Privacy Policy

Section 01

Introduction

This Privacy Policy ("Policy") is issued by Mega228 ("we", "us", "our", "the Platform", "Mega228") and applies to all personal data collected, processed, stored, and used in connection with your access to and use of the Mega228 website at https://mega228.cam and all associated services, features, and communications.

Mega228 is an internationally licensed online gaming platform providing live casino games, sports betting, video slots, and related entertainment services, operating primarily for players based in Malaysia. We recognise that the handling of personal data carries significant responsibility, and we are committed to processing your information transparently, lawfully, and in accordance with applicable data protection standards.

By registering an account on Mega228, using any of our services, or otherwise interacting with the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

If you have any questions about this Policy or wish to exercise any of your data protection rights, please contact our Data Protection team using the details provided in Section 14 of this document.

Malaysian Users: Malaysia's Personal Data Protection Act 2010 (PDPA 2010) governs the processing of personal data in commercial transactions in Malaysia. While Mega228 operates as an internationally licensed offshore platform, we are committed to applying data protection standards that are consistent with internationally recognised best practice, including transparency, purpose limitation, and data minimisation principles.

Section 02

Definitions

The following definitions apply throughout this Privacy Policy:

"Personal Data" Any information that directly or indirectly identifies a living individual, including name, email address, IP address, device identifiers, payment method details, and account activity data.

"Processing" Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, and deletion.

"Data Controller" Mega228, as the entity that determines the purposes and means of processing personal data collected through the platform.

"Data Subject" The identified or identifiable natural person to whom personal data relates — in this context, any registered player or visitor to the Mega228 platform.

"Third-Party Processor" Any external company or service provider that processes personal data on behalf of Mega228 under contractual data processing obligations, such as payment processors, KYC verification providers, and analytics platforms.

"Consent" A freely given, specific, informed, and unambiguous indication by which a Data Subject agrees to the processing of their personal data for a stated purpose.

"KYC" Know Your Customer — the identity and age verification process Mega228 conducts to confirm the identity of players and fulfil regulatory compliance obligations.

Section 03

Data We Collect

Mega228 collects personal data through several channels: directly from you when you register an account or interact with our services; automatically through your use of the platform; and from third parties such as identity verification providers and payment processors. The categories of data we collect include:

3.1 Registration & Account Data

Full legal name
Date of birth (for age verification — 21+ requirement)
Residential address (including city, postcode, and country — e.g., Kuala Lumpur, Penang, Johor Bahru)
Email address
Mobile phone number
Username and encrypted password
Preferred language setting

3.2 Identity Verification (KYC) Data

Government-issued photo ID (e.g., Malaysian MyKad, passport)
Proof of address documentation
Proof of payment method ownership
Source of funds documentation (where required by compliance obligations)
Facial verification data (biometric, where applicable to automated KYC services)

3.3 Financial & Transaction Data

Deposit and withdrawal transaction records, including amounts and timestamps
Payment method identifiers (e.g., partial account numbers, e-wallet IDs) for Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Public Bank Online, and Hong Leong Connect
Account balance history
Bonus credit and wagering activity records

3.4 Gaming & Betting Activity Data

Game session logs, bet histories, and win/loss records
Sports betting selections and live betting activity
Game preferences and platform feature usage patterns
Responsible gambling tool settings (deposit limits, self-exclusion status)

3.5 Technical & Device Data

IP address and approximate geolocation derived from IP
Device type, operating system, and browser information
Session duration, page views, and navigation paths
Cookie identifiers and similar tracking technology data (see Section 7)

3.6 Communications Data

Live chat transcripts, support ticket content, and email correspondence with our support team
Responses to surveys or promotional communications where you choose to participate

Section 04

How We Process Your Data

Mega228 processes personal data only for specific, legitimate purposes that are necessary to deliver our services, meet our legal obligations, and protect the integrity of the platform. The primary purposes for which we process personal data are:

Account Management Creating, maintaining, and administering your player account; verifying your identity and age; processing login and authentication events.

Service Delivery Providing access to games, sports betting markets, live casino, and all other platform features and content; processing deposits and withdrawals via Malaysian payment methods.

KYC & Compliance Conducting identity and age verification; fulfilling anti-money laundering (AML) obligations; screening against sanctions lists and fraud databases; reporting to relevant authorities as required by law.

Responsible Gambling Monitoring account activity for indicators of problem gambling; enforcing deposit limits, self-exclusion requests, and other responsible gambling tools you have activated; sending reality-check notifications.

