md88 Privacy Policy

1. Introduction & Scope

This Policy applies to all personal data processed by md88 in connection with the operation of its online gaming platform, including data collected during account registration, KYC verification, deposit and withdrawal transactions, gameplay activity, customer support interactions, and marketing communications.

By registering an account with md88 or continuing to use the md88 platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must not use the md88 platform.

This Policy is to be read in conjunction with the md88 Terms and Conditions, which govern your use of the platform generally.

2. Data Controller Information

md88 is the data controller responsible for the personal data collected through the md88 platform. As data controller, md88 determines the purposes and means by which your personal data is processed.

For all data protection enquiries, requests to exercise your data subject rights, or complaints regarding md88's handling of your personal data, please contact the md88 Data Protection point of contact via the support channels specified in Section 15 of this Policy.

3. Personal Data We Collect

md88 collects the following categories of personal data from players:

• Identity Data: Full legal name, date of birth, nationality, gender, and a copy of government-issued identification (MyKad for Malaysian players, or equivalent for other nationalities);
• Contact Data: Email address, Malaysian mobile number, and residential address (including city — for example, Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Bangsar, or other locations);
• Account Credentials: Username and hashed password (md88 does not store passwords in plaintext);
• Financial Data: Deposit and withdrawal transaction records, eWallet identifiers (Touch n Go, Boost), bank account details used for withdrawals, and partial payment card information where applicable;
• Gaming Activity Data: Bet history, game session logs, win and loss records, bonus redemption history, and wagering patterns;
• Technical Data: IP address, device type, browser fingerprint, operating system, session timestamps, and geolocation data derived from IP;
• Communications Data: Records of all interactions with md88 customer support, including live chat transcripts and email correspondence.

4. How We Collect Your Data

md88 collects personal data through the following means:

• Direct submission: Information you provide when registering your md88 account, completing KYC verification, depositing or withdrawing funds, contacting support, or completing promotional opt-in forms;
• Automated collection: Technical and usage data collected automatically when you access the md88 platform, including through cookies, session logs, and analytics systems;
• Third-party sources: Identity verification data obtained from KYC service providers; fraud screening data from payment processors; and geolocation data from IP intelligence services used for compliance purposes.

5. Purposes & Legal Basis for Processing

md88 processes your personal data for the following purposes and on the following legal bases:

• Contract performance: To create and maintain your md88 account, process deposits and withdrawals, record gameplay, and provide customer support — all necessary for performance of the contract between you and md88;
• Legal obligation: To conduct KYC and anti-money laundering checks, maintain transaction records as required by gaming licensing authorities, and respond to regulatory enquiries or law enforcement requests;
• Legitimate interests: To detect and prevent fraud, maintain platform security, conduct internal analytics to improve services, and manage responsible gaming obligations including identification of problem gambling patterns;
• Consent: To send marketing communications regarding md88 promotions, bonuses, and new features, where you have explicitly opted in to receive such communications. Consent may be withdrawn at any time by contacting md88 support.

6. KYC & Identity Verification Data

md88 is required by its international gaming authority licensing obligations to verify the identity of all players prior to processing withdrawal requests. This process — known as Know Your Customer ("KYC") verification — involves the collection and processing of identity documents, which for Malaysian players typically means a clear copy of your MyKad (National Registration Identity Card) and a corresponding selfie photograph.

KYC documentation is processed by md88's internal compliance team and, where applicable, by third-party identity verification service providers who are contractually bound to process such data only for the purposes specified by md88 and in compliance with applicable data protection requirements. KYC documents are stored in encrypted form on secure servers and are retained for the minimum period required by applicable gaming licensing regulations, which is typically a minimum of five (5) years following account closure.

md88 will not use your KYC documents for any purpose other than identity verification, age verification, and compliance with gaming licensing and anti-money laundering obligations.

7. Payment Data & Financial Information

md88 processes financial transaction data in order to credit deposits to your MYR wallet and process withdrawal requests to your verified payment method. The payment channels supported by md88 include Touch n Go eWallet, Boost eWallet, Maybank, CIMB, Public Bank, and Visa/Mastercard.

md88 does not store full credit or debit card numbers on its own servers. Card transaction processing is handled by Payment Card Industry Data Security Standard ("PCI-DSS") compliant payment service providers. md88 retains only partial card identifiers (last four digits and card type) for transaction reference purposes.

