shell888 Privacy Policy

shell888 ("the Company", "we", "us", or "our") operates the online gaming platform accessible at shell888.co. Shell888 is a licensed gaming operator and acts as the data controller in respect of the personal data it collects from Members and visitors of the shell888 platform.

This Privacy Policy applies to all personal data collected through the shell888 website, mobile web platform, customer support channels, and any other touchpoints through which you interact with shell888. It does not apply to third-party websites or services that may be referenced in our content — those parties have their own privacy policies for which shell888 is not responsible.

If you have any questions or concerns about how shell888 handles your personal data, please contact our Data Protection team at [email protected] (plain text — not a clickable link).

Shell888 collects personal data through several channels. The categories of data we collect include:

2.1 Registration Data. When you create a shell888 account, we collect your full legal name, date of birth, Malaysian mobile number, and a chosen username. This data is required to open an account and is mandatory.

2.2 Identity Verification (KYC) Data. To comply with our licensing obligations and to process withdrawals, shell888 may request copies of identity documents such as your MyKad or passport, proof of address, and, in some cases, proof of payment method ownership. This data is handled with additional security controls and strict access limitations.

2.3 Financial Data. We collect transaction records including deposit amounts, withdrawal requests, payment method identifiers (such as masked eWallet or bank account details), and transaction timestamps. Shell888 does not store full payment card numbers.

2.4 Usage Data. We automatically collect information about how you use the shell888 platform, including pages visited, games played, bets placed, session duration, IP address, device type, operating system, and browser type. This data is used to improve platform performance and detect fraudulent activity.

2.5 Communications Data. When you contact shell888 support via live chat or email, we retain records of those communications for quality assurance, dispute resolution, and training purposes.

2.6 Responsible Gaming Data. If you interact with shell888's responsible gaming tools — such as setting deposit limits or requesting self-exclusion — we record that data to enforce your chosen restrictions and comply with our licensing obligations.

Shell888 uses the personal data it collects for the following purposes:

• Account management: To create, maintain, and administer your shell888 account, including processing deposits and withdrawals, applying responsible gaming restrictions, and communicating important account information.
• KYC and fraud prevention: To verify your identity as required by our gaming licence, to prevent money laundering and fraudulent activity, and to comply with applicable anti-money laundering (AML) obligations.
• Platform operation and improvement: To monitor platform performance, diagnose technical issues, analyse usage patterns, and develop new features that improve the shell888 experience for Malaysian players.
• Customer support: To respond to your enquiries, resolve disputes, and provide technical assistance via live chat and email.
• Marketing communications: With your consent, to send you information about shell888 promotions, bonuses, and new product offerings. You may opt out of marketing communications at any time by updating your account notification preferences.
• Legal and regulatory compliance: To fulfil our obligations under applicable gaming regulations and respond to lawful requests from competent authorities.
• Responsible gaming: To enforce deposit limits, loss limits, cool-off periods, and self-exclusion restrictions that you have set, and to identify patterns of play that may indicate problem gambling behaviour.

Shell888 processes your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the shell888 services you have requested, including account management, payment processing, and customer support.
• Legal obligation: Processing required to comply with our gaming licence conditions, KYC requirements, AML obligations, and any lawful orders from regulatory or law enforcement authorities.
• Legitimate interests: Processing necessary for the pursuit of shell888's legitimate business interests, including fraud detection, platform security, and platform improvement — where such interests are not overridden by your privacy rights.
• Consent: Where we rely on your consent as the legal basis for processing (for example, for optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Shell888 does not sell your personal data. We may share personal data with the following categories of recipient where necessary:

• Payment service providers: To process your deposits and withdrawals via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and other approved payment methods. These providers receive only the data necessary to complete transactions.
• Identity verification providers: Third-party KYC service providers who assist shell888 in verifying Member identities and screening against sanctions and watchlists as required by our licence.
• Gaming software providers: Game studios and platform technology partners who need access to session and account data in connection with the games and services they provide to shell888.
• Regulatory and law enforcement authorities: Where required by law, court order, or regulatory direction, shell888 will disclose personal data to competent authorities. We will notify you of such disclosure where legally permitted to do so.
• Professional advisers: Legal, audit, and compliance advisers who are bound by professional confidentiality obligations.

