Privacy Policy — MRC88

1. Introduction

This Privacy Policy ("Policy") is published by MRC88 ("we", "us", or "the Platform"), the operator of the online casino and sports betting service available at mrc88.cam. This Policy applies to all users ("Player", "User", or "you") who access or use MRC88's website, mobile interface, and associated services (collectively, the "Service").

We take your privacy seriously. This Policy is designed to give you a clear, honest understanding of exactly what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. We do not use unnecessarily complex legal language where plain English serves equally well.

This Policy is to be read alongside our Terms & Conditions and our Responsible Gambling Policy, each of which forms part of the overall agreement governing your use of MRC88. In the event of any conflict between this Policy and the Terms & Conditions regarding data matters, this Policy shall prevail.

2. Definitions

For the purposes of this Policy, the following terms shall carry the meanings set out below:

• "Controller" means MRC88, the entity that determines the purposes and means of processing your personal data.
• "Personal Data" means any information that identifies or is reasonably capable of identifying a natural person, directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "KYC Data" means identity verification documents and associated information collected as part of the Know Your Customer process.
• "Cookies" means small text files placed on your device by the Platform or by authorised third-party services to facilitate functionality, analytics, or session management.
• "Third-Party Processor" means any entity engaged by MRC88 to process Personal Data on our behalf, operating under a data processing agreement that mandates equivalent data protection standards.
• "Data Subject" means the individual to whom Personal Data relates — in most instances, this means you, the Player.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register, verify your account, or interact with our support team, you provide us with Personal Data including:

• Full legal name and date of birth
• Email address and contact number
• Residential address
• Government-issued photo ID (Malaysian NRIC / MyKad, Passport, or Driver's Licence) — front and back
• Proof of address documentation (utility bills, bank statements issued within 3 months)
• Selfie photograph for liveness verification
• Payment instrument details (e-wallet account numbers, bank account details, cryptocurrency wallet addresses)
• Communications with our support team, including live chat transcripts and email correspondence

3.2 Data Collected Automatically

When you access the Platform, we automatically collect certain technical and behavioural data:

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Session duration, pages visited, and features used
• Betting history, game play records, and transaction logs
• Login timestamps and authentication event logs
• Cookie identifiers and session tokens

3.3 Data from Third Parties

We may receive limited Personal Data from authorised third-party sources, including:

• Identity verification service providers used to cross-check KYC submissions
• Payment processors confirming transaction status and payer identity
• Fraud prevention and anti-money-laundering screening services

4. How We Use Your Personal Data

The following table summarises the primary purposes for which MRC88 processes your Personal Data:

5. Legal Basis for Processing

MRC88 processes your Personal Data under one or more of the following legal bases, depending on the specific processing activity:

• Contract Performance: Processing is necessary to perform our obligations under the Terms & Conditions — for example, operating your account and processing transactions.
• Legal Obligation: Processing is required to comply with applicable laws, including anti-money-laundering regulations, licensing requirements, and age verification obligations.
• Legitimate Interest: Processing serves a legitimate interest of MRC88 — including fraud prevention, platform security, and service improvement — where that interest is not overridden by your rights and freedoms.
• Consent: Where we rely on consent — for example, for marketing communications — you have the right to withdraw that consent at any time without affecting prior processing.

6. Data Sharing & Disclosure

6.1 Authorised Third-Party Processors

MRC88 engages certain trusted third-party service providers to process Personal Data on our behalf. These include:

• Identity verification providers — to authenticate KYC documents
• Payment processors — including the operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX networks, and cryptocurrency settlement services
• Fraud and AML screening services — to screen against sanctions lists and fraud databases
• Cloud hosting and infrastructure providers — who store and process data on our behalf under binding contractual terms
• Customer support platforms — to manage live chat and ticket-based support interactions

All third-party processors operate under Data Processing Agreements (DPAs) that require them to maintain data security standards equivalent to or exceeding those we apply ourselves.

6.2 Legal and Regulatory Disclosure

We may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or our licensing obligations. We will notify you of such requests where legally permitted to do so.

6.3 What We Do Not Do

7. Cookies & Tracking Technologies

7.1 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function. These include session tokens, authentication cookies, and security identifiers. Cannot be disabled without breaking core functionality.
• Analytical Cookies: Used to understand how players navigate and use the Platform, enabling us to improve user experience. Data collected is aggregated and anonymised where possible.
• Preference Cookies: Store your language preference, display settings, and other personalisation options between sessions.

