Myr88 Privacy Policy – Malaysian User Data Protection

1. Introduction

This Privacy Policy ("Policy") describes how myr88 ("we", "the Platform") collects, uses, stores, shares, and protects your personal data when you use the myr88 website, mobile application, and all related services.

Myr88 is the data controller for the personal data you provide to us. We are fully compliant with Malaysia's Personal Data Protection Act (PDPA) 2010 and all subsidiary regulations in force under it. In the event of any conflict between this Policy and applicable legal provisions, PDPA regulations shall prevail.

This Policy takes effect on 1 January 2026. We encourage you to review it periodically, as it may be updated from time to time to reflect changes in our practices or applicable legal requirements.

2. Personal Data We Collect

Myr88 collects various categories of data depending on how you interact with our Platform. Our guiding principle is data minimisation — we only collect what is genuinely necessary.

We do not collect more sensitive information such as your full identification card number, biometric data, or health data, except in cases specifically required by law, such as the KYC (Know Your Customer) process that may be required for withdrawals exceeding certain limits.

3. How Your Personal Data Is Used

Myr88 uses the data we collect for the following purposes, each grounded in a valid legal basis under Malaysia's PDPA:

• Account management and services: Creating and managing your account, processing deposits and withdrawals in RM via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and FPX, and providing access to all Platform services including football, slots, Live Casino and poker.
• Identity and age verification: Ensuring all users are aged 18 and above and meet the eligibility requirements for using the Platform in accordance with myr88's Terms & Conditions.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, account abuse, and violations of myr88's Terms.
• Platform Improvements: Analysing usage patterns in aggregate (without identifying individuals) to improve the design, performance, and user experience of the myr88 Platform.
• Customer support: Handling enquiries, complaints, and support requests you submit to our team via live chat or email.
• Important communications: Sending account-related notifications, policy updates, security alerts, and important transaction information.
• Legal compliance: Meeting reporting obligations required under applicable Malaysian law, including obligations under the Anti-Money Laundering Act (AMLA) and relevant financial regulations.
• Marketing (with your consent): Sending information about myr88 promotions, bonuses, and special offers — only if you have given your consent to receive such marketing communications.

4. Legal Basis for Data Processing

Under Malaysia's PDPA 2010, myr88 requires a valid legal basis for every data processing activity. The bases we rely on are:

• Consent: For marketing communications and non-essential data use — you provide this consent during registration and may withdraw it at any time.
• Contract performance: To process financial transactions, manage your account, and provide the services you have signed up for — this is necessary to fulfil our contractual obligations to you.
• Legitimate interests: For security, fraud prevention, and Platform improvement purposes — where myr88's legitimate interests do not override your fundamental privacy rights.
• Legal obligation: To meet the reporting and compliance requirements imposed by applicable Malaysian law — including financial, tax, and anti-crime legislation.

For each category of data we process, we ensure there is at least one clear legal basis in place. If you would like to know which legal basis applies to a particular processing activity, please contact us by email at support@myr88.best.

5. Data Sharing with Third Parties

Myr88 does not sell, rent, or trade users' personal data. However, in the course of normal Platform operations, we may share data with the following selected parties and only for the stated purposes:

• Payment service providers: Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX, and local banks (Maybank2u, CIMB Clicks, etc.) receive the transaction information necessary to process your deposits and withdrawals. They are bound by their own privacy policies and security standards.
• Game providers: Slots, Live Casino, and sports providers receive only the minimum technical data needed to run the games — typically an anonymised session ID, not your full personal details.
• Technical service providers: Cloud hosting companies, cybersecurity services, and other technical infrastructure providers that process data on our behalf and are bound by strict data processing agreements.
• Lawful authorities: Law enforcement agencies, financial regulatory bodies, or courts when we are legally required to disclose such information. myr88 will notify you of any such request where permitted by law.
• Professional advisors: Lawyers, accountants, and auditors bound by professional confidentiality obligations in the context of advising myr88.

In all instances of data sharing with third parties, myr88 ensures that suitable data protection agreements are in place and that third parties use the data only for permitted purposes.

6. Personal Data Security

Myr88 implements a range of technical and organisational security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction:

• Transit encryption: All communications between your device and myr88 servers are protected by 256-bit SSL/TLS encryption. Sensitive information such as passwords and payment details is never transmitted without encryption.
• Data-at-rest encryption: Personal data stored in our databases is protected with industry-grade AES-256 encryption — the same standard used by leading financial institutions.
• Access controls: Access to user data within myr88's internal systems is restricted to staff who require it to perform their duties, based on the principle of least privilege.
• Continuous monitoring: Our systems are monitored 24/7 to detect any suspicious activity, intrusion attempts, or security anomalies that may affect user data.
• Security audits: myr88 conducts regular penetration testing and security audits to identify and address any vulnerabilities before they can be exploited.
• Staff training: All myr88 staff who handle user data undergo regular data protection and information security training.

While we take all reasonable steps to protect your data, no security system can be guaranteed to be 100% secure. In the event of a material data breach affecting myr88 users, we will notify the affected users and the Malaysian PDPA Commissioner in accordance with established procedures.

