merah88 Privacy Policy

1. Introduction

merah88 ("merah88", "we", "us", "our") operates the online gaming platform accessible at merah88.club ("Platform"). As a platform that serves players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Bangsar — we collect and process personal data as a necessary part of providing our services.

This Privacy Policy ("Policy") sets out how merah88 collects, uses, stores, shares, and protects your personal data. It applies to all registered account holders, visitors to the merah88 website, and any person whose personal data merah88 processes in connection with its gaming and related services. By registering a merah88 account or continuing to use the Platform, you acknowledge that you have read and understood this Policy.

merah88 takes its data protection obligations seriously. We process personal data only for legitimate, specified purposes and apply appropriate technical and organisational security measures to protect it from unauthorised access, loss, or disclosure.

2. Personal Data We Collect

merah88 collects the following categories of personal data:

2.1 Identity Data

Full legal name, date of birth, nationality, and copies of government-issued identity documents (Malaysian MyKad, passport, or equivalent) collected for age verification and Know Your Customer (KYC) compliance purposes.

2.2 Contact Data

Email address, Malaysian mobile phone number, and residential address. This information is used for account management, transaction notifications, customer support communications, and responsible gaming outreach where appropriate.

2.3 Financial Data

Payment method details including Touch n Go eWallet account references, Boost wallet identifiers, bank account or card details used for deposits and withdrawals, transaction history, and account balance records. Full payment card numbers are not stored by merah88 — card processing is handled by certified payment service providers.

2.4 Account and Gaming Data

Username, account registration date, login history (timestamps and IP addresses), game session data (games played, wager amounts, session duration), betting history, bonus activity, and account preference settings.

2.5 Technical Data

Internet Protocol (IP) address, device type and identifiers, browser type and version, operating system, screen resolution, referring URL, and pages visited within the merah88 Platform. This data is collected automatically when you access the Platform.

2.6 Communications Data

Records of communications between you and merah88, including live chat transcripts, support ticket content, and any correspondence submitted via the Platform's contact channels.

3. How We Collect Personal Data

merah88 collects personal data through the following means:

• Direct provision: Data you provide when registering a merah88 account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access the Platform.
• Third-party sources: Identity verification data obtained from authorised verification service providers; payment data obtained from certified payment processors; fraud prevention data obtained from anti-fraud service providers.

4. Purpose of Processing

merah88 processes personal data for the following specified purposes:

• Account registration, verification, and ongoing management.
• Processing deposits, withdrawals, and maintaining accurate financial records in MYR.
• Age verification to enforce the 21+ access requirement — a legal and responsible gaming obligation.
• KYC and anti-money laundering (AML) compliance, including transaction monitoring and suspicious activity reporting.
• Fraud detection and prevention, including identifying multiple account abuse, payment fraud, and bonus manipulation.
• Delivering and improving gaming services, including personalising the player experience based on game history and preferences.
• Customer support — responding to queries, complaints, and disputes.
• Responsible gaming monitoring — identifying patterns that may indicate problem gambling and triggering appropriate interventions.
• Legal compliance — meeting obligations under applicable law and regulatory requirements.
• Marketing communications — sending promotional offers and platform updates to players who have consented to receive them.

5. Legal Basis for Processing

merah88 relies on the following legal bases to process personal data:

• Contractual necessity: Processing required to perform the gaming service agreement between merah88 and the account holder — including account management, game access, and payment processing.
• Legal obligation: Processing necessary to comply with applicable legal requirements including AML obligations, KYC requirements, age verification mandates, and data retention laws.
• Legitimate interests: Processing for fraud prevention, platform security, service improvement, and responsible gaming monitoring, where these interests are not overridden by individual rights.
• Consent: Marketing communications and non-essential cookies, where express consent has been obtained and may be withdrawn at any time.

6. Data Sharing and Disclosure

merah88 does not sell personal data to third parties for their own marketing purposes. We may share personal data with the following categories of recipient, strictly for the purposes set out in this Policy:

• Payment processors: Certified payment service providers facilitating MYR transactions via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, and card networks.
• Identity verification providers: Third-party KYC and age verification service providers engaged to confirm player identity and age.
• Game technology providers: Licensed game studios and platform technology partners who may process limited technical data to deliver games.
• Fraud prevention services: Anti-fraud and AML screening services used to protect the platform and its players.
• Legal and regulatory authorities: Regulators, law enforcement agencies, or courts where merah88 is legally required to disclose data or where disclosure is necessary to protect the rights and safety of merah88 or its players.

