stich88 Privacy Policy

1. Introduction

stich88 ("stich88", "we", "us", or "our") operates the online betting and casino platform accessible at stich88.org. We are committed to protecting the privacy and personal data of our players and platform visitors. This Privacy Policy describes what personal information we collect, the purposes for which we use it, with whom we share it, how long we retain it, and what rights you have in relation to it.

This Policy applies to all personal data processed by stich88 in connection with the registration and use of player accounts, access to the platform, customer support interactions, and marketing communications. It should be read alongside the stich88 Terms & Conditions available at /terms-conditions.

By registering a stich88 account or continuing to use the platform after this Policy has been updated, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue use of the platform and contact our support team to close your account.

2. Data Controller

stich88 is the data controller responsible for personal data collected through the stich88.org platform. As data controller, stich88 determines the purposes and means of processing your personal data and is accountable for ensuring that processing is carried out in accordance with applicable data protection laws and regulations.

For all data protection enquiries, subject access requests, and complaints, you may contact our Data Protection team at [email protected] with the subject line "Data Protection Enquiry". We aim to respond to all data-related correspondence within fourteen (14) business days.

3. Data We Collect

stich88 collects personal data through several means: information you provide directly during registration and account use, data generated automatically through your interaction with the platform, and in limited cases data obtained from third parties as part of KYC verification and fraud prevention processes.

3.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, nationality, and government-issued identification document details (MyKAD number, passport number, or driving licence number).
• Contact data: Email address, mobile phone number, and residential address.
• Account credentials: Username and encrypted password hash (we never store passwords in plain text).
• Financial data: Payment method details (e-wallet account identifiers, bank account names for withdrawal matching purposes). We do not store full card numbers — payment processing is handled by certified payment gateways.
• KYC documents: Copies of identity documents and proof of address submitted for account verification.
• Support communications: Content of live chat, email, and WhatsApp messages exchanged with stich88 support staff.

3.2 Data Generated Automatically

• Usage data: Pages visited, features accessed, bet placement actions, game sessions, and navigation patterns within the platform.
• Transaction data: Deposit amounts, withdrawal requests, bet stakes, game results, and account balance history.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone.
• Session data: Login timestamps, session duration, and logout events.
• Cookie and tracking data: As described in Section 10 of this Policy.

3.3 Data from Third Parties

• Identity verification providers: Confirmation of identity document authenticity and age verification during KYC.
• Payment gateways: Transaction confirmation data from Touch 'n Go eWallet, Boost, DuitNow, FPX, and bank partners to reconcile deposits and withdrawals.
• Fraud and risk screening providers: Data to assess the risk profile of transactions and account behaviour in line with anti-money laundering (AML) obligations.

4. How We Use Your Data

stich88 uses the personal data we collect for the following purposes:

• Account creation and management: To register your player account, verify your identity, and maintain your account in good standing.
• Service delivery: To enable you to place bets, play casino games, make deposits, and request withdrawals on the stich88 platform.
• KYC and age verification: To confirm that you meet the 21+ age requirement and that your identity matches the registered account details before processing your first withdrawal.
• Financial processing: To process deposits and withdrawals via your selected Malaysian payment method (Touch 'n Go eWallet, DuitNow, FPX, etc.) and to reconcile transaction records.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and other prohibited conduct as defined in the stich88 Terms & Conditions.
• Legal and regulatory compliance: To meet our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and gaming regulatory requirements.
• Responsible gaming: To monitor player behaviour for signs of problem gambling and to administer deposit limits, self-exclusion, and other responsible gaming tools that you activate.
• Customer support: To respond to your enquiries, resolve disputes, and process complaints efficiently.
• Platform improvement: To analyse usage patterns, fix technical issues, and develop new features that better serve Malaysian players.
• Marketing (where consented): To send promotional emails, SMS notifications, and in-platform messages about stich88 bonuses, VIP offers, and new game releases — only where you have provided explicit consent or where permitted under applicable law.

stich88 does not use your personal data for automated individual decision-making that produces significant legal effects, except as required to satisfy AML screening obligations — in which case human review is available upon request.

5. Legal Basis for Processing

stich88 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between stich88 and the player — including account registration, bet settlement, deposits, withdrawals, and customer support.
• Legal obligation: Processing required to comply with AML, CTF, KYC, and gaming regulatory requirements applicable to stich88's operations.
• Legitimate interests: Processing for fraud prevention, security monitoring, platform abuse detection, and internal analytics — where such processing does not override your privacy rights and interests.
• Consent: Processing for direct marketing communications — email newsletters, promotional SMS, and push notifications — where you have provided explicit consent. You may withdraw marketing consent at any time via account settings or by contacting support, without affecting the lawfulness of any prior processing.

