Privacy Policy

This Privacy Policy ("Policy") sets out the manner in which vf238 ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects personal data provided by or generated about members ("you", "your", "User") in connection with your use of the website located at vf238.casa and all associated services, games, and features.

vf238 operates an online gaming platform serving players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations. The personal data we handle relates primarily to account registration, identity verification, transaction processing via Malaysian payment networks including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and RHB, and the ongoing provision of gaming and customer support services.

By creating a vf238 account, making a deposit, or otherwise using our platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the vf238 platform.

The following terms carry the meanings set out below throughout this Privacy Policy:

"Personal Data"

Any information that identifies or could reasonably be used to identify a specific living individual, including but not limited to name, email address, date of birth, payment account details, IP address, and device identifiers.

"Processing"

Any operation performed on personal data, whether or not by automated means — including collection, recording, storage, use, disclosure, transmission, combination, restriction, erasure, or destruction.

"Data Controller"

vf238, which determines the purposes and means by which personal data collected from Members is processed.

"Data Processor"

Any third party that processes personal data on behalf of vf238, including payment processors, identity verification providers, cloud infrastructure providers, and licensed game studios.

"Consent"

A freely given, specific, informed, and unambiguous indication of your wishes — by means of a statement or clear affirmative action — signifying your agreement to the processing of your personal data for a stated purpose.

"KYC" (Know Your Customer)

The identity and age verification process that vf238 conducts to confirm a Member's identity, age eligibility (21+), and payment method ownership, in accordance with applicable regulatory and internal compliance requirements.

vf238 collects personal data that is necessary for the operation of our platform, the delivery of gaming services, regulatory compliance, and the improvement of user experience. The categories of personal data we collect include:

vf238 does not collect sensitive personal data categories — such as racial or ethnic origin, religious beliefs, health data, or biometric data — except where strictly required for identity verification purposes, in which case collection will be limited to what is necessary and conducted with your explicit consent.

vf238 collects personal data through several channels, depending on the nature of your interaction with the Platform:

• Direct submission: Data you provide voluntarily during account registration, KYC submission, deposit or withdrawal requests, and when contacting our support team via live chat or email.
• Automated technical collection: Data gathered automatically as you browse and use the Platform, including through cookies, session tokens, server logs, and device fingerprinting technology.
• Payment providers: Transactional data received from Malaysian payment networks including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and RHB when you initiate deposits or request withdrawals.
• Identity verification partners: Identity and document verification data from third-party KYC service providers engaged to confirm your age (21+) and identity in compliance with applicable regulations.
• Game providers: Gameplay logs and session data transmitted from licensed game studio platforms when you participate in slots, live dealer games, crash games, or other gaming products on vf238.
• Fraud prevention services: Risk scoring and device reputation data from third-party fraud detection services used to protect the integrity and security of the Platform.

vf238 uses the personal data we collect strictly for the purposes described in this Policy. We do not sell personal data to third parties, and we do not use personal data for purposes that are incompatible with those stated here. The primary purposes for which we process your data include:

• Account creation and management: Establishing and maintaining your Member Account, including authentication, account settings, and Member profile maintenance.
• Service delivery: Enabling you to access and participate in games, sports betting, promotions, and all other services available on the vf238 Platform.
• Payment processing: Facilitating deposits and withdrawals through Malaysian payment channels, reconciling transactions, and managing your account balance.
• Identity and age verification: Conducting KYC checks to confirm your identity and verify that you meet the minimum age requirement of 21 years.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorised account access, and other prohibited conduct.
• Responsible gambling: Monitoring gameplay patterns for signs of problem gambling behaviour and applying responsible gambling tools where appropriate, in accordance with our Responsible Gambling policy.
• Legal and regulatory compliance: Meeting obligations imposed by applicable laws, regulations, and licensing requirements, including record-keeping and regulatory reporting.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to Members who have opted in to receive such communications. You may withdraw marketing consent at any time.
• Customer support: Responding to enquiries, resolving disputes, handling complaints, and maintaining records of support interactions for quality assurance purposes.
• Platform improvement: Analysing aggregated and anonymised usage data to improve game selection, platform performance, and user experience across all devices.

vf238 processes personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing that is necessary to perform our obligations under the Member Agreement with you — including account registration, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC obligations, anti-money laundering requirements, and data retention mandates.
• Legitimate interests: Processing carried out in pursuit of vf238's legitimate business interests — including fraud prevention, platform security, and improving our services — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent, particularly in respect of marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

vf238 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data only in the following limited circumstances:

• Payment processors and banking partners: Data shared with Malaysian payment networks (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB) solely to process your transactions. These entities act as data processors under contractual obligations that require them to maintain appropriate data protection standards.
• Identity verification providers: Personal and document data shared with licensed KYC service providers strictly for the purpose of completing age (21+) and identity verification. Data is not retained by these providers beyond what is necessary to deliver the verification service.
• Game content providers: Gameplay session data shared with licensed game studios as necessary to deliver the game content and maintain accurate game logs. Game providers operate under contractual data protection obligations.
• Fraud prevention and security services: Technical and identity data shared with third-party fraud detection platforms to identify and prevent fraudulent activity, account takeovers, and other security threats.
• Cloud and infrastructure providers: Personal data processed on secure cloud infrastructure operated by contracted service providers. All such providers are bound by strict data processing agreements and are prohibited from using your data for their own purposes.
• Regulatory and law enforcement authorities: Personal data disclosed to competent authorities where required or permitted by applicable law, including in response to valid legal process or regulatory enquiries.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all assets of vf238, personal data may be transferred to the relevant acquiring entity, subject to continued compliance with this Privacy Policy.