All third-party recipients are required to handle personal data in accordance with applicable data protection standards and are prohibited from using it for any purpose beyond that for which it was shared.

7. International Data Transfers

As an online platform serving Malaysian players, merah88 may transfer personal data to service providers and partners located outside Malaysia. Where such transfers occur, merah88 ensures that appropriate safeguards are in place — including contractual data protection obligations — to maintain the same standard of protection for your personal data as if it remained in Malaysia. By using the Platform, you consent to such transfers where they are necessary to provide the merah88 service.

8. Data Retention

merah88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and audit requirements. In practice:

• Account and identity data is retained for the duration of the account relationship and for a minimum of five (5) years after account closure, to satisfy AML and regulatory record-keeping obligations.
• Financial transaction records are retained for a minimum of seven (7) years in accordance with standard financial record-keeping requirements.
• Marketing preferences and consent records are retained for the duration of the marketing relationship and for a reasonable period thereafter.
• Technical and session logs are retained for security and fraud investigation purposes for up to two (2) years.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised.

9. Cookies and Tracking Technologies

The merah88 Platform uses cookies and similar tracking technologies to operate core platform functions, analyse usage, and where consented, personalise your experience. The categories of cookies used include:

• Essential cookies: Required for login session management, security functions, and core Platform operation. These cannot be disabled without impacting Platform functionality.
• Analytics cookies: Used to understand how players navigate and use the Platform, enabling us to improve the user experience. These are activated on the basis of consent.
• Preference cookies: Used to remember your settings and preferences across sessions, such as language or game category defaults.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform, but may affect certain personalisation features.

10. Security Measures

merah88 implements industry-standard technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the merah88 Platform.
• Encrypted storage of sensitive account and financial data at rest.
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate need.
• Two-factor authentication (2FA) available to all merah88 account holders to protect login credentials.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Staff training on data protection obligations and information security practices.

While merah88 takes all reasonable steps to protect your data, no internet transmission can be guaranteed to be completely secure. Players are encouraged to use strong, unique passwords and enable 2FA on their merah88 accounts.

11. Your Data Rights

As a merah88 account holder and data subject, you hold the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data merah88 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to object: You may object to processing based on legitimate interests or direct marketing at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact merah88 support. We will respond to verifiable requests within a reasonable timeframe and in accordance with applicable law. Note that exercising certain rights (such as erasure) may result in account closure where data retention is legally required for continued account operation.

12. Children's Privacy and Age Restriction

The merah88 Platform is strictly not intended for or directed at persons under the age of 21. merah88 does not knowingly collect personal data from individuals under 21. Where merah88 discovers or has reasonable grounds to believe that a minor has created an account or provided personal data, the account will be immediately closed, funds returned net of any prior withdrawals, and all associated personal data deleted. Any adult who becomes aware of a minor using the merah88 Platform should contact us immediately via our support channel.

13. Third-Party Links

The merah88 Platform may contain references to third-party services (such as licensed game providers). merah88 is not responsible for the privacy practices of third-party websites or services. We encourage players to review the privacy policies of any third-party platforms they interact with independently of merah88.

14. Changes to This Privacy Policy

merah88 may update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or Platform services. Material changes will be communicated to registered players via email or prominent notice on the Platform at least 7 days before the revised Policy takes effect. The effective date at the top of this Policy reflects the date of the most recent revision. Continued use of the merah88 Platform after the effective date of any revision constitutes acceptance of the updated Policy.

15. Contact Us

For privacy-related enquiries, data subject rights requests, or concerns about how merah88 handles your personal data, please contact our support team. We are committed to addressing data protection concerns promptly and transparently.

Privacy enquiries: [email protected] (plain text — not a clickable link)

For further information on your account, please visit our FAQ page. For our full user agreement, see the Terms & Conditions.