Privacy Policy

This Privacy Policy (the "Policy") is issued by amg28 (the "Platform", "we", "us", or "our") and governs the collection, processing, storage, and disclosure of personal data belonging to individuals (the "Player", "User", or "you") who access or use the amg28 website at https://amg28.cam and all associated gaming and payment services.

amg28 operates as a Malaysia-focused online gaming platform offering sports betting, live casino, slots, lottery, and related services to players aged 21 and above. In the course of providing these services, we necessarily collect and process certain personal information. This Policy explains what that information is, the lawful bases upon which we process it, how it is safeguarded, and the rights you hold over it.

By registering an account on the Platform, making a deposit, or otherwise using our services, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not use the Platform.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — directly or indirectly — including name, identification number, contact details, financial information, device identifiers, and behavioural data.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" means amg28, which determines the purposes and means by which personal data is processed.
• "Data Processor" means any third-party entity that processes personal data on behalf of amg28 pursuant to a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their personal data for a stated purpose.
• "KYC" (Know Your Customer) means the identity and age verification process conducted by amg28 in accordance with its anti-money laundering and responsible gaming obligations.
• "Cookies" means small data files placed on a user's device by a website for the purposes of session management, security, preferences, and analytics.

amg28 collects the following categories of personal data in connection with the provision of its services:

3.1 Identity & Contact Data

• Full legal name as appearing on a government-issued identity document
• Date of birth (for age verification purposes)
• Residential address (including city, state, and postcode — Malaysian players may reference Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, or other localities)
• Email address registered to the account
• Malaysian mobile number
• Nationality

3.2 Verification Documents

• Copy of MyKad (Malaysian national identity card), passport, or equivalent government-issued photo ID
• Proof of residential address (e.g., utility bill, bank statement not older than 3 months)
• Payment method ownership confirmation where required for withdrawal processing

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts (MYR), timestamps, and payment method references
• Payment method identifiers (e.g., partial account numbers, e-wallet IDs) — full card or bank account numbers are not stored on amg28 infrastructure
• Bonus and promotional credit records

3.4 Gaming Activity Data

• Betting history, game session records, wagering amounts, and outcomes
• Sports betting activity including markets wagered on (e.g., EPL, Liga Super Malaysia, UFC)
• Responsible gambling tool settings (deposit limits, session limits, self-exclusion status)

3.5 Technical & Device Data

• IP address at the time of registration and login
• Device type, operating system, and browser type
• Session duration and navigation patterns within the Platform
• Cookie data as described in Section 9 of this Policy

3.6 Communications Data

• Records of support interactions conducted via live chat or email
• Feedback and complaint submissions
• Opt-in preferences for promotional communications

amg28 collects personal data through the following channels and mechanisms:

• Directly from you — during account registration, KYC verification, deposit and withdrawal initiation, and support interactions.
• Automatically — through cookies, server logs, and analytics tools as you navigate the Platform, which capture technical and behavioural data.
• From payment processors — transaction confirmation data returned by FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network confirmations.
• From identity verification partners — confirmation of identity document authenticity and sanctions screening results returned by our KYC service providers.
• From third-party game providers — session and outcome data generated during gameplay on licensed third-party game software integrated into the Platform.

We process personal data only for the following defined purposes:

We do not use personal data for any purpose not listed above without first notifying you and, where applicable, obtaining fresh consent.

amg28 processes personal data on the following legal bases, consistent with internationally recognised data protection standards:

• Contractual Necessity: Processing required to perform the services you have contracted for — including account management, deposit processing, game access, and withdrawal fulfilment — is carried out on the basis of contractual necessity.
• Legal Obligation: KYC verification, AML screening, and regulatory reporting are carried out in compliance with the legal obligations imposed by amg28's international gaming licence.
• Legitimate Interests: Fraud prevention, platform security monitoring, and aggregate analytics are conducted on the basis of amg28's legitimate interest in operating a secure, fair, and financially stable platform, provided such interests are not overridden by your privacy rights.
• Consent: Marketing communications and the use of non-essential cookies are processed solely on the basis of your explicit, freely given consent, which you may withdraw at any time without penalty.

amg28 does not sell, rent, or trade your personal data to any third party for commercial purposes. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: Transaction data is shared with certified payment service providers — including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong — solely to the extent required to process your deposits and withdrawals. These providers operate under their own published privacy policies and applicable financial regulation.
• KYC and Identity Verification Partners: Identity document images and personal details are transmitted to our identity verification service provider(s) for the purpose of age and fraud screening. Data is processed under a written data processing agreement.
• Game Software Providers: Session and outcome data may be passed to or received from our licensed third-party game providers as a technical necessity of delivering the gaming experience. Providers are contractually restricted from using this data for any purpose beyond service delivery.
• Regulatory Authorities: amg28 may be required to disclose personal data to regulatory bodies or law enforcement authorities pursuant to its licensing obligations or in response to a lawful order. In such cases, we will notify you of the disclosure to the extent legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or transfer of business assets involving amg28, personal data held by the Platform may be transferred as part of that transaction. Affected Players will be notified in advance of any change in data controllership.