6. Data Sharing and Disclosure

stich88 does not sell your personal data to third parties. We share personal data only in the following circumstances:

• Payment processors: Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Connect — to process your deposit and withdrawal transactions. Each payment partner is contractually bound to use your data only for payment processing purposes.
• KYC and identity verification providers: To authenticate your identity documents and age during account verification. These providers operate under strict data handling agreements.
• Fraud prevention and AML screening services: To screen transactions and account behaviour against financial crime risk databases as required by applicable regulations.
• Game providers: In some live casino and slots integrations, a session token and minimal account identifier may be shared with the game provider to authenticate your session. No financial data or identity documents are shared with game providers.
• Legal and regulatory authorities: Where required by law, court order, or a legitimate regulatory request from a competent authority — including gaming regulators, financial intelligence units, or law enforcement agencies with appropriate jurisdiction.
• Professional advisors: Legal, accounting, and auditing firms under strict confidentiality obligations, in connection with compliance audits and regulatory filings.

All third parties with whom stich88 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the specified purpose and in accordance with stich88's instructions.

7. International Data Transfers

stich88 operates with infrastructure that may involve the storage and processing of personal data in jurisdictions outside Malaysia. Where such transfers occur, stich88 ensures that appropriate safeguards are in place — including data processing agreements incorporating standard contractual clauses — to provide a level of protection for your personal data that is equivalent to the protections afforded under applicable Malaysian data protection law.

By using the stich88 platform, you acknowledge and consent to the transfer of your personal data to such jurisdictions as necessary for the operation of the Services, subject to the safeguards described in this section.

8. Data Retention

stich88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specific retention periods include:

• Active account data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, to satisfy AML and regulatory record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following the completion of KYC or account closure, whichever is later, in compliance with AML legislation.
• Transaction records: Retained for a minimum of five (5) years following each transaction for financial audit and regulatory compliance purposes.
• Support communications: Retained for three (3) years following the closure of each support ticket, unless the communication relates to a formal complaint or legal dispute — in which case the relevant record is retained for the duration of that proceeding plus five (5) years.
• Marketing consent records: Retained for the duration of the consent and for two (2) years after consent withdrawal, as evidence of the consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

9. Security Measures

stich88 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• SSL/TLS encryption for all data transmitted between your browser and stich88 servers;
• Password hashing using industry-standard algorithms — plain-text passwords are never stored;
• Two-factor authentication (2FA) available on all player accounts;
• Access controls restricting employee access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of platform infrastructure;
• Secure data centre facilities with physical access controls;
• Incident response procedures for detecting and responding to data security breaches.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, stich88 will notify affected players without undue delay via the email address registered to your account.

10. Cookies & Tracking Technologies

stich88 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device by your browser. The types of cookies used by stich88 include:

• Strictly necessary cookies: Required for the platform to function — including session authentication, login state maintenance, and security tokens. These cannot be disabled without impairing platform functionality.
• Functional cookies: Store your preferences such as language settings and default sports view to improve your experience on return visits.
• Analytics cookies: Collect anonymised data about how players use the platform — which pages are visited, how long sessions last, and which features are used most frequently. This data is used solely to improve the platform.
• Security cookies: Used to detect fraud, prevent bot activity, and protect the integrity of player sessions.

stich88 does not use third-party advertising or behavioural targeting cookies. You can manage cookie preferences through your browser settings, noting that disabling strictly necessary cookies will affect your ability to log in and use the platform.

11. Your Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by stich88:

• Right of access: You may request a copy of the personal data stich88 holds about you (subject access request).
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for its continued processing — subject to our legal retention obligations under AML and gaming regulations, which may prevent full erasure.
• Right to restriction: You may request that stich88 restricts the processing of your data in certain circumstances while a dispute regarding its accuracy or use is resolved.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including processing for direct marketing purposes. Marketing objections are acted upon immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact stich88 at [email protected] with the subject line "Data Rights Request". We will respond within fourteen (14) business days. We may need to verify your identity before processing your request.

12. Children and Minors

The stich88 platform is strictly for individuals aged 21 years and over. stich88 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. Any funds deposited by a minor will be returned.

Parents and guardians who believe that a minor may have registered a stich88 account should contact support at [email protected] immediately.

13. Third-Party Links

The stich88 platform may contain references to third-party game providers and payment services. This Privacy Policy applies solely to personal data processed by stich88 in connection with the platform. Third-party services — including game studios accessed within the platform interface and payment gateway portals — operate under their own privacy policies. stich88 is not responsible for the privacy practices of third-party services.

14. Changes to This Privacy Policy

stich88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform operations. Material changes will be communicated to registered players via email and/or a prominent notice on the platform no fewer than seven (7) days before the changes take effect.

The date at the top of this page reflects the most recent revision. Your continued use of the stich88 platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

15. Contact & Complaints

For all privacy-related enquiries, subject access requests, or complaints, please contact the stich88 Data Protection team through the following channels:

• Email: [email protected] — subject line: "Data Protection Enquiry" or "Data Rights Request".
• Live Chat: Available 24/7 via the stich88 platform — average response 3–5 minutes for general queries; data rights requests will be escalated to the relevant team.

If you are not satisfied with stich88's response to a data protection complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.