Privacy Policy

This Privacy Policy ("Policy") issued by ocmy8 ("Platform", "we", "us", "our") and applies to all personal data collected from users ("User", "you", "your") who access, register for, or otherwise interact with the ocmy8 platform, including its website, any associated mobile interface and all services offered through them.

ocmy8 is an online gaming and sports betting information platform serving adult users in Malaysia and other eligible jurisdictions. In providing these services, we collect and process personal information as described in this Policy. We take this responsibility seriously and are committed to maintaining appropriate standards of data protection, transparency and user control.

By accessing ocmy8 or creating an Account, you acknowledge that you have read and understood this Policy. This Policy should be read alongside the ocmy8 Terms and Conditions, which are incorporated herein by reference.

Where this Policy refers to "personal data" or "personal information", these terms mean any information that identifies or could reasonably be used to identify a living individual, either alone or in combination with other data.

• "Account" — a registered user profile created on the ocmy8 platform.
• "Controller" — the entity that determines the purposes and means of processing personal data. For this Policy, ocmy8 acts as the Controller in respect of user Account data.
• "Data Subject" — a natural person whose personal data is processed; in this context, any ocmy8 User.
• "KYC" — Know Your Customer verification procedures requiring submission of identity and address documentation.
• "Payment Data" — information relating to deposit and withdrawal transactions, including Payment Method identifiers, transaction references and amounts in MYR or cryptocurrency equivalent.
• "Personal Data" — any information relating to an identified or identifiable natural person.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure or destruction.
• "Processor" — a third party that processes personal data on behalf of ocmy8 under a data processing agreement.
• "Special Category Data" — sensitive personal data including health information, financial vulnerability indicators or data relating to responsible gambling interventions.

ocmy8 collects personal data through several channels — directly from you during registration and platform use, automatically through technical systems, and from third-party verification providers where applicable.

We do not collect or store full payment card numbers. Where card-based payment is facilitated, the transaction is processed directly by a certified third-party payment provider under PCI-DS compliance standards. ocmy8 retains only the payment reference and status.

ocmy8 uses personal data collected from Users for the following purposes:

• Account management: To create, maintain and secure your Account, verify your identity, process login requests and enforce the one-accountper-user policy.
• Service delivery: To process deposits and withdrawals through your chosen Payment Method (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, USDT TRC20 and others), settle bets, credit bonuses and fulfil other platform functions.
• Compliance and KYC: To verify age (minimum 21 years), confirm identity, comply with applicable anti-money laundering and financial crime prevention obligations, and report to competent authorities where required by law.
• Security and fraud prevention: To detect and investigate suspicious activity, prevent misuse of the platform, identify prohibited conduct under the Terms and Conditions, and protect the integrity of the ocmy8 system.
• Responsible gambling: To monitor account activity for indicators of problem gambling, honour self-exclusion and deposit limit instructions, and apply account restrictions where appropriate.
• Customer support: To respond to queries, complaints and requests submitted through live chat, email or other support channels.
• Platform improvement: To analyse aggregated, anonymised usage data for the purpose of improving platform performance, user experience and game catalogue relevance for Malaysian users.
• Marketing communications: Where you have provided consent, to send promotional information about offers, new games and platform updates. You may withdraw this consent at any time via Account settings.

Where applicable data protection law requires a legal basis for processing personal data, ocmy8 relies on one or more of the following grounds depending on the specific processing activity:

• Contractual necessity: Processing required to perform the services set out in the Terms and Conditions, including Account registration, payment processing and game delivery.
• Legal obligation: Processing required to comply with applicable law, including identity verification, anti-money laundering checks, age verification and regulatory reporting duties.
• Legitimate interests: Processing undertaken in pursuit of ocmy8's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring and service improvement, where these interests are not overridden by the rights and interests of Data Subjects.
• Consent: Processing of personal data for direct marketing communications, where explicit consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

ocmy8 does not sell personal data to third parties for their own marketing purposes. We may share personal data with third parties only in the following circumstances:

• Payment providers: Transaction data shared with payment processing partners (including e-wallet operators such as Touch 'n Go, bank transfer gateways, DuitNow and FPX infrastructure, and cryptocurrency network processors) solely to process and settle financial transactions.
• Identity verification providers: Identity and document data shared with KYC and age verification service providers operating under data processing agreements with ocmy8.
• Technology and platform providers: Technical data shared with hosting, cloud infrastructure, analytics and customer support technology providers acting as Processors under appropriate contractual arrangements.
• Game content providers: Limited session and account-tier data shared with licensed game studios or aggregators to deliver entitled game content.
• Legal and regulatory authorities: Personal data disclosed to law enforcement, financial intelligence units, tax authorities or courts where required by a valid legal obligation, court order or regulatory direction.
• Business transfers: In the event of a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

All third-party Processors are required to handle personal data in accordance with applicable data protection obligations and are not permitted to use the data for their own independent purposes.

ocmy8 uses cookies and similar tracking technologies to support the operation of the platform, maintain session security and gather aggregated usage analytics.

• Essential cookies: Required for core platform functions including authenticated sessions, fraud prevention tokens and security headers. These cannot be disabled without affecting platform functionality.
• Analytical cookies: Used to collect anonymised data about page interactions, session duration and feature usage patterns. This data is used in aggregate form to improve the platform experience for Malaysian users.
• Preference cookies: Used to remember Account settings, language preferences and display configurations across sessions.
• Marketing cookies: Used, where consent has been given, to deliver relevant promotional content within the platform and to measure the effectiveness of communications.