7.2 What We Do Not Use

MRC88 does not use third-party advertising or retargeting cookies. We do not place pixels or tracking beacons from social media platforms or external advertising networks on our Platform.

7.3 Managing Cookies

You can manage or delete cookies through your browser settings. Disabling essential cookies will impair the functionality of the Platform and may prevent you from logging in or completing transactions. Analytical and preference cookies can be disabled without materially affecting core account features.

8. Data Retention

MRC88 retains Personal Data for as long as your account is active and for a minimum period of five (5) years following account closure. This retention period is mandated by anti-money-laundering regulations applicable under our international gaming licence and is not discretionary.

Specific categories of data and their retention periods are set out below:

• Account registration data: Duration of account plus 5 years post-closure
• KYC documents: Duration of account plus 5 years post-closure, or longer if required by applicable law
• Transaction records: 7 years from the date of each transaction
• Support communications: 3 years from the date of the interaction
• Marketing preferences and consent records: Until consent is withdrawn, plus 2 years for audit purposes
• Analytical and usage data: Typically 24 months in identifiable form; thereafter anonymised indefinitely

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our internal data disposal procedures.

9. Data Security

MRC88 implements a comprehensive set of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure:

• Transport Layer Security (TLS/SSL): All data in transit is encrypted using 256-bit SSL/TLS encryption.
• Encryption at Rest: Sensitive data — including KYC documents and payment details — is encrypted at rest using industry-standard algorithms.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. All staff with data access undergo security training.
• Two-Factor Authentication: Available to all players and mandatory for internal administrative access.
• Regular Security Audits: Our infrastructure undergoes periodic penetration testing and vulnerability assessments by independent security specialists.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach affecting your rights, we will notify you within the timeframe required by applicable regulations.

10. Your Rights as a Data Subject

Subject to applicable law and our regulatory obligations, you hold the following rights in respect of your Personal Data processed by MRC88. To exercise any of these rights, please contact us using the details in Section 15.

11. Minors and Age Restrictions

MRC88 is strictly an adults-only platform. The Service is not directed at, and we do not knowingly collect Personal Data from, any individual under the age of 21 years. Age is verified as part of the KYC process. If we become aware that Personal Data has been collected from an individual under 21, we will immediately close the associated account and delete or return any deposited funds to the original payment method.

Parents and guardians who believe that a minor has accessed or registered on MRC88 should contact our support team immediately via live chat or at [email protected].

12. Third-Party Services and Links

The MRC88 platform may reference or interact with third-party payment services — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong Bank), and cryptocurrency networks. When you complete a transaction through these services, you are also subject to their respective privacy policies and terms of service.

MRC88 is not responsible for the privacy practices of third-party payment providers or any other external service. We encourage you to review the privacy policy of any third-party service you interact with in connection with your MRC88 account.

13. International Data Transfers

As MRC88 operates under international licensing and engages third-party processors in multiple jurisdictions, your Personal Data may be transferred to and processed in countries outside Malaysia. Such transfers are conducted under appropriate legal safeguards, including:

• Standard contractual clauses providing equivalent data protection to that described in this Policy
• Binding corporate rules where applicable
• Transfers to jurisdictions recognised as providing an adequate level of data protection

If you would like further information about the specific safeguards in place for any particular transfer, please contact us using the details in Section 15.

14. Changes to This Policy

MRC88 reserves the right to update this Privacy Policy at any time. Where material changes are made — for example, changes to the categories of data collected or new sharing arrangements — we will provide reasonable advance notice via the Platform or by email to your registered address.

The "Last Updated" date at the top of this page reflects when the most recent substantive revision was made. Continued use of the Service following the effective date of any amendment constitutes your acceptance of the revised Policy. We recommend reviewing this Policy periodically.

15. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please reach out to MRC88 through the following channels:

• Live Support: Available 24/7 via the in-platform chat widget — the fastest channel for urgent matters.
• Email: [email protected] — for written privacy requests, data subject access requests, and erasure requests. Please include your registered name and account email in your enquiry.

We aim to acknowledge all privacy-related requests within 5 business days and to resolve them within 30 calendar days. Complex requests may require additional time, in which case we will inform you of the expected timeline.

For responsible gambling concerns, self-exclusion requests, or deposit limit adjustments, please visit our Responsible Gambling page for dedicated tools and support resources.