All third-party recipients are required to handle your personal data in accordance with applicable data protection standards and are prohibited from using your data for any purpose other than the specific service they provide to shell888.

Shell888 uses cookies and similar tracking technologies to operate the platform and improve your experience. The types of cookies we use include:

• Essential cookies: Required for the platform to function, including session authentication, login state maintenance, and security features. These cannot be disabled without affecting platform functionality.
• Performance cookies: Collect anonymised data about how Members use the shell888 platform, which pages are visited most frequently, and where errors occur. This data is used solely to improve platform performance.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and game lobby filters to provide a more personalised experience on future visits.
• Analytics cookies: Used to understand aggregate usage patterns. Data collected via analytics cookies is anonymised before analysis and is not linked to individual Member identities.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to log in and use the shell888 platform.

Shell888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations.

In practice, this means:

• Account registration and KYC data is retained for a minimum of 5 years following account closure, as required by standard AML and gaming regulatory requirements.
• Transaction records are retained for a minimum of 5 years following the transaction date.
• Customer support communications are retained for 3 years from the date of the last interaction.
• Marketing consent records are retained for the duration of your shell888 membership and for 1 year following account closure.

When the applicable retention period expires, shell888 will securely delete or anonymise your personal data in accordance with our data destruction procedures.

Shell888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include:

• 256-bit TLS encryption for all data in transit between your device and the shell888 platform.
• Encryption of sensitive data at rest, including passwords (which are stored as salted hashes — never in plain text) and identity documents.
• Strict role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning of the shell888 platform.
• Automated fraud and anomaly detection systems that monitor for unusual account activity around the clock.

In the event of a data breach that is likely to affect your rights and freedoms, shell888 will notify affected Members in accordance with our notification obligations under applicable law.

Subject to applicable law and our regulatory obligations, you have the following rights in relation to the personal data shell888 holds about you:

• Right of access: The right to request a copy of the personal data shell888 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to our legal retention obligations.
• Right to restriction: The right to request that we limit our processing of your data in certain circumstances.
• Right to data portability: The right to receive your personal data in a structured, machine-readable format.
• Right to object: The right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting prior processing.

To exercise any of the above rights, please contact shell888 support at [email protected] (plain text — not a clickable link). We will respond to all verifiable requests within 30 calendar days.

The shell888 platform is strictly intended for adults aged 21 years and above. Shell888 does not knowingly collect personal data from individuals under the age of 21.

If shell888 becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately closed, all associated data will be deleted, and any funds deposited will be returned to the originating payment method (less any applicable processing fees) following identity verification of the account holder.

If you believe that a minor has registered a shell888 account, please contact our support team immediately at [email protected] (plain text — not a clickable link).

Shell888's platform infrastructure and some of its third-party service providers may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, shell888 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia.

Safeguards used for international transfers include contractual data processing agreements with receiving parties that impose obligations equivalent to those applied by shell888, and selection of processors operating in jurisdictions with recognised adequate data protection frameworks.

Shell888 may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable legal requirements. Material changes will be communicated to Members via a notice on the shell888 platform or to your registered email address at least 14 days before taking effect.

The "Last updated" date at the top of this document indicates when the most recent revision was made. We encourage you to review this page periodically. Continued use of the shell888 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

For any questions, concerns, or requests related to this Privacy Policy or shell888's handling of your personal data, please contact our Data Protection team through one of the following channels:

• Live Chat: Available 24/7 within your shell888 account dashboard.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" for data-related enquiries.

Shell888 aims to acknowledge all privacy-related enquiries within 3 business days and to provide a substantive response within 30 calendar days of receipt of a verifiable request.