Kerbau28 takes every member's privacy seriously. This document clearly explains what data we collect, how it is used, and your rights under Malaysia's Personal Data Protection Act (PDPA).
By registering an account or using any of the services Kerbau28, you agree to the collection and processing of your personal data as described in this Privacy Policy. Please read this document carefully. If you do not agree with any part of it, please do not use the Kerbau28 or contact us for further clarification before proceeding.
Kerbau28 is an online entertainment platform operating in Malaysia, fully committed to protecting the privacy of every individual who uses our services. This Privacy Policy outlines our practices regarding the collection, use, storage, disclosure, and protection of your personal information.
This policy applies to all users of the platform Kerbau28 — including unregistered website visitors, registered members, active players, and former members whose accounts have been closed. This covers all channels we operate, including the kerbau28.my website, Android and iOS mobile apps, customer support channels via live chat, email and WhatsApp, and all official social media platforms Kerbau28.
Kerbau28 fully complies with Malaysia's Personal Data Protection Act 2010 (PDPA) and all implementing regulations in force under it. We also adhere to international data security standards relevant to the financial services and online entertainment industry.
As a data controller under Malaysia's PDPA, Kerbau28 is fully responsible for how your personal data is collected, processed, and protected within our systems.
Kerbau28 only collects data that is genuinely necessary for the purposes stated in this Privacy Policy. We do not collect data that is excessive or irrelevant to the platform's operations.
Note: Kerbau28 does not directly store your credit card number or full banking details. Payment data is processed through licensed and regulated third-party payment service providers in Malaysia.
Kerbau28 collects your personal data through several different channels, depending on how you interact with our platform:
This is the primary way we collect data — when you voluntarily provide information to us. This includes during the registration process for a new account at Kerbau28, when submitting identity verification documents (KYC) to enable fund withdrawals, when contacting customer support via live chat, email or WhatsApp for any enquiries or complaints, when completing feedback forms or member satisfaction surveys, and when updating your account profile information.
When you use the website or application Kerbau28, our system automatically collects certain technical data required to keep the platform running correctly and securely. This includes access log information, IP addresses, session cookie data and gaming activity records. This automatic data collection occurs each time you log in to your Kerbau28 you.
In certain cases, Kerbau28 may receive information about you from legitimate third parties — for example, from identity verification service providers we use for the KYC process, from payment service providers such as Touch 'n Go eWallet, DuitNow or GrabPay when processing transactions, or from referral programmes where an existing member refers you to the platform Kerbau28.
Kerbau28 uses your personal data only for legitimate and limited purposes. We do not use your data for purposes unrelated to platform operations without your explicit consent.
Kerbau28 does not sell, rent or trade your personal data to any third party for their own marketing or commercial purposes. This is our absolute commitment to every member.
There are limited situations in which Kerbau28 needs to share your information with certain parties to enable our platform to operate or to comply with the law:
In all of the above cases, Kerbau28 ensuring that every party receiving your data is bound by data protection obligations equal to or exceeding the standards we uphold ourselves.
Kerbau28 continuously invests in robust security infrastructure to protect your personal data from unauthorised access, misuse, disclosure, alteration or destruction.
Website and application Kerbau28 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. This section explains the types of cookies we use and how you can manage them.
You can manage and delete cookies through your web browser settings at any time. Please note, however, that disabling certain cookies may affect the functionality of the platform Kerbau28 — particularly session cookies required for login and transaction processing. We recommend disabling non-essential cookies only if you understand the implications.
Kerbau28 does not retain your personal data longer than is necessary for the purposes stated in this Privacy Policy, or longer than required under Malaysian law.
Active account data and transaction records are retained for the duration of your active account plus seven years following account closure — in line with Malaysian legal requirements governing financial records and anti-money laundering. This retention period is mandated by law, not a matter of discretion Kerbau28.
Gaming activity data and betting history are retained for three years from the date of activity for audit purposes, dispute resolution and VIP programme analysis. Technical data such as access logs and IP addresses are retained for 12 months for security purposes and fraud detection.
Communications with customer support are retained for two years to enable Kerbau28 providing better support and resolving any disputes that may arise.
Once the retention period expires, or when you request deletion of data that we are legally able to fulfil, Kerbau28 will securely delete or anonymise your data using methods that meet industry standards.
Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a data subject have several important rights regarding your personal data held by Kerbau28. We fully respect and facilitate the exercise of these rights.
You have the right to request a copy of the personal data we hold about you. Kerbau28 will provide a data report within 14 business days from the date a valid request is received. The first request is free; subsequent requests within the same 12-month period may be subject to a reasonable administrative fee.
If you find that any personal data we hold about you is inaccurate, incomplete, or outdated, you have the right to request a correction. Most basic profile information can be updated directly in your account settings Kerbau28 yours. For corrections to information that require document verification — such as your full name or identity card number — please contact our customer support.
For data processing that relies on your consent — such as receiving marketing communications — you may withdraw that consent at any time through the notification settings in your Kerbau28 or by contacting our support team. Withdrawing your consent does not affect the validity of any processing that took place prior to the withdrawal.
In certain circumstances provided for under the PDPA Malaysia — such as when you dispute the accuracy of your data or during a complaints investigation — you may request that we temporarily restrict the processing of your data.
To submit any request relating to the rights above, please contact the Data Protection Officer Kerbau28 at privacy@kerbau28.my or through our customer support.
Kerbau28 is a platform strictly restricted to individuals aged 18 and above. We do not knowingly collect, store, or process personal data from individuals under the age of 18 under any circumstances.
