Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") is issued by ofa168 (hereinafter referred to as "ofa168", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://ofa168.cam (the "Platform").

This Policy governs how ofa168 collects, uses, stores, protects, and discloses personal data obtained from individuals who access or use the Platform, including players based in Malaysia (including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and all other states and territories) and from other jurisdictions where access is permitted.

By registering an account on, or otherwise using, the ofa168 Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, you must cease use of the Platform and may request account closure in accordance with our Terms & Conditions.

For the purposes of this Policy, the following terms shall have the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, information that can directly or indirectly identify you, whether alone or in combination with other data.
• "Processing" means any operation performed on personal data, including collection, storage, use, transmission, alteration, disclosure, restriction, or deletion.
• "Data Controller" means ofa168, being the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third-party service provider that processes personal data on behalf of ofa168 pursuant to a written data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a specified purpose.
• "KYC" means Know Your Customer — the identity and age verification procedures conducted by ofa168 as required by applicable regulatory obligations.
• "Third Party" means any individual or entity other than the data subject (you) and ofa168.

ofa168 collects personal data from you in the following categories and through the following means:

ofa168 does not intentionally collect special categories of personal data (such as racial or ethnic origin, religious beliefs, health data, or criminal records) unless specifically required by applicable law or regulation for AML/KYC compliance purposes, in which case collection will be disclosed at the point of collection.

ofa168 relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing required to perform the contract between you and ofa168 — including account management, payment processing, game delivery, and customer support. Without this processing, we cannot provide the Platform services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations — including Anti-Money Laundering (AML) obligations, Know Your Customer (KYC) requirements, taxation reporting, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing that is necessary for ofa168's legitimate business interests, where those interests are not overridden by your rights — including fraud detection and prevention, platform security, internal analytics, and business development activities.
• Consent: For processing activities where consent is the appropriate legal basis — specifically, direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

ofa168 processes your personal data for the following purposes:

• To create and manage your ofa168 account and to verify your identity and age (21+) as required by our operating terms.
• To process deposits and withdrawals in Malaysian Ringgit (MYR) and cryptocurrency, including via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Bitcoin (BTC), Ethereum (ETH), and Tether (USDT).
• To provide access to all games, live casino tables, and sportsbook services on the Platform, including bet placement and settlement.
• To conduct KYC and AML checks and to comply with all applicable regulatory and legal obligations.
• To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
• To administer our bonus and VIP loyalty programme, including calculating wagering requirements and processing birthday bonus and referral reward claims.
• To provide multilingual customer support via Live Chat, WhatsApp, and email in English, Bahasa Melayu, and Mandarin.
• To send you transactional communications relating to your account — including deposit confirmations, withdrawal notifications, security alerts, and policy update notices.
• To send promotional and marketing communications where you have provided consent to receive them.
• To analyse aggregate usage patterns and Platform performance for the purpose of improving our services (using anonymised or pseudonymised data where possible).
• To enforce our Terms & Conditions and to protect the rights and safety of ofa168, our players, and third parties.

ofa168 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We may, however, share your personal data with the following categories of recipients where necessary and on a strictly need-to-know basis:

• Payment Service Providers: Financial institutions and payment processors that facilitate deposit and withdrawal transactions — including e-wallet operators (Touch 'n Go, Boost, GrabPay), DuitNow/FPX infrastructure providers, and Malaysian banking partners. These processors are contractually bound to handle data solely for payment processing purposes.
• KYC and AML Service Providers: Third-party identity verification and compliance platforms engaged by ofa168 to conduct mandatory KYC checks and screen accounts against regulatory watchlists.
• Game Technology Providers: The software studios and live dealer platform operators that power games accessible on ofa168. Where session data is passed to these providers, it is processed under data processing agreements that restrict its use to game delivery and technical support.
• Fraud Prevention and Security Services: Service providers that assist in detecting and preventing fraudulent transactions, account takeovers, and other security threats.
• Regulatory and Law Enforcement Authorities: Where ofa168 is legally required or compelled by a valid court order or regulatory mandate to disclose personal data, we will comply with such obligations. Where permitted, we will notify you of any such disclosure.
• Professional Advisers: Solicitors, accountants, auditors, and insurers engaged by ofa168 in the course of its business operations, all of whom are bound by professional obligations of confidentiality.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a substantial portion of ofa168's business assets, personal data held by ofa168 may be transferred to a successor entity. Players will be notified of any such transfer in advance.

ofa168 uses cookies and similar tracking technologies on the Platform to ensure proper functionality, improve user experience, and collect aggregate analytical data. A cookie is a small text file stored on your device by your web browser when you visit a website.

