Privacy Policy

This Privacy Policy ("Policy") is issued by mg108 ("we", "us", "our", "the Platform"), the operator of the online gaming and sports betting platform accessible at mg108.lat. This Policy governs the collection, use, storage, disclosure, and protection of personal data belonging to users ("you", "Player", "Data Subject") who interact with the mg108 Platform, including through account registration, deposits, gaming activity, support communications, and all other touchpoints.

mg108 operates under international gaming licensing frameworks and is committed to responsible data stewardship. We process personal data only for the specific, legitimate purposes described in this Policy and in compliance with applicable international data protection standards. mg108 does not sell your personal data to third parties under any circumstances.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, all of which form part of the contractual relationship between you and mg108. By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy.

The following definitions apply throughout this Privacy Policy:

• Personal Data means any information relating to an identified or identifiable natural person. This includes, but is not limited to, name, identification number, contact details, location data, financial information, and online identifiers.
• Processing means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• Data Controller means mg108, which determines the purposes and means of processing Personal Data collected through the Platform.
• Data Processor means any third party engaged by mg108 to process Personal Data on our behalf, subject to written data processing agreements.
• Cookies means small text files placed on your device by the Platform to facilitate session management, analytics, personalisation, and fraud prevention.
• KYC (Know Your Customer) means the identity and age verification procedures mg108 conducts to comply with licensing and anti-money laundering obligations.
• Sensitive Data means categories of Personal Data warranting heightened protection, including financial account details and government-issued identification documents.

mg108 collects Personal Data across several categories. The data collected varies depending on the nature of your interaction with the Platform. The principal categories are outlined below:

mg108 collects Personal Data through the following channels and methods:

• Direct submission by you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact our support team, or respond to surveys or promotions.
• Automated technical collection: The Platform automatically records certain device and usage data when you access mg108, including via cookies, web beacons, and server log files. This data is collected regardless of whether you are logged in to an Account.
• Payment processors and e-wallet providers: When you deposit or withdraw using Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, or cryptocurrency networks, those providers may share transaction reference data with mg108 for the purpose of reconciling your account credit or debit.
• Identity verification providers: mg108 uses third-party KYC and AML screening services that may verify your identity details against external databases as required by our licensing obligations.
• Fraud prevention and AML monitoring systems: Automated risk monitoring tools analyse behavioural and transaction data in real time to detect patterns consistent with fraud, money laundering, or bonus abuse.

mg108 processes Personal Data only where a lawful basis exists for doing so. The primary purposes and corresponding legal bases for our data processing activities are described below:

• Account creation and management — Processing is necessary for the performance of our contractual agreement with you. Without this data, we cannot provide you with access to the Platform.
• Identity verification and age enforcement (KYC) — Processing is required to comply with our legal obligations under our international gaming licence, including the strict 21+ age requirement and anti-money laundering regulations.
• Processing deposits and withdrawals — Necessary for performance of contract. Financial data is required to credit your Account and process withdrawal payments to your nominated Malaysian bank account or e-wallet.
• Fraud prevention and security — Processing is carried out on the basis of our legitimate interests in protecting the Platform, its players, and the integrity of all financial transactions from fraud and unauthorised activity.
• Responsible gambling monitoring — We are obligated under our licensing conditions to monitor player behaviour for signs of problem gambling and to enforce self-exclusion and limit settings. Processing in this context is based on legal obligation and vital interest.
• Customer support communications — Processing is necessary for the performance of our contractual support obligations and to resolve disputes submitted by Players.
• Marketing and promotional communications — Where you have provided explicit consent to receive promotional emails or notifications, we process your contact data for this purpose. You may withdraw consent at any time as described in Section 11.
• Platform analytics and improvement — Based on our legitimate interest in understanding how the Platform is used and improving its performance, stability, and user experience for all Malaysian players.
• Regulatory record-keeping and audit compliance — We are legally required to maintain records of account activity, transactions, and KYC documentation for defined retention periods under our licensing framework.