7. Data Retention Period

Myr88 does not retain your personal data for longer than is necessary for the purpose it was collected, or as required by applicable law. Our data retention schedule is as follows:

• Active account data: Retained for the duration your account remains active on myr88 and for three years after account closure, for legal compliance and dispute resolution purposes.
• Financial transaction history: Retained for seven years in accordance with applicable Malaysian financial and accounting legal requirements.
• Betting history and activity logs: Retained for 90 days for review, complaints, and customer support purposes. After this period, data is deleted or anonymised.
• Support communication records: Retained for 12 months from the date of communication for reference and quality assurance purposes.
• Technical and security logs: Retained for 30 days, unless there is a specific requirement to retain the data longer in the context of an ongoing security investigation.
• Marketing data (with consent): Retained until you withdraw your consent or request deletion, whichever comes first.

Once the applicable retention period expires, data is securely deleted or permanently anonymised so that it can no longer be linked to you as an individual. Deletion is carried out in accordance with procedures that ensure the data cannot be recovered.

8. Cookies and Tracking Technologies

Myr88 uses cookies and similar tracking technologies to enhance your experience on the Platform. The following are the categories of cookies we use:

• Essential cookies: Required for core Platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting your use of the Platform.
• Performance cookies: Collecting information on how users interact with the Platform (most visited pages, time spent, errors encountered) to help us improve our services. All data is collected in aggregate form and does not identify any individual.
• Functional cookies: Saves your preferences such as language (Bahasa Melayu), odds display format, and other display settings so you do not have to reconfigure them each time you log in.
• Virtual Sports Helping to detect and prevent fraudulent activity and unauthorised access by identifying suspicious usage patterns.

You can manage your cookie settings through your web browser at any time. However, blocking essential cookies may affect the functionality of the myr88 Platform. myr88 does not use third-party cookies for marketing or cross-site profiling.

9. User Rights Regarding Personal Data

Under Malaysia's PDPA 2010, you have the following rights, which you may exercise at any time:

• Right of Access: Request access to the personal data we hold about you, including details on how it is used and with whom it is shared. myr88 will process such requests within 21 business days.
• Right to Rectification: Request correction of inaccurate or incomplete data. You can also update most of your profile information directly through your account settings.
• Right to Erasure: Request deletion of your personal data when it is no longer needed for the original purpose of collection, or when you withdraw consent and there is no other valid legal basis for continued processing. Note: some data may need to be retained to fulfil legal obligations even after a deletion request is received.
• Right to Object: Object to the processing of your data for direct marketing purposes at any time, without needing to provide a reason. You may also object to processing based on legitimate interests in certain circumstances.
• Right to Restriction: Request that we restrict the processing of your data in certain circumstances, such as while you are disputing the accuracy of the data or awaiting resolution of an objection.
• Data Portability: Receive a copy of the personal data you have provided to us in a machine-readable format, for transfer to another service provider where technically feasible.

To exercise any of the above rights, send us a written request by email at support@myr88.best or via live chat within the Platform. Include your account username to help expedite the process. myr88 will process your request within the timeframes set by Malaysia's PDPA and will not charge a fee for reasonable requests.

10. Protection of Children's Data

Myr88 is a Platform designed exclusively for adult users aged 18 years of age and above only. We do not knowingly collect, process or store any personal data from individuals under the age of 18.

Should we discover that we have inadvertently collected data from a minor, we will promptly take the following steps:

• Linked to immediate account closure.
• Securely and permanently deleting all collected personal data.
• Returning any remaining funds in the relevant account to the original payment method used.

If you believe your child or a minor under your care has registered an account on myr88, please contact us immediately at support@myr88.best. We will take appropriate action promptly.

11. Cross-Border Data Transfers

In the course of its operations, myr88 may need to process or store your data on servers located outside Malaysia, primarily for information technology infrastructure purposes used by the Platform.

Any transfer of personal data outside Malaysia is carried out only under the following circumstances:

• The recipient country or territory provides a level of data protection comparable to Malaysia's PDPA 2010.
• All recipients are bound by comprehensive data processing agreements that require them to protect your data to a standard no less stringent than myr88's own.
• The transfer is necessary to perform the contract between you and myr88, or is carried out at your own request.
• You have given explicit consent for such a transfer.

Myr88 does not transfer data to countries or territories known to have inadequate data protection without appropriate contractual safeguards. Financial data and sensitive account information are prioritised for storage on servers located within the Asia Pacific region.

12. Changes to the Privacy Policy

Myr88 may update this Privacy Policy from time to time to reflect changes in our data handling practices, legislative updates, or new technological developments. We are committed to notifying users of any material changes through:

• A notice prominently displayed on the Platform's main page when you log in.
• Email notification to the address registered with your account for significant changes.
• Updating the "Last Updated" date at the top of this page.

Minor, non-material changes to this Policy may not be actively communicated, but the latest version will always be available on this page. Continued use of the myr88 Platform after any changes are published will be considered acceptance of the updated Policy.

We encourage you to review this Privacy Policy at least once every three months to stay informed about how we handle your personal data.

13. Contact Us – Privacy Enquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or how myr88 handles your personal data, our team is ready to assist:

• Privacy Email: support@myr88.best — please state "Privacy Enquiry" in the subject line.
• Live Chat: Available directly on the myr88 Platform, 24 hours a day, 7 days a week. Average response time under 3 minutes.
• Operating hours: 24 hours a day, 7 days a week, including all Malaysian public holidays.

For requests relating to PDPA rights such as data access, correction, or deletion, we will process your request within 21 business days from the date we receive a complete and verifiable request. For complex cases, we may require additional time and will notify you within the initial period.

If you are dissatisfied with how we have handled your privacy enquiry, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under PDPA 2010.