Privacy Policy – candy918

1. Introduction

This Privacy Policy applies to all personal data processed by candy918 in connection with the operation of the candy918 online gaming platform at candy918.net and all associated services. candy918 takes its data protection obligations seriously and processes personal data only in accordance with applicable data protection law and the requirements of its international gaming authority licence.

By creating an account on candy918, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should not register an account or use the candy918 Platform.

This Privacy Policy should be read alongside candy918's Terms & Conditions and Responsible Gaming Policy, all of which together govern your relationship with candy918.

2. Data Controller

candy918 is the data controller responsible for the personal data collected and processed through candy918.net. As data controller, candy918 determines the purposes and means by which your personal data is processed. candy918 operates under international gaming authority licensing which imposes binding obligations regarding data protection, player fund segregation, and anti-money laundering compliance.

For all data protection enquiries, you may contact candy918's support team via live chat (available 24/7 on-site) or by email at [email protected].

3. Personal Data We Collect

candy918 collects the following categories of personal data from players and prospective players:

candy918 does not collect special category data (such as health, racial, or political data) except where strictly required by responsible gaming obligations — for example, where a player voluntarily discloses health-related reasons for a self-exclusion request.

4. How We Collect Your Data

candy918 collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, or contacting candy918 support.
• Automated collection: Technical data collected automatically when you access and use the candy918 Platform, including through cookies, log files, and session tracking technology.
• Third-party sources: Identity and fraud-prevention data received from KYC verification service providers, payment processors (including Touch n Go eWallet, Boost, and FPX banking partners), and credit reference or fraud-screening agencies as required by candy918's licensing obligations.

5. Legal Basis for Processing

candy918 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil candy918's obligations under the account agreement, including identity verification, payment processing, and game service delivery.
• Legal obligation: Processing required to comply with candy918's licensing conditions, anti-money laundering laws, and other applicable regulations — including mandatory KYC checks, transaction monitoring, and regulatory reporting.
• Legitimate interests: Processing for fraud prevention, Platform security, responsible gaming monitoring, and internal analytics, where these interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, where you have opted in to receive such communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. How We Use Your Personal Data

candy918 uses your personal data for the following purposes:

• Registering and administering your candy918 account, including identity and age verification (21+ requirement).
• Processing deposits and withdrawal requests and maintaining accurate financial records.
• Delivering live casino, slots, sportsbook, and other gaming services through the candy918 Platform.
• Detecting and preventing fraud, money laundering, account abuse, and prohibited conduct as defined in the Terms & Conditions.
• Monitoring gaming behaviour for responsible gaming purposes, including identifying patterns indicative of problem gambling and applying player protection measures where appropriate.
• Providing customer support and resolving disputes.
• Complying with applicable regulatory reporting and audit obligations under candy918's international gaming authority licence.
• Sending account-related transactional communications (deposit confirmations, withdrawal status updates, security alerts).
• Sending promotional communications where you have provided consent, including bonus offers and Platform updates.

7. Sharing Your Personal Data

candy918 does not sell your personal data to third parties. candy918 may share your personal data with the following categories of recipients, strictly for the purposes identified in this Privacy Policy:

• Payment processors: Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and FPX banking partners, for the purpose of processing deposits and withdrawals.
• KYC and identity verification providers: Third-party services used to verify the identity and age of candy918 players as required by licensing obligations.
• Fraud prevention and AML screening services: External agencies used to screen transactions and player data against fraud databases and sanctions lists.
• Game content providers: Licensed game studios whose software operates through the candy918 Platform may receive the minimum technical data necessary for game delivery and integrity logging.
• Regulatory and licensing authorities: candy918's international gaming authority and any other competent regulatory body entitled to access player data under applicable law.
• Law enforcement agencies: Where required by a lawful court order, subpoena, or equivalent legal instrument.

All third-party processors engaged by candy918 are required to maintain appropriate data security standards and may only process personal data for the purposes specified by candy918.

8. Data Retention

candy918 retains personal data for as long as your account remains active and for a minimum period after account closure as required by applicable law and candy918's licensing obligations. In practice, this means:

• Identity and KYC data is retained for a minimum of five years after account closure to comply with anti-money laundering regulations.
• Financial transaction data is retained for a minimum of five years after each transaction for regulatory and audit purposes.
• Gaming history data is retained for the duration of the account and for a minimum of three years after account closure.
• Support communications are retained for three years unless required longer for outstanding dispute resolution.
• Marketing preference data is retained until you withdraw consent and for a further period to evidence compliance with opt-out requests.

When data is no longer required for any legitimate purpose, candy918 securely deletes or anonymises it.

9. Cookies & Tracking Technologies

The candy918 Platform uses cookies and similar tracking technologies to support Platform functionality, security, and analytics. The following categories of cookies are used:

• Strictly necessary cookies: Required for user authentication, session management, and Platform security. These cannot be disabled without impairing your ability to use candy918.
• Functional cookies: Store preferences such as language settings and game lobby layout to improve your experience on candy918.
• Analytics cookies: Collect aggregated data on Platform usage to help candy918 improve navigation, content, and game library organisation. Data collected is not used to personally identify individual players in analytics reporting.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to candy918 and using core Platform features.

10. Your Data Protection Rights

Subject to applicable law and candy918's regulatory obligations, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data candy918 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Minor account details can be updated directly in your candy918 account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to candy918's legal retention obligations.
• Right to restriction: You may request that candy918 restricts processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to candy918.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. Marketing opt-outs take effect within 48 hours of receipt.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact candy918 support via live chat or email at [email protected]. candy918 will respond to verified requests within 30 days. Requests may be subject to identity verification before action is taken.

11. Data Security

candy918 implements technical and organisational security measures appropriate to the risk level of the personal data processed, including:

• TLS encryption for all data transmitted between your browser and the candy918 Platform.
• Encryption at rest for sensitive personal and financial data stored in candy918's systems.
• Role-based access controls limiting internal access to personal data on a need-to-know basis.
• Regular security assessments and penetration testing as required under candy918's licensing framework.
• Fraud monitoring and anomaly detection systems operating continuously across all player accounts.

Notwithstanding these measures, no method of electronic transmission or storage is completely secure. candy918 cannot guarantee absolute security but undertakes to notify affected players and relevant authorities promptly in the event of a personal data breach, in accordance with applicable law.

12. Children's Privacy

The candy918 Platform is strictly prohibited to persons under the age of 21. candy918 does not knowingly collect personal data from persons under 21. If candy918 becomes aware that a minor has registered an account, the account will be immediately closed and all personal data associated with it deleted, except to the extent retention is required by applicable law.

If you believe a person under 21 has registered an account on candy918, please contact support immediately at [email protected].

13. Changes to This Privacy Policy

candy918 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or candy918's data processing practices. Material changes will be communicated to registered players via the email address on their account and/or via a notice displayed prominently on the candy918 Platform. The "Last Updated" date at the top of this page will be revised accordingly. Continued use of the candy918 Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

For all privacy-related enquiries, data subject access requests, or complaints regarding candy918's handling of your personal data, please contact us:

If you are not satisfied with candy918's response to your privacy concern, you may have the right to lodge a complaint with the relevant data protection supervisory authority or candy918's licensing authority, depending on the nature of your complaint.