Privacy Policy m98 — Personal Data Protection for Malaysian Members

Welcome to the m98 Privacy Policy. This document is published by m98 and applies to all users who access or use our platform at m98.cx, including the website, mobile app, and any related services provided by m98.

We understand that trusting a platform with your personal information is a significant decision. That is why we are committed to being fully transparent about our privacy practices — what we collect, why we need it, and how we protect it.

This Privacy Policy should be read together with Terms and Conditions and Responsible Gaming Policy m98. By using the m98 platform, you agree to the collection and use of information as described in this document.

M98 collects various types of information to enable us to provide a secure, personalized service that meets our members' needs. The information collected falls into three main categories:

2.1 Information You Provide Directly

• Registration information — full name, date of birth, identification card or passport number, email address, phone number, and password.
• Financial information — bank account number, bank name, and payment method details used for deposits and withdrawals.
• KYC verification documents — copies of identification cards, passports, bank statements, or proof of address documents submitted during the identity verification process.
• Communications — messages you send to our customer support team via live chat, email, or other communication channels.

2.2 Automatically Collected Information

• Technical data — IP address, web browser type, operating system, screen resolution, and device information.
• Usage data — pages you visit, time spent, games played, and navigation patterns within the platform.
• Approximate location data — geographic location based on IP address for legal compliance and fraud detection purposes.
• Cookie data — session information and preferences stored via your web browser cookies.

2.3 Information from Third Parties

In certain circumstances, m98 may receive information about you from trusted third parties, such as identity verification service providers, payment processors, and fraud prevention agencies. This information is used solely to verify your identity and protect your account.

M98 uses the personal data collected solely for legitimate purposes related to the provision of our platform services. The following is a full description of how your information is used:

3.1 Service Provision and Management

• Creating and managing your member account securely.
• Processing deposits, withdrawals, and all financial transactions on the platform.
• Verifying your identity through the KYC process as required by law.
• Enabling you to access and enjoy all m98 games and services.
• Providing responsive and effective customer support.

3.2 Security and Fraud Prevention

• Detecting and preventing fraud, money laundering, and any unlawful use of the platform.
• Monitoring suspicious transaction patterns to protect your account.
• Verifying that all users meet the minimum age requirement.
• Complying with reporting requirements to the relevant authorities as required by law.

3.3 Service Improvement

• Analysing usage patterns to improve the platform's design, performance, and functionality.
• Developing new features better suited to the needs of Malaysian members.
• Running A/B tests to ensure an optimal user experience.

3.4 Marketing Communications

M98 may send you information about promotions, exclusive offers, and special events via email or in-app notifications, based on the preferences you set in your account settings. You may opt out of marketing communications at any time through the unsubscribe link included in every email.

M98 takes a highly cautious approach to sharing your personal data. We only share your information in limited and justified circumstances as described below:

4.1 Trusted Service Providers

M98 works with carefully selected third-party service providers to help us operate our platform. These include:

• Payment processors — to facilitate secure deposit and withdrawal transactions.
• Identity verification service providers — to carry out the required KYC process.
• Cloud service providers — for secure and integrated data storage.
• Analytics companies — to help us understand platform usage patterns (data shared in anonymous form).

All these service providers are bound by strict confidentiality agreements and are only permitted to use your data for purposes specified by m98.

4.2 Legal Obligations

M98 may be required to disclose your information to government authorities or regulatory bodies if we receive a valid court order, instructions from law enforcement authorities, or in situations where disclosure is necessary to prevent serious crime. In such circumstances, we will comply with the applicable legal requirements.

4.3 Business Transfers

If m98 is involved in any merger, acquisition, or sale of assets, user data may be transferred as part of those assets. You will be notified in advance before any such transfer takes place, and the new Privacy Policy will describe how your data is protected.

Protecting your personal data is m98's highest priority. We continuously invest in the latest security infrastructure to keep your information safe from cyber threats at all times.

5.1 Technical Security Measures

• 256-bit SSL/TLS encryption — all data transmitted between your device and m98 servers is fully encrypted.
• Encryption of data at rest — sensitive data such as passwords and financial information is encrypted in our database.
• Two-factor authentication (2FA) — an additional security layer available to all registered members.
• 24/7 security monitoring — our systems are continuously monitored to detect and respond to any threats.
• Firewall and intrusion detection systems — multi-layered protection against unauthorized access.

5.2 Organisational Security Measures

• Role-based access control — only authorised staff may access sensitive data.
• Regular security training for all m98 staff who handle user data.
• Regular internal and external security audits are conducted periodically.
• A clearly defined and tested incident response procedure in the event of any data breach.

5.3 Data Breach Response

In the event of a data breach that may affect your personal information, m98 is committed to notifying you within 72 hours of becoming aware of the incident, in line with international data protection best practices. This notification will include details on the type of data exposed, potential impact, and the steps we are taking to address the situation.

M98 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

6.1 Types of Cookies We Use

• Essential cookies — required for core platform functions such as login session management and security. These cookies cannot be disabled.
• Functional cookies — stores your preferences such as language, display settings, and game preferences for a more personalized experience.
• Analytics cookies — helps us understand how users interact with the platform for continuous improvement purposes. This data is collected in aggregated and anonymous form.
• Marketing cookies — used to show you more relevant promotions based on your interests and activity on the platform.

6.2 Managing Your Cookies

You can manage or delete cookies through your web browser settings at any time. Please note, however, that disabling certain cookies may affect the functionality and your experience on the m98 platform. Essential cookies cannot be disabled as they are required for the platform's core operations.

For more information on how to manage cookies on popular browsers such as Google Chrome, Mozilla Firefox, and Safari, please refer to the respective browser's help documentation.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and m98's privacy practices, you have the following rights regarding your personal data:

To submit any request related to the above rights, please contact our data protection team via the m98 support email. We will process your request within 30 days of receipt.

The m98 platform is not intended for individuals under the age of 18. We do not knowingly collect or process personal data from minors. Creating an m98 account requires users to confirm that they have reached the minimum age of 18.

If we discover or are informed that we have collected personal data from an individual under the age of 18, we will take immediate steps to delete that information from our systems and terminate the relevant account.

M98 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our privacy practices, legal requirements, or the services we offer. Whenever a significant change occurs, we will:

• Publishing the latest version on this page with an updated revision date.
• Sending notifications to your registered email address regarding significant changes.
• Displaying clear notices within our platform for at least 30 days after any changes take effect.

Continued use of the m98 platform after notification of Privacy Policy changes constitutes your acceptance of the updated terms. If you do not agree with the changes, you have the right to close your account and discontinue use of our services.

We encourage you to review this page periodically to stay informed about how we protect your personal information.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact the m98 Data Protection Officer through the following channels:

We are committed to responding to every enquiry within 3 business days. For official requests related to data protection rights, please include "Data Protection Request" in your message subject line so our dedicated team can process it promptly.