Mega288 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by Mega288 ("we", "us", "our", "the Platform") and applies to all personal data collected and processed in connection with your use of the Mega288 online casino and sports betting platform accessible at mega288.lat, including any associated mobile-optimised interfaces.

We are committed to handling your personal information with care, transparency, and in compliance with applicable international data protection standards. This Policy explains what data we collect about you, why we collect it, how it is used and stored, and the rights you hold in relation to that data.

By registering an account with Mega288 or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read in conjunction with our Terms & Conditions.

2. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, identification number, IP address, and payment details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means Mega288, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third-party entity that processes Personal Data on behalf of Mega288 under a data processing agreement.
• "User" or "You" means any individual who accesses, registers on, or uses the Mega288 Platform.
• "KYC" (Know Your Customer) means the identity verification process carried out to confirm a user's identity in accordance with anti-money laundering obligations.

3. Personal Data We Collect

Mega288 collects the following categories of personal data about you:

Category	Examples	When Collected
Identity Data	Full legal name, date of birth, nationality, MyKad or passport number	Registration and KYC verification
Contact Data	Email address, phone number, residential address	Registration and KYC verification
Financial Data	Bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay, DuitNow), transaction history in MYR	Deposits and withdrawal requests
Account Data	Username, account ID, login timestamps, account balance history, bonus redemption history	Ongoing account usage
Technical Data	IP address, browser type and version, device type, operating system, session duration	Automatically, upon each platform visit
Usage Data	Games played, bet amounts, sports markets accessed (EPL, Liga Super Malaysia, UFC), page navigation patterns	Automatically, during active sessions
Communications Data	Live chat transcripts, support email correspondence, any documents submitted to support	When you contact our support team
Verification Documents	Copies of government-issued ID, proof of address, payment method screenshots	KYC and fraud-prevention checks

We do not intentionally collect sensitive categories of personal data (such as racial or ethnic origin, health data, or political opinions) and ask that you do not submit such information.

4. How We Collect Your Data

We collect your personal data through the following means:

• Direct submission: Information you provide when registering, completing KYC verification, contacting support, or updating your account profile.
• Automated technical collection: Data gathered automatically when you visit or interact with the Platform, including cookies, server logs, and analytics tools.
• Transaction processing: Data provided by or confirmed with payment processors and e-wallet providers (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX) when processing deposits and withdrawals.
• Third-party identity verification: Data obtained from third-party KYC and fraud-prevention service providers where used to supplement our internal verification processes.
• Publicly available sources: In limited circumstances, information from public registers or databases where required for compliance or fraud-prevention purposes.

5. Purposes of Data Processing

Mega288 processes your personal data for the following specific purposes:

1. Account creation and management: To register your account, verify your identity, and maintain your account in good standing.
2. Service delivery: To process deposits and withdrawals in MYR, settle bets, credit bonuses, and provide live casino and sports betting services.
3. KYC and regulatory compliance: To fulfil anti-money laundering (AML), counter-terrorism financing (CTF), and know-your-customer obligations under applicable international standards.
4. Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, unauthorised account access, and prohibited conduct.
5. Customer support: To respond to your enquiries, process complaints, and resolve disputes.
6. Platform improvement: To analyse usage patterns, identify technical issues, and enhance the user experience across the Platform.
7. Responsible gambling: To monitor betting behaviour, identify indicators of problem gambling, and facilitate self-exclusion and limit-setting tools.
8. Communications: To send you account-related notifications, security alerts, and, where you have opted in, promotional communications regarding Mega288 offers.
9. Legal proceedings: To exercise or defend legal rights, comply with court orders, and respond to regulatory requests.

6. Legal Basis for Processing

Mega288 processes your personal data under the following legal bases, depending on the purpose:

• Contractual necessity: Processing required to perform the contract between you and Mega288 (i.e., operating your account and delivering the gaming services you have requested).
• Legal obligation: Processing necessary to comply with AML/CTF laws, KYC requirements, and other applicable regulatory obligations.
• Legitimate interests: Processing conducted for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where our legitimate interests are not overridden by your privacy rights.
• Consent: Processing of your data for optional marketing communications, where you have provided clear and specific consent. You may withdraw consent at any time by contacting our support team.