mg108 does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes. We share data only in the circumstances described below, and only to the extent necessary for each stated purpose:

• Payment service providers: Transactional data is shared with our payment processing partners — including providers facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network processors — solely to process your deposit and withdrawal instructions.
• KYC and identity verification providers: Identity documents and personal identifiers are shared with licensed third-party verification services for the purpose of completing our mandatory age and identity checks. These providers are contractually bound to use your data exclusively for the verification purpose.
• Game software providers: Certain gaming data (session identifiers, bet amounts) may be shared with our licensed game providers to facilitate gameplay and resolve technical disputes. No personally identifiable information is shared beyond what is operationally required.
• AML and fraud screening services: Transaction and behavioural data may be processed by specialised AML and fraud detection platforms to fulfil our compliance obligations under our gaming licence.
• Regulatory and law enforcement authorities: mg108 will disclose Personal Data to competent authorities where required by applicable law, valid legal process, court order, or licensing requirement. We will notify affected users where legally permissible to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of mg108's business, Personal Data held by the Platform may be transferred to the acquiring entity, subject to equivalent data protection commitments.

As an internationally licensed gaming platform serving Malaysian players, mg108 and its service providers may process Personal Data in jurisdictions outside Malaysia. Where Personal Data is transferred internationally, mg108 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to internationally recognised data protection principles.

Such safeguards may include: contractual data processing agreements incorporating standard contractual clauses; binding corporate rules where applicable; or transfers to jurisdictions recognised as providing an adequate level of data protection under relevant international frameworks.

For Malaysian players specifically, we note that the Personal Data Protection Act 2010 (PDPA) generally prohibits the transfer of personal data outside Malaysia except to countries specified by the Minister of Communications. Players acknowledge that by registering with mg108, their data may be processed internationally in accordance with our licensing and operational requirements, and that they accept this on the basis of the safeguards described above.

mg108 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, licensing obligation, or legitimate business need. The following general retention periods apply:

• Active Account data: Retained for the duration of your Account's active status plus a minimum of five (5) years following Account closure, in accordance with standard AML and gaming licence record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or Account closure, whichever is later, as required by our licensing authority.
• Financial transaction records: Retained for a minimum of five (5) years to meet AML compliance obligations and to facilitate dispute resolution.
• Support communications: Retained for a minimum of two (2) years from the date of last communication, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your consent, plus a reasonable period thereafter to demonstrate compliance with consent obligations.
• Analytical and technical logs: Typically retained for up to twelve (12) months, after which data is aggregated and anonymised.

Upon expiry of applicable retention periods, Personal Data will be securely deleted or anonymised in accordance with our data disposal procedures.

mg108 uses cookies and related tracking technologies to provide and improve Platform functionality, maintain secure sessions, understand usage patterns, and detect fraudulent activity. By continuing to use the Platform, you consent to our use of cookies as described in this section.

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without disabling the Platform itself.
• Functional Cookies: Enable the Platform to remember your preferences, such as preferred language, currency display (MYR/RM), and game lobby layout settings.
• Analytics Cookies: Used to collect aggregated data on how Players navigate and use the Platform, enabling us to identify and fix usability issues and improve the overall experience. Data collected via analytics cookies is anonymised before analysis.
• Security and Fraud Detection Cookies: Help identify devices and sessions associated with suspicious activity, bot traffic, or multiple account attempts. These are essential to our fraud prevention obligations.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may impair Platform functionality, including the ability to log in and place bets. mg108 does not use third-party advertising cookies or behavioural tracking cookies for external marketing purposes.

mg108 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These include:

• 256-bit TLS/SSL encryption on all data transmitted between your device and the mg108 Platform, including account pages, cashier transactions, and support communications.
• Encryption at rest for Sensitive Data categories including KYC documents, financial records, and authentication credentials stored on our servers.
• Two-factor authentication (2FA) available for all Player accounts, providing an additional layer of protection for login and withdrawal authorisation.
• Access controls and role-based permissions limiting access to Personal Data to only those employees and contractors with a demonstrated operational need.
• Regular security audits and penetration testing conducted by independent security professionals to identify and remediate potential vulnerabilities.
• Incident response procedures for detecting, containing, and notifying affected parties in the event of a data breach, in accordance with applicable regulatory requirements.