The following categories of cookies are used on the ofa168 Platform:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session cookies that maintain your logged-in state, security cookies that prevent cross-site request forgery, and cookies that remember your language preference. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Used to remember your preferences and personalise your experience — such as your preferred game category, notification settings, and deposit method. These cookies improve your experience but are not strictly required.
• Analytical Cookies: Used to collect aggregate, anonymised data about how players navigate and use the Platform, enabling us to identify areas for improvement. These cookies do not identify individual users.
• Security and Fraud Prevention Cookies: Used to detect and mitigate fraudulent activity, including identification of unusual login patterns and detection of automated bot traffic.

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of parts of the Platform. ofa168 does not use third-party advertising cookies.

ofa168 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ofa168 servers.
• Encryption at rest for sensitive stored data, including financial information and identification documents.
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access personal data, on a strict least-privilege basis.
• Multi-factor authentication enforced for all internal systems that store or process personal data.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists.
• Comprehensive audit logging of all access to personal data records.
• An incident response protocol for identifying, containing, and reporting data security incidents in accordance with applicable notification obligations.

While ofa168 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is unconditionally secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, ofa168 will notify affected individuals in accordance with applicable data protection law as expeditiously as practicable.

ofa168 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of the active account relationship and for a minimum period of five (5) years following account closure, in compliance with AML and KYC regulatory requirements.
• Financial and Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, as required by applicable anti-money laundering legislation.
• Customer Support Records: Retained for three (3) years from the date of the last support interaction, to enable us to handle follow-up queries and disputes.
• Technical and Usage Logs: Retained for twelve (12) months in aggregated or pseudonymised form for security monitoring and platform improvement purposes.
• Marketing Consent Records: Retained for the duration of your consent status and for three (3) years following withdrawal of consent, to evidence compliance with our marketing obligations.

Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised in accordance with our internal data disposal procedures. You may request early deletion of your personal data in accordance with the User Rights provisions below, subject to any overriding legal retention obligations.

Subject to applicable data protection law, you hold the following rights in relation to your personal data held by ofa168. You may exercise any of these rights by contacting our support team via email at [email protected] (plain text — not a clickable link) or via Live Chat. ofa168 will respond to all valid requests within 30 days of receipt, or notify you if additional time is required.

Please note that some rights are subject to exceptions and may be limited where ofa168 has a legitimate legal ground for continued processing — for example, the retention of financial records as required by AML regulations cannot be overridden by a deletion request.

ofa168 operates on infrastructure hosted in jurisdictions that may be outside Malaysia. Where personal data is transferred outside the jurisdiction in which it was collected, ofa168 ensures that appropriate safeguards are in place to protect the data in accordance with applicable data protection law. These safeguards may include:

• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection by relevant regulatory authorities.
• The use of standard contractual clauses or equivalent transfer mechanisms approved under applicable data protection frameworks.
• Binding corporate rules or other approved transfer tools where applicable.

Where ofa168 transfers personal data to third-party processors located outside Malaysia, such processors are required to implement equivalent data protection standards as a condition of their contractual engagement with ofa168.

The ofa168 Platform is strictly restricted to individuals aged 21 years and above. ofa168 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If ofa168 becomes aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

ofa168 employs mandatory age verification as part of the KYC process. Players who cannot or do not complete age verification will be restricted from making deposits or withdrawals until verification is satisfactorily completed.

ofa168 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our operational practices. Where material changes are made, ofa168 will notify registered users via email or through an in-platform notification prior to the changes taking effect. The revised Policy will display the updated effective date at the top of this page.

Your continued use of the ofa168 Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. We recommend reviewing this page periodically. This Policy was last reviewed with an effective date of 1 January 2026.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ofa168, please contact our support team using any of the following channels. Our team is available 24 hours a day, 7 days a week:

• Live Chat: Available directly through the ofa168 Platform. Average response time is 3–5 minutes. Our agents are available in English, Bahasa Melayu, and Mandarin.
• WhatsApp: Accessible via our support page on the Platform. Response time typically within 5–10 minutes.
• Email (plain text — not a link): [email protected] — for formal data subject access requests and privacy-related enquiries, please use email as your primary contact method and include your registered account username and a clear description of your request. We aim to respond to all email enquiries within 30 calendar days.