Privacy Policy

This Privacy Policy (hereinafter referred to as "the Policy", "this Policy", or "the Privacy Policy") sets out how MR88 (hereinafter referred to as "MR88", "we", "us", or "the Platform") collects, uses, stores, discloses, and otherwise processes the personal data of individuals who access or use the services available athttps://mr88.cam (hereinafter referred to as "the Website" or "the Platform").

MR88 is an online casino and sports betting platform operated primarily for users in Malaysia. We are committed to protecting the privacy and personal data of all individuals who interact with our Platform — including registered players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia — in a manner that is transparent, fair, and consistent with applicable data protection principles.

By accessing the Website, creating an account, making a deposit, or otherwise using MR88's services, you (hereinafter referred to as "the User", "you", or "the Data Subject") acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or in combination with other information held by MR88.
• "Data Controller" means MR88, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of MR88 under a contractual arrangement.
• "Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, deletion, or any combination thereof.
• "KYC" means Know Your Customer — the identity verification process required before the first withdrawal, and at any point deemed necessary by MR88 for compliance purposes.
• "Cookie" means a small text file placed on a User's device by the Website for the purposes of session management, functionality, analytics, or fraud prevention.
• "Third Party" means any individual, company, or organisation other than MR88 and the User.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the User's agreement to the processing of their personal data for a stated purpose.

MR88 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

MR88 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, submitting support requests, or communicating with our team.
• Automated collection: Technical data (IP address, device identifiers, session logs) collected automatically when you access or browse the Platform, using cookies and server-side logging mechanisms.
• Payment processors: Financial and transaction data received from licensed Malaysian payment processors, including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network confirmations for USDT TRC20 deposits and withdrawals.
• Identity verification partners: Data returned from KYC and document verification service providers where applicable.
• AML and fraud screening tools: Results from sanctions lists, politically exposed persons (PEP) databases, and fraud risk scoring engines used as part of MR88's compliance framework.

MR88 processes your personal data only for specified, explicit, and legitimate purposes. The primary purposes for which we process personal data are as follows:

1. Account Management: To create, maintain, and administer your player account, including authentication, account security, and communication related to your account status.
2. Transaction Processing: To process deposits and withdrawals via supported Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and bank transfers to Maybank, CIMB, Public Bank, and Hong Leong Bank.
3. KYC and Identity Verification: To verify your identity, age, and address as required before processing your first withdrawal and at any subsequent point deemed necessary for compliance.
4. Regulatory Compliance: To fulfil MR88's obligations under applicable AML, KYC, and financial crime prevention requirements, including reporting obligations to relevant authorities where mandated by law.
5. Responsible Gambling: To monitor usage patterns and flag potential indicators of problem gambling behaviour, enabling MR88 to offer appropriate interventions and enforce responsible gambling tools such as deposit limits and self-exclusion.
6. Customer Support: To investigate, respond to, and resolve queries, complaints, and disputes submitted by players via live chat or email.
7. Platform Security and Fraud Prevention: To detect and prevent fraudulent activity, account takeovers, multi-accounting, bonus abuse, and other prohibited conduct outlined in MR88's Terms and Conditions.
8. Service Improvement: To analyse aggregated, anonymised usage data for the purpose of improving Platform performance, game selection, and user experience.
9. Direct Communications: To send account-related notifications, security alerts, and promotional communications where you have opted in to receive them.

MR88 processes personal data one or more of the following legal bases:

• Contractual necessity: Processing is necessary for the performance of the contract between MR88 and the User (i.e., the Terms and Conditions), including account management, payment processing, and game access.
• Legal obligation: Processing is required to comply with applicable laws, including AML regulations, KYC obligations, and any lawful order from a competent regulatory or law enforcement authority.
• Legitimate interests: Processing is necessary for MR88's legitimate interests, including fraud prevention, platform security, and business analytics, provided such interests are not overridden by the User's rights and freedoms.
• Consent: Where MR88 relies on consent as the legal basis for processing (for example, for the sending of marketing communications), the User may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

MR88 does not sell, rent, or otherwise commercially transfer your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and for the purposes described in this Policy:

• Payment Processors: Licensed Malaysian payment service providers including Touch 'n Go Sdn Bhd, Boost by Axiata, GrabPay, DuitNow, the FPX network, Maybank, CIMB Bank, Public Bank Berhad, and Hong Leong Bank — solely for the purpose of processing deposits and withdrawals in MYR.
• KYC and Verification Partners: Authorised identity verification service providers engaged to perform document authentication and biometric checks as part of MR88's KYC process.
• AML and Compliance Vendors: Fraud detection, AML screening, and sanctions checking service providers acting as Data Processors under binding data processing agreements.
• Regulatory and Law Enforcement Authorities: Where MR88 is required by law, court order, or regulatory mandate to disclose personal data, we will do so in accordance with applicable legal obligations and will not disclose more data than is strictly required.
• Professional Advisers: Lawyers, auditors, and other professional advisers acting under duties of confidentiality where necessary for the operation of MR88's business.
• Business Successors: In the event of a merger, acquisition, restructuring, or sale of MR88's business assets, personal data may be transferred to a successor entity, subject to the same level of data protection as this Policy.

