Privacy Policy —
How Million88 Protects
Your Personal Data

This Privacy Policy ("Policy") describes how Million88 ("the Platform", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("User", "you", "your") who access, register with, or otherwise interact with the million88 website at https://million88.cam and all associated services.

We are committed to handling your personal data responsibly, lawfully, and transparently in accordance with applicable data protection legislation. This Policy should be read in conjunction with our Terms and Conditions, which govern your use of the million88 platform as a whole.

By using the million88 platform, creating an account, or submitting personal information through our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any provision of this Policy, please discontinue your use of the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and location data.
• Processing: Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, disclosure, erasure, or destruction.
• Data Controller: The entity that determines the purposes and means of processing personal data — in this context, Million88.
• Data Processor: A third party that processes personal data on behalf of the Data Controller, pursuant to a contractual arrangement.
• Consent: A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• KYC: Know Your Customer — the identity and document verification process undertaken to satisfy regulatory and anti-fraud obligations.
• Cookie: A small text file placed on a User's device by a website to store information about preferences, session state, and browsing behaviour.

Million88 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, we are responsible for ensuring that your personal data is processed in compliance with applicable data protection laws and the provisions of this Policy.

For all data protection queries, subject access requests, or requests to exercise any of your data rights set out in Section 11, please contact us using the details provided in Section 15 (Contact Us) of this Policy.

We collect personal data through several channels: data you provide directly to us, data generated automatically through your use of the Platform, and data received from trusted third parties. The specific categories of data collected are as follows:

4.1 — Data You Provide Directly

4.2 — Data Collected Automatically

When you access the Platform, we automatically collect certain technical and behavioural data through cookies, log files, and similar technologies. This includes:

• IP address, device type, operating system, and browser type and version;
• Pages visited, time spent on each page, links clicked, and referring URL;
• Session identifiers, login timestamps, and access frequency;
• Geolocation data at country or city level, derived from your IP address;
• In-play betting activity, wager amounts, game session data, and win/loss records.

4.3 — Data Received from Third Parties

We may receive personal data about you from third-party sources including: payment processors (for transaction verification purposes), identity verification service providers (for KYC compliance), fraud prevention databases, and advertising partners where applicable. All such third-party data sharing is subject to this Policy and applicable data protection law.

The table below sets out each purpose for which we process personal data, along with the corresponding data categories involved:

Million88 processes personal data only where a valid legal basis exists. The legal bases we rely upon include:

• Contractual Necessity: Processing required to fulfil the contract between you and million88, including account management, deposit and withdrawal processing, and provision of gaming services.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, anti-money laundering obligations, and regulatory reporting requirements.
• Legitimate Interests: Processing carried out for the purposes of fraud prevention, platform security, and service improvement, where our interests are not overridden by your data protection rights.
• Consent: Where we process your data for marketing communications or optional analytics, we do so on the basis of your freely given, informed consent. You may withdraw consent at any time by contacting our support team or updating your account notification preferences.

We do not sell your personal data. We share personal data only in the circumstances described below, and only to the extent necessary for the stated purpose:

• Payment Service Providers: We share relevant transaction and identity data with payment processors — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow/FPX operators, and USDT network infrastructure — solely for the purpose of processing your deposits and withdrawals.
• Identity Verification Providers: KYC document data may be shared with third-party identity verification services to fulfil our regulatory obligations regarding age and identity verification.
• Fraud Prevention and AML Services: We may share data with fraud screening databases and anti-money laundering compliance services to protect the platform and its users.
• Cloud and Infrastructure Providers: Personal data may be stored on or processed through secure third-party cloud infrastructure providers who operate under contractual data processing agreements.
• Legal and Regulatory Authorities: We may disclose personal data to competent authorities, courts, or regulators where required to do so by applicable law, court order, or regulatory direction.
• Business Transfers: In the event of a merger, acquisition, or sale of the Platform, personal data may be transferred as part of the business assets, subject to equivalent data protection commitments being maintained.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your account, plus a minimum post-closure period as required by applicable anti-money laundering and regulatory record-keeping obligations (typically five to seven years following account closure).
• KYC Documents: Retained for a minimum of five years following the conclusion of the customer relationship, in line with standard AML compliance requirements.
• Transaction Records: Deposit, withdrawal, and wagering records are retained for a minimum of five years for regulatory and audit purposes.
• Customer Support Records: Communication records are retained for three years following the resolution of the relevant matter, or longer if required for ongoing dispute or legal proceedings.
• Technical and Analytics Data: Aggregated analytics data may be retained indefinitely in anonymised form. Identifiable technical logs are typically retained for 12 months.
• Marketing Consent Records: Records of marketing consent and withdrawal of consent are retained for the duration of the relationship and a minimum of three years thereafter.

Where personal data is no longer required, we take appropriate measures to securely delete or irreversibly anonymise it in accordance with our data disposal procedures.

Million88 employs a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures in place include:

• TLS/SSL Encryption: All data transmitted between your browser and our servers is protected by Transport Layer Security (TLS) encryption. Our connection is HTTPS-enforced — you should always verify the padlock indicator in your browser address bar.
• AES-256 Encryption at Rest: Sensitive personal and financial data stored in our systems is encrypted using AES-256, a standard adopted by financial institutions worldwide.
• Two-Factor Authentication (2FA): Account login can be secured with 2FA, providing an additional layer of protection beyond your password.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with access to user data undergo background checks and receive data protection training.
• Intrusion Detection: Our infrastructure is monitored around the clock for suspicious activity, with automated alerts and response procedures in place.
• Vulnerability Management: Regular security assessments and penetration tests are conducted to identify and remediate vulnerabilities in our systems.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected Users and relevant authorities within the timeframes required by applicable law. We encourage you to notify us immediately at [email protected] if you suspect any unauthorised access to your account.

Million88 uses cookies and similar tracking technologies to enable core platform functionality, improve user experience, and carry out anonymised analytics. The categories of cookies in use are described below:

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use core Platform features including logging in and processing transactions. Disabling optional cookies will not affect your ability to use the Platform but may result in a less personalised experience.

Subject to applicable data protection law, you hold the following rights in respect of your personal data held by million88:

To exercise any of the above rights, please contact us at [email protected] with your request. We will respond within 30 days. We may need to verify your identity before processing any request. Where a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline to act, with written explanation.

The million88 platform is strictly intended for users aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Account registration by persons below this age is prohibited and constitutes a breach of our Terms and Conditions.

As part of our KYC process, we verify the age of all registered users. Where we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant account and securely delete the associated personal data, subject to any legal obligations that require us to retain records of the compliance investigation.

Million88 operates with infrastructure and service providers that may be located in jurisdictions outside Malaysia. Where your personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable in Malaysia, we will ensure that appropriate safeguards are in place before the transfer is made.

Appropriate safeguards may include: standard contractual clauses approved by relevant supervisory authorities, binding corporate rules, or reliance on the recipient country's adequacy determination. You may request information about the specific safeguards applicable to any international transfer of your data by contacting us at [email protected].

Million88 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. Material changes will be communicated to registered Users via email notification or a prominent notice on the Platform homepage, no later than 30 days before the changes take effect.

The "Last Updated" date displayed at the top of this Policy reflects when the current version was published. We recommend reviewing this Policy periodically to stay informed about how we protect your data. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

Archived versions of prior Privacy Policies are available upon request by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to make a complaint about how your personal data has been handled, please contact us through the following channels:

If you are not satisfied with our response to a data-related complaint, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. We encourage you to contact us first so that we can attempt to resolve the matter directly.