Privacy Policy – How mega918 Handles Your Data

1. Who We Are

1.1

mega918 ("mega918", "the Platform", "we", "us", "our") operates the online gaming platform accessible at mega918.co and is the data controller responsible for the personal data of registered players and visitors to the platform. mega918 operates under an international online gaming licence that mandates compliance with data protection obligations applicable to licensed gaming operators.

1.2

This Privacy Policy applies to all personal data collected by mega918 in connection with the operation of the platform, including data collected during account registration, identity verification, payment processing, gaming activity, customer support interactions, and platform analytics. By registering an account or using the mega918 platform, you acknowledge that you have read and understood this Privacy Policy.

2. Personal Data We Collect

2.1

mega918 collects the following categories of personal data in connection with account registration, platform use, and legal compliance obligations:

Category	Data Elements	Purpose
Identity Data	Full legal name, date of birth, gender, nationality, MyKad / passport number	Account registration, KYC verification, age verification
Contact Data	Email address, Malaysian mobile number, residential address	Account communication, OTP delivery, support
Financial Data	Payment method details, transaction history, deposit and withdrawal records	Payment processing, AML compliance, dispute resolution
KYC Documents	Photographic ID (MyKad / passport), proof of address, source of funds documentation	Identity verification, regulatory compliance
Gaming Activity	Game history, bet amounts, win/loss records, session duration, bonus usage	Platform operation, responsible gaming monitoring, dispute resolution
Technical Data	IP address, device type, browser type, operating system, login timestamps	Security monitoring, fraud prevention, platform analytics
Communication Data	Live chat transcripts, email correspondence, support ticket records	Customer support, quality assurance, dispute resolution

3. How We Collect Your Data

3.1

Direct collection. mega918 collects personal data directly from you when you: register a new account; complete the KYC identity verification process; make a deposit or withdrawal; contact customer support; or respond to a survey or promotion.

3.2

Automated collection. When you access and use the mega918 platform, certain technical data is collected automatically through server logs, cookies, and similar tracking technologies. This includes your IP address, device identifiers, browser type, session timestamps, and the pages or sections of the platform you visit. This data is used for platform security, fraud detection, and anonymous aggregate analytics.

3.3

Third-party collection. mega918 may receive personal data about you from third-party sources including payment processors (for transaction verification), identity verification services (for KYC document authentication), and fraud prevention databases. Data received from third parties is used solely for the stated purpose and is handled in accordance with this Privacy Policy.

4. Purpose & Legal Basis for Processing

4.1

mega918 processes personal data only where a lawful basis exists under applicable data protection law. The primary lawful bases relied upon are:

• Contractual necessity: Processing required to provide the gaming services you have registered for, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with the obligations imposed by mega918's international gaming licence, including KYC verification, AML monitoring, responsible gaming compliance, and regulatory reporting.
• Legitimate interests: Processing carried out for fraud prevention, platform security monitoring, and aggregate analytics, where such processing does not override your fundamental rights and freedoms.
• Consent: Where consent is the lawful basis (for example, for optional marketing communications), mega918 will request your explicit consent before processing, and you may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Data Sharing & Third Parties

5.1

mega918 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. mega918 shares personal data only in the following limited circumstances:

• Payment processors: Financial data is shared with payment service providers including Touch n Go, Boost, GrabPay, DuitNow, and FPX bank partners solely for the purpose of processing deposits and withdrawals.
• Game providers: Minimum necessary session data is shared with licensed game studios (including Pragmatic Play, PG Soft, Evolution Gaming, and others) for game delivery and technical integration purposes.
• KYC and identity verification services: Identity document data is shared with certified third-party KYC service providers for the purpose of verifying your identity in compliance with licence obligations.
• Regulatory authorities: mega918 may disclose personal data to relevant gaming regulatory authorities, financial intelligence units, or law enforcement agencies where required by applicable law or gaming licence conditions.
• Professional advisers: Personal data may be disclosed to legal advisers, auditors, or accountants on a need-to-know basis and subject to obligations of confidentiality.

5.2

All third parties with whom mega918 shares personal data are contractually required to process such data in accordance with applicable data protection law and to implement appropriate technical and organisational security measures. mega918 does not permit third-party service providers to use your personal data for their own purposes beyond the specific service they provide to mega918.

