Privacy Policy – mag888 Platform

1. Who We Are

mag888 ("we", "us", "our") operates an online casino and sportsbook platform accessible at mag888.co. mag888 is a Malaysia-facing gaming platform operating under international licensing from recognised offshore regulatory authorities. mag888 is not regulated by any Malaysian government body.

For the purposes of this Privacy Policy, mag888 is the data controller in respect of personal data collected through the Platform. This Privacy Policy applies to all persons who access or use the mag888 website, create an account, make a deposit, place a wager, or otherwise interact with the Platform ("you", "your").

We encourage you to read this document in full. If you do not agree with how we collect or use your data as described herein, you should not use the Platform. Continued use of the Platform constitutes your acknowledgement of this Privacy Policy.

2. Data We Collect

mag888 collects personal data through several means: directly from you during registration and use of the Platform; automatically through technical systems; and in limited circumstances from third-party sources such as payment processors and identity verification providers.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, features accessed, game sessions played, betting patterns, session duration, and navigation paths.
• Cookie Data: Session identifiers, authentication tokens, and analytics identifiers as described in Section 7 of this Policy.
• Location Data: Approximate geographic location derived from IP address, used solely for jurisdictional compliance and fraud prevention purposes.

2.3 Data from Third Parties

We may receive supplementary identity verification data from accredited third-party KYC providers, fraud screening data from payment processors, and in cases of suspected financial crime, information from relevant regulatory or law enforcement bodies.

3. How We Use Your Data

mag888 uses the personal data we collect for the following purposes:

• Account Management: Creating and maintaining your mag888 account, authenticating your identity at login, and processing your requests.
• Service Delivery: Processing deposits and withdrawals in MYR, operating your casino and sportsbook sessions, applying bonuses, and delivering winnings to your registered payment method.
• KYC & AML Compliance: Verifying your identity before processing any withdrawal, screening for politically exposed persons and sanctions lists, and fulfilling our anti-money laundering obligations under international licensing requirements.
• Fraud Prevention & Security: Detecting and preventing fraudulent transactions, money laundering, account takeover, and bonus abuse. We use automated risk-scoring tools as part of this process.
• Responsible Gaming: Monitoring account activity to identify patterns associated with problem gambling, enforcing deposit limits and self-exclusion orders, and delivering responsible gaming communications where appropriate.
• Customer Support: Responding to your queries, resolving complaints, and maintaining records of support interactions.
• Legal Obligations: Retaining records as required by our international gaming licence, applicable AML frameworks, and any court or regulatory orders.
• Platform Improvement: Analysing aggregate, anonymised usage data to understand player behaviour and improve the Platform's design, game selection, and payment flows.
• Communications: Sending transactional emails (e.g., deposit confirmations, withdrawal notifications, security alerts) and, where you have opted in, promotional communications about relevant offers.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, other than standard fraud screening processes. You may request human review of any automated decision that materially affects your account.

4. Legal Basis for Processing

mag888 processes your personal data on the following legal bases:

• Contract Performance: Processing necessary to fulfil the agreement between you and mag888 — including account creation, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with our international licensing obligations, anti-money laundering laws, and responses to lawful regulatory or law enforcement requests.
• Legitimate Interests: Processing conducted for fraud prevention, platform security, and aggregate analytics, where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing for promotional communications, where you have explicitly opted in. You may withdraw consent at any time by updating your communication preferences in your account settings or by contacting support.

5. Data Sharing & Disclosure

mag888 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share personal data only in the following circumstances:

• Payment Processors: We share necessary financial data with payment processing partners (including Touch 'n Go, Boost, and participating Malaysian banks) solely to process your deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Identity documents and data points are shared with accredited third-party verification services for the purpose of completing your KYC check. These providers operate under data processing agreements with mag888.
• Game Studio Partners: Technical session data (non-identifying) may be shared with game studios to deliver certified RNG games and live dealer feeds. Studios do not receive your personally identifiable information.
• Regulatory & Law Enforcement Authorities: Where required by our licensing authority or pursuant to a lawful order, we may disclose personal data to relevant regulatory bodies, financial intelligence units, or law enforcement agencies.
• Platform Infrastructure Providers: Hosting, cybersecurity, and analytics infrastructure partners who process data on our behalf under contractual data processing agreements and are prohibited from using the data for their own purposes.