Customer Support Investigating and resolving account queries, technical issues, complaints, and disputes raised by players; maintaining records of support interactions for quality assurance.

Security & Fraud Prevention Detecting and preventing fraud, cheating, bonus abuse, money laundering, and unauthorised account access; monitoring for multi-accounting and collusion indicators.

Marketing Communications Sending promotional offers, bonus notifications, and platform updates to players who have not opted out of marketing communications. You may withdraw consent at any time.

Platform Analytics & Improvement Analysing aggregated and anonymised usage data to improve platform performance, game selection, user experience, and support quality.

Section 05

Legal Basis for Processing

Mega228 relies on the following legal bases when processing your personal data, in accordance with applicable data protection principles:

Contractual Necessity: Processing required to fulfil the service agreement between Mega228 and you as a registered player — including account creation, payment processing, game access, and withdrawal handling.
Legal Obligation: Processing required to comply with applicable laws and regulatory obligations, including KYC/AML obligations, age verification requirements, and law enforcement requests.
Legitimate Interests: Processing that serves Mega228's legitimate business interests and does not override your fundamental rights and freedoms — including fraud prevention, security monitoring, and platform analytics.
Consent: Processing for which you have provided explicit consent, including the sending of marketing communications and, where applicable, the processing of certain sensitive data categories. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Section 06

Data Sharing & Third Parties

Mega228 does not sell your personal data to any third party. We share personal data with third parties only in the specific circumstances set out below, and only to the extent necessary for the stated purpose:

Payment Processors: We share transaction and payment method identifier data with our certified payment processing partners — including those facilitating DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect — solely for the purpose of processing deposits and withdrawals in MYR.
KYC & Identity Verification Providers: We share identity documentation and verification data with certified third-party KYC providers for the purpose of conducting mandatory identity and age verification checks.
Fraud Prevention and AML Services: We may share data with recognised fraud prevention and anti-money laundering screening services to protect the platform and comply with applicable compliance obligations.
Technology and Infrastructure Providers: We work with third-party cloud hosting, data centre, and platform infrastructure providers who process data on our behalf under contractual data processing agreements with equivalent data protection obligations.
Legal and Regulatory Authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, or courts when required to do so by applicable law or valid legal process, including orders issued by competent courts.
Business Transfers: In the event of a merger, acquisition, or sale of all or part of Mega228's business operations, personal data held by Mega228 may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Note: All third-party processors engaged by Mega228 are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with Mega228's documented instructions and applicable data protection law.

Section 07

Cookies & Tracking Technologies

Mega228 uses cookies and similar tracking technologies on its platform to enable core functionality, enhance your user experience, maintain session security, and gather analytics data to improve the service.

7.1 Types of Cookies Used

Strictly Necessary Cookies Essential for the operation of the platform. These include session authentication cookies, security tokens, and cookies that preserve your language and account preferences. These cookies cannot be disabled without affecting your ability to use the platform.

Functional Cookies Used to remember your preferences and personalise your experience on the platform, including previously selected game categories, interface settings, and regional preferences.

Analytics Cookies Used to collect aggregated and anonymised data about how players interact with the platform — including pages visited, session duration, and feature usage — to help us improve the service. Analytics data does not identify individual players.

Security Cookies Used to detect and prevent fraudulent activity, bot access, and unauthorised login attempts on the platform.

7.2 Managing Your Cookie Preferences

You may control and manage non-essential cookie use through your browser settings. Most modern browsers provide options to block or delete cookies. Please note that blocking strictly necessary cookies will significantly impair your ability to access and use the Mega228 platform. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

Section 08

Data Retention

Mega228 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or compliance obligations. The following general retention periods apply:

Active Account Data Retained for the duration of the active account relationship, plus any mandatory post-closure retention period required by applicable law.

Transaction Records Financial transaction records, including deposit and withdrawal history, are retained for a minimum of five (5) years following account closure to comply with AML and financial record-keeping obligations.

KYC Documentation Identity verification documents are retained for a minimum of five (5) years following the end of the account relationship, in accordance with applicable AML compliance requirements.

Support Records Customer support interaction records are retained for up to two (2) years following the resolution of the relevant query, for quality assurance and dispute resolution purposes.

Marketing Opt-Out Records Records of marketing consent withdrawal are retained indefinitely to ensure that future marketing communications are not sent to players who have opted out.

Where personal data is no longer required, it is securely deleted or irreversibly anonymised in accordance with Mega228's internal data disposal procedures.

