Longfu88 Privacy Policy – Plain Language Data Guide
Effective: March 2026 | Domain: longfu-88.my
This policy lists every category of personal data Longfu88 holds on players, the reason it’s collected, how long it’s retained, and who else can access it. It’s written in plain language because a policy that requires a law degree to read isn’t a real disclosure.
Data questions: [email protected] or live chat at longfu-88.my.
1. Data Controller
Longfu88, operator of longfu-88.games, is the data controller for all personal information collected through this platform. Processing practices are aligned with Malaysia’s Personal Data Protection Act 2010 (PDPA), which governs collection, storage and use of personal data by organisations operating in or targeting Malaysian residents.
2. What We Collect – By Stage
At registration
- Mobile phone number – your primary account identifier. Used for OTP delivery, login, and account recovery
- Date of birth – age verification. Must confirm 18+ before account activation
- Password – stored as a salted cryptographic hash. Longfu88 staff cannot read or recover your actual password. If lost, it must be reset via OTP
- Referral or promo code (if entered) – used to attribute your registration for bonus purposes only
During KYC verification
- Government ID – MyKad (front and back) or passport. Processed by a third-party KYC provider under a data processor agreement. Used for identity matching only
- Selfie with ID – facial match against the submitted document
- Payment method proof – screenshot showing name and account number of the withdrawal destination. Confirms account ownership
During gameplay and transactions
- Transaction records – every deposit and withdrawal: amount, method, timestamp, status. Retained minimum 5 years
- Gameplay data – game sessions, bet sizes, session length. Required for responsible gambling monitoring
- Device and IP data – device model, OS version, IP address per session. Used for fraud detection and duplicate account identification
- eWallet references – TnG, GrabPay, DuitNow transaction identifiers. Not full account credentials
Support interactions
- Live chat conversation content and any files you share
- Ticket history retained and accessible to agents working your account
3. Legal Basis for Each Data Type
- Phone number, DOB, password – contractual necessity to operate your account
- KYC documents – legal obligation under anti-money-laundering compliance requirements
- Transaction and gameplay records – legal obligation plus contractual necessity
- Device and IP data – legitimate interest in fraud prevention and account security
- eWallet references – contractual necessity for payment processing
- Support records – legitimate interest in service delivery
- Marketing messages – consent only. Opt-in at registration, revocable at any time through account settings or by emailing [email protected]
4. Third-Party Access
Longfu88 does not sell personal data. Data is shared with third parties only where operationally required:
- Payment processors – FPX banks (Maybank, CIMB, RHB, Public Bank, Hong Leong), TnG, GrabPay, DuitNow, and crypto gateways receive only the transaction data needed for each individual payment
- KYC provider – receives identity documents for verification, operates under a data processor agreement, does not retain documents after verification is complete
- Game studios – Pragmatic Play, PG Soft, Evolution and others receive anonymised session tokens only. No name, phone number or financial data is shared with game providers
- Legal authorities – Longfu88 complies with lawful requests from Malaysian authorities under applicable law. Players are notified where legally permitted
5. Retention Periods
- Active account data – held for the duration of your account
- KYC documents – minimum 5 years from account closure
- Transaction records – minimum 5 years from each transaction date
- Gameplay records – 2 years from each session
- Support records – 2 years from last contact
- Device and IP logs – 12 months rolling
- Marketing consent records – until consent is withdrawn, deleted within 30 days thereafter
Data past its retention period is permanently deleted or irreversibly anonymised.
6. Security Measures
Longfu88 applies layered technical controls to all stored player data:
- TLS encryption in transit – all platform connections are encrypted
- AES-256 encryption at rest – applied to personal and financial records
- Role-based access control – support, finance and development teams access only the data their function requires
- Two-factor authentication for all staff – no internal system access without 2FA
- Independent annual security testing – conducted by a third-party auditor
- Breach notification within 72 hours – if a breach creates risk for your rights, you are notified within 72 hours of Longfu88 becoming aware of it
Longfu88’s security approach aligns with the SANS Institute’s critical security controls framework for organisations handling financial account data.
7. Cookies
Three cookie categories are used on longfu-88.games:
- Essential – session tokens, CSRF protection, login state. Disabling these breaks core platform functions
- Analytics – anonymised page-level usage data. No personally identifiable information is captured in analytics
- Marketing – ad effectiveness tracking. Only set with your consent. Revocable through the cookie preference panel
8. Your Rights Under PDPA
As a Malaysian resident, your rights under the Personal Data Protection Act 2010 include:
- Access – request a copy of all data Longfu88 holds on you. Response within 30 days
- Correction – correct inaccurate or outdated information
- Erasure – request deletion. Regulatory retention requirements (KYC, transactions) prevent early deletion of those specific records
- Withdrawal of consent – for marketing communications, takes effect within 24 hours
- Objection – object to processing based on legitimate interest grounds
To exercise any right: email [email protected] with subject line ‘Data Rights Request’ and your registered phone number. Longfu88 responds within 30 days.
9. Age Policy
Longfu88 does not knowingly accept players under 18. Date of birth is collected at registration and verified against identity documents during KYC. If an underage account is identified, it is suspended immediately, funds are returned to the source payment method, and data is deleted. Report suspected underage accounts to [email protected].
10. Policy Updates
Material changes – those that affect how your data is used beyond what you previously agreed to – trigger an SMS notification to your registered number and an in-app alert. Minor clarifications take effect without notice. Continued use of Longfu88 after a material update constitutes acceptance of the revised policy.
11. Contact
