Below are the main categories of data we collect.

Kafe777 does not collect sensitive data such as health information, religious beliefs, political affiliations or biometric data unless specifically required for identity verification purposes and with your explicit consent.

3. How kafe777 Collects Your Data

Your personal data is collected by kafe777 through several different channels, depending on how you interact with our platform.

• Directly from you — when you complete the kafe777 account registration form, go through the KYC process, make a deposit or withdrawal, contact our support team, or take part in promotions and surveys.
• Automatically during use — kafe777's systems automatically log platform activity such as games played, bets placed, session duration, and your device's technical data for security and service improvement purposes.
• Through cookies and similar technologies — kafe777 uses session cookies and preference cookies to maintain a consistent user experience. Further details on our cookie usage can be found in Section 8.
• From legitimate third parties — in certain circumstances, kafe777 may receive information from authorised third-party identity verification service providers, or payment service providers such as Touch 'n Go, GrabPay or DuitNow, to verify transactions.
• Via referral programme — if a kafe777 player refers you to register, we may receive your basic contact details (email or phone number) from that player solely for the purpose of sending you a registration invitation.

4. How kafe777 Uses Your Data

Kafe777 uses your personal data solely for the legitimate, stated purposes below. We do not use your data for any other purpose without first obtaining fresh consent from you.

• Account management — creating, verifying, managing and securing your kafe777 account, including processing logins and two-factor authentication.
• Payment processing — securely processing deposits and withdrawals in MYR via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks and FPX.
• KYC and AML Compliance — verifying player identities to comply with Malaysia's Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.
• Security and fraud prevention — detecting and preventing unauthorised access, fraud, money laundering and misuse of the kafe777 platform.
• Customer support — to handle enquiries, complaints and support requests that you submit to the kafe777 support team in Bahasa Melayu.
• Responsible gambling compliance — to monitor usage patterns in order to identify players who may need responsible gaming support, and to enforce limits you have set yourself.
• Service communications — to send important account-related notifications, including transaction confirmations, security updates and material changes to our terms.
• Platform improvements — analysing usage data in aggregated, anonymised form to improve the performance, security and user experience of the kafe777 platform.
• Marketing (with your consent) — sending promotional information, bonus offers and the latest kafe777 news only where you have given explicit consent. You may withdraw this consent at any time.

5. Disclosure of Data to Third Parties

Kafe777 does not sell, rent or disclose players' personal data to third parties for their marketing purposes. However, in the course of operating our platform, kafe777 may need to share certain information with the following parties under strictly limited and controlled circumstances.

• Payment service providers — required transaction information is shared with payment processors such as Touch 'n Go, GrabPay, DuitNow and banks involved in FPX solely for the purpose of processing your deposits and withdrawals.
• Authorised game providers — game session information that must be shared with providers such as Pragmatic Play, PG Soft and Evolution Gaming to enable games to function and results to be recorded correctly.
• KYC service provider — copies of identification documents submitted during the KYC process may be processed by accredited third-party identity verification service providers who are bound by strict confidentiality agreements with kafe777.
• Law enforcement authorities — kafe777 will disclose information to the police, regulatory authorities or courts when required to do so under applicable Malaysian law, or where such disclosure is necessary to protect the rights, property or safety of kafe777, our players or the public.
• Technical infrastructure provider — cloud and hosting service providers used by kafe777 may have technical access to data stored on their servers, but they are bound by strict data protection agreements and are not permitted to use that data for their own purposes.

All third parties that receive data from kafe777 are bound by contractual agreements to handle that data to data protection standards no less stringent than those we apply to ourselves.

6. kafe777 Data Security Measures

Kafe777 implements multiple layers of technical and organisational safeguards to protect your personal data against unauthorised access, loss, destruction or accidental disclosure.

• Data encryption in transit — all communications between your device and kafe777's servers are encrypted using the TLS 1.3 protocol with AES-256 encryption. This means that even if someone were to intercept your network traffic, the data transmitted would be unreadable.
• Data encryption at rest — account passwords are stored in an irreversible hashed format using the bcrypt algorithm. Sensitive financial information is stored in encrypted form using AES-256 encryption.
• Access controls — only kafe777 staff who require access to specific data to perform their designated job functions are permitted to do so. This access is governed by a role-based access control (RBAC) system.
• Two-factor authentication (2FA) — kafe777 offers 2FA for all player accounts and requires 2FA for all internal administrative access as an additional layer of security.
• Continuous security monitoring — kafe777's security monitoring system operates 24/7 to detect any suspicious activity, intrusion attempts or anomalies that may indicate a security threat.
• Regular security audits — kafe777 conducts regular security audits and penetration testing by independent security experts to identify and address any vulnerabilities before they can be exploited.
• Incident response plan — kafe777 has a clearly defined incident response procedure to address any data breaches swiftly and effectively, including notification procedures for affected players.

