md88 Privacy Policy

md88 ("the Site", "we", "us" or "our") operates as an English-language gaming information and entertainment reference website for adult audiences in Malaysia. We are committed to protecting the privacy of every individual who visits, registers on or interacts with the Site.

This Privacy Policy has been drafted in accordance with internationally recognised data protection principles. We take our obligations seriously and aim to be fully transparent about how your personal data is handled at every stage, from initial collection through to deletion.

By accessing the Site or creating an account, you acknowledge that you have read and understood this policy. This document should be read alongside our Terms and Conditions and Responsible Gambling policy, both of which are available through the main navigation.

The following terms carry specific meanings throughout this Privacy Policy.

md88 collects personal data through three primary channels: information you provide directly, information generated automatically through your use of the Site, and information received from third-party service providers.

Information you provide directly:

• Registration details: full name, date of birth, email address, phone number and residential address.
• Identity verification documents submitted during KYC: national identification card, passport copy or driving licence, and proof of address (such as a utility bill or bank statement).
• Payment information: transaction references, deposit amounts, withdrawal requests and the payment method used (for example, Touch n Go eWallet, Boost, DuitNow, FPX, Maybank, CIMB, Public Bank or eligible card). We do not store full card numbers; payment data is handled by PCI-DSS-compliant processors.
• Support communications: content of messages, live-chat transcripts and emails sent to [email protected].
• Responsible gambling declarations: self-assessed risk disclosures, limit-setting preferences and self-exclusion requests.

Information collected automatically:

• Device and technical data: IP address, browser type and version, operating system, screen resolution and device identifiers.
• Usage data: pages visited, navigation path, session duration, links clicked and feature interactions.
• Cookie and tracking data: session cookies, preference cookies and analytics identifiers (see Section 9).
• Approximate geolocation derived from your IP address.

Information from third parties:

• Identity verification results from accredited KYC providers.
• Payment confirmation and fraud-screening results from payment processors.
• Anti-money-laundering screening outcomes from compliance service providers.

We process personal data only for defined, legitimate purposes. The table below summarises the primary processing activities carried out by md88.

md88 processes personal data under one or more of the following lawful bases, consistent with internationally recognised data protection standards:

• Contractual necessity: Processing required to create and manage your account, process transactions, handle withdrawals and provide services described in our Terms and Conditions.
• Legal obligation: Processing required to comply with applicable anti-money-laundering regulations, age-verification requirements, responsible-gambling obligations and any lawful regulatory order.
• Legitimate interest: Processing carried out to protect the security of our systems and users, prevent fraud, analyse Site performance and improve our services, where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for optional marketing communications, non-essential cookies and any purpose where explicit opt-in consent has been obtained. Consent can be withdrawn at any time without affecting prior lawful processing.

md88 does not sell personal data to third parties. We share personal data only in the limited circumstances described below and only to the extent necessary for the stated purpose.

• Payment processors: To facilitate deposits and withdrawals via Touch n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong and eligible card networks. These providers operate under their own privacy frameworks and are contractually required to handle data securely.
• KYC and compliance providers: Accredited third-party services that verify identity documents, confirm age and conduct anti-money-laundering screening as required by applicable regulation.
• Hosting and infrastructure providers: Cloud-service and data-centre operators that store and transmit Site data under binding contractual obligations consistent with this policy.
• Analytics providers: Aggregated and pseudonymised usage statistics may be processed by analytics partners to help md88 understand Site performance and user experience.
• Regulatory and law-enforcement authorities: Where required by a valid legal order, court direction or government authority with lawful jurisdiction.
• Corporate transactions: In the event of a merger, acquisition or asset sale, personal data may be transferred to the relevant successor entity, subject to equivalent privacy protections.

md88 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulation.

• Active account data: Retained throughout the lifetime of your account and for a reasonable period thereafter to support dispute resolution and legal audit requirements.
• KYC and identity documents: Retained for a minimum of five years from account closure or the date of the last transaction, consistent with anti-money-laundering retention obligations.
• Transaction records: Financial transaction logs are retained for a minimum of seven years to meet applicable financial compliance requirements.
• Marketing data: Retained until you withdraw consent or unsubscribe from communications.
• Technical logs: Server and access logs are retained for up to twelve months for security and debugging purposes before being anonymised or deleted.