You can manage non-essential cookie preferences through your browser settings. Please note that disabling certain cookies may affect your ability to use some platform features. Detailed cookie information is available in the cookie management section of Account settings.

ocmy8 retains personal data for as long as is necessary for the purposes described in this Policy, including compliance with legal retention obligations applicable to gambling operators and financial service providers.

• Account and KYC data: Retained for a minimum period following Account closure, as required by applicable anti-money laundering, financial crime prevention and regulatory obligations. This period is typically five to seven years from the date of Account closure.
• Transaction records: Payment and betting transaction records retained for the period required under applicable financial record-keeping obligations.
• Communication records: Support chat transcripts and complaint correspondence retained for a reasonable period sufficient to resolve disputes and meet audit requirements.
• Marketing consent records: Records of consent and withdrawal retained for the duration of the user relationship and for a period thereafter to demonstrate compliance.
• Technical and usage data: Aggregated and anonymised analytics data may be retained indefinitely. Individual IP logs and session records are retained for a shorter period consistent with security and fraud monitoring requirements.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in manner that prevents re-identification.

ocmy8 implements and maintains appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include:

• Encrypted data transmission using TLS/HTTPS protocols for all platform communications.
• Encrypted storage of sensitive Account and identity data at rest.
• Access controls restricting personal data access to authorised personnel on a need-to-know basis.
• Two-factor authentication options for User Accounts.
• Regular security assessments and vulnerability monitoring of platform infrastructure.
• Incident response procedures for the identification, containment and notification of data security events.

While ocmy8 takes reasonable steps to protect your personal data, no internet-based system can guarantee absolute security. Users are responsible for maintaining the security of their Account credentials and should never share passwords, verification codes or private cryptocurrency keys with any party, including ocmy8 support staff.

Subject to applicable data protection law and any overiding legal obligations, ocmy8 Users have the following rights in respect of their personal data:

• Right of access: The right to request a copy of the personal data ocmy8 holds about you and to receive information about how it is being used.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held on your Account.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overiding legal retention obligations.
• Right to restriction: The right to request that processing of your personal data be restricted in certain circumstances, for example while a data accuracy dispute is being resolved.
• Right to data portability: The right to receive personal data you have provided to ocmy8 in a structured, commonly used and machine-readable format, where technically feasible.
• Right to object: The right to object to processing based on legitimate interests, including processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact ocmy8 support using the contact details set out in Clause 15. We will respond to valid requests within a reasonable period and no later than thirty days from receipt, unless the complexity of the request requires an extension, in which case we will notify you accordingly.

ocmy8 is strictly for use by adults aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in the Account registration and KYC process.

Where ocmy8 identifies or is notified that an Account has been registered by or on behalf of a person under the minimum age, the following steps will be taken without delay:

• The Account will be immediately suspended and then permanently closed.
• All deposits made by the underage individual will be returned.
• Any winings or bonus funds acrued will be void and forfeited.
• Personal data held in connection with the underage Account will be deleted as soon as legally permissible, subject to any required retention for reporting purposes.

If you believe that an underage individual has accessed the ocmy8 platform, please contact our support team immediately.

ocmy8 may transfer personal data to, or process personal data in, countries outside Malaysia in connection with hosting infrastructure, KYC provider operations, payment gateway processing and technology service delivery. Where personal data is transferred internationally, ocmy8 ensures that appropriate safeguards are in place, which may include:

• Data processing agreements incorporating standard contractual clauses or equivalent transfer mechanisms.
• Transfers to jurisdictions that provide an adequate level of data protection under the relevant legal framework applicable to ocmy8's licensing entity.
• Technical security measures applied consistently regardless of the location of processing.

Malaysian users acknowledge that Malaysia does not currently have a comprehensive personal data transfer restriction framework equivalent to some other jurisdictions, and that personal data processed in connection with the ocmy8 platform may be subject to the laws of the jurisdiction in which ocmy8 or its processors operate.

The ocmy8 platform may include references to third-party payment providers, game studios or technology services. This Policy applies only to personal data processed by ocmy8 directly. Where you interact with a third-party service — including through a payment gateway operated by Maybank, CIMB, Touch 'n Go, GrabPay, Boost or a cryptocurrency network — the privacy practices of that third party are governed by their own privacy policies.

ocmy8 recommends that Users review the privacy policies of any third-party services they engage with in connection with their ocmy8 Account. ocmy8 is not responsible for the privacy practices or data handling of third-party providers.

ocmy8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in platform operations, applicable law or data processing practices. Where a material amendment is made, ocmy8 will endeavour to provide reasonable advance notice through the platform — for example, via a notification on login or a prominent homepage notice.

The "Last updated" date displayed at the top of this Policy indicates when the current version came into effect. Continued use of the ocmy8 platform following the publication of an amended Policy constitutes acceptance of the updated terms. If you do not accept any material amendment, you should cease using the platform and close your Account.

If you have questions, concerns or requests relating to this Privacy Policy or the personal data ocmy8 holds about you, please contact our support team using the details below. Email is displayed as plain text for security reasons and cannot be clicked as a link.

• Support email: [email protected]
• Live chat: Available 24 hours a day, seven days a week through the platform interface, subject to scheduled maintenance windows.
• Response commitment: Data rights requests are acknowledged within 24 hours and addressed within 30 days. Complex requests may require an extension, and you will be notified if this applies.

When submitting a data rights request, please provide only the information needed to identify your Account — typically your registered email address and Account username. Do not include your password, full payment card details or private cryptocurrency key information in any message to support.