Privacy at Fun88: How We Control Data and Protect Players' Personal Information

Fun88 has been operating since 2008, and throughout this time, all player personal data and transaction information has been processed through TLS/SSL encrypted connections — a technical standard that prevents third parties from intercepting data during transmission. The privacy policy below applies to all accounts registered with the brand, whether accessed via browser or Mobile app.

What types of data does Fun88 collect and use?

When players create an account, conduct transactions, or contact support, the brand records certain groups of information — not everything a user does on the platform becomes "stored data." The typical collection scope includes:

• Identification information: full name, date of birth, contact address, identity document number (during Kyc verification process).
• Transaction information: deposit and withdrawal history, payment methods used.
• Device and session data: IP address, browser type, access timestamps — used to detect unusual access attempts.

Data usage purposes are limited to account operation, transaction processing, legal compliance, and — when players have consented — sending promotional notifications. No purposes beyond these scopes are permitted without prior notice.

Why does information need to be collected?

This question arises frequently, especially among experienced players familiar with managing multiple platforms. Identity data collection is not optional — it's a mandatory requirement from Pagcor (the licensing regulatory body in the Philippines) and Isle of Man GSC to ensure anti-money laundering standards and player protection. The KYC process is therefore not just an internal brand requirement but a legal condition players must complete to use full withdrawal features.

Device and session data serve a different purpose: detecting logins from unusual geographic locations or previously unused devices, thereby reducing the risk of unauthorized account access. This is a platform verification mechanism supported by IOVATION infrastructure.

How do data protection technical mechanisms work?

Connection encryption and internal access controls

All data transmitted between a player's device and servers passes through TLS/SSL connections in the 128–256-bit range — meaning content is encrypted before leaving the device and only decrypted at the destination server. Even if data is intercepted in transit, the actual content remains unreadable without the correct decryption key.

Internally, only authorized personnel can access data systems, and access requires multi-factor authentication. Every action in the system is logged centrally — meaning if an incident occurs, the technical team can precisely trace who did what, when, and with which data.

Servers and storage infrastructure

Player data is stored in internationally certified data centers, combined with multi-layer firewalls to prevent unauthorized external access. Servers are located in the Philippines — the same jurisdiction as operational headquarters — ensuring data is not transferred to unrelated jurisdictions without specific justification.

Does Fun88 share data with third parties?

General principle: no sharing of personal information with third parties without explicit player consent. There are two legal exceptions: (1) mandatory requests from competent legal authorities under applicable law, and (2) direct operational partners in the system — such as payment providers or identity verification units — but only at the minimum data level necessary to complete transactions.

For email marketing and promotional notifications, players can customize or disable entirely in account settings — this is an opt-out right requiring no support contact.

What rights do players have over their data?

This is the section many long-term users overlook, defaulting to thinking "submitted data is out of control." In reality, Fun88's policy grants players three active rights:

• Right to access: review all personal information the system is storing.
• Right to correct: request updates to information no longer accurate — for example, changed contact address or phone number.
• Right to delete: request deletion of personal data, except items that law requires retention for a specified period (typically related to financial and transaction history for legal audit purposes).

These three rights can mostly be exercised through the account interface or by submitting a request to the dedicated support channel operating 24/7. The brand commits to responding and processing requests according to published procedures, without indefinite delays.

Legal compliance and complaint handling

The brand's privacy policy is built to comply with GDPR standards — the European Union's personal data protection regulation — as well as similar applicable laws in Asia. This is a legal framework that clearly defines the brand's responsibilities and player rights even in case of disputes.

If players suspect data is being processed incorrectly or show signs of breach, the 24/7 support portal is the first channel to file a complaint. The request should specify: the type of data involved, when the suspected incident occurred, and a brief description of the issue. Every action in the system has logged records, helping the technical team cross-reference and respond with evidence rather than speculation. See Terms of use for details on each party's responsibility scope.

One important note: the right to delete data does not mean immediate deletion of entire account history. Financial transaction items typically must be retained under legal obligation for a specified period before complete deletion is possible — this stems from PAGCOR and Isle of Man GSC audit requirements, not arbitrary brand decisions.