Me88 Privacy Policy — Our Commitment to Protecting Malaysian Players' Data

1Introduction & me88's Commitment to Privacy

Me88 is an online Sports Betting and casino platform operating for Malaysian players. As part of our operations, we collect and process players' personal data in accordance with legal requirements and service needs. me88 hereby acknowledges our responsibilities as a data controller under the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This Privacy Policy details the types of data we collect when you register and use the me88 platform, how that data is used to deliver our services, the parties that may access your data under certain circumstances, the measures we take to protect your data, and the rights you hold as a data subject under Malaysian law.

Me88 builds trust with Malaysian players one day at a time. Every time you make a deposit via Touch 'n Go eWallet or GrabPay, every time you place a bet on the Malaysia Super League or watch a live match stream in the me88 app — you are trusting us with your information. We have never taken that trust lightly, and we never will.

2Types of Personal Data Collected by me88

Me88 collects several categories of personal data as you interact with our platform. The type of data collected depends on the activities you carry out and the stage of your platform usage.

Me88 only collects data that is strictly necessary for the stated purposes. This data minimisation principle means we do not request information that is irrelevant to the delivery of our services.

3Purposes for Using Personal Data

Me88 uses the personal data collected solely for the purposes stated below. We will not use your data for any other purpose without first obtaining fresh consent from you.

• Account Management: Creating and maintaining your me88 account, processing registration, managing logins, and ensuring account security
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and other payment methods, as well as withdrawals of winnings to your account
• Identity Verification (KYC): Verifying your identity to comply with anti-money laundering (AML) and fraud prevention legal requirements
• Service Provision: Providing access to all me88 services, including Sports Betting, casino, jackpot, e-sports, lottery, and match odds
• Customer Support: Processing and responding to enquiries, complaints, and support requests submitted to the me88 team
• Legal Compliance: To fulfil applicable legal and regulatory obligations, including reporting requirements to relevant authorities
• Platform Security: Detecting and preventing fraud, abuse, unauthorized access, and activities that violate me88's Terms & Conditions
• Service Improvement: Analysing aggregated, non-personally identifiable usage data to improve the performance and user experience of the me88 platform
• Service Communications: Sending important account notices, policy updates, and relevant security information

Me88 may use your data to keep you informed about promotions and new offers via email or in-platform notifications. You can opt out of marketing communications at any time through your account settings or by contacting me88 customer support.

4Sharing Data with Third Parties

Me88 does not sell, rent, disclose, or transfer your personal data to third parties for marketing purposes or any other purpose unrelated to the provision of me88's services. That said, there are specific situations where data must be shared with other parties to enable the me88 platform to operate effectively.

Third parties that may receive your data in limited and controlled contexts:

• Payment Processors: Payment service providers such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, FPX, Maybank2u, and CIMB Clicks receive the transaction information necessary to process your deposits and withdrawals. All these providers are subject to their own privacy policies and strict security obligations.
• Game Providers: Casino and slot game providers such as Pragmatic Play, Evolution Gaming, and others may receive the technical data needed to run games properly. They do not receive your full personal identification information.
• Authority: me88 is legally required to disclose data to law enforcement agencies, courts, or relevant regulatory bodies when lawfully directed to do so, or to report activities suspected of involving money laundering.
• Technical Services: Cloud infrastructure providers and technical service vendors that support me88's platform operations may process your data as part of delivering those services, subject to strict data processing agreements.

5me88 Data Security Measures

Me88 invests seriously in security infrastructure to ensure your personal data is always protected. Security is not an afterthought — it is the backbone of the trust you place in our platform.

