128mega Privacy Policy

This Privacy Policy ("Policy") is issued by 128mega ("the Company," "we," "us," "our") and applies to all personal data processed by 128mega in connection with the operation of the 128mega online casino and sportsbook platform, accessible at 128mega.org ("the Platform"). 128mega acts as the data controller in respect of the personal data described in this Policy.

This Policy is intended to provide you — as a registered Member, a visitor to the 128mega website, or any other individual whose personal data we process — with a clear, complete, and accurate account of our data processing practices. We have written this Policy in plain English, consistent with the expectations of our Malaysian member base, while maintaining the legal precision required of a data protection disclosure document.

By using the 128mega Platform or by creating a Member account, you acknowledge that you have read and understood this Policy and that you consent to the collection and use of your personal data as described herein. If you do not consent to the terms of this Policy, you must not use the 128mega Platform. This Policy should be read alongside the 128mega Terms & Conditions, which are incorporated herein by reference.

128mega collects personal data through several channels: directly from you during account registration and use; automatically through your interaction with the Platform; and from third parties including identity verification providers and payment processors. The categories of personal data we collect are set out below.

We do not collect or process special categories of personal data (such as health data, biometric data, or racial or ethnic origin data) except where you voluntarily disclose such information in the course of a responsible gaming self-exclusion request or similar interaction. In such cases, the disclosure is treated with the highest level of confidentiality.

128mega uses personal data collected from you for the following purposes. Each purpose is matched to the legal basis on which 128mega relies for that processing activity, as described in Section 4 of this Policy.

• Account creation and management — to register your account, verify your identity, maintain your Member profile, and manage your account throughout its lifecycle;
• Service delivery — to provide you with access to the 128mega Platform's betting, casino, and gaming services, to process your bets and wagers, and to credit winnings to your account;
• Payment processing — to process deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, FPX) and to maintain an accurate financial record;
• Regulatory compliance and KYC — to verify your age (21+), identity, and source of funds in compliance with applicable anti-money laundering (AML) and Know Your Customer (KYC) regulatory requirements;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent transactions, unauthorised account access, bonus abuse, and other prohibited activities;
• Responsible gaming — to administer self-exclusion requests, deposit limit settings, and other responsible gaming tools, and to identify patterns of problematic gambling behaviour for proactive intervention;
• Customer support — to respond to your enquiries, resolve complaints, and maintain records of support interactions;
• Marketing and promotions — to send you promotional communications and personalised offers where you have provided consent, and to administer bonus and loyalty programmes;
• Platform improvement — to analyse usage patterns, game performance, and member behaviour (in aggregated or pseudonymised form) to improve the 128mega Platform and its services;
• Legal proceedings — to establish, exercise, or defend legal claims involving 128mega.

128mega relies on the following legal bases for processing your personal data, consistent with applicable data protection law:

• Contractual necessity — processing required to perform the Member Agreement (Terms & Conditions) between you and 128mega, including account management, payment processing, and service delivery;
• Legal obligation — processing required to comply with applicable legal and regulatory requirements, including AML/KYC obligations and age verification requirements;
• Legitimate interests — processing required for 128mega's legitimate business interests, including fraud prevention, platform security, and service improvement, where those interests are not overridden by your data protection rights;
• Consent — processing for marketing communications and the use of non-essential cookies, where your explicit consent has been obtained. You may withdraw marketing consent at any time by contacting support or updating your communication preferences in your account settings.

128mega does not sell, rent, or licence your personal data to third-party marketing companies or data brokers. We share your personal data only in the following circumstances and only with the categories of recipients listed below:

• Payment processors — we share necessary transaction data with licensed payment service providers (including FPX network banks, Touch 'n Go, and Boost) to process your deposits and withdrawals;
• Identity verification providers — we share identity documents with third-party KYC/AML service providers who perform document verification and sanctions screening on our behalf;
• Game content providers — providers of game software and live casino infrastructure (such as Pragmatic Play, Evolution, and others) may receive technical session data necessary to operate game services within the 128mega Platform;
• Regulatory and law enforcement authorities — we disclose personal data to relevant authorities where required to do so by applicable law, court order, or regulatory directive, including under anti-money laundering regulations;
• Professional advisers — we may share personal data with legal counsel, auditors, and accountants where necessary for the conduct of legitimate professional advisory engagements;
• Business successors — in the event of a merger, acquisition, or sale of all or part of 128mega's business, personal data may be transferred to the successor entity, subject to equivalent data protection obligations.

All third-party service providers with whom 128mega shares personal data are required to implement appropriate data protection safeguards and are contractually prohibited from using your data for any purpose other than the specific service they provide to 128mega.