While kafe777 takes all reasonable steps to protect your data, no system can be guaranteed 100% secure. The security of your account also depends in part on your own actions — use a strong password, enable 2FA, and never share your login credentials with anyone.

7. Data Retention Period

Kafe777 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or for the period required under applicable Malaysian law — whichever is longer.

• Active account data — for as long as your kafe777 account remains active, all associated data will be retained to ensure continuity of service.
• Financial transaction records — kafe777 is legally required to retain financial transaction records (deposits, withdrawals, betting records) for a minimum of seven (7) years for AML and tax compliance purposes.
• KYC Documents — copies of MyKad and other identity verification documents are retained for the period required under Malaysia's AML legislation, typically five (5) years after the end of the business relationship.
• Support communication data — live chat and email conversation records are retained for two (2) years for service improvement purposes and to resolve any disputes that may arise.
• After account closure — once your account is closed, kafe777 will delete or anonymise your personal data within ninety (90) days, except for data that must be retained for legal compliance as outlined above.

8. Cookies & Tracking Technologies

Kafe777 uses cookies and similar tracking technologies to keep the platform running smoothly and to deliver a better user experience. Below are the types of cookies we use.

• Session cookies (required) — required to manage your login session, store items in your betting slip and maintain security settings while you use the kafe777 platform. These cookies cannot be disabled without affecting the platform's core functionality.
• Preference cookies — storing your preferences such as interface language and display settings so you don't have to reconfigure them each time you log in to kafe777.
• Analytics cookies — used by kafe777 to understand how players interact with the platform — which pages are visited most frequently, how long sessions last, and where players encounter issues. This data is collected in aggregated, anonymised form.
• Security cookies — to help kafe777 detect suspicious activity, such as login attempts from unusual locations or unexpected changes to account settings.

You can manage cookie settings through your browser preferences. However, disabling certain cookies may affect the functionality of the kafe777 platform. Third-party cookies used by our game providers such as Pragmatic Play and Evolution Gaming are subject to their respective privacy policies.

9. Your Rights as a kafe777 Player

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and kafe777's own policies, you hold the following rights regarding your personal data. All rights can be exercised by contacting us at support@kafe777.best.

10. Protection of Children's Data

Kafe777 is an online entertainment platform restricted to individuals aged eighteen (18) and above. Our platform is not designed for, nor intended to be used by, minors.

Kafe777 does not knowingly collect personal data from individuals under the age of 18. If you are a parent or guardian and believe your child under 18 has provided personal data to kafe777, please contact us immediately at support@kafe777.best. kafe777 will take steps to delete that information promptly upon verifying the situation.

11. Cross-Border Data Transfers

In the course of operating the kafe777 platform, some of your personal data may be processed or stored on servers located outside Malaysia — particularly in connection with international gaming software providers such as Pragmatic Play, PG Soft, NetEnt and Evolution Gaming, which operate across multiple countries.

When your personal data is transferred outside Malaysia, kafe777 ensures adequate protections are in place through the following mechanisms:

• Binding data processing agreements with all third-party providers who receive kafe777 player data, requiring them to uphold data protection standards equivalent to Malaysia's PDPA.
• Data transfers are made only to jurisdictions with recognised data protection laws, or where adequate contractual safeguards are in place.
• The most sensitive financial data is processed in an encrypted environment regardless of the physical location of the servers used.

12. Amendments to This Privacy Policy

Kafe777 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements or player feedback. We are committed to notifying you of any material changes that affect how we handle your personal data.

When we make material changes to this Privacy Policy, kafe777 will display a prominent notice on the platform at least seven (7) days before the changes take effect, and send an email notification to all affected registered members. The "Updated" date at the top of this document will always reflect the date of the most recent revision.

Your continued use of the kafe777 platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to discontinue use of the platform and close your account.

13. Contact Us Regarding Privacy

If you have any questions, concerns or requests regarding kafe777's Privacy Policy or how we handle your personal data, our privacy team is ready to assist you.

For more complex enquiries relating to the exercise of your PDPA rights, please include in your email: your full name, kafe777 account number, the type of request (access, correction, deletion, etc.), and any other relevant information. This will help us process your request more quickly and accurately.

You may also refer to supporting documents such as Terms & Conditions and page Responsible Gaming kafe777 for further information about your rights and our commitment to players in Malaysia.