Technical and organisational security measures we have implemented:

• Encryption in Transit: All communications between your device and me88's servers are protected by 128-bit TLS/SSL protocol. This means that data transmitted — including login credentials, card details, and personal information — cannot be intercepted or read by unauthorised parties.
• Storage Encryption: Sensitive personal data is stored in encrypted form within me88's databases. Even in the event of unauthorised database access, the stored data cannot be read without the correct encryption key.
• Internal Access Controls: Access to player data within me88's systems is restricted to staff who require it to perform their duties only — the "least privilege" principle. All access is logged and monitored automatically.
• Two-Factor Authentication (2FA): me88's internal systems containing sensitive data are protected by two-factor authentication for all staff. 2FA is also available for player accounts as an added layer of security.
• Regular Security Audits: me88 conducts regular security audits and penetration testing carried out by independent cybersecurity experts to identify and address any vulnerabilities before they can be exploited.
• Incident Response Procedure: me88 has a structured procedure for handling data security incidents. Should a data breach occur that affects players, we will notify those involved within the timeframe stipulated by the PDPA and take immediate steps to contain the damage.

6Data Retention Period

Me88 does not retain your personal data indefinitely. Data is stored only for as long as necessary for the purpose it was collected and in accordance with applicable legal requirements.

• Active Account Data: For as long as your account remains active with me88, your personal data will be retained to ensure the continued provision of services
• Financial Transaction Data: Financial transaction records (deposits, withdrawals, betting) are retained for a minimum of 7 years in accordance with Malaysian accounting and anti-money laundering legal requirements
• Identity Verification Data (KYC): KYC documents are retained for 5 years after account closure or the date of the last transaction, whichever is later
• Communication Logs: Customer support interaction records are retained for 3 years for dispute resolution and service improvement purposes
• Technical Data: Server logs and technical data are typically retained for 90 days for security and debugging purposes

Upon expiry of the retention period, data will be permanently deleted or anonymised in accordance with secure data disposal procedures. me88 employs disposal methods that ensure data cannot be recovered once the process is complete.

7Your Rights Under Malaysia's PDPA

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data me88 holds about you. me88 respects and facilitates the exercise of all these rights.

• Right to Access: You have the right to request a copy of the personal data me88 holds about you. me88 will provide this information within 21 days of receiving your request.
• Right to Correction: If any personal data held by me88 about you is inaccurate or out of date, you have the right to request a correction. Corrections will be carried out within a reasonable timeframe.
• Right to Erasure: Under certain circumstances permitted by law, you may request that me88 delete your personal data. Please note that me88 may be legally required to retain certain data for a minimum period.
• Right to Restrict Processing: You may request that me88 restrict how your data is processed under certain circumstances — for example, while we are investigating a dispute regarding data accuracy.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the validity of any processing that took place prior to the withdrawal.
• Right to Lodge a Complaint: If you believe me88 has violated your privacy rights, you have the right to lodge a complaint with the Malaysian Personal Data Protection Commissioner.

To submit any request relating to the rights listed above, please contact the me88 customer support team by email at support@me88.express or via live chat within the platform. Clearly state your request and we will guide you through the process.

8Cookies & Tracking Technologies

Me88 uses cookies and similar tracking technologies on our website and mobile app. Cookies are small text files stored on your device when you browse the me88 platform. They help us deliver a better and more personalised experience for you.

9Protection of Children's Data

Me88's services are strictly for individuals aged 18 and above. me88 does not knowingly collect, store, or process the personal data of children under 18 years of age.

If me88 discovers that personal data of a minor has been collected without our knowledge due to false information provided during registration, the account in question will be closed immediately and all collected data will be deleted in accordance with our security procedures. Any associated account balance or winnings will also be forfeited in accordance with me88's terms of use.

10Amendments to This Privacy Policy

Me88 reserves the right to update or amend this Privacy Policy from time to time in line with changes to laws, technology, or our business practices. However, we are committed to always providing you with adequate notice before any amendments take effect.

The notice process for amendments to me88's Privacy Policy:

• An email notification will be sent to your registered email address at least 7 calendar days before the amendment takes effect
• An in-platform notice will be displayed to all active users upon login
• The latest version of the Privacy Policy is always available on this page with a clearly stated effective date
• For material or significant amendments, the notice period may be extended to up to 30 days

Your continued use of the me88 platform after any amended Privacy Policy comes into effect will be considered your acceptance of the revised policy. If you do not agree with the changes made, you have the right to close your me88 account and request data deletion in accordance with the procedure set out in Section 7 above.