At cm888, your privacy is a foundational commitment — not an afterthought. This policy explains in plain, structured terms exactly what data we collect, why we collect it, how it is used, and what rights you hold over your personal information.
These cards outline the six core privacy principles that govern every data decision we make. Full details are provided in the policy sections below.
We collect only the personal data that is strictly necessary for the purposes stated in this policy. We do not gather data speculatively or for purposes we cannot justify to you on request.
All personal data stored by cm888 is protected by 256-bit SSL encryption in transit and AES-256 encryption at rest. Access to personal data is restricted on a strict need-to-know basis among our staff.
cm888 does not sell, rent, or commercially trade your personal data to any third party under any circumstances. Your data is yours. We are stewards of it — not owners who can monetise it without your consent.
This Privacy Policy is written in plain English, structured clearly, and updated whenever our data practices change. We will always notify you of material changes before they take effect.
You have the right to access, correct, export, and delete your personal data. Requests are processed within 30 days. See Section 9 of this policy for the full list of data rights available to you.
We retain personal data only for as long as it is needed to fulfil the purposes described in this policy, or as required by applicable regulatory obligations. Data no longer required is securely deleted.
This Privacy Policy ("Policy") is published by cm888 ("the Platform", "we", "us", "our") and applies to all personal data collected from individuals ("Users", "Members", "you") who access or use the cm888 website at https://cm888.casa and any associated services, features, or mobile versions thereof (collectively, "the Platform").
cm888 is committed to protecting the privacy and personal data of all Members in accordance with applicable data protection legislation and best-practice standards for the online gaming industry. This Policy describes in detail how we collect, store, process, share, and safeguard personal data, and clearly sets out the rights you hold as a data subject.
By registering an account on cm888 or by continuing to use the Platform after this Policy has been brought to your attention, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform and close your account.
This Policy forms an integral part of the cm888 Terms & Conditions. Reading this Policy alongside our Terms & Conditions will give you a complete picture of how we operate and what obligations we owe you as a Member.
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
cm888 collects the following categories of Personal Data, depending on the nature of your interaction with the Platform:
3.1 Registration & Identity Data
3.2 Financial & Transaction Data
3.3 Platform Usage Data
3.4 Communications Data
cm888 collects Personal Data through the following primary channels:
cm888 processes your Personal Data for the following purposes:
| Purpose | Data Categories Used | Legal Basis |
|---|---|---|
| Account registration & management | Identity, contact, login data | Contract performance |
| KYC identity verification | Identity documents, selfie, address proof | Legal obligation (AML/KYC) |
| Deposit & withdrawal processing | Financial, transaction data | Contract performance |
| Fraud prevention & security | Usage, device, transaction data | Legitimate interests |
| Regulatory compliance & AML monitoring | Identity, financial, transaction data | Legal obligation |
| Platform improvement & analytics | Usage, device, clickstream data | Legitimate interests |
| Customer support | Communications, account data | Contract performance |
| Responsible gambling monitoring | Usage, wagering pattern data | Legal obligation / legitimate interests |
| Marketing & promotional communications | Contact, usage, preferences | Consent (opt-in) |
cm888 will never use your Personal Data for any purpose not listed in the table above without first obtaining your explicit consent or establishing a new lawful basis for processing.
cm888 processes Personal Data under the following legal bases, as applicable to each processing activity:
cm888 does not sell, rent, or commercially trade your Personal Data to any third party. We may, however, share specific Personal Data with carefully selected third parties in the following circumstances:
All third-party Data Processors engaged by cm888 are bound by contractual data processing agreements that require them to apply appropriate technical and organisational security measures and to process Personal Data only in accordance with our documented instructions.
cm888 uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The types of cookies we use are as follows:
You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your core Platform experience, though some personalisation and analytics features may be limited. Note that disabling strictly necessary cookies may prevent you from logging in or using core Platform features.
As a data subject, you hold a range of rights in respect of your Personal Data held by cm888. These rights are described below. To exercise any of these rights, please contact our Data Protection team at the details provided in Section 15. We will respond to all valid requests within 30 calendar days.
Request a copy of all Personal Data cm888 holds about you, together with information about how it is being processed.
Request correction of any inaccurate or incomplete Personal Data we hold about you without undue delay.
Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Request that we restrict processing of your Personal Data in certain circumstances, such as while the accuracy of data is disputed.
Receive your Personal Data in a structured, commonly used, machine-readable format for transfer to another data controller.
Object to processing based on legitimate interests or for direct marketing purposes. Objections to direct marketing are always honoured immediately.
Withdraw any previously given consent for processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Not to be subject to decisions made solely by automated processing where those decisions produce significant legal or similarly significant effects for you.
cm888 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The general retention schedule is as follows:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of account + 5 years post-closure | Regulatory / AML |
| KYC identity documents | 5 years from account closure | Anti-money laundering obligations |
| Transaction records | 5 years from transaction date | Regulatory / financial record-keeping |
| Customer support communications | 3 years from last interaction | Legitimate interests / dispute resolution |
| Usage and analytics data | 24 months from collection | Legitimate interests (platform improvement) |
| Marketing consent records | 3 years from consent or last interaction | Legal obligation (consent audit trail) |
| Self-exclusion records | Indefinite (for enforcement purposes) | Responsible gambling compliance |
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our data destruction procedures.
cm888 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key security controls include:
Whilst cm888 takes all reasonable steps to protect your Personal Data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for securing your own device.
The cm888 Platform is strictly for use by adults aged 21 years and above. We do not knowingly collect or process Personal Data from persons under the age of 21. Age verification is applied at the point of registration and during KYC review.
If cm888 becomes aware that it has collected Personal Data from a person under 21 years of age, that data will be immediately and securely deleted, the associated account will be closed, and any deposited funds will be returned to the original payment method. Any winnings generated by an underage account will be forfeited in full.
If you are a parent or guardian and believe that a minor under your care has registered an account on cm888, please contact our support team immediately at [email protected] so that we can take appropriate action without delay.
cm888's primary data processing infrastructure is located within jurisdictions that maintain recognised data protection standards. Where Personal Data is transferred to or processed in jurisdictions outside Malaysia, cm888 ensures that adequate safeguards are in place — including contractual Standard Contractual Clauses (SCCs) or equivalent mechanisms — to protect the data in transit and at destination to a standard equivalent to that described in this Policy.
Third-party KYC verification providers, fraud detection services, and platform analytics tools used by cm888 may process certain data on infrastructure located outside Malaysia. All such providers are contractually bound to apply data security measures consistent with those described in this Policy.
cm888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. The date of the most recent revision is displayed prominently at the top of this page.
Where changes are material — meaning they significantly alter how we process your Personal Data or affect your rights — we will notify you by email to the address registered on your Account and/or by posting a prominent notice on the Platform, no fewer than 14 days before the revised Policy takes effect.
Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the revised terms. If you do not accept the revised Policy, you should cease using the Platform and contact us to close your account.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by cm888, please contact our Data Protection and Compliance team. We are committed to addressing all privacy-related enquiries promptly and thoroughly.
For matters relating to responsible gambling and self-exclusion, please visit our Responsible Gambling page. For full Platform usage rules, see our Terms & Conditions.
Your data is secure. Your rights are clear. Your gaming experience is protected. Join the cm888 community — Malaysia's trusted online casino and sports betting platform.