amg28 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Active Accounts: Personal data is retained for the duration of your account's existence on the Platform, plus any mandatory post-closure retention period.
• Closed Accounts: Following account closure, identity documents and transaction records are retained for a minimum of five (5) years in compliance with standard AML record-keeping obligations under our international licence.
• Responsible Gambling Records: Self-exclusion status and responsible gambling tool settings are retained for the duration of any exclusion period plus an additional twelve (12) months to prevent re-registration during an exclusion window.
• Support Communications: Records of support interactions are retained for three (3) years from the date of the relevant interaction to facilitate future dispute resolution.
• Marketing Opt-In Records: Consent records for marketing communications are retained for the duration of the consent and for five (5) years following withdrawal of consent, as evidence of compliance.

At the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

amg28 uses cookies and similar tracking technologies to operate the Platform securely and effectively. The following categories of cookies are in use:

amg28 does not use third-party advertising cookies or cross-site tracking technologies. You may manage or delete cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features.

amg28 implements a layered technical and organisational security framework designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit TLS (Transport Layer Security) encryption for all data transmitted between your device and the Platform.
• Encryption at rest for all stored personal data and identity documents held on our servers.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for internal administrative access to data systems.
• Regular penetration testing and security audits conducted by independent third-party specialists.
• Automatic session timeout and suspicious login detection protocols to limit exposure from unauthorised access attempts.

Despite these measures, no internet-based system is entirely immune to security risks. In the event of a data breach that is likely to result in a risk to your rights or freedoms, amg28 will notify affected Players without undue delay and will take all reasonable steps to contain and remediate the breach.

You are also responsible for maintaining the security of your account credentials. Never share your password, and use a unique, strong password not reused across other services.

You hold the following rights with respect to the personal data amg28 holds about you. To exercise any of these rights, please contact our support team via live chat or the support email address listed in Section 15 of this Policy. We will respond to all valid requests within a reasonable period, ordinarily no longer than 30 days.

The amg28 platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect or process personal data belonging to individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process, and accounts found to belong to individuals under 21 are terminated immediately with all associated data deleted.

If you believe that we have inadvertently collected personal data from a person under the age of 21, please contact us immediately at the details provided in Section 15. We will investigate and, where confirmed, delete all such data without delay.

As an internationally licensed platform serving Malaysian players, amg28's operations may involve the transfer of personal data to servers and service providers located in jurisdictions outside Malaysia. Where such transfers occur, we take steps to ensure that your data is afforded a level of protection consistent with internationally recognised data protection standards, including:

• Transferring data only to countries or territories that offer an adequate level of data protection as determined by the relevant data protection authority.
• Implementing contractual clauses (standard contractual clauses or equivalent) with data processors in non-adequate jurisdictions to ensure appropriate safeguards.
• Ensuring that all data processors are contractually bound to process personal data solely for the purposes specified, to maintain appropriate security measures, and to notify amg28 promptly of any actual or suspected data breach.

amg28 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory obligations, or applicable law. Material changes to this Policy will be communicated to registered Players via the email address associated with their account and/or via a prominent notice on the Platform, with a minimum of 7 days' advance notice prior to the changes taking effect.

The version number and effective date at the top of this document indicate the current version. Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you must discontinue use of the Platform and may request account closure in accordance with our Terms and Conditions.

Previous versions of this Policy are available upon request by contacting our support team.

If you wish to exercise any of your data rights, have a question about this Privacy Policy, or wish to raise a concern about how amg28 processes your personal data, please contact our Data Privacy team through the following channels:

• Support Email: [email protected] — please include "Privacy Request" in the subject line of your message. Email addresses above are displayed as plain text and are not clickable links.
• Live Chat: Available 24 hours a day, 7 days a week, in English, Bahasa Melayu, and Mandarin. Please select "Privacy / Data" as your query category when initiating the chat. Average response time under 5 minutes.

When submitting a privacy request, please provide your registered username, the email address associated with your account, and a clear description of your request or concern. We will acknowledge receipt of your request within 2 business days and aim to provide a full response within 30 calendar days.

For queries related to responsible gambling tools, self-exclusion, or deposit limits, please also refer to our Responsible Gambling page for the relevant resources and contact information.