khalti88 Privacy Policy and Data Protection Commitment

Introduction

This Privacy Policy is issued by khalti88 and applies to personal information collected through the khalti88 website, associated payment flows, account registration processes and any other interaction through which a user provides data to khalti88. It describes our practices in plain, professional English so that users in Malaysia and other locations can understand how their information is handled.

By accessing or using khalti88, the user acknowledges having read and understood this Privacy Policy. Use of khalti88 constitutes acceptance of the data-handling practices described herein. Users who do not accept these practices should discontinue use and may submit a deletion request as described in Section 12.

This policy should be read alongside the khalti88 Terms and Conditions and Responsible Gambling information, both of which contain provisions relevant to account safety and appropriate use. In any conflict between this policy and another document, this policy governs personal-data matters.

Definitions

The following terms have the meanings assigned to them in this section wherever they appear in this Privacy Policy.

• "Personal Data" means any information that identifies or can reasonably identify a living individual, directly or in combination with other data.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer or deletion.
• "Controller" means khalti88 in its capacity as the entity determining the purposes and means of processing personal data.
• "Processor" means a third party that processes personal data on behalf of khalti88 under a contractual arrangement.
• "User" means any individual who visits, registers with or otherwise interacts with khalti88.
• "Consent" means freely given, specific, informed and unambiguous agreement to the processing of personal data for a stated purpose.
• "Payment Partner" means an authorised payment service provider used by khalti88, including GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong.

Personal Data We Collect

khalti88 may collect the categories of personal data set out in the table below. Not all categories apply to every user; the relevant categories depend on the functions accessed and the information voluntarily provided.

khalti88 does not intentionally collect sensitive personal data such as racial origin, political opinion, health records or biometric data beyond what is strictly necessary for legally required identity-verification purposes. Where such data must be reviewed during verification, it is handled with elevated safeguards and is not retained beyond the minimum period required.

How We Collect Personal Data

Personal data is collected through the following channels:

• Direct provision: when a user completes registration, uploads verification documents, submits a support query or otherwise provides information voluntarily to khalti88.
• Automated technical collection: device identifiers, browser characteristics, IP addresses and session metadata collected when a user accesses the khalti88 website.
• Payment partners: transaction confirmation data received from GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB and other authorised payment partners when a deposit or withdrawal is processed.
• Verification service providers: identity or address confirmation data returned by third-party KYC providers engaged by khalti88 to comply with security and compliance obligations.
• Cookies and tracking technologies: where applicable and subject to the cookie provisions in Section 11.

Purposes of Data Processing

Personal data collected by khalti88 is processed for the following purposes:

• Creating, verifying and managing user accounts, including identity checks required before payment or withdrawal.
• Processing MYR deposits and withdrawals through eligible Malaysian payment methods including e-wallets, FPX, DuitNow and direct bank transfer.
• Detecting, investigating and preventing fraudulent, abusive or suspicious account activity and payment transactions.
• Complying with anti-money laundering, age-verification, identity and other applicable legal obligations.
• Communicating with users about account status, transaction progress, support requests and policy updates.
• Maintaining website security, operational stability and technical performance for users accessing khalti88 from Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam and other locations.
• Supporting responsible-gambling measures including self-exclusion tracking, deposit-limit enforcement and cooling-off periods.
• Improving khalti88 content, features and service quality through aggregated, anonymised usage analysis.

Legal Bases for Processing

khalti88 processes personal data where a valid legal basis exists. The primary bases applicable to khalti88 processing activities are:

• Contractual necessity: processing required to operate a user account, facilitate transactions and deliver the functions requested by the user.
• Legal obligation: processing necessary to comply with identity verification, anti-money laundering, age restriction and other binding legal requirements applicable to the operating entity.
• Legitimate interests: fraud prevention, security monitoring, system integrity and responsible-gambling oversight, where these interests are not overridden by the rights and interests of users.
• Consent: for optional communications, non-essential cookies or other processing activities that require specific agreement, where khalti88 relies on consent as its legal basis and the user has provided it clearly.

Third-Party Disclosure

khalti88 does not sell personal data. Data may be shared with the following categories of recipient only where sharing is necessary for the stated purpose and appropriate safeguards are in place.

• Payment partners: GrabPay, Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong and equivalent providers, solely to process authorised transactions.
• Identity verification providers: third-party KYC service providers engaged to verify documents, addresses and identity under compliance requirements.
• Technology and infrastructure providers: hosting, security and platform service providers operating under strict contractual data-processing obligations.
• Regulatory or law enforcement authorities: where khalti88 is required by applicable law, court order or authorised regulatory direction to disclose data.
• Professional advisers: legal, compliance, audit or financial advisers bound by confidentiality obligations.

Any third party engaged by khalti88 to process personal data must do so only in accordance with documented instructions and is prohibited from using the data for any other purpose.

