mplay8 Privacy Policy

1. Data Controller

1.1 For the purposes of this Privacy Policy, the data controller responsible for the personal data of mplay8 platform users is the mplay8 operating entity, which operates the platform at mplay8.org under an international gaming authority compliance framework.

1.2 Questions, requests, or complaints relating to this Privacy Policy should be directed to our Data Protection contact at [email protected]. We will acknowledge all written privacy enquiries within 5 business days.

2. Personal Data We Collect

2.1 mplay8 collects the categories of personal data described below in the course of operating the platform and fulfilling our obligations under applicable gaming authority compliance frameworks:

Category	Examples	Collection Point
Identity Data	Full name, date of birth, nationality, MyKad or passport number	Registration, KYC verification
Contact Data	Email address, mobile phone number, residential address	Registration, account settings
Financial Data	Payment method details, deposit and withdrawal transaction history, MYR balance records	Cashier transactions, KYC
Technical Data	IP address, browser type and version, device type, operating system, login timestamps	Automatic collection during platform use
Usage Data	Betting history, game session data, pages visited, features used, session duration	Automatic collection during platform use
Communications Data	Support chat transcripts, email correspondence with mplay8 customer service	Support interactions

2.2 mplay8 does not collect special category data (such as health data or biometric data) beyond what is strictly required for responsible gaming obligations, such as identifying signs of problem gambling behaviour in accordance with our compliance framework obligations.

3. How We Use Your Personal Data

3.1 mplay8 uses your personal data for the following purposes:

• Account creation and management: To register your mplay8 account, authenticate your identity at login, and maintain your account settings and preferences.
• Platform service delivery: To process bets, settle outcomes, credit winnings, process deposits and withdrawals in MYR, and provide access to the sportsbook, casino, and slots products.
• Identity and age verification (KYC): To verify that you meet the minimum age requirement of 21 years and to comply with anti-money laundering (AML) and Know Your Customer (KYC) obligations required under our gaming authority compliance framework.
• Security and fraud prevention: To detect and prevent fraudulent activity, unauthorised account access, and abuse of platform systems, including through IP monitoring, device fingerprinting, and login anomaly detection.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance regarding your account, payments, or gameplay issues.
• Responsible gaming: To monitor for patterns of play that may indicate problem gambling behaviour and to enforce responsible gaming tools including deposit limits, self-exclusion, and session alerts.
• Legal and regulatory compliance: To meet obligations under applicable law and our gaming authority compliance framework, including retention of transaction records and cooperation with regulatory requests.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the mplay8 platform, fix bugs, and develop new features.
• Marketing communications: To send you promotional communications about mplay8 offers where you have provided consent or where legitimate interest applies. You may opt out of marketing communications at any time via your account settings or by contacting support.

4. Legal Basis for Processing

4.1 mplay8 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to provide the platform services and perform our obligations under the mplay8 Terms & Conditions, including account management, payment processing, and bet settlement.
• Legal obligation: Processing required to comply with KYC/AML obligations, gaming authority regulatory requirements, and applicable law.
• Legitimate interests: Processing for security monitoring, fraud detection, platform improvement, and responsible gaming monitoring, where our legitimate interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications, where we have obtained your prior consent. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

5. Data Sharing with Third Parties

5.1 mplay8 does not sell, rent, or trade your personal data to any third party. We share personal data only in the following circumstances:

• Service providers: We share data with trusted third-party service providers who assist in operating the mplay8 platform, including payment processors (such as those facilitating Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank transactions), KYC verification providers, game software providers, and IT infrastructure suppliers. All service providers are contractually required to process data only for the purposes for which it was shared and in accordance with this Privacy Policy.
• Regulatory and gaming authority compliance: We may share data with gaming regulatory authorities, law enforcement agencies, or other government bodies where required by law or where we are legally compelled to do so.
• Fraud prevention: We may share data with fraud prevention agencies or industry databases where required to protect mplay8 and its players from fraud, money laundering, or other financial crime.
• Business transfers: In the event of a merger, acquisition, or sale of mplay8's operating entity, personal data may be transferred as part of that transaction. Affected users will be notified of any such transfer and of any material changes to data handling practices that result from it.