When data is no longer required and no legal obligation exists to retain it, md88 will securely delete or irreversibly anonymise the relevant records.

md88 implements technical and organisational security measures proportionate to the sensitivity of the personal data we hold. These include but are not limited to:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your browser and our servers.
• Encryption at rest for sensitive data stored within our infrastructure.
• Role-based access controls that restrict internal access to personal data to authorised personnel on a need-to-know basis.
• Regular penetration testing and vulnerability assessments of our systems.
• Incident response procedures to detect, investigate and notify in the event of a data breach within legally required timeframes.
• PCI-DSS-compliant payment processing to ensure card data is never stored or transmitted insecurely.

While md88 takes all reasonable steps to protect your data, no internet transmission or electronic storage system is entirely risk-free. Users are responsible for maintaining the security of their own devices, credentials and one-time verification codes. md88 support will never request your password or security token through any channel.

md88 uses cookies and similar tracking technologies to operate the Site, maintain session state, remember user preferences and collect aggregate analytics. The following cookie categories are in use:

• Strictly necessary cookies: Required for the Site to function correctly, including session authentication and security tokens. These cannot be disabled without impacting site functionality.
• Functional cookies: Store user preferences such as language settings, layout choices and previously entered display options to improve the browsing experience.
• Analytical cookies: Collect anonymised data about how visitors interact with the Site, including pages viewed, session duration and navigation paths, to help md88 improve content and performance.
• Marketing cookies: Used only where you have provided explicit consent, to measure the effectiveness of promotional communications. These may be managed through your account preferences.

You may manage non-essential cookies through your browser settings or the md88 consent manager where available. Disabling certain cookies may affect Site functionality. For further detail on the specific cookies in use, please contact us at the address in Section 14.

Subject to applicable law, you hold the following rights in relation to the personal data that md88 processes about you. To exercise any of these rights, please submit a written request to [email protected] with your registered account identifier and a clear description of your request.

• Right of access: You may request a copy of the personal data md88 holds about you and information on how it is being processed.
• Right to rectification: You may ask us to correct any inaccurate or incomplete personal data without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to overriding legal retention obligations.
• Right to restriction: You may ask us to limit processing of your data in certain circumstances, for example while a correction request is being assessed.
• Right to data portability: Where processing is based on your consent or a contract, you may request your data in a structured, commonly used machine-readable format.
• Right to object: You may object to processing based on legitimate interest, including direct marketing. Objection to direct marketing will be honoured unconditionally.
• Right to withdraw consent: Where processing relies on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

md88 will respond to verified rights requests within thirty (30) calendar days. Where a request is complex or where we receive a high volume of requests, we may extend this period by a further sixty (60) days, notifying you accordingly.

The Site is directed exclusively at adults aged 21 and above. md88 does not knowingly collect or process personal data relating to persons under the age of 21. If we become aware that a minor has provided personal data without appropriate parental consent, we will delete that data as soon as practicable and close the associated account.

If you believe that a person under the age of 21 has registered on the Site or provided personal data, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

In order to deliver the Site and associated services, personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, md88 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses with data processors requiring equivalent data protection standards.
• Transfer only to jurisdictions that maintain adequate privacy protections as assessed against internationally recognised benchmarks.
• Additional technical measures such as encryption in transit and at rest where heightened risk is identified.

By using the Site, you acknowledge that your personal data may be transferred to servers located outside your country of residence. md88 commits to maintaining the same level of protection for your data regardless of where it is processed.

md88 may update this Privacy Policy from time to time to reflect changes in applicable law, our data practices or the services we provide. The revised policy will be published on this page with an updated effective date.

Where a change is material and affects how your personal data is processed, md88 will use reasonable efforts to notify registered users via the email address associated with their account. We recommend reviewing this page periodically. Continued use of the Site after any update is published constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a privacy concern, please contact the md88 privacy team in writing. We will acknowledge receipt within five business days and provide a substantive response within thirty calendar days of verifying your identity.

Website email:
[email protected]

Please include your registered account identifier (if applicable), a clear description of your request and, where relevant, documentation to support your identity verification. md88 will not charge a fee for processing a reasonable rights request made in good faith.