For eWallet and bank transfer transactions, md88 retains sufficient financial data to maintain accurate transaction records as required by its gaming licence, to process withdrawal reversals where applicable, and to comply with anti-money laundering reporting obligations.

8. Cookies & Tracking Technologies

The md88 platform uses cookies and similar tracking technologies to facilitate platform functionality, maintain session state (so you remain logged in during your visit), and collect anonymised usage analytics to improve platform performance.

The following categories of cookies are used by md88:

• Strictly necessary cookies: Required for the platform to function, including session management and security tokens. These cannot be disabled without impairing platform functionality;
• Functional cookies: Remember your preferences (such as language setting and table limit preferences) to personalise your md88 experience;
• Analytics cookies: Collect anonymised data on how players navigate the md88 platform, which pages receive the most traffic, and where technical errors occur. This data is used solely to improve the platform and is not linked to your personal identity.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to log in and use the md88 platform normally.

9. Sharing of Personal Data

md88 does not sell, rent, or trade your personal data to third parties for marketing purposes. md88 shares personal data only in the following limited circumstances:

• Service providers: Third-party vendors who process data on behalf of md88, including KYC verification providers, payment processors, fraud detection systems, cloud hosting providers, and customer support software vendors — all bound by data processing agreements;
• Game providers: Where game session data is transmitted to third-party game studios (such as Pragmatic Play, Playtech, or similar providers) to operate their gaming services, limited technical data is shared as necessary for game function;
• Regulatory & legal authorities: md88 will disclose personal data to its gaming licensing authority, financial intelligence units, or law enforcement agencies where required by applicable law or licensing conditions, including in response to lawful requests relating to anti-money laundering investigations;
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of md88's assets, player data may be transferred to the successor entity, subject to equivalent data protection standards.

10. Data Retention

md88 retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods imposed by md88's gaming licensing obligations:

• Account and identity data: Retained for a minimum of five (5) years following permanent account closure;
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by anti-money laundering regulations;
• Gaming activity logs: Retained for a minimum of two (2) years from the date of each game session;
• Customer support communications: Retained for a minimum of two (2) years from the date of last interaction;
• Technical and session logs: Retained for up to twelve (12) months for security and fraud analysis purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with md88's data disposal procedures.

11. Your Rights as a Data Subject

Subject to applicable data protection law and md88's regulatory obligations, you have the following rights with respect to your personal data held by md88:

• Right of access: Request a copy of the personal data md88 holds about you;
• Right of rectification: Request correction of inaccurate or incomplete personal data;
• Right of erasure: Request deletion of your personal data, subject to md88's regulatory retention obligations — which may require that certain data be retained for a minimum period even after account closure;
• Right to restrict processing: Request that md88 limits the processing of your data in certain circumstances;
• Right to data portability: Request a structured, machine-readable copy of personal data you have provided to md88, where technically feasible;
• Right to withdraw consent: Where processing is based on consent (for example, marketing communications), withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact md88 via the support channels specified in Section 15. md88 will respond to all verified data subject requests within a reasonable timeframe and in accordance with applicable regulatory requirements.

12. Security Measures

md88 implements technical and organisational security measures proportionate to the risk associated with the personal data processed. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between players and md88 servers;
• Encryption of sensitive data at rest, including KYC documents and financial records;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication on administrative systems;
• Regular security assessments and penetration testing of the md88 platform infrastructure;
• Documented incident response procedures for identification, containment, and notification of data security breaches.

Notwithstanding these measures, no internet-based system can guarantee absolute security. You are responsible for maintaining the confidentiality of your md88 account credentials and for notifying md88 immediately if you suspect unauthorised access to your account.

13. Children's Privacy

The md88 platform is strictly intended for adults aged 21 years and above. md88 does not knowingly collect, process, or store personal data relating to persons under 21 years of age. If md88 becomes aware that personal data has been collected from a person under 21, that account will be immediately closed, all associated data will be deleted, and any funds deposited will be returned through the original payment method subject to verification.

If you believe that a minor has registered an md88 account, please contact md88 support immediately via the channels specified in Section 15.

14. Amendments to This Policy

md88 reserves the right to amend this Privacy Policy at any time. The revised Policy will be published on this page with an updated effective date. Where amendments are material — including changes to data sharing practices or retention periods — md88 will provide advance notice via email to registered players.

Your continued use of the md88 platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you must cease use of the platform and request account closure before the revised Policy takes effect.