7. Data Sharing & Disclosure

Mega288 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may disclose your personal data in the following limited circumstances:

• Payment processors and e-wallet providers: To process deposits and withdrawals, we share relevant financial and identity data with our payment partners, including operators of DuitNow, FPX, and major Malaysian bank transfer services (Maybank, CIMB, Public Bank, Hong Leong).
• KYC and identity verification providers: We engage certified third-party services to assist with identity verification and fraud screening. These providers act as data processors under contractual data protection obligations.
• Game software providers: Game outcome data (not personally identifiable beyond your account ID) is shared with RNG-certified casino game providers to validate and settle game rounds.
• IT infrastructure and hosting providers: Our technology infrastructure partners process certain technical and account data for the purpose of hosting and maintaining the Platform, under strict data processor agreements.
• Legal and regulatory authorities: We may disclose personal data where required to do so by court order, regulatory direction, or law enforcement request. We will notify you of any such disclosure to the extent permitted by law.
• Business transfers: In the event of a merger, acquisition, or asset sale involving Mega288, your personal data may be transferred to the successor entity, subject to equivalent privacy protections.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your active account relationship with Mega288, and for a minimum of five (5) years following account closure to satisfy AML and regulatory record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with financial record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years following account closure or the completion of the relevant verification process, whichever is later.
• Support communications: Retained for three (3) years following the resolution of the relevant support interaction, unless the matter is the subject of ongoing legal proceedings.
• Marketing consent records: Retained for three (3) years from the date of consent, or until withdrawn, to maintain an audit trail of your preferences.
• Technical and usage data: Retained in aggregated or anonymised form for platform analytics. Identifiable technical data is retained for up to twelve (12) months.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with Mega288's data disposal procedures.

9. Data Security

Mega288 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers;
• Encrypted storage of sensitive personal and financial data at rest using industry-standard cryptographic protocols;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for internal systems handling personal data;
• Regular security audits and penetration testing of the Platform infrastructure;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

While we take all reasonable precautions, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorised access to your account, please contact our support team immediately.

10. Cookies & Tracking Technologies

Mega288 uses cookies and similar tracking technologies to operate the Platform, maintain session security, and collect basic analytics data. We do not use third-party advertising or retargeting cookies.

The types of cookies we deploy are as follows:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences, such as preferred language settings and display options, to improve your experience across sessions.
• Analytics cookies: First-party analytics tools that collect aggregated, anonymised usage data (e.g., pages visited, session duration) to help us understand how the Platform is used and identify areas for improvement. No personally identifiable information is collected for analytics purposes.

Most browsers allow you to control or delete cookies through browser settings. Disabling strictly necessary cookies will affect your ability to log in and use the Platform. Disabling functional or analytics cookies will not prevent access but may reduce personalisation features.

11. Your Data Rights

Subject to applicable law, you hold the following rights in relation to your personal data held by Mega288:

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held on your account.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we are required to retain certain data for regulatory compliance and cannot delete it on request.
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as while a rectification request is under review.
• Right to Data Portability: Where technically feasible and legally applicable, you may request a structured, machine-readable export of your personal data.
• Right to Object: You may object to processing of your personal data based on legitimate interests, including profiling for responsible gambling monitoring purposes.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact our support team via live chat or email. We will respond to all valid requests within 30 calendar days. We may require you to verify your identity before processing any data rights request.

12. Minors & Age Policy

The Mega288 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted at the point of registration and reinforced through KYC procedures.

If Mega288 becomes aware that personal data has been collected from a person under 21 years of age, that data will be deleted and the associated account will be immediately closed, with any deposited funds returned subject to verification of the source account.

Parents or guardians who believe that a minor may have created a Mega288 account should contact our support team immediately using the contact details in Section 15 of this Policy.

13. International Data Transfers

Mega288 operates across international infrastructure. Your personal data may be transferred to and processed in countries outside Malaysia, including countries where our servers, payment processors, or KYC service providers are located. These jurisdictions may have data protection laws that differ from those applicable in Malaysia.

Where personal data is transferred internationally, Mega288 ensures that appropriate safeguards are in place, including contractual data processing agreements that bind recipients to data protection standards equivalent to those applied by Mega288, as a condition of receiving or processing any personal data on our behalf.

14. Amendments to This Privacy Policy

Mega288 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. Where changes are material, we will notify active account holders via registered email or an on-platform notification prior to the changes taking effect.

The date at the top of this document indicates when the Policy was last revised. Continued use of the Platform following notification of material changes constitutes your acknowledgement of the updated Policy. We encourage you to review this page periodically.

15. Contact Us — Privacy Enquiries

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to raise a privacy-related concern, please contact the Mega288 Data & Privacy team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 via the on-platform chat widget, with GMT+8 priority coverage aligned to Malaysia Standard Time. Typical first-response time: under 3 minutes.

We will acknowledge all privacy-related requests within 3 business days and aim to resolve them within 30 calendar days. For complex requests, we may request additional information to verify your identity before proceeding.