Privacy Policy

1. Data Controller

mega918 (referred to in this policy as "mega918", "we", "us", or "our") is the data controller responsible for the personal information collected through the mega918 website and platform at mega918.club. mega918 operates under an international gaming authority licence and processes personal data in accordance with applicable data protection legislation, including the Malaysian Personal Data Protection Act 2010 (PDPA).

By registering an account on mega918 or continuing to use the platform, you acknowledge that we may collect, process, and use your personal data as described in this Privacy Policy.

2. Data We Collect

mega918 collects personal data in the following categories, depending on how you interact with the platform:

• Identity Data: Full legal name, date of birth, nationality, and a copy of government-issued identification (e.g., Malaysian MyKad or passport) where KYC verification is required.
• Contact Data: Malaysian mobile phone number, email address, and residential address as provided during registration or account updates.
• Financial Data: Payment method identifiers (e.g., Maybank2u account reference, Touch 'n Go eWallet ID, DuitNow details), transaction amounts, deposit and withdrawal history. mega918 does not store full bank account numbers or card numbers on its servers.
• Account Data: Username, hashed account password, account settings, bonus eligibility status, session history, and game play activity.
• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, time zone, and referring URL collected automatically when you access the platform.
• Usage Data: Pages visited, games played, session duration, click-through events, and feature interactions within the mega918 platform.
• Communications Data: Records of customer support interactions via Live Chat or email, including the content of messages exchanged with the mega918 support team.

mega918 does not collect sensitive personal data categories (such as racial or ethnic origin, political opinions, or health data) except where required by law or responsible gaming obligations.

3. How We Use Your Data

mega918 uses your personal data for the following purposes:

• Account Creation & Management: To create and maintain your mega918 member account, verify your identity, and manage account settings and preferences.
• Transaction Processing: To process MYR deposits and withdrawals via your chosen payment method (Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, etc.) accurately and securely.
• Legal & Regulatory Compliance: To comply with anti-money laundering (AML) obligations, KYC requirements under our operating licence, and any applicable Malaysian law or international regulatory standard.
• Responsible Gaming: To monitor gaming behaviour and enforce responsible gaming tools, self-exclusion requests, and age verification obligations.
• Platform Improvement: To analyse usage patterns, identify bugs, and develop new features based on aggregated, anonymised platform data.
• Customer Support: To respond to your enquiries, resolve disputes, and manage your account-related requests.
• Marketing Communications: To send promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw consent at any time via account settings or by contacting support.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, and any conduct that violates our Terms & Conditions.

4. Legal Basis for Processing

mega918 processes your personal data on the following legal bases:

• Contract Performance: Processing necessary to create and operate your mega918 account and fulfil the services described in our Terms & Conditions.
• Legal Obligation: Processing required to comply with AML legislation, gaming licence obligations, and other applicable laws — including mandatory KYC verification and transaction reporting obligations.
• Legitimate Interests: Processing for fraud prevention, platform security, and the improvement of our services, where these interests are not overridden by your data protection rights.
• Consent: Where we send marketing communications, we rely on your prior consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

mega918 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your data in the following limited circumstances:

• Payment Processors: We share transaction data with Malaysian payment processors (including FPX network participants, Touch 'n Go eWallet, and Boost) strictly as necessary to process your deposits and withdrawals.
• Game Providers: Anonymised session data may be shared with third-party game providers for the purpose of delivering certified game content. No directly identifiable personal data is shared with game providers without your consent.
• Regulatory Authorities: We may disclose personal data to relevant regulatory authorities, law enforcement agencies, or anti-money laundering units where required by applicable law or our operating licence.
• Service Providers: We engage third-party service providers (e.g., cloud hosting, analytics, customer support tools) who process data on our behalf under binding data processing agreements. These providers are contractually prohibited from using your data for any purpose other than delivering services to mega918.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of mega918's business, personal data may be transferred as part of that transaction, subject to the same privacy protections described in this policy.

6. Cookies & Tracking Technologies

mega918 uses cookies and similar tracking technologies to operate and improve the platform. The following cookie categories are used:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in to your mega918 account and security tokens that prevent cross-site request forgery. These cannot be disabled.
• Performance Cookies: Collect anonymised data about how members use the platform — which games are most visited, how long sessions last, and which pages generate errors. This data is used solely to improve platform performance.
• Functional Cookies: Remember your platform preferences, such as preferred language, display settings, and last-visited game category, to personalise your experience on return visits.
• Analytics Cookies: Used to understand traffic patterns and user journeys on mega918. Analytics data is aggregated and does not identify individual members.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair platform functionality, including the ability to remain logged in to your mega918 account.