128mega uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device when you visit a website. 128mega uses the following categories of cookies:

• Strictly necessary cookies — essential for the Platform to function. These include session authentication cookies that maintain your logged-in state and security tokens. These cookies cannot be disabled as they are required for the Platform to operate;
• Functional cookies — used to remember your preferences (such as language, preferred payment method, and responsible gaming settings) to personalise your 128mega experience;
• Analytics cookies — used to collect aggregated, pseudonymised data about how Members use the Platform — pages visited, session duration, feature engagement — to help 128mega improve the service;
• Security cookies — used to detect and prevent fraudulent login attempts, account takeover, and other security threats.

You may manage cookie preferences through your browser settings. Disabling functional or analytics cookies may affect your experience on the Platform. Strictly necessary cookies cannot be disabled via browser settings without preventing the Platform from functioning. 128mega does not use cookies to serve third-party advertising.

128mega retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to applicable legal and regulatory minimum retention requirements. The following general retention periods apply:

• Active Member data — retained for the full duration of your membership and for a period of at least 5 years following account closure, in accordance with applicable AML record-keeping requirements;
• Transaction and betting records — retained for a minimum of 5 years from the date of the transaction, as required by financial regulatory obligations;
• KYC and identity verification documents — retained for a minimum of 5 years following account closure;
• Support communications — retained for 3 years following the resolution of the relevant support interaction;
• Technical and usage data — retained for up to 24 months in identifiable form, after which it may be anonymised and retained in aggregate form for analytical purposes without time limit.

Where retention is no longer required for any legitimate purpose, 128mega securely deletes or anonymises personal data in accordance with our internal data disposal procedures.

Subject to applicable data protection law, you have the following rights in relation to your personal data held by 128mega. You may exercise any of these rights by contacting the 128mega support team. We will respond to all verified requests within 30 calendar days.

Requests to exercise data rights are free of charge in ordinary circumstances. 128mega may charge a reasonable fee or decline to act on manifestly unfounded or excessive requests. We may need to verify your identity before processing a rights request to protect against fraudulent submissions.

128mega's operations involve the use of technology infrastructure, third-party service providers, and personnel that may be located outside Malaysia. As a result, your personal data may be transferred to, stored in, or processed in jurisdictions other than Malaysia. Where such transfers occur, 128mega takes appropriate steps to ensure that your personal data continues to receive a level of protection equivalent to that which it receives in Malaysia, in accordance with applicable data protection requirements.

These steps may include relying on adequacy determinations, implementing standard contractual clauses with the recipient entity, or ensuring that the recipient is subject to binding corporate rules or an equivalent approved framework. By using the 128mega Platform, you acknowledge and consent to such international transfers of your personal data as described in this Policy.

The 128mega Platform is strictly intended for individuals aged 21 years and above. 128mega does not knowingly collect personal data from any person under the age of 21. Age verification controls are applied at registration and at the KYC stage to enforce this restriction. If 128mega becomes aware that personal data has been collected from a person under the age of 21, the Company will immediately close the associated account, delete the personal data in question, and take any further steps required by applicable law.

If you are a parent or guardian and believe that a minor in your care has registered with 128mega or provided personal data to us, please contact our support team immediately. We will take prompt action to investigate and, if confirmed, to remove the data and close the account without delay.

128mega implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and 128mega servers;
• Encryption of sensitive data at rest, including KYC documentation and payment information;
• Strict role-based access controls limiting employee access to personal data to those with a legitimate operational need;
• Multi-factor authentication required for all internal systems that process Member personal data;
• Regular penetration testing and security audits of the 128mega Platform infrastructure;
• Automated anomaly detection systems monitoring for unusual login patterns, transaction behaviours, and data access events;
• Comprehensive employee training on data protection obligations and secure data handling procedures.

While 128mega takes these measures seriously and invests continuously in security infrastructure, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. In the unlikely event of a security incident affecting your personal data, 128mega will notify you and take all appropriate remediation steps in accordance with applicable law.

128mega reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. Material changes to this Policy will be communicated to registered Members via email to the address associated with their account, or through prominent in-platform notification, prior to the changes taking effect. The date of the most recent update to this Policy is displayed at the top of this page.

Your continued use of the 128mega Platform following the effective date of any updated Policy constitutes your acknowledgement of the revised terms. We encourage you to review this Policy periodically to stay informed about how 128mega protects your personal data. If you object to any amendment, you may request account closure and the deletion of your personal data (subject to applicable retention requirements) by contacting the 128mega support team.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern about how 128mega has handled your personal data, please contact the 128mega Data Protection team. All enquiries are handled with strict confidentiality and responded to within the timelines specified in this Policy.

If you are not satisfied with 128mega's response to a privacy complaint, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. 128mega encourages you to contact us first so we can attempt to resolve your concern directly before escalation to a supervisory authority.