vf238 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including the satisfaction of any legal, regulatory, accounting, or reporting requirements. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

As a general guide, vf238 applies the following retention principles:

• Active Member Accounts: Personal and transactional data is retained for the full duration of an active Member relationship plus a minimum period of five (5) years following account closure, in compliance with applicable regulatory retention requirements.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years following the conclusion of the business relationship, as required by applicable anti-money laundering regulations.
• Transaction Records: Financial transaction records, including deposit and withdrawal logs, are retained for a minimum of five (5) years from the date of each transaction.
• Support Communications: Live chat transcripts and email correspondence are retained for a period of three (3) years from the date of the interaction, unless a longer period is required in connection with an unresolved dispute or regulatory matter.
• Marketing Data: Marketing preference records and consent logs are retained for the duration of your membership and for three (3) years following withdrawal of consent or closure of your account.
• Technical and Log Data: Server logs, IP records, and session data are retained for a period of twelve (12) to twenty-four (24) months, subject to security and fraud prevention requirements.

vf238 implements robust technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

• SSL/TLS encryption: All data transmitted between your device and the vf238 platform is protected by industry-standard SSL/TLS encryption protocols to prevent interception.
• Encrypted data storage: Sensitive personal and financial data is stored in encrypted form using current industry-standard encryption algorithms. Encryption keys are managed under strict access control protocols.
• Two-factor authentication (2FA): Account access is reinforced by optional two-factor authentication, and 2FA is mandated for all internal staff accounts with access to Member data.
• Access controls: Personal data is accessible internally only on a strict need-to-know basis. All internal access is logged, monitored, and audited.
• Penetration testing and security audits: vf238 conducts regular security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses in our systems.
• Real-time fraud monitoring: Automated systems monitor platform activity 24/7 for anomalous patterns indicative of fraud, account takeover attempts, or other security threats.

Despite these measures, no data transmission over the internet or electronic storage system is completely secure. vf238 cannot guarantee absolute security of your personal data. You are responsible for maintaining the confidentiality of your account credentials and for reporting any suspected unauthorised access to your account promptly.

vf238 uses cookies and similar tracking technologies on the Platform to improve functionality, analyse usage patterns, and deliver a personalised experience. A cookie is a small text file placed on your device by our web server when you access the Platform.

The categories of cookies we use include:

• Strictly necessary cookies: Essential to the operation of the Platform, including session management, authentication, and security. These cookies cannot be disabled without materially affecting Platform functionality.
• Performance and analytics cookies: Used to collect anonymised data about how Members interact with the Platform — including pages visited, features used, and error events — to improve platform performance and user experience.
• Functionality cookies: Used to remember your preferences such as language settings, preferred payment method display, and interface customisation choices.
• Targeting and marketing cookies: Used to deliver relevant promotional content and to measure the effectiveness of marketing communications. These cookies are only deployed with your prior consent.

You may control and manage cookies through your browser settings. Please note that disabling certain categories of cookies may affect your ability to use some features of the Platform. Your cookie preferences can be updated at any time via the cookie management tool available on the Platform.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data vf238 holds about you:

• Right of access: You may request a copy of the personal data vf238 holds about you, along with information about how that data is processed.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you. You may update basic account details directly through your Member Account settings.
• Right to erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to overriding requirements to retain data for legal, regulatory, or fraud prevention purposes.
• Right to restrict processing: You may request that vf238 restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to a particular processing activity.
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, and you may withdraw consent for marketing communications at any time. Withdrawal of marketing consent will not affect the lawfulness of prior processing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of these rights, please contact our Privacy team at [email protected] with the subject line "Data Rights Request". We will acknowledge receipt of your request within 5 business days and endeavour to fulfil it within 30 days of receipt, except where extended timescales are permitted by applicable law.

The vf238 platform is strictly for persons aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21. Our registration and KYC processes include explicit age verification steps designed to prevent underage access to the Platform.

If vf238 becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to suspend the relevant account, delete the collected data, and return any deposited funds to the source payment method.

In the course of operating a global gaming platform, vf238 may transfer your personal data to service providers and data processors located in countries outside Malaysia. Such transfers may occur, for example, when data is processed on cloud infrastructure operated outside Malaysia or when licensed game content providers process gameplay data in their home jurisdictions.

Where personal data is transferred outside Malaysia, vf238 takes appropriate safeguards to ensure that such transfers comply with applicable data protection standards. These safeguards may include entering into data processing agreements containing standard contractual clauses, ensuring the recipient country provides an adequate level of data protection, or relying on other lawful transfer mechanisms available under applicable law.

The vf238 platform integrates services provided by third parties — including licensed game studios, payment processors, identity verification providers, and analytics tools — in order to deliver the full range of services available to Members. While vf238 takes reasonable steps to ensure that all third-party partners maintain appropriate data protection standards, we are not responsible for the privacy practices of external parties.

This Privacy Policy does not extend to any third-party website, service, or application that you may access via links or integrations from within the vf238 platform. You are encouraged to review the privacy policies of any third-party services you access independently of vf238.

vf238 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or data processing activities. Where material amendments are made, we will endeavour to notify active Members via email or through a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of the vf238 platform following publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to a material amendment, you may close your account by contacting our support team.

We recommend that you review this Privacy Policy periodically to remain informed of how vf238 handles your personal data.

If you have any questions, concerns, or complaints regarding this Privacy Policy, the handling of your personal data, or the exercise of your data rights, please contact the vf238 Privacy team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.