MR88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The following general retention principles apply:

• Active Account Data: Personal data associated with an active account is retained for the duration of the account's existence and for a period following account closure as required by AML and regulatory obligations.
• KYC Documentation: Identity documents and KYC records are retained for a minimum of five (5) years from the date of collection or from the date of account closure, whichever is later, in line with standard AML record-keeping requirements.
• Transaction Records: Financial transaction records including deposit and withdrawal history are retained for a minimum of five (5) years for AML compliance and auditing purposes.
• Support and Communications Data: Live chat transcripts, email correspondence, and support ticket records are retained for a period of up to three (3) years from the date of interaction.
• Technical and Usage Data: Server logs and usage data are retained for a maximum of twelve (12) months unless retained longer for fraud investigation or legal proceedings.

When personal data is no longer required for any of the above purposes, MR88 will securely delete or anonymise it. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes without restriction.

MR88 implements and maintains appropriate technical and organisational security measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between the User's device and MR88's servers;
• Encryption of sensitive stored data, including KYC documents and financial records, using industry-standard cryptographic protocols;
• Role-based access controls ensuring that personal data is accessible only to authorised personnel with a legitimate need to access it;
• Comprehensive audit logging of all administrative access to systems containing personal data;
• Regular security assessments and penetration testing of the Platform infrastructure;
• Two-factor authentication (2FA) options for User accounts;
• Incident response procedures enabling MR88 to detect, contain, and respond to data security incidents in a timely manner.

MR88 uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file stored on your device by your web browser. Cookies do not contain executable code and cannot access other files on your device.

MR88 does not use third-party advertising or retargeting cookies. You may manage cookie settings through your browser's privacy controls. Disabling strictly necessary cookies may impair the Platform's core functionality, including login and payment processing.

As a User of the MR88 Platform, you have the following rights with respect to your personal data. MR88 is committed to facilitating the exercise of these rights promptly and without undue burden:

To exercise any of the above rights, please contact MR88's support team via live chat or email at [email protected]. MR88 will respond to data rights requests within a reasonable timeframe. Requests may be subject to identity verification before processing to prevent unauthorised access to another person's data.

MR88 is strictly intended for use by individuals aged 21 years and above. MR88 does not knowingly collect, process, or store personal data of individuals under the age of 21. Account registration by persons under the minimum age is prohibited under MR88's Terms and Conditions.

Where MR88 becomes aware or reasonably suspects that personal data belonging to an individual under the age of 21 has been submitted to the Platform — whether through a fraudulent registration or any other means — MR88 will immediately suspend the associated account, delete the personal data in question, and forfeit any funds held in the account in accordance with its Terms and Conditions.

MR88 operates primarily in and for the Malaysian market, and its primary data processing activities are conducted using infrastructure located in or accessible from the Asia-Pacific region. In certain circumstances — for example, where MR88 engages KYC verification partners, fraud screening vendors, or game content providers — personal data may be transferred to or processed in jurisdictions outside Malaysia.

Where such transfers occur, MR88 takes reasonable steps to ensure that the recipient maintains data protection standards equivalent to those applied by MR88 under this Privacy Policy. This may include the use of contractual safeguards, data processing agreements, or transfers to jurisdictions that maintain adequate data protection frameworks.

MR88 will not transfer personal data to any jurisdiction where MR88 does not have reasonable confidence that the data will be adequately protected.

MR88 reserves the right to review, update, and amend this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, our data processing practices, or Platform functionality. Any amended version of this Policy will be published on this page with an updated "Last Reviewed" date.

Where an amendment materially changes the way in which MR88 processes your personal data, MR88 will endeavour to notify registered Users via email or an in-platform notification prior to the change taking effect. Continued use of the Platform following publication of an amended Policy constitutes acceptance of the revised terms.

We encourage Users to review this Privacy Policy periodically to remain informed of how MR88 handles their personal data. If you have any concerns about a proposed or recent change to this Policy, please contact us using the details in Section 15.

If you have any questions, concerns, or requests relating to this Privacy Policy or MR88's personal data processing practices, please contact us using the following channels:

When submitting a data rights request, please include your registered account username, a clear description of your request, and your preferred contact method. MR88 will verify your identity before processing any request involving access to or deletion of personal data, in order to protect against unauthorised access.