Mega198 Privacy Policy

This Privacy Policy (hereinafter the "Policy") sets out the basis on which Mega198 (hereinafter "Mega198", "we", "us", or "our") — the operator of the online gaming platform at mega198.cam (the "Platform") — collects, processes, stores, and discloses personal data relating to users of the Platform (hereinafter "you", "User", or "Player").

Mega198 is committed to protecting the privacy and personal data of all users in accordance with applicable data protection legislation and international best practices. This Policy applies to all personal data collected through the Platform, including data gathered during registration, identity verification, financial transactions, gameplay activity, and communications with our support team.

By accessing mega198.cam, creating an account, or continuing to use the Platform following an update to this Policy, you acknowledge that you have read and understood this Policy and consent to the data processing practices described herein. If you do not agree to this Policy, you must discontinue use of the Platform immediately.

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, location data, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Mega198, which determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" — any third party that processes personal data on behalf of Mega198, such as payment service providers or identity verification services.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their personal data.
• "KYC" — Know Your Customer, the identity and age verification process required of all Players prior to withdrawal processing.
• "Cookie" — a small data file stored on a User's device by the Platform to facilitate functionality, analytics, and session management.

Mega198 collects personal data through multiple channels in the course of operating the Platform and fulfilling its legal and contractual obligations. The categories of data we collect are described in the table below.

Mega198 processes personal data only where a valid lawful basis exists. The following bases are relied upon for the respective processing activities:

• Contract Performance: Processing necessary to create and manage your account, process deposits and withdrawals, and deliver the gaming services you have engaged with.
• Legal Obligation: Processing required to fulfil regulatory obligations, including anti-money laundering (AML) checks, KYC verification, age verification (21+), and financial reporting requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, abuse detection, system analytics, and service improvement — where such interests are not overridden by your data protection rights.
• Consent: Where you have explicitly opted in to receive marketing communications, personalised offers, or promotional notifications. You may withdraw consent at any time by contacting our support team or adjusting your account settings.

Mega198 uses collected personal data for the following specific purposes:

Account Management

To register your account, authenticate your identity at login, manage your account settings, and communicate essential account-related information such as password resets, security notifications, and policy updates.

Payment Processing

To facilitate deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and other accepted payment methods, and to process withdrawal requests in Malaysian Ringgit (MYR) to your verified payment account.

Identity & Age Verification

To verify that you are aged 21 years or above and that the details provided during registration match your legal identity documents, in compliance with our age restriction policy and applicable regulatory requirements.

Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and any other prohibited conduct as defined in our Terms & Conditions. This includes automated screening and manual review by our compliance team.

Responsible Gambling

To monitor gameplay patterns and identify potential indicators of problem gambling behaviour, to apply and enforce self-exclusion or deposit limit requests, and to refer users to responsible gambling resources where appropriate.

Customer Support

To respond to your enquiries, resolve disputes, process complaints, and maintain records of support interactions for quality assurance and training purposes.

Marketing Communications (Opt-In Only)

Where you have provided explicit consent, to send you promotional offers, bonus notifications, and platform updates by email. You may opt out of marketing communications at any time.

Mega198 does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for commercial or marketing purposes. Personal data is shared only in the following defined circumstances:

• Payment Service Providers: Financial data is shared with regulated payment processors and e-wallet providers (including DuitNow operators, FPX gateway providers, and Malaysian banks) strictly as necessary to process your transactions.
• Identity Verification Services: Identity and documentary data is shared with licensed KYC and AML screening service providers for the purpose of regulatory compliance.
• Game Technology Providers: Limited gameplay data is shared with our game studio technology partners as required for game functionality, fairness auditing, and progressive jackpot pooling.
• Regulatory Authorities: Where legally required, personal data may be disclosed to financial intelligence authorities, gaming regulators, or law enforcement agencies in response to lawful requests or as part of our AML/CTF reporting obligations.
• Cloud & Infrastructure Providers: Technical data is processed by our cloud infrastructure partners under data processing agreements that require equivalent data protection standards.

