Privacy Policy

This Privacy Policy (hereinafter "the Policy") is issued by Sigma168 (the "Platform", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at sigma168.cam. This Policy governs the collection, processing, storage, and disclosure of personal data relating to users of the platform ("you", "the User", "Account Holder") in connection with the services we provide.

Sigma168 operates under an international gaming licence and adheres to internationally recognised data protection principles, including those set out in applicable privacy frameworks. We are committed to processing personal data lawfully, transparently, and only for specified, legitimate purposes.

By registering an account on sigma168, accessing the platform, or otherwise using our services, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data as described in this Policy. If you do not agree with this Policy, you must not register an account or use our services.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, which together form the complete set of agreements governing your relationship with sigma168.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:

Sigma168 collects personal data in the following categories, depending on the nature of your interaction with the platform:

Identity and Registration Data

• Full legal name as it appears on your identification document;
• Date of birth (required for age verification — users must be 21 or above);
• Residential address, including city and country;
• Email address and telephone number;
• Username and encrypted password hash;
• Copies of identification documents submitted for KYC (MyKad, passport, or equivalent).

Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• Payment method identifiers (e.g., masked bank account numbers, e-wallet registered phone numbers for Touch 'n Go eWallet, Boost, or GrabPay, DuitNow recipient references);
• Account balance history and transaction summaries;
• Cryptocurrency wallet addresses where applicable (USDT/BTC).

Activity and Gaming Data

• Game session records, wager history, bet amounts, odds accepted, and outcomes;
• Sports betting market selections across EPL, Liga Super Malaysia, UFC, and other available markets;
• Bonus and promotional uptake records;
• Login timestamps, session durations, and account activity logs.

Technical and Device Data

• IP address and geolocation data derived therefrom;
• Device type, operating system, and browser information;
• Cookie identifiers and similar tracking technology data (detailed in Section 11);
• Platform access logs and error reports.

Communications Data

• Records of your interactions with the sigma168 support team via Live Chat, email, or other channels;
• Feedback, complaint, and dispute correspondence.

Personal data is collected through the following mechanisms:

1. Directly from you: When you complete the account registration form, submit KYC documents, make deposits or withdrawal requests, contact our support team, or participate in promotional activities.
2. Automatically during platform use: Through cookies, session tokens, log files, and similar technologies that record your interactions with the platform. See Section 11 for full cookie details.
3. From third-party payment processors: Payment service providers (including FPX, DuitNow, and e-wallet platforms) may share transaction confirmation data with us to verify deposits and facilitate withdrawals.
4. From identity verification services: Where we engage third-party KYC service providers to assist with identity verification, those providers may share verification outcomes and document analysis results with us.
5. From fraud prevention and security services: We may receive risk signals or flagging data from contracted security service providers to protect the integrity of the platform and its users.

Sigma168 processes your personal data for the following specified purposes:

Sigma168 processes your personal data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions — including account management, payment processing, and game service delivery.
• Legal Obligation: Processing required to comply with our international gaming licence, anti-money laundering regulations, and other applicable legal or regulatory requirements — including KYC identity verification and transaction record keeping.
• Legitimate Interests: Processing carried out on the basis of our legitimate interests in operating a secure, fair, and commercially viable platform — including fraud detection, security monitoring, and aggregated analytics. We ensure that these interests do not override your fundamental rights and freedoms.
• Consent: Where we rely on your consent as the legal basis for processing — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Sigma168 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Personal data is shared with third parties only in the following limited and controlled circumstances:

1. Payment Service Providers: We share payment reference data with contracted payment processors — including FPX participating banks (Maybank, CIMB, Public Bank, Hong Leong), DuitNow, Touch 'n Go eWallet, Boost, and cryptocurrency processing services — solely for the purpose of processing your transactions. These providers process your data only under our instruction and in accordance with their own regulatory obligations.
2. Identity Verification (KYC) Providers: Where third-party KYC service providers are engaged to assist with identity verification, we share document data and account details required to complete the verification process. Such providers are contractually bound to process data only for verification purposes.
3. Fraud Prevention & Security Services: We may share technical data (including IP addresses, device fingerprints, and transaction patterns) with contracted security and fraud prevention providers to protect the platform and its users.
4. Legal and Regulatory Authorities: We may disclose personal data to law enforcement agencies, gaming regulators, financial intelligence units, or other competent authorities where required by applicable law, regulatory instruction, valid court order, or where we reasonably believe such disclosure is necessary to prevent or investigate illegal activity.
5. Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Sigma168 operates as an international platform and, as such, your personal data may be processed and stored on servers located outside of Malaysia. When transferring personal data across international borders, we implement appropriate safeguards to ensure that your data receives a level of protection equivalent to the standards applied within our licensing jurisdiction.