Subject to applicable law and our legal obligations (including those arising from our gaming licence and AML requirements), you hold the following rights with respect to your Personal Data processed by mg108:

• Right of Access: You may request confirmation of whether mg108 processes your Personal Data, and if so, obtain a copy of that data along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data held about you. For registered Account details, certain corrections may require identity re-verification.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where processing is no longer necessary, where consent is withdrawn, or where data has been unlawfully processed — subject to our obligation to retain certain data under gaming licence and AML requirements.
• Right to Restriction of Processing: You may request that we temporarily limit processing of your data while a dispute or objection is being resolved.
• Right to Data Portability: Where processing is based on your consent or on contract performance, you may request that we provide your Personal Data in a structured, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, including direct marketing. Where you object to marketing communications, we will cease processing your data for that purpose without delay.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., promotional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the rights above, please submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and respond substantively within thirty (30) calendar days. Identity verification may be required before we process certain requests.

mg108 operates exclusively for players aged 21 years and above. The Platform does not knowingly collect Personal Data from any individual under the age of 21. Age verification is a mandatory component of our KYC process, and accounts found to belong to underage individuals will be closed immediately, with any associated data handled in accordance with our underage gambling and data protection procedures.

If you believe that a minor has created an Account or provided Personal Data on mg108 without appropriate parental or guardian oversight, please contact us immediately at [email protected]. We will investigate and take appropriate action promptly, including deletion of any relevant data where there is no conflicting legal obligation to retain it.

The mg108 Platform may contain references to or integrations with third-party services, including payment processors, game software providers, and analytics platforms. These third parties operate under their own privacy policies and data practices, for which mg108 accepts no direct responsibility.

Where third-party game providers or payment services (such as Touch 'n Go eWallet, Boost, GrabPay, or cryptocurrency network providers) are accessed through our Platform, please be aware that your interaction with those services is also subject to their own terms and privacy practices. mg108 selects third-party partners carefully and requires contractual data protection commitments from all processors, but we cannot guarantee the privacy practices of independent third-party platforms beyond the scope of our data processing agreements.

mg108 is not responsible for the privacy practices of any external website, application, or service that may be referenced in our communications or accessible through links on the Platform.

mg108 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page;
• Notify registered Players via their registered email address for material changes that affect how we process their Personal Data; and
• Display a prominent notice on the Platform prior to the amendment taking effect, where practically feasible.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. We strongly recommend reviewing this Privacy Policy periodically to stay informed of any changes. If you object to any amendments, you must discontinue use of the Platform and may request Account closure in accordance with our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how mg108 handles your Personal Data, please contact us through the following channels:

• Email — General Privacy Enquiries: [email protected] (subject line: "Privacy Policy Enquiry" or "Data Rights Request")
• Live Chat: Available 24 hours a day, 7 days a week via the Platform interface. For formal data rights requests, we recommend email to ensure a documented response trail.
• Response Time: Privacy and data rights requests will be acknowledged within 48 hours and responded to substantively within thirty (30) calendar days. Complex requests may require up to a further thirty (30) days where permitted by applicable law, in which case we will notify you of the extension.

If you are not satisfied with our response to a privacy complaint, you may have the right to escalate the matter to a relevant supervisory authority under applicable data protection law. As a Malaysian player, you may also refer data protection concerns to the Department of Personal Data Protection Malaysia (JPDP) where the Personal Data Protection Act 2010 applies to your situation.