Privacy Policy MRT88 – Transparent & Responsible Personal Data Protection for Malaysian Players

MRT88 collects various types of information from members and prospective members to enable us to provide a safe, fair, and legally compliant online casino service. The information we collect falls into three main categories:

A. Information you provide directly:

• Registration information – full name, active Malaysian phone number, email address, date of birth, and a password of your choosing.
• Identity verification information – your MyKad number may be required to verify your identity and age eligibility when requested, particularly prior to processing your first withdrawal.
• Payment information – details required to process deposits via DuitNow, FPX (Maybank2u, CIMB Clicks, RHB Now), Touch 'n Go eWallet, GrabPay, Boost, or ShopeePay. Please note that sensitive financial information is not stored directly on MRT88's servers.
• Communications with us — any messages, complaints, or enquiries you send via live chat, email, or WhatsApp to the MRT88 support team.

B. Information collected automatically:

• IP address and general geolocation information.
• The type and version of the web browser or app you are using.
• Your device's operating system (Android, iOS, Windows, etc.).
• Gaming activity history – games played, session duration, bet amounts, and game outcomes.
• Cookie data and similar tracking technologies — described further in Section 5.

C. Information from third-party sources:

• Identity verification from accredited KYC (Know Your Customer) service providers for fraud prevention purposes.
• Information required to fulfil our legal obligations under anti-money laundering (AML) regulations.

MRT88 uses collected personal data solely for legitimate purposes related to delivering our online casino services to Malaysian players. We do not use your data for any other purpose without first obtaining your consent.

For promotional communications such as bonus emails, periodic MRT88 promotional notifications, and tournament-related messages, we will only contact you if you have provided your consent at the point of registration. You may withdraw this consent at any time by updating your notification settings in your MRT88 account or by contacting our support team.

MRT88 makes serious investments in data security infrastructure to protect every member's personal information. Data security is not an afterthought for us — it is a core investment that reflects how seriously we take the trust of Malaysian players.

Technical security measures we employ:

• 256-bit SSL/TLS Encryption for all data in transit between your device and MRT88's servers.
• At-rest data encryption for all sensitive records stored in our databases.
• Tokenisation for all financial information — your bank account and e-wallet details are never stored in their original form on MRT88's servers.
• Two-factor authentication (2FA) available to all MRT88 member accounts, and we strongly encourage every player to enable it for added security.
• 24/7 security monitoring by our cybersecurity team, who monitor and respond to any threats or suspicious activity in real time.
• Penetration testing conducted periodically by accredited independent parties to identify and address any security vulnerabilities before they can be exploited.

Organisational security measures:

• Access to member personal data is restricted to MRT88 staff who have a legitimate need to access it in the course of carrying out their responsibilities.
• All staff with access to personal data are required to sign legally binding confidentiality agreements.
• Data security awareness training is conducted on a regular basis for all MRT88 staff.

MRT88 does not sell, rent, or transfer members' personal data to third parties for their own marketing purposes. However, we work with a select number of service providers who assist us in operating the platform and delivering services to you. Any data shared with these parties is strictly limited to what is genuinely necessary.

Categories of third parties that may receive data from MRT88:

• Payment service providers – Providers of DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay that process your deposit and withdrawal transactions in MYR. Data shared is limited to the minimum required to complete the relevant transaction.
• Game software providers – Companies that provide the games, such as slots and Classic Blackjack, that you play on MRT88. Data shared is limited to what is necessary to ensure the games function properly.
• KYC/AML service providers – Companies that assist us in verifying identities and complying with anti-money laundering laws. Only the minimum data required for verification purposes is shared.
• Cloud infrastructure provider – Companies that provide the server and data storage services used by MRT88. All such providers are bound by strict data processing agreements.
• Authorities and regulators – We are required to disclose certain data to Malaysian authorities when mandated by law or a valid court order.

All third-party service providers we engage are subject to legally binding data protection agreements, requiring them to use your data solely for the purposes we specify and to protect it to an adequate security standard.

The MRT88 platform uses cookies and similar tracking technologies to enhance the user experience, maintain login session security, and help us understand how players use our platform so we can continue to improve it.