Mega198 retains personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal and regulatory obligations. The following indicative retention periods apply:

• Account and Identity Data: Retained for the duration of the account and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial regulation.
• KYC Documentation: Retained for five (5) years after the end of the customer relationship or the date the document was verified.
• Gameplay & Betting Records: Retained for five (5) years from the date of each transaction for audit, dispute resolution, and regulatory reporting purposes.
• Support Communications: Retained for two (2) years from the date of the last interaction, or longer where required for active dispute resolution.
• Marketing Consent Records: Retained for the period of consent plus two (2) years following withdrawal of consent, as evidence of the lawful basis for prior communications.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

Mega198 uses cookies and similar tracking technologies on the Platform to enable core functionality, improve user experience, and gather analytics data. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly, including session authentication, security tokens, and load balancing. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Enable personalisation features such as language preferences, remembered login states, and preferred payment method display.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform — including pages visited, session duration, and error events — to help us improve the Platform experience.
• Security Cookies: Used for fraud detection and abuse prevention, including identifying unusual login behaviour and device fingerprinting for account protection purposes.

Non-essential cookies are only placed on your device with your consent, which you may provide or withdraw through the cookie preference controls available on the Platform. Strictly necessary cookies do not require consent as they are essential to deliver the service you have requested.

Mega198 implements comprehensive technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• AES-256 encryption for all personal data stored at rest on our servers.
• TLS 1.3 encryption for all data transmitted between your browser and the Platform.
• Multi-factor authentication (MFA) available and encouraged for all Player accounts.
• Role-based access controls limiting internal access to personal data to authorised personnel with a demonstrable need.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Automated intrusion detection and real-time alerting for anomalous access events.
• Secure data destruction procedures for hardware and digital storage media.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, Mega198 will notify affected Users without undue delay in accordance with applicable data protection obligations.

You are responsible for maintaining the confidentiality of your account credentials. Mega198 will never request your password via email, live chat, or any other channel. If you suspect unauthorised access to your account, you must contact our support team immediately.

The mega198 Platform is strictly for individuals aged 21 years and above. Mega198 does not knowingly collect, process, or retain personal data from any person under the age of 21.

All registrations are subject to age verification as part of the KYC process. Where Mega198 becomes aware that personal data has been collected from a person under the minimum age threshold, that data will be deleted promptly and the associated account will be permanently closed.

If you believe that a minor has registered on the Platform or provided personal data, please contact our support team immediately at the address provided in the Contact section of this Policy.

As a User of the mega198 Platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please submit a request to our support team using the contact details provided in Section 14.

• Right of Access: You may request a copy of the personal data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held on your account.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations.
• Right to Restrict Processing: You may request that processing of your personal data be restricted in defined circumstances, such as while a data accuracy dispute is being resolved.
• Right to Data Portability: Where processing is based on consent or contract performance and conducted by automated means, you may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

Mega198 will respond to all verified data rights requests within thirty (30) calendar days. Where a request is complex or Mega198 receives a high volume of requests, this period may be extended by a further two months, with notification provided to you.

The mega198 Platform may reference or link to third-party services, including Malaysian payment service providers, game studio platforms, and identity verification systems. These third-party services operate their own privacy policies, which are independent of this Policy.

Mega198 is not responsible for the privacy practices or data handling of third-party services. Where we engage third parties as Data Processors, we enter into formal data processing agreements requiring them to implement appropriate data protection measures and to process your personal data only in accordance with our instructions.

Payment service providers engaged by Mega198 — including banks such as Maybank, CIMB, and Public Bank, and e-wallet providers such as Touch 'n Go eWallet and Boost — are regulated financial institutions operating under their own regulatory frameworks and privacy obligations.

Mega198 reserves the right to amend or update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, Platform functionality, or our data processing practices.

Where changes are material, registered Users will be notified via a prominent notice on the Platform or by email to the registered account address, not less than fourteen (14) days prior to the changes taking effect. The updated Policy will display a revised "Last Updated" date at the top of the page.

Continued use of the mega198 Platform following the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

For all privacy-related enquiries, including data rights requests, questions about this Policy, or to report a potential data breach or privacy concern, please contact the Mega198 data team using the details below. All enquiries are treated with confidentiality.

• Email (plain text — not a link): [email protected]
• Live Chat: Available 24/7 via the Platform. State "Privacy Request" in your opening message and you will be connected to the appropriate team.
• Response Commitment: We acknowledge all privacy requests within 5 business days and aim to provide a full response within 30 calendar days.

If you are dissatisfied with our response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. Mega198 encourages Users to contact us directly in the first instance so that we have the opportunity to address any concerns promptly and fairly.

For further information about your rights and account policies, you may also review our Terms & Conditions, our Responsible Gambling page, and our FAQ.