Privacy Policy — riding168

1. Introduction

This Privacy Policy ("Policy") describes how riding168 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("User", "you", "your") who access or use the riding168 website, mobile-optimised interface, and all associated services available at riding168.cam.

riding168 is an internationally licensed online casino and sports betting platform serving players across Malaysia, including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other cities nationwide. We take our data protection obligations seriously and have designed this Policy to be clear, comprehensive, and honest about our data practices.

By registering an Account on riding168 or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the Platform.

2. Definitions

For the purposes of this Policy, the following terms have the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means riding168, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of riding168 pursuant to a written data processing agreement.
• "KYC" means Know Your Customer — the identity and age verification process undertaken to comply with applicable anti-money-laundering and age verification obligations.
• "Cookie" means a small data file placed on a User's device by a website to store information about that User's session, preferences, or behaviour.
• "Account" means a registered user account on the riding168 Platform through which the User accesses games, manages funds, and receives promotions.

3. Data We Collect

riding168 collects Personal Data in the following categories. We collect only the data that is necessary for the purposes described in this Policy.

4. How We Collect Your Data

riding168 collects Personal Data through the following means:

Data provided directly by you during: Account registration, KYC document submission, deposit or withdrawal requests, live chat interactions, email correspondence with our support team, and participation in promotions or surveys.

Technical and usage data collected automatically as you interact with the Platform, including through cookies, web beacons, server logs, and similar tracking technologies. See Section 10 (Cookies & Tracking) for full details.

We may receive Personal Data from third parties, including:

• Payment processors and e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks including Maybank, CIMB, Public Bank, and Hong Leong Bank) — to confirm transaction status and verify payment method ownership.
• Identity verification service providers — to cross-reference KYC documents against official records.
• Fraud prevention and AML screening services — to flag accounts associated with known risk indicators.
• Marketing analytics platforms — to measure the effectiveness of our promotional activities (subject to applicable consent frameworks).

5. How We Use Your Data

riding168 processes Personal Data for the following purposes:

• Account Management: Creating, maintaining, and securing your riding168 Account, including authentication, password recovery, and session management.
• Age & Identity Verification: Confirming that all users are aged 21 or above and that account details correspond to a real, identifiable individual. This is a core compliance obligation and non-negotiable.
• Payment Processing: Facilitating deposits and withdrawals via Malaysian payment methods including DuitNow QR, FPX, and major e-wallets, as well as cryptocurrency transactions in BTC, ETH, USDT, and LTC.
• Fraud Prevention & Security: Monitoring transactions, login patterns, and account behaviour to detect and prevent fraud, money laundering, multi-accounting, and other prohibited activities.
• Responsible Gambling Compliance: Monitoring usage patterns to identify signs of problem gambling behaviour and administering responsible gambling tools such as deposit limits, self-exclusion requests, and session time limits.
• Customer Support: Responding to queries, resolving disputes, and maintaining records of communications for quality assurance and legal purposes.
• Legal & Regulatory Compliance: Meeting obligations under applicable anti-money-laundering laws, our international gaming licence conditions, and any lawful requests from competent authorities.
• Product Improvement: Analysing aggregated usage data to improve game offerings, platform performance, and user experience.
• Marketing & Promotions: Sending promotional communications, bonus offers, and VIP updates where you have provided consent to receive such communications. You may withdraw this consent at any time.

6. Legal Basis for Processing

We process your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to perform our obligations under the User Agreement, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable laws, including KYC obligations, AML regulations, and lawful orders from competent authorities.
• Legitimate Interests: Processing for fraud prevention, platform security, and internal analytics, where our legitimate interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

riding168 does not sell your Personal Data to third parties. We do not share your data with advertisers for their own independent marketing purposes. We disclose Personal Data only in the following circumstances:

We share data with trusted third-party service providers who process data on our behalf under written agreements that bind them to confidentiality and data protection obligations equivalent to those we observe. These include: payment processors and e-wallet operators, identity verification providers, cloud hosting and infrastructure providers, customer support software vendors, and fraud detection services.

We may disclose Personal Data where required to do so by applicable law, court order, or lawful request from a competent regulatory or law enforcement authority. We will endeavour to notify you of any such disclosure where permitted by law.

In the event of a merger, acquisition, or sale of substantially all of riding168's assets, Personal Data held by the Platform may be transferred to the acquiring entity. We will provide notice of any such transfer and any change in privacy practices that may result.