6. Data Retention

6.1 mplay8 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account data and transaction records: Retained for a minimum of 5 years following account closure, in accordance with gaming authority compliance framework requirements and standard AML record-keeping obligations.
• KYC documentation: Retained for a minimum of 5 years from submission or from the date of the last transaction, whichever is later.
• Support communications: Retained for a minimum of 2 years from the date of the last communication.
• Marketing preferences: Retained until consent is withdrawn or the account is closed, whichever is earlier.

6.2 Where retention beyond the minimum period is not required for legal or compliance purposes, mplay8 will securely delete or anonymise the relevant data.

7. Cookies and Tracking Technologies

7.1 mplay8 uses the following categories of cookies on the platform:

• Strictly necessary cookies: Essential for the operation of the platform, including session management, authentication, and security. These cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and display preferences, to improve your experience on return visits.
• Analytics cookies: Used to collect aggregated, anonymised data about how players interact with the platform, to help mplay8 identify technical issues and improve platform performance. This data does not identify individual users.

7.2 mplay8 does not use third-party advertising or behavioural tracking cookies. No data collected through platform cookies is shared with advertising networks or used for behavioural profiling.

7.3 Most browsers allow you to manage cookie settings. Disabling strictly necessary cookies may impair the functionality of the mplay8 platform.

8. Your Data Protection Rights

8.1 Subject to applicable law and our compliance obligations, you have the following rights with respect to your personal data held by mplay8:

• Right of access: You may request a copy of the personal data mplay8 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction: You may request that mplay8 restrict the processing of your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request a structured, machine-readable copy of your data.
• Right to object: You may object to processing based on legitimate interests, including direct marketing, at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

8.2 To exercise any of the above rights, please contact us at [email protected]. We will respond to verified requests within 30 days. We may require identity verification before processing certain requests.

9. Data Security

9.1 mplay8 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS 1.3 encryption for all data in transit between your browser and the mplay8 platform;
• Bcrypt password hashing — your password is never stored or accessible in plain text;
• Access controls restricting internal data access to authorised personnel on a need-to-know basis;
• Regular security audits and penetration testing conducted by independent third parties;
• Two-factor authentication (2FA) available for all player accounts;
• Login anomaly detection and automated account protection responses.

9.2 In the event of a data breach that poses a significant risk to your rights, mplay8 will notify affected users without undue delay and will take all reasonable steps to mitigate harm.

10. Children's Privacy

10.1 The mplay8 platform is strictly for adults aged 21 years and above. mplay8 does not knowingly collect personal data from persons under the age of 21. If we become aware that personal data has been collected from an individual who is underage, that account will be closed immediately and all associated data will be deleted.

10.2 If you believe an underage person has registered on mplay8, please contact us immediately at [email protected].

11. International Data Transfers

11.1 In the course of providing its services, mplay8 may transfer personal data to service providers located in jurisdictions outside Malaysia. Where such transfers occur, mplay8 ensures that appropriate safeguards are in place, including contractual protections, to ensure that your data receives a level of protection consistent with internationally recognised data protection standards.

11.2 mplay8 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate supplementary safeguards.

12. Changes to This Privacy Policy

12.1 mplay8 may update this Privacy Policy from time to time to reflect changes in our data practices, platform services, or applicable legal requirements. When material changes are made, we will notify registered users via email to their registered address and/or via a prominent notice on the Platform at least 7 days prior to the changes taking effect.

12.2 Your continued use of the mplay8 platform following the effective date of any update constitutes acceptance of the revised Privacy Policy. We recommend reviewing this Policy periodically.

13. Contact Us

For any questions, requests, or complaints relating to this Privacy Policy or mplay8's handling of your personal data, please contact us at:

mplay8 Data Protection
Email: [email protected]
Available: 24 hours, 7 days a week (UTC+8)
Response time: Within 5 business days for privacy enquiries

This Privacy Policy was last reviewed and updated in June 2026. mplay8 recommends that all players read this Policy in full and revisit it periodically to stay informed of how their data is handled.