Privacy Policy

1 Introduction

STM88 (hereinafter "STM88", "we", "us", or "our") operates the online sports betting and casino gaming platform accessible at https://stm88.lat and all associated subdomains and mobile interfaces (collectively, the "Platform").

We recognise that your personal data is important to you, and we take our obligations as a data processor seriously. This Privacy Policy sets out, in clear and accessible terms, the nature of the personal data we collect from users of the Platform, the purposes for which that data is processed, the legal grounds upon which we rely for such processing, and the rights available to you in relation to your personal data.

This Policy applies to all registered users and visitors of the STM88 Platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and any other location from which the Platform is accessed. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

3 Data Controller

STM88 is the Data Controller in respect of all Personal Data collected and processed through the Platform. As Data Controller, STM88 determines the purposes for which your Personal Data is collected and the manner in which it is processed.

STM88 operates under international online gaming licensing. The entity holding the applicable gaming licence is responsible for the lawful processing of Personal Data in accordance with the data protection obligations attached to that licence and the laws of the licensing jurisdiction. Where STM88 engages third-party Data Processors (such as payment service providers, KYC verification platforms, or game software suppliers), such engagement is governed by data processing agreements that require processors to handle Personal Data only in accordance with STM88's instructions and applicable data protection law.

For all data protection enquiries, users may contact STM88 via the channels set out in Section 17 of this Policy.

4 Data We Collect

STM88 collects Personal Data in several categories depending on the nature of your interaction with the Platform. The following table summarises the categories of data we hold and the purpose for which each is collected:

5 How We Collect Your Data

STM88 collects Personal Data through the following means:

• Direct Provision: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, submitting a support request, or corresponding with STM88 by any channel.
• Automated Technical Collection: Technical Data and Usage Data collected automatically when you access the Platform, via server logs, session tracking, and cookies (see Section 10).
• Third-Party Sources: Identity verification and fraud screening data received from licensed KYC and AML service providers, payment confirmation data from payment processors (including Maybank, CIMB, Touch 'n Go eWallet, DuitNow, Boost, GrabPay, FPX, and cryptocurrency network operators), and, where applicable, responsible gambling database checks.
• Publicly Available Sources: Where required for AML, fraud prevention, or regulatory compliance purposes, STM88 may supplement its records with information available from public registers or commercially licensed data providers.

6 Legal Basis for Processing

STM88 processes your Personal Data only where a valid legal basis exists for doing so. The applicable legal bases are as follows:

• Performance of a Contract: Processing that is necessary for the provision of the Platform services you have registered to receive, including account management, bet placement, payment processing, and customer support.
• Legal Obligation: Processing required to comply with applicable laws and regulatory obligations, including KYC identity verification, AML transaction monitoring, age verification (21+), and mandatory record retention.
• Legitimate Interests: Processing necessary for the legitimate interests of STM88, including fraud detection and prevention, network security, responsible gambling monitoring, platform improvement, and analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where STM88 relies on your consent as the legal basis for processing (such as for non-essential cookies or optional marketing communications), you retain the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

7 How We Use Your Data

STM88 uses the Personal Data we hold for the following purposes:

• Account Creation and Management: To register, maintain, and administer your STM88 account, including authentication, security, and Account preference management.
• Payment Processing: To process deposits and withdrawals via your nominated payment method, including Malaysian e-wallets, FPX online banking, and cryptocurrency channels.
• Identity Verification and KYC: To verify your identity and age (21+) in fulfilment of our obligations under applicable anti-money laundering and responsible gambling frameworks.
• Responsible Gambling Compliance: To monitor betting behaviour, apply deposit limits, process self-exclusion requests, and fulfil our duty of care obligations to players at risk of gambling-related harm.
• Fraud and Security: To detect, investigate, and prevent fraudulent activity, money laundering, system abuse, and unauthorised access attempts.
• Customer Support: To handle your enquiries, complaints, and disputes effectively, and to maintain records of communications for quality assurance and regulatory purposes.
• Marketing Communications: Where you have provided consent or where permitted under applicable law, to send you promotional offers, bonus notifications, and platform updates via email or SMS. You may opt out of such communications at any time.
• Analytics and Platform Improvement: To analyse usage patterns, identify technical issues, and continuously improve the performance, design, and feature set of the Platform.
• Regulatory Reporting: To fulfil mandatory reporting obligations to our licensing authority and other applicable regulatory bodies where required by law.

8 Data Sharing & Disclosure

STM88 does not sell, rent, or trade your Personal Data to any third party for their own commercial or marketing purposes. We may share your Personal Data with third parties only in the following circumstances and only to the extent strictly necessary:

• Payment Service Providers: Personal Data necessary to process deposits and withdrawals is shared with the relevant payment processor (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow operator, FPX network, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency network operators). These providers act as Data Processors bound by appropriate data processing agreements.
• KYC and AML Providers: Identity verification and fraud screening data is shared with licensed identity verification service providers for the purpose of satisfying KYC and AML obligations.
• Game Software Providers: Where technically necessary for the delivery of games, certain session and account identifiers may be shared with licensed game software providers operating on the Platform.
• Regulatory Authorities: STM88 will disclose Personal Data to licensing authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction.
• Professional Advisers: In specific circumstances, Personal Data may be shared with legal advisers, auditors, or compliance consultants under strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of STM88's assets, Personal Data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

9 International Data Transfers

Given the international nature of STM88's operations and the technology infrastructure that supports the Platform, your Personal Data may be transferred to, stored in, or processed in countries outside Malaysia. In particular, data may be processed in the jurisdiction(s) in which our licensing authority, cloud infrastructure providers, or game software suppliers are established.

Where such transfers occur, STM88 takes reasonable steps to ensure that your Personal Data receives an equivalent level of protection to that required under Malaysian law and applicable international data protection standards. This may include entering into data transfer agreements with the relevant receiving parties, incorporating standard contractual clauses, or relying on adequacy determinations where available.

By using the Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Malaysia for the purposes described in this Privacy Policy.

10 Cookies & Tracking Technologies

STM88 uses cookies and similar tracking technologies to provide, secure, and improve the Platform. The following categories of cookies are used:

You can manage or disable non-essential cookies at any time through your browser's cookie settings. Please note that disabling certain cookies may affect your experience on the Platform. For detailed information on the specific cookies in use, please contact STM88 support or refer to your browser's cookie management documentation.

11 Data Retention

STM88 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable regulatory retention requirements. The following general retention periods apply:

• Active Accounts: Personal Data is retained for the full duration of your active account relationship with STM88.
• Closed Accounts: Following account closure, STM88 retains Personal Data for a minimum period of five (5) years in accordance with AML record-keeping obligations. Where regulatory requirements mandate a longer period, that longer period will apply.
• Transaction Records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years from the date of the transaction.
• KYC Documentation: Identity verification documents are retained for the period of the account relationship plus five (5) years post-closure, or for such longer period as required by applicable law.
• Support Communications: Customer support records are retained for three (3) years from the date of the relevant interaction, unless they form part of an unresolved dispute or regulatory inquiry.
• Marketing Consent Records: Records of consent to marketing communications are retained for as long as the consent remains valid and for three (3) years thereafter.

Upon expiry of the applicable retention period, Personal Data is securely deleted, anonymised, or archived in a manner that renders re-identification impossible, unless continued retention is required by a specific legal obligation.

12 Data Security

STM88 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in Transit: All data exchanged between your device and the STM88 Platform is encrypted using 256-bit SSL/TLS protocols.
• Encryption at Rest: Sensitive Personal Data stored on STM88 servers is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to Personal Data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access control systems and two-factor authentication for administrative access.
• Infrastructure Security: The Platform is hosted on secure, ISO-certified cloud infrastructure with continuous monitoring for intrusion attempts, anomalous access patterns, and system vulnerabilities.
• Penetration Testing: STM88 conducts regular third-party security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: In the event of a Personal Data breach, STM88 maintains a documented incident response procedure and will notify affected Data Subjects and applicable regulatory authorities in accordance with applicable legal requirements.

13 Your Data Rights

Subject to applicable law and any overriding regulatory obligations, you hold the following rights in relation to your Personal Data held by STM88:

To exercise any of the above rights, please submit a written request to STM88 via the contact details in Section 17. STM88 will acknowledge all data rights requests within 5 business days and aim to respond substantively within 30 days. Where a request is complex or relates to a large volume of data, we may extend this period by up to a further 60 days, in which case we will notify you accordingly.

Please note that certain rights are subject to exceptions. For example, STM88 may decline an erasure request where continued retention is required by applicable AML legislation or to establish, exercise, or defend legal claims.

14 Children's Privacy

The STM88 Platform is strictly restricted to individuals aged 21 years and above. STM88 does not knowingly collect or process Personal Data from individuals under the age of 21. Where STM88 identifies or is notified that Personal Data from a person under 21 has been collected — whether through misrepresentation or otherwise — that data will be promptly deleted, the associated account will be suspended, and any funds held will be returned in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a minor under your care has provided Personal Data to STM88, please contact us immediately using the details in Section 17 so that we can take appropriate action.

We strongly encourage parents and guardians who share computing devices with minors to install appropriate parental control software and to supervise online activity to prevent access to age-restricted platforms.

15 Third-Party Links

The STM88 Platform may, from time to time, contain references to or integrations with third-party services, including payment processors, game software providers, and support tools. While STM88 exercises reasonable care in selecting its third-party partners, we are not responsible for the privacy practices of those third parties.

Each third-party provider you interact with — such as Touch 'n Go eWallet, DuitNow, Boost, GrabPay, or FPX — operates under its own privacy policy. We encourage you to review the privacy documentation of any third-party service with which you interact, particularly in connection with payment transactions.

STM88's Privacy Policy applies solely to Personal Data processed by STM88 through the Platform. It does not govern the data processing practices of any external entity.

16 Policy Amendments

STM88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing activities, or Platform functionality. When material changes are made, we will:

• Update the "Effective Date" displayed at the top of this page.
• Display a notice on the Platform homepage or via Account email notification for significant changes.
• Where required by applicable law, seek fresh consent before implementing changes that affect the legal basis or purpose of existing data processing activities.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform following the publication of an amended Policy constitutes your acknowledgement of the changes. If you do not accept the amended Policy, you should cease using the Platform and may request Account closure in accordance with our Terms and Conditions.

17 Contact & Data Protection Enquiries

For any questions, concerns, or formal requests relating to this Privacy Policy or to the processing of your Personal Data by STM88, please contact us through the following channels:

For further information about your rights as a data subject under Malaysian law, you may refer to the Personal Data Protection Department (PDPD) of Malaysia. For responsible gambling concerns or self-exclusion requests, please visit our Responsible Gambling page. For general platform queries, visit our FAQ page.