mplay8 Privacy Policy

mplay8 ("we", "us", "our") is committed to protecting the privacy and personal data of all individuals who register for, access, or use the mplay8 platform at mplay8.app ("Platform"). This Privacy Policy describes the types of personal data we collect, the purposes for which we use that data, how we protect it, and the rights available to you as a data subject.

By registering an account or using the mplay8 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Privacy Policy, you should not create an account or access the Platform.

This Privacy Policy should be read together with the mplay8 Terms & Conditions, which govern your use of the Platform. Capitalised terms used but not defined in this Privacy Policy have the meanings given to them in the Terms & Conditions.

For the purposes of applicable data protection legislation, mplay8 is the data controller in respect of the personal data of registered players and Platform visitors. As data controller, mplay8 determines the purposes for which and the means by which personal data is processed.

Where mplay8 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, and analytics platforms — those providers act as data processors under the direction of mplay8 and are subject to contractual obligations that require them to protect your data in a manner consistent with this Privacy Policy and applicable law.

mplay8 collects personal data from you directly when you register an account, make a deposit or withdrawal, interact with our support team, or use the Platform. We also collect certain data automatically when you access the Platform. The categories of data we collect include:

• Identity Data: Full name, date of birth, nationality, and identity document details (MyKad number or passport number) provided during registration and KYC verification.
• Contact Data: Email address, Malaysian mobile phone number, and residential address.
• Financial Data: Bank account details, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), DuitNow reference information, and transaction history on the Platform.
• Account Data: Username, account creation date, login history, session data, balance history, betting and gaming activity records, bonus and promotion history.
• Technical Data: IP address, browser type and version, device type, operating system, time zone, and other technical identifiers collected automatically through cookies and server logs when you access the Platform.
• Communications Data: Records of your interactions with the mplay8 support team via Live Chat, email, and WhatsApp, including the content of those communications.
• Responsible Gaming Data: Records of any deposit limits, cool-off periods, or self-exclusion settings applied to your account.

mplay8 does not intentionally collect sensitive personal data (such as racial or ethnic origin, religious beliefs, or medical information) and requests that you do not provide such data to us through any channel.

mplay8 uses the personal data we collect for the following purposes:

• Account Management: Creating, maintaining, and administering your mplay8 account, including processing login authentication and account security settings.
• KYC & Age Verification: Verifying your identity and confirming that you are at least 21 years of age, as required under our operating standards and responsible gaming obligations.
• Payment Processing: Processing deposits and withdrawals via your chosen payment methods, including verification that payment accounts are in your own name.
• Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) regulations, gaming authority requirements, and other applicable laws, including the retention of transaction records for the required statutory periods.
• Customer Support: Responding to your account queries, complaints, and requests through Live Chat, email, and WhatsApp.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, usability, and content of the mplay8 Platform.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, prohibited conduct, and security breaches.
• Marketing Communications: Where you have opted in, sending you information about mplay8 promotions, bonuses, and new features. You may withdraw consent for marketing communications at any time.
• Responsible Gaming: Monitoring gaming patterns to identify potential problem gambling indicators and facilitating access to responsible gaming tools where appropriate.

mplay8 processes your personal data on the following legal bases:

• Contractual Necessity: Processing necessary to perform our obligations under the mplay8 Terms & Conditions, including account management, payment processing, and dispute resolution.
• Legal Obligation: Processing required to comply with applicable laws, including AML regulations, identity verification obligations, and transaction record-keeping requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregated analytics, where those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided express, freely given consent which may be withdrawn at any time.

mplay8 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We share personal data with third parties only in the following circumstances:

• Payment Processors: Financial data is shared with payment service providers (including banks and e-wallet operators such as Touch 'n Go, Boost, and GrabPay) solely to process your transactions.
• Identity Verification Providers: Identity and document data is shared with certified KYC/AML service providers for the purpose of verifying your identity and age.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory authority demand, mplay8 will disclose personal data as legally obligated. mplay8 will, where legally permissible, inform you of such disclosures.
• Technology Service Providers: Hosting, analytics, and platform infrastructure providers who process data solely on mplay8's instructions and under strict data processing agreements.
• Professional Advisers: Legal, accounting, and auditing professionals engaged by mplay8, subject to professional confidentiality obligations.

All third-party data processors engaged by mplay8 are required by contract to implement appropriate technical and organisational security measures and to process personal data only as directed by mplay8.