7. Data Retention

mega918 retains personal data for as long as is necessary to fulfil the purposes outlined in this policy or as required by applicable law. The following general retention principles apply:

• Active Accounts: Personal data is retained for the duration of your active mega918 membership plus a minimum period of five (5) years following account closure, to satisfy AML record-keeping requirements under applicable gaming licence conditions.
• Transaction Records: Financial transaction records are retained for a minimum of seven (7) years in compliance with Malaysian financial record-keeping obligations.
• Marketing Data: Where consent was the basis for processing, marketing preference data is retained until you withdraw consent or for a maximum of three (3) years of inactivity, whichever is earlier.
• Support Communications: Customer support interaction records are retained for a period of two (2) years following the resolution of the relevant interaction.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised.

8. Data Security

mega918 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, or disclosure:

• All data transmitted between your device and the mega918 platform is encrypted using 256-bit SSL/TLS encryption — the same standard used by major Malaysian banking institutions.
• Account passwords are stored as cryptographic hashes. mega918 does not store passwords in plain text and cannot retrieve your password — only a password reset is possible.
• Platform infrastructure is hosted in secure data centres with physical access controls, network firewalls, and intrusion detection systems.
• Access to personal data within mega918's organisation is restricted to authorised personnel on a need-to-know basis, governed by role-based access controls.
• Regular security audits and penetration testing are conducted to identify and remediate vulnerabilities.

9. Your Data Rights

Subject to applicable law and certain exemptions, you have the following rights in relation to the personal data mega918 holds about you:

• Right of Access: You may request a copy of the personal data mega918 holds about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held in your mega918 account.
• Right to Erasure: In certain circumstances, you may request deletion of your personal data — for example, where data is no longer necessary for the purpose for which it was collected and no legal retention obligation applies.
• Right to Restrict Processing: You may request that mega918 restrict processing of your personal data in specified circumstances, such as while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract, you may request your personal data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Object: You may object to processing based on legitimate interests, including profiling, where you have grounds relating to your particular situation.

To exercise any of these rights, contact the mega918 support team via Live Chat or by email at [email protected] (plain text — not a clickable link). mega918 will respond to verified requests within 30 days. Note that certain rights may be limited where compliance with applicable law or regulatory obligations requires continued processing.

10. Children's Privacy

The mega918 platform is strictly intended for persons aged 21 years and above. 21+ mega918 does not knowingly collect personal data from persons under this age. If we become aware that personal data has been collected from an individual below the minimum age, that data will be deleted and the associated account will be closed immediately. If you believe a minor has registered a mega918 account, please contact our support team without delay.

11. International Data Transfers

mega918 may transfer your personal data to service providers and infrastructure partners located outside Malaysia, including in jurisdictions that may not provide the same level of data protection as Malaysian law. Where such transfers occur, mega918 ensures that appropriate safeguards are in place — including standard contractual clauses or transfers to jurisdictions with recognised adequate data protection frameworks — to protect your personal data to the same standard as required under Malaysian PDPA obligations.

12. Third-Party Links

The mega918 platform may contain references to third-party game providers and payment services. This Privacy Policy applies solely to mega918's own data processing activities. mega918 has no control over, and accepts no responsibility for, the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with independently of the mega918 platform.

13. Amendments to This Policy

mega918 reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes will be communicated via in-platform notification or email to registered members prior to taking effect. The "Last Updated" date at the top of this page reflects the date of the most recent revision. Your continued use of mega918 following notification of changes constitutes your acceptance of the revised policy.

14. Contact & Complaints

For any questions, requests, or complaints relating to this Privacy Policy or mega918's data processing practices, please contact us:

• Live Chat: Available 24/7 from within the mega918 platform — average response time under 3 minutes.
• Email: [email protected] (plain text — not a clickable link). Responses within 24 hours on business days.

If you are not satisfied with mega918's response to a data protection complaint, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction, including the Personal Data Protection Department (JPDP) of Malaysia.