Such safeguards may include contractual data processing agreements with service providers, standard contractual clauses, and due diligence assessments of the data protection frameworks in destination jurisdictions.

By registering an account and using the platform, you acknowledge and consent to the transfer of your personal data to and processing in countries outside Malaysia, subject to the protections described in this Policy.

Sigma168 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following general retention periods apply:

Following expiry of the applicable retention period, personal data is securely and irreversibly deleted or anonymised in accordance with industry-standard data destruction protocols.

Sigma168 implements a comprehensive suite of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data transmitted between your device and the sigma168 platform is encrypted using 256-bit SSL/TLS protocols. Sensitive data fields, including passwords and payment details, are encrypted at rest using industry-standard algorithms;
• Access Controls: Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis, enforced through role-based access control, multi-factor authentication, and regular access reviews;
• Network Security: The platform infrastructure is protected by firewalls, intrusion detection systems, and regular penetration testing conducted by independent security specialists;
• Incident Response: Sigma168 maintains a documented data breach response procedure. In the event of a personal data breach posing a risk to your rights, we will notify affected individuals and relevant authorities within the timeframes required under applicable regulations;
• Staff Training: All sigma168 personnel who handle personal data receive regular data protection and security awareness training.

Sigma168 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device by the platform when you visit. Cookies allow us to recognise your device on subsequent visits, maintain your session state, and analyse platform usage patterns.

Sigma168 uses the following categories of cookies:

Sigma168 does not place third-party advertising or tracking cookies. You may configure your browser settings to block or delete cookies, however doing so may impair the functionality of the platform, including your ability to log in or maintain a game session.

Subject to applicable data protection law and the specific circumstances of your request, you hold the following rights in relation to your personal data processed by sigma168:

1. Right of Access: You have the right to request confirmation of whether sigma168 processes personal data about you and, if so, to receive a copy of that data along with information about the purposes, categories, recipients, and retention periods of the processing.
2. Right to Rectification: You have the right to request correction of inaccurate personal data and completion of incomplete personal data held by sigma168 without undue delay.
3. Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent on which processing is based, or where processing is unlawful. This right is subject to overriding legal obligations that may require us to retain certain data.
4. Right to Restriction of Processing: You have the right to request restriction of processing in certain circumstances — for example, where you contest the accuracy of data, pending verification by sigma168.
5. Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You have the right to object to processing based on sigma168's legitimate interests at any time. You also have an absolute right to object to processing for direct marketing purposes.
7. Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce significant effects for you, unless such processing is necessary for contract performance or subject to your explicit consent.

To exercise any of the above rights, please contact the sigma168 Data Protection team using the contact details in Section 15. We will respond to verified requests within a reasonable timeframe, and in any event no later than thirty (30) days from receipt of a complete request. We may request identification verification before processing a data subject request to ensure that personal data is not disclosed to unauthorised parties.

The sigma168 platform is strictly for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under 21 years of age. Age verification is a mandatory component of the account registration and KYC process.

Where sigma168 discovers or has reason to believe that personal data has been collected from an individual under the age of 21, we will suspend the associated account, delete or anonymise the personal data collected, and return any deposited funds to the payment source in accordance with our Terms & Conditions.

If you are a parent or guardian and believe a minor has accessed or registered on the sigma168 platform, please contact us immediately at the details provided in Section 15 so that we may take appropriate action.

Sigma168 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or platform operations. When material changes are made, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide notice to registered account holders via email or in-platform notification.

We encourage you to review this Policy periodically to remain informed about how we process and protect your personal data. Your continued use of the sigma168 platform following publication of an updated Policy constitutes your acceptance of the revised terms. If you do not accept the revised Policy, you must cease using the platform and may request account closure.

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or wish to raise a concern regarding the processing of your personal data, please contact the sigma168 team through the following channels:

• Live Chat: Available 24/7 within the sigma168 platform interface. Agents fluent in English, Bahasa Melayu, and Mandarin are available at all hours.
• Email: [email protected] (plain text — not a clickable link). Please mark your email with the subject line "Privacy Request" or "Data Subject Request" for prioritised routing.
• Response Time: We aim to acknowledge all privacy-related requests within 3 business days and to resolve substantive requests within 30 days. Complex requests may require additional time, in which case we will notify you of the extended timeline.