International Data Transfers

khalti88 may engage service providers or infrastructure located outside Malaysia. Where personal data is transferred to a jurisdiction without equivalent data protection standards, khalti88 takes appropriate steps to ensure the transfer is governed by adequate contractual protections, such as standard contractual clauses or equivalent recognised safeguards. Users may request further information about transfer safeguards through the contact details in Section 15.

Data Retention

Personal data is retained only for as long as it is necessary for the purpose for which it was collected, or as required by applicable legal, regulatory or operational obligations. Key retention considerations include:

• Account and identity records are generally retained for the duration of an active account and for a reasonable period after closure, to comply with anti-money laundering and audit requirements.
• Transaction records including MYR payment history, deposit and withdrawal details, and associated verification documents are retained for legally required minimum periods.
• Support and communication records are retained for as long as necessary to resolve the matter and for a reasonable period thereafter.
• Technical and behavioural data is typically anonymised or deleted on a shorter cycle unless retained for security investigation purposes.

Retention periods may be extended where data is subject to an ongoing legal process, regulatory inquiry, dispute or security investigation. Upon expiry of the applicable retention period, data is securely deleted or anonymised.

Security Measures

khalti88 applies organisational and technical safeguards to protect personal data against unauthorised access, accidental loss, disclosure or destruction. These include encrypted connections for data in transit, access controls restricting data to authorised personnel with a legitimate operational need, and monitoring for suspicious access patterns.

Users are equally responsible for protecting their own access credentials. Passwords, one-time security codes and device access should be kept confidential. A user who suspects that their khalti88 account has been accessed without authorisation should report the concern to the website email promptly. khalti88 will not accept responsibility for data loss caused by a user's failure to apply reasonable personal security precautions.

Cookies and Tracking Technologies

khalti88 may use cookies and similar technologies to support website functionality, remember user preferences, maintain session security and collect aggregated analytical data. Cookies are small data files placed on a user's device when the site is visited.

Essential Cookies

These are necessary for core website operation, including secure session management and authentication. They cannot be disabled without affecting fundamental site functionality.

Analytical Cookies

Where analytics tools are used, they help khalti88 understand how users navigate the site, which content is most useful and where technical issues may occur. Data is aggregated and not used to identify individual users where avoidable.

Users can manage cookie preferences through their browser settings. Disabling certain cookies may limit the functionality available on khalti88. Further details on the specific cookies deployed by khalti88 are available on request.

User Rights

Subject to applicable legal limitations, users whose personal data is held by khalti88 may exercise the following rights by contacting us through the email address in Section 15.

• Right of access: request a copy of the personal data khalti88 holds about you.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of personal data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful, subject to overriding legal retention obligations.
• Right to restrict processing: request that processing be limited in specified circumstances, such as while accuracy is disputed.
• Right to object: object to processing based on legitimate interests in circumstances where your individual situation warrants it.
• Right to data portability: request a structured, machine-readable copy of personal data provided directly by you where technically feasible.
• Right to withdraw consent: where khalti88 relies on consent as its legal basis, withdraw that consent at any time without affecting the lawfulness of prior processing.

khalti88 will respond to valid requests within a reasonable period. khalti88 may verify identity before processing a data rights request, and may decline requests that are manifestly unfounded, excessive or that conflict with legal retention obligations. Where a request is declined, the reason will be communicated.

Children and Minors

khalti88 is strictly for adults aged 21 and above. khalti88 does not knowingly collect or process personal data from persons under 21 years of age. Where khalti88 identifies or reasonably suspects that an account holder is under 21, the account will be suspended, associated data will be reviewed and, where required, deleted or escalated in accordance with applicable responsible-gambling and legal obligations.

Parents or guardians who become aware that a minor has submitted personal data to khalti88 without authorisation are encouraged to contact us immediately using the email address in Section 15 so that appropriate action can be taken promptly.

Changes to This Privacy Policy

khalti88 may update this Privacy Policy from time to time to reflect changes in services, data-processing practices, legal requirements or payment-partner arrangements. Updated versions will be published on this page with a revised effective date. Continued use of khalti88 following publication of an updated policy constitutes acceptance of the revised terms where permitted under applicable law.

Users are encouraged to review this page periodically. Significant changes affecting the rights or expectations of users will be communicated where practicable through a notice on the website. The version published on this page at any given time shall be the governing version.

Contact Us

Data-related enquiries, access requests, correction requests, deletion requests or privacy complaints may be directed to khalti88 using the website email address displayed as plain text in the footer of this page. Users should state their enquiry clearly and include sufficient information to allow khalti88 to locate the relevant records, without including full financial credentials, one-time security codes or complete passwords in any message.

khalti88 is committed to addressing privacy concerns fairly and in a reasonable timeframe. Where a user is not satisfied with the response received, they may seek guidance from the applicable data protection authority or regulatory body in their jurisdiction.