6. Cookies & Tracking Technologies

6.1

mega918 uses the following categories of cookies and similar technologies on the platform:

• Strictly necessary cookies: Required for the platform to function, including session authentication cookies that keep you logged in during your visit. These cannot be disabled.
• Functional cookies: Store your preferences such as language settings and display preferences to improve your platform experience.
• Analytics cookies: Collect anonymised data about how the platform is used to help mega918 improve performance and identify technical issues. These are processed in aggregate form only.
• Security cookies: Used for fraud detection and prevention purposes, including identifying unusual login patterns or suspicious activity.

6.2

You may configure your browser to refuse or delete cookies; however, disabling strictly necessary cookies will affect your ability to access and use the mega918 platform. mega918 does not use third-party advertising cookies or share tracking data with advertising networks.

7. Data Retention

7.1

mega918 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including compliance with gaming licence obligations and applicable legal requirements. The following retention periods apply as general guidance:

• Account and KYC data: Retained for a minimum of 5 years from the date of account closure, as required under gaming licence AML compliance obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction in accordance with financial record-keeping obligations.
• Gaming activity records: Retained for a minimum of 3 years from the date of activity for dispute resolution and regulatory audit purposes.
• Customer support records: Retained for 2 years from the date of the last interaction.
• Technical and security logs: Retained for 12 months on a rolling basis.

8. Data Security

8.1

mega918 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Security measures in place include:

• 256-bit SSL/TLS encryption for all data transmissions between your device and the mega918 platform;
• Encrypted storage of passwords using industry-standard hashing algorithms; passwords are never stored in plain text;
• Access controls limiting personal data access to authorised mega918 personnel on a strict need-to-know basis;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• Segregation of player funds from operational accounts to protect balances in the event of financial difficulty;
• Two-factor authentication available to all players and mandatory for certain high-value account actions.

8.2

In the event of a personal data breach that poses a risk to your rights and freedoms, mega918 will notify affected individuals and relevant regulatory authorities in accordance with applicable data breach notification requirements.

9. Your Data Rights

9.1

Subject to applicable data protection law, you have the following rights in relation to your personal data held by mega918:

• Right of access: You may request a copy of the personal data mega918 holds about you.
• Right to rectification: You may request that inaccurate or incomplete personal data be corrected or completed.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to restriction: You may request that mega918 restrict the processing of your personal data in certain circumstances.
• Right to data portability: Where processing is carried out by automated means on the basis of consent or contract, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming monitoring purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

9.2

To exercise any of the above rights, contact mega918 at [email protected] (plain text — not a link). mega918 will respond to verified requests within 30 days. We may need to verify your identity before processing a data rights request.

10. Children's Privacy

The mega918 platform is strictly intended for adults aged 21 and above. mega918 does not knowingly collect personal data from persons under the age of 21. If mega918 becomes aware that personal data has been collected from a person under 21 without verifiable parental consent or in violation of the minimum age requirement, such data will be deleted immediately and the associated account will be closed. If you are a parent or guardian and believe your child has provided personal data to mega918, please contact support immediately.

11. Cross-Border Data Transfers

In operating an international online gaming platform, mega918 may transfer your personal data to service providers and infrastructure located in jurisdictions outside Malaysia. Where such transfers occur, mega918 ensures that appropriate safeguards are in place to protect your personal data in accordance with applicable data protection standards, including contractual clauses that impose equivalent protections to those available under Malaysian law.

12. Policy Amendments

mega918 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, gaming licence requirements, or data processing practices. Material changes will be communicated to registered players via email with a minimum of 14 days' advance notice. The current version of the Privacy Policy is always available at mega918.co/privacy-policy. Your continued use of the platform following the effective date of an amended Privacy Policy constitutes your acknowledgement of the amendments.

13. Contact & Complaints

For any queries, data rights requests, or concerns relating to this Privacy Policy or mega918's data processing practices, contact the mega918 Data Protection team at [email protected] (plain text — not a link). If you are not satisfied with mega918's response to a privacy concern, you have the right to escalate the matter to the relevant gaming regulatory authority under whose licence mega918 operates.