Section 09

Data Security

Mega228 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

256-bit SSL/TLS encryption for all data transmitted between your device and the Mega228 platform;
Encryption of personal data at rest within our database infrastructure;
Role-based access controls limiting employee access to personal data to those with a documented need;
Two-factor authentication (2FA) options for player accounts;
Regular security assessments, penetration testing, and vulnerability scanning;
Incident response protocols for the detection, containment, and notification of data security incidents.

Despite these measures, no method of electronic storage or internet transmission is entirely secure. Mega228 cannot guarantee absolute security of your personal data and encourages players to maintain strong, unique passwords and to enable 2FA on their accounts.

Security Incident Notification: In the event of a data security incident that poses a material risk to your rights and interests, Mega228 will notify affected players without undue delay, in accordance with applicable data breach notification obligations.

Section 10

Your Rights

Subject to applicable data protection law and certain legitimate exceptions (such as overriding legal obligations), you hold the following rights in relation to the personal data Mega228 holds about you:

Right	Description	How to Exercise
Right of Access	You may request a copy of the personal data Mega228 holds about you, together with information about how it is processed.	Contact support via live chat or email
Right to Rectification	You may request that inaccurate or incomplete personal data held about you be corrected or updated.	Update via account settings or contact support
Right to Erasure	In certain circumstances you may request that personal data about you be deleted. This right is subject to legal retention obligations.	Submit a written request to support
Right to Restrict Processing	You may request that Mega228 restricts the processing of your personal data in specific circumstances, such as where you contest the accuracy of the data.	Submit a written request to support
Right to Data Portability	Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your data in a structured, machine-readable format.	Submit a written request to support
Right to Object	You may object to processing based on legitimate interests, including the use of your data for direct marketing purposes. Marketing opt-outs take effect immediately.	Manage via account preferences or contact support
Right to Withdraw Consent	Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.	Manage via account preferences or contact support

Mega228 will respond to all valid data subject rights requests within 30 days of receipt, or within any shorter period required by applicable law. Where a request is complex or numerous, we may extend this period by a further 30 days and will inform you accordingly.

Section 11

Minors & Age Restrictions

The Mega228 platform is strictly intended for use by individuals who are 21 years of age or older. We do not knowingly collect personal data from individuals under the age of 21, and we do not permit individuals under 21 to register or use the platform.

Where Mega228 becomes aware, or has reasonable grounds to believe, that personal data has been collected from an individual under 21 years of age, we will take immediate steps to delete that data and close the relevant account. If you believe a minor has registered on the platform, please contact us immediately using the contact details in Section 14.

21+ Age Enforcement: Mega228 uses automated and manual KYC processes to verify the age of all registered players. Age verification is a mandatory step in the account activation process, and accounts that cannot be verified as belonging to a player aged 21 or above will be suspended.

Section 12

International Data Transfers

As an internationally licensed online gaming platform, Mega228 may transfer personal data to servers, service providers, and group entities located outside of Malaysia. Such transfers may include data hosted in data centres in the European Union, Singapore, or other jurisdictions where Mega228 or its service providers operate.

Where personal data is transferred internationally, Mega228 takes appropriate steps to ensure that the receiving parties maintain a level of data protection equivalent to the standards described in this Policy. These steps may include the use of standard contractual clauses, data processing agreements, and assessments of the data protection environment in the destination country.

Section 13

Amendments to This Policy

Mega228 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or operational requirements. The effective date of the current version of this Policy is displayed at the top of this document.

Where amendments are material — meaning they significantly affect your rights or the way in which we process your personal data — Mega228 will notify registered players via email or a prominent notice on the platform prior to the changes taking effect, where reasonably practicable.

Your continued use of the Mega228 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. We encourage players to review this Policy periodically.

Section 14

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Mega228 processes your personal data, please contact our customer support and data protection team using the following channels:

Live Chat: Available directly on the platform, 24/7 in English, Bahasa Melayu, and Mandarin. Average response time: 3–5 minutes.
WhatsApp Support: Available via the contact details displayed in your account support section.
Email: [email protected] (plain text — not a clickable link). Please use the subject line "Data Protection Request" for privacy-related enquiries to ensure timely routing to the appropriate team.

We will acknowledge receipt of your data protection request within 3 business days and provide a substantive response within 30 days. For responsible gambling concerns or self-exclusion requests, please also visit our Responsible Gambling page.

Data Minimisation

Secure Storage & Transmission

No Sale of Personal Data

Your Rights Are Respected

Payment Data Protection

Marketing Opt-Out Respected