Types of cookies used by MRT88:

You can manage or delete cookies through your web browser settings at any time. Please note, however, that deleting or disabling essential cookies may affect certain features of the MRT88 platform, including the login process and session security. For non-essential cookies (performance and functional), you may opt out via your MRT88 account settings.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and global data protection best practices, you as an MRT88 member hold several important rights regarding your personal data. MRT88 respects and facilitates the exercise of all these rights.

MRT88 takes a strict approach to protecting vulnerable individuals, particularly those under the age of 21. We firmly prohibit registration or use of the platform by anyone under 21, and employ multiple mechanisms to enforce this restriction.

MRT88's child and youth protection measures:

• Date of birth verification is mandatory during registration, and this information is re-verified during the KYC process.
• MRT88 does not knowingly collect personal data from individuals under the age of 21. Should we become aware that such data has been collected, we will delete it immediately and close the account in question.
• If you are a parent or guardian who believes your child has registered an account on MRT88 without your consent, please contact us immediately at [email protected] and we will take prompt action.

MRT88 also recognises the need for special protections for individuals vulnerable to problem gambling. We provide self-exclusion tools and collaborate with national assistance programmes. Data belonging to players who enrol in a self-exclusion programme is handled with a higher level of confidentiality and is not used for any promotional communications.

In operating its platform, MRT88 may need to transfer member personal data to servers or service providers located outside Malaysia. This is a standard technical requirement for modern digital platforms that rely on global cloud infrastructure.

When your personal data is transferred outside Malaysia, MRT88 ensures that such transfers are carried out with adequate safeguards through the following mechanisms:

• Legally binding data processing agreements with all data recipients outside Malaysia, requiring a standard of data protection equivalent to Malaysia's PDPA requirements.
• Transfers are made only to countries or entities recognised as providing an adequate level of data protection.
• Application of internationally recognised standard data protection clauses where applicable.

All cross-border data transfers are strictly for legitimate operational purposes and do not exceed what is necessary to provide MRT88's services to you.

MRT88 does not retain your personal data for longer than is necessary for the purposes outlined in this Privacy Policy, or beyond any period required by applicable Malaysian law.

MRT88 data retention guidelines:

• Active account data – retained for the duration that your account remains active with MRT88 and for up to seven (7) years after account closure for legal compliance purposes (primarily financial records for AML and tax purposes).
• Financial transaction records – retained for seven (7) years in accordance with Malaysian financial and tax law requirements.
• Customer support communication logs – retained for two (2) years from the date of the last communication.
• Technical and security log data – retained for 12 months for the purpose of detecting and investigating security incidents.
• Non-essential cookie data – as per the retention periods specified in Section 5 above.

Once the applicable retention period has elapsed, your personal data will be securely deleted or anonymised using methods that prevent recovery. The deletion process is carried out systematically according to a defined schedule.

MRT88 takes every privacy-related enquiry and complaint seriously. If you have any concerns about how we handle your personal data, or if you wish to exercise any of the rights set out in Section 6, we encourage you to contact us directly in the first instance.

Channels to reach the MRT88 privacy team:

• Email: [email protected] (use the subject line "Privacy Enquiry" for faster processing)
• Live Chat: Available 24/7 directly within the MRT88 platform — our team is fully fluent in Bahasa Malaysia
• WhatsApp: For immediate assistance during regular operating hours

We are committed to responding to all privacy enquiries within two (2) business days and resolve complaints within 14 working days from the date the complaint is received. For more complex complaints requiring thorough investigation, we will keep you informed of your case progress at reasonable intervals.

If you are dissatisfied with how MRT88 has handled your privacy complaint after going through our internal process, you have the right to submit a complaint to Malaysia's Department of Personal Data Protection (JPDP) as the regulatory authority for data protection in Malaysia.

MRT88 reserves the right to update this Privacy Policy from time to time. Any significant updates will be communicated to you via email or an in-platform notice. Your continued use of the MRT88 platform after an updated Privacy Policy takes effect will be considered acceptance of the revised terms.