The mplay8 Platform is primarily designed for use by players in Malaysia. However, some of the third-party service providers engaged by mplay8 may be located in or process data from jurisdictions outside Malaysia. Where personal data is transferred internationally, mplay8 ensures that appropriate safeguards are in place — including contractual protections equivalent to those provided under applicable data protection law — to protect your data during and after any such transfer.

mplay8 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy applicable legal, regulatory, accounting, and reporting requirements. The following general retention periods apply:

• Account and transaction data: Retained for a minimum of five (5) years following account closure, as required by applicable AML and gaming regulatory standards.
• KYC verification documents: Retained for the duration of the account and for a minimum of five (5) years after account closure.
• Support communications: Retained for three (3) years from the date of the last interaction.
• Technical and log data: Retained for up to twelve (12) months for security and fraud analysis purposes.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of consent.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with mplay8's data disposal procedures.

The mplay8 Platform uses cookies and similar tracking technologies (including local storage and session storage) to operate and improve the Platform. The categories of cookies used include:

• Strictly Necessary Cookies: Essential for the Platform to function, including maintaining your login session, remembering your account preferences, and processing transactions. These cookies cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the Platform — including pages visited, session duration, and navigation paths — to help us improve the Platform experience. These cookies do not identify individual users.
• Preference Cookies: Store your chosen display preferences, language settings, and other personalisation options to improve your experience on return visits.

You can control analytics and preference cookies through your browser settings. However, disabling strictly necessary cookies will affect your ability to use core Platform features including login and payment functions. Most modern browsers — including Chrome, Safari, Firefox, and Edge — provide cookie management controls in their privacy or settings menus.

mplay8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the mplay8 Platform.
• Encryption of sensitive data at rest, including identity documents and financial data.
• Role-based access controls restricting employee access to personal data on a strict need-to-know basis.
• Regular independent security audits and penetration testing of Platform infrastructure.
• Multi-factor authentication for internal administrative access to systems holding personal data.
• Incident response procedures for detecting, containing, and reporting data security incidents.

Despite these measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your mplay8 account credentials. If you suspect that your account credentials have been compromised, you should notify mplay8 immediately via Live Chat.

Subject to applicable law, you have the following rights in relation to the personal data mplay8 holds about you:

• Right of Access: The right to request a copy of the personal data mplay8 holds about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data, subject to mplay8's legal obligations to retain certain records.
• Right to Restrict Processing: The right to request that mplay8 restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: The right to receive your personal data in a structured, machine-readable format in certain circumstances.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or on the basis of legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact mplay8 via Live Chat or by emailing [email protected]. mplay8 aims to respond to data subject requests within thirty (30) calendar days. We may require identity verification before processing any request relating to your personal data.

The mplay8 Platform is strictly intended for adults aged 21 and above. mplay8 does not knowingly collect personal data from persons under the age of 21. Age verification is required during the account registration and KYC processes, and any account identified as belonging to a person under 21 will be closed immediately, with any deposited funds returned.

If you believe that mplay8 has inadvertently collected personal data from a person under 21, please contact us immediately at [email protected] and we will take prompt steps to delete that data and close the relevant account.

mplay8 may process your gaming activity data — including session duration, betting frequency, deposit patterns, and loss history — to identify indicators of potential problem gambling and to facilitate the responsible gaming tools available on the Platform. This processing is conducted in your interest and forms part of mplay8's responsible gaming obligations.

Records of responsible gaming settings applied to your account — including deposit limits, cool-off periods, and self-exclusion status — are retained for the duration of the account and for the applicable regulatory retention period following closure. Self-exclusion records are retained to prevent re-registration during the exclusion period.

mplay8 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. Material changes will be communicated to registered players via the email address on file or through a prominent notice on the Platform. The "Last updated" date at the top of this Privacy Policy will be revised accordingly.

Your continued use of the mplay8 Platform following notification of changes to this Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the revised policy, you should cease using the Platform and contact our support team to close your account.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data mplay8 holds about you, please contact our support team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week on the mplay8 Platform.
• Email: [email protected] (displayed as plain text — not a clickable link).
• WhatsApp: Available 9am – 11pm MYT.

mplay8 aims to acknowledge all privacy-related requests within 48 hours and to provide a substantive response within 30 calendar days. For complex requests involving large volumes of data, we may notify you if additional time is required.