We may share aggregated, anonymised statistical data — which cannot be used to identify individual users — with business partners, analytics providers, or industry research bodies. This data is not Personal Data and is not subject to the restrictions in this Policy.

8. Data Retention

riding168 retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to any longer retention periods required by applicable law or our licence conditions.

• Active Accounts: Personal Data is retained for the duration of your Account registration, plus a minimum of five (5) years following Account closure, in compliance with standard AML record-keeping requirements.
• KYC Documents: Identity documents are retained for a minimum of five (5) years from the date of submission or Account closure, whichever is later.
• Transaction Records: Financial transaction logs are retained for a minimum of seven (7) years in line with standard accounting and AML obligations.
• Support Communications: Live chat and email records are retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing Data: Where you have opted out of marketing communications, we retain a suppression record to ensure we do not re-contact you. The suppression record itself is retained indefinitely.
• Technical & Log Data: Server logs and technical data are retained for up to twelve (12) months and then anonymised or deleted.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised.

9. Data Security

riding168 implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• 256-bit TLS Encryption: All data transmitted between your browser or device and our servers is encrypted using Transport Layer Security (TLS) with a minimum 256-bit cipher strength.
• Data Encryption at Rest: Sensitive data stored in our databases — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Personal Data is accessible only to riding168 staff who require it to perform their duties. Access is granted on a least-privilege basis and is logged and audited.
• Two-Factor Authentication: Administrative access to systems containing Personal Data requires multi-factor authentication.
• Penetration Testing: Our infrastructure undergoes regular security assessments and penetration testing by independent security professionals.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable law and without undue delay.

While we take all reasonable measures to protect your data, no internet-based system is completely immune from security risks. You are responsible for maintaining the security of your Account credentials and for notifying us promptly if you suspect unauthorised access to your Account.

10. Cookies & Tracking Technologies

riding168 uses cookies and similar tracking technologies to operate the Platform, enhance your experience, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies, authentication tokens, and security cookies. These cannot be disabled without rendering the Platform non-functional. No consent is required for these cookies.
• Functional Cookies: Remember your preferences such as language settings, last-visited game category, and preferred withdrawal method. These improve your experience but are not essential. They are set only with your consent.
• Analytics Cookies: Collect anonymised information about how users interact with the Platform, including pages visited, time on page, and navigation paths. This data is used to improve the Platform. Analytics cookies are set only with your consent.
• Marketing Cookies: Used to deliver promotional content relevant to your interests and to measure the effectiveness of our campaigns. Marketing cookies are set only where you have explicitly opted in to receiving marketing communications.

You may control cookie settings through your browser preferences. Please note that disabling certain cookies may affect Platform functionality. Your cookie preferences can be updated at any time by accessing the cookie settings panel available on the Platform.

11. Your Rights

You have the following rights in relation to your Personal Data held by riding168. To exercise any of these rights, please contact us using the details provided in Section 15. We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days.

Please note that some rights are subject to limitations. For example, we may be unable to delete data that we are legally required to retain under AML or gaming licence obligations. Where we are unable to fulfil a request in full, we will explain the reason clearly.

12. Children & Minors

13. International Data Transfers

riding168 operates globally and may process or store your Personal Data on servers located outside of Malaysia. Where such transfers occur, we take steps to ensure that your data receives an equivalent level of protection to that required under applicable Malaysian data protection law.

Transfers to third-party service providers in other jurisdictions are governed by contractual data processing agreements that incorporate standard data protection clauses. We do not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards.

14. Amendments to This Policy

riding168 reserves the right to update this Privacy Policy at any time. When material changes are made, we will notify registered users via the email address associated with their Account and will post a prominent notice on the Platform specifying the effective date of the revision.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically. The "Last Reviewed" date at the top of this page indicates when the most recent revision was made.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data, please contact riding168 through any of the following channels:

• Data Protection Enquiries — Email: support@riding168.cam — please include "Privacy Policy Enquiry" or "Data Request" in the subject line. We aim to respond within 4 hours during MYT business hours (9:00 AM – 11:00 PM MYT daily).
• Live Chat: Available 24 hours a day, 7 days a week, accessible from any page on the Platform. For data protection requests, please ask to be connected to our Data Protection point of contact.

For requests to exercise your data subject rights under Section 11, please include your full registered Account username and a clear description of your request. Identity verification may be required before we are able to process certain requests, to ensure we are disclosing or modifying data only for the rightful Account holder.