All third-party service providers who handle personal data on behalf of mag888 are bound by contractual obligations to process that data only in accordance with our instructions and to implement appropriate security measures.

6. Data Retention

mag888 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following indicative retention periods apply:

• Account Data & Transaction Records: Retained for a minimum of five (5) years following account closure, in accordance with standard international AML record-keeping requirements.
• KYC Documents: Retained for the duration of the account relationship and for five (5) years thereafter, or longer if required by a specific regulatory instruction.
• Support Correspondence: Retained for three (3) years following resolution of the underlying matter.
• Marketing Opt-In Data: Retained until you withdraw consent or until the data is no longer needed for the relevant communication programme.
• Cookie and Analytics Data: Aggregated analytics data is retained for up to twenty-four (24) months. Session cookies are deleted when you close your browser.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with you.

7. Cookies & Tracking Technologies

The mag888 Platform uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:

• Strictly Necessary Cookies: Required for authentication, session management, and security. These cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Store your preferences (e.g., language, game lobby layout) to personalise your experience across sessions.
• Analytics Cookies: Collect anonymised data on how players navigate the Platform to enable us to identify and resolve usability issues and optimise page performance.
• Fraud Prevention Cookies: Used to identify and flag potentially fraudulent access patterns or automated activity.

mag888 does not deploy third-party advertising or retargeting cookies. You may configure your browser to block or delete cookies; note that doing so may affect the functionality of certain Platform features, including automatic session restoration.

8. Security Measures

mag888 implements and maintains a range of technical and organisational security measures appropriate to the sensitivity of the data we process, including:

• Transport Layer Security (TLS/SSL) encryption on all data transmitted between the Platform and your browser;
• Encryption at rest for stored KYC documents and financial data;
• Access controls limiting internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for Platform administrative access;
• Automated intrusion detection and anomaly monitoring systems;
• Regular penetration testing by independent third-party security auditors; and
• Incident response procedures for detecting, reporting, and addressing data security breaches.

In the event of a data breach that poses a risk to your rights, mag888 will notify affected users and the relevant supervisory authority without undue delay, in accordance with applicable breach notification requirements.

9. Your Privacy Rights

Subject to applicable law and our legal retention obligations, you have the following rights in respect of your personal data held by mag888:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to AML retention obligations.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances, for example while you contest its accuracy.
• Right to Data Portability: Request a machine-readable export of personal data you have provided to us, where technically feasible.
• Right to Object: Object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, contact the mag888 support team as described in Section 13. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. We may require identity verification before processing certain requests.

10. Children's Privacy

The mag888 Platform is strictly restricted to persons aged 21 years and above. mag888 does not knowingly collect personal data from individuals under the age of 21. Where we discover that personal data has been submitted by a person under 21, we will immediately suspend the associated account and delete the data in question as promptly as practicable, subject only to any mandatory legal retention requirements.

If you are a parent or guardian and believe that a person under your care has submitted personal data to mag888, please contact our support team immediately using the contact details in Section 13.

11. International Data Transfers

mag888 operates infrastructure and engages service providers across multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside of Malaysia. When such transfers occur, mag888 ensures that appropriate safeguards are in place, including contractual data processing agreements that impose data protection obligations on recipient organisations equivalent to those described in this Policy.

Players in Malaysia should be aware that data protection law in Malaysia is governed by the Personal Data Protection Act 2010 (PDPA). As an offshore operator, mag888's primary compliance framework is aligned with the data protection standards of its licensing jurisdiction. We nonetheless commit to applying standards of data handling that respect the spirit and principles of the PDPA.

12. Updates to This Policy

mag888 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform functionality. When we make material changes, we will notify registered users via email or a prominent notice on the Platform at least 14 days before the changes take effect.

Your continued use of the Platform following the effective date of any revision constitutes your acknowledgement of and agreement to the updated Policy. We recommend reviewing this page periodically. The "Last Updated" date at the top of this document reflects the most recent revision.

13. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or the personal data mag888 holds about you, please contact us through the following channels:

• Live Chat: Available daily from 10:00 AM to 2:00 AM MYT. Average response time under 3 minutes.
• Email: [email protected] (plain text — not a link). Please include "Privacy Request" in your subject line. Average response time within 4 hours.

For formal data subject access requests or erasure requests, please email us with the subject line "Data Subject Request — [Your Username]". We will require identity verification before actioning any request that involves disclosure or deletion of personal data.