In the event that Kerbau28 discovers that personal data belonging to a child or minor has been collected without our knowledge — for example, through registrations made using false information or by borrowing an adult's identity — we will take immediate action to:
Parents and guardians who believe a minor may have accessed the platform Kerbau28 are requested to contact our support team immediately at support@kerbau28.my so that prompt action can be taken.
Kerbau28 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, applicable laws or regulations, or new technological developments that affect how we process data.
You will be notified of any material amendments to this Privacy Policy at least 14 days before the effective date via email to the address registered to your account and through a clear in-platform notification Kerbau28. The "Updated" date at the top of this document will always reflect the date of the most recent amendment.
Continued use of the platform Kerbau28 after the effective date of the amended Privacy Policy will be considered as your acceptance of the revised terms. If you do not agree with the amendments made, you have the right to close your account before the effective date of those amendments.
If you have any questions, concerns or complaints regarding how Kerbau28 handles your personal data, or if you wish to submit any request relating to your PDPA rights, please reach us through the following channels:
If you believe that Kerbau28 does not comply with Malaysia's Personal Data Protection Act 2010 (PDPA) in handling your data, you have the right to lodge a complaint directly with the Department of Personal Data Protection Malaysia (JPDP). We encourage you to contact us directly first so we have the opportunity to resolve any concerns before formal action is taken.
The Bahasa Malaysia version of this Privacy Policy is the official and binding version. Should translations into other languages be made available for members' convenience, the Bahasa Malaysia version shall prevail in the event of any dispute or inconsistency.
Our commitment to protecting member personal data goes beyond legal compliance — it is one of our core values
Every bit of data transmitted between your device and our servers Kerbau28 is encrypted using 256-bit TLS/SSL protocols — the same technology used by Maybank, CIMB, and Malaysia's leading financial institutions. You can play with peace of mind knowing your data is secure in transit.
Kerbau28 fully complies with Malaysia's Personal Data Protection Act 2010 (PDPA) across all aspects of data collection, processing and storage. We do not merely meet the minimum legal requirements — we strive to exceed established standards in order to provide members with the strongest possible protection.
This is an absolute commitment Kerbau28: we have never and will never sell, rent, or trade your personal data to any third party for their commercial purposes. Your data belongs to you, and we use it solely for purposes you have consented to.
As a member Kerbau28, you have full rights under the PDPA to access, correct, restrict the processing of, or request the deletion of your personal data. Requests will be handled within 14 business days. We take these rights seriously and make them straightforward to exercise.
Kerbau28 does not retain your data longer than necessary. Retention periods are clearly defined based on legal and operational requirements. Once a period expires, data is securely deleted using methods that meet industry standards.
Any material changes to the Privacy Policy Kerbau28 will be communicated to you at least 14 days before taking effect, via email and platform notification. You will always have sufficient time to review the changes and make an informed decision.
Malaysian law gives you control over your personal data — know your rights
Request a copy of all personal data that Kerbau28 hold about you. We will provide a full report within 14 business days.
Correct any inaccurate or outdated personal data in your account Kerbau28 yours — directly through your account settings or via customer support.
Withdraw consent for marketing communications at any time via your account notification settings Kerbau28 you.
Request Kerbau28 to temporarily restrict the processing of your data under specific circumstances provided for under Malaysia's PDPA.
Request deletion of personal data that is no longer needed — subject to retention requirements mandated by Malaysian law.
Lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) if you believe Kerbau28 does not comply with the PDPA. We encourage you to seek a resolution directly with us first.
A clear overview of the data collected, its purposes, and retention periods
| Data Type | Primary Purpose | Shared with | Retention Period |
|---|---|---|---|
| Identity Data (Name, IC, DOB) | Account verification & KYC | KYC Provider (limited) | 7 years after account closure |
| Phone Number & Email | Communications & security 2FA | None (internal only) | 7 years after account closure |
| Payment Data (TNG, DuitNow, etc.) | Processing MYR deposits & withdrawals | Malaysian payment providers | 7 years (legal requirement) |
| Gaming Activity Records | VIP programme, audit & security | None | 3 years |
| Technical Data (IP, device) | Security & fraud detection | None (internal only) | 12 months |
| Customer Support Records | Issue resolution & improvement | None | 2 years |
*All retention periods stated are maximum durations. Data that is no longer required will be deleted earlier in accordance with kerbau28's scheduled deletion cycles.
Kerbau28 has never sold and will never sell or trade your personal data to any third party for marketing purposes. This is an absolute commitment.
We only process transactions through legitimate Malaysian payment methods — Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay and FPX. All transactions are in Malaysian Ringgit (MYR).
Account password Kerbau28 you are stored in encrypted form using industry-recognised algorithms. Our team cannot view your password — and we will never ask for it via email or chat.
Communications with personal account managers for Platinum members and above at Kerbau28 is strictly confidential and stored in a separate system with more restricted access.
This Privacy Policy forms part of the overall agreement between you and Kerbau28. To fully understand your rights and responsibilities as a member, please also read our Terms & Conditions and Responsible Gaming Policy.
Protecting your privacy is part of our commitment Kerbau28 broader commitment to member wellbeing. We also provide responsible gaming tools including deposit limits, loss limits, and self-exclusion. You must be 18 years of age or older to use this platform. If gambling is negatively affecting your life, please seek help through our Responsible Gaming page.
Over 200,000 Malaysian players have trusted Kerbau28 with their personal data since 2018. We take your privacy seriously — 256-bit SSL encryption, full PDPA compliance, and absolutely no sale of data to third parties.