M888 Privacy Policy – How We Protect Your Personal Data

This Privacy Policy is published by m888 ("we", "platform", "Company") and applies to all personal information collected, processed, and stored through the website m888-app.com as well as all related services we provide.

We are committed to protecting the privacy of all m888 members in Malaysia, in accordance with the Personal Data Protection Act 2010 (PDPA) and relevant international standards. This policy outlines your rights as a user and our responsibilities as a data controller.

By registering an m888 account or using any of our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any terms herein, please discontinue use of the m888 platform.

M888 only collects information necessary to provide platform services to you safely and effectively. The following are the categories of information we collect:

We does not collect sensitive information such as health data, religious beliefs, union membership or biometric information unless specifically required by law for identity verification purposes.

The information we collect is used solely for purposes related to providing m888 services to you. The main purposes are as follows:

• Account Management: Securely create, verify, and manage your m888 account
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, Boost, ShopeePay and withdrawals in RM, accurately and securely
• Service Provision: Providing access to Sports Betting, Live Casino, slots, and all m888 products
• Communications: Sending important notifications related to your account, transactions and promotions (only where you have consented to receive marketing communications)
• Security & Fraud Prevention: Identifying and preventing fraudulent activity, money laundering, and unauthorised access
• Legal Compliance: Fulfilling legal and regulatory obligations, including KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements
• Platform Enhancement: Analysing usage patterns to improve m888's functionality and user experience
• Customer Support: Helping you resolve technical issues, account enquiries and complaints

M888 processes your personal data on one or more valid legal bases under Malaysia's PDPA and applicable data protection laws:

• Contract Performance: Processing necessary to fulfil the service agreement between you and m888 – including account management and financial transaction processing in RM
• Legal Obligation: Processing necessary to comply with Malaysian law, including KYC requirements under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001
• Legitimate Interests: Processing for m888's legitimate interests, such as fraud prevention, enhancing platform security, and analysing usage to improve our services
• Consent: For direct marketing purposes and the use of non-essential cookies, we rely on your freely given and withdrawable consent

Each processing purpose has an appropriate legal basis. If you wish to know the specific legal basis for any processing activity, please contact our Data Protection Officer.

M888 does not sell, rent or trade your personal data to third parties for their own commercial purposes. However, we may share your information in the following limited situations:

• Service Provider: Carefully selected third parties that assist us in operating the platform – such as payment gateway providers (for processing deposits and withdrawals in MYR via Touch 'n Go, GrabPay, DuitNow and others), customer service providers and technical infrastructure providers. All such providers are bound by strict data protection agreements.
• Legal Authorities: When required by court order, police investigation or official request from a competent authority in Malaysia
• Fraud Prevention: To industry bodies or identity verification platforms to detect and prevent fraudulent activity or money laundering
• Business Transfer: In the event of a merger, acquisition or sale of business assets, your information may be transferred to the receiving entity, subject to notification being provided to you

M888 continuously invests in security infrastructure to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and m888's servers is encrypted using the latest TLS protocol
• Encrypted Data Storage: Sensitive information is stored in encrypted form on protected servers in secure data centres
• Two-Factor Authentication (2FA): Available to all members and strongly recommended to enhance login security
• Internal Access Controls: Only authorised m888 staff who have undergone background checks may access member data — and only on a strictly need-to-know basis
• 24/7 Monitoring: Our security systems are monitored around the clock to detect any unusual activity or intrusion attempts
• Regular Security Audits: Independent security audits are conducted periodically by third-party cybersecurity firms

While we take all reasonable steps to protect your data, no security system is 100% impenetrable. In the event of a data breach that affects you, we are committed to notifying you within the timeframe required by law.

M888 retains your personal data only for as long as necessary for the stated purposes or as required by law. Our retention policy is as follows:

• Active Account Data: Retained for as long as your account is active and for a period of 7 years after account closure to comply with Malaysian legal requirements
• Financial Transaction Records (MYR): Retained for 7 years from the transaction date as required under Malaysian financial law
• Communication Logs: Live chat session records and customer support emails are retained for 2 years
• Cookie Data: Session cookies expire when you close your browser; persistent cookies are stored for the duration stated in our cookie policy, typically no longer than 12 months
• KYC Documents: Identity verification documents are retained for the duration of the active account and for 7 years after closure

Once the relevant retention period has expired, your data will be securely deleted or anonymised so that it can no longer be personally associated with you.

M888 uses cookies and similar tracking technologies to enhance your experience on the platform and help us understand how the platform is used. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session security and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information about how you use m888 (pages visited, time spent) to help us improve the platform. This information is gathered in aggregate form and does not identify you personally.
• Functional Cookies: Allows the platform to remember your preferences such as language, time zone and display settings to deliver a more personalised experience.
• Analytics Cookies: We use analytics tools to understand platform usage patterns. Data collected is anonymised and used solely for internal improvement purposes.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the m888 platform.

Under Malaysia's PDPA and m888's privacy policy, you have the following rights regarding your personal data held by us:

In certain circumstances, your personal data may be transferred to or stored outside Malaysia — for example, with providers of technical infrastructure or support services in other countries.

When such a transfer takes place, m888 ensures that:

• The recipient country provides a level of data protection equivalent to or higher than that of Malaysia
• Appropriate data transfer agreements are in place, including Standard Contractual Clauses or equivalent protective mechanisms
• Providers in the recipient country are bound by strict security and privacy obligations

You can learn more about the transfer mechanisms we use by contacting our Data Protection Officer.

M888 Services are for individuals aged 18 and above only. We do not knowingly collect, store or process personal data of individuals under the age of 18.

If we find that we have inadvertently collected personal data from minors, we will immediately take the following steps:

• Permanently closing the account in question
• Deleting all personal data associated with the account
• Returning any funds to their rightful owner
• Reporting cases to the relevant authorities where necessary

If you become aware that a minor has registered an account on m888, please contact us immediately at support@m888-app.com.

M888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, applicable laws or relevant business developments.

• You will be notified of material amendments via in-account notifications or your registered email at least 14 days prior to taking effect
• The "Effective Date" and "Version" at the top of this document will be updated whenever changes are made
• Continued use of the m888 platform after the effective date of any amendment constitutes acceptance of the updated privacy terms
• Version history of the privacy policy is available upon request from our Data Protection Officer

M888 has appointed a Data Protection Officer (DPO) responsible for overseeing all privacy and data protection matters. If you have any questions, concerns or complaints regarding this Privacy Policy or how we handle your data, please contact us: