01 Introduction
This Privacy Policy (hereinafter "the Policy") is published by Mahkota888 (hereinafter "Mahkota888", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at mahkota888.cam (hereinafter "the Platform").
This Policy governs the collection, use, storage, disclosure, and protection of personal data relating to all persons who access, register on, or interact with the Platform, whether as registered users or as visitors (hereinafter collectively "you" or "the User"). It applies to all data processing activities carried out by Mahkota888 in connection with the Platform, including through our mobile interface, live chat services, email communications, and customer support channels.
By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions, which govern the contractual relationship between you and Mahkota888.
02 Definitions
For the purposes of this Policy, the following definitions apply:
- "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, location data, financial information, and online identifiers.
- "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, and deletion.
- "Data Controller" means Mahkota888 as the entity that determines the purposes and means of processing personal data collected through the Platform.
- "Data Processor" means any third party that processes personal data on behalf of Mahkota888, pursuant to a written data processing agreement.
- "User" means any natural person who accesses or registers on the Platform, whether for the purpose of gambling, browsing content, or contacting support.
- "KYC Data" means identity verification documentation collected for Know Your Customer compliance purposes, including government-issued identification, proof of address, and source of funds declarations.
- "Cookies" means small text files placed on your device by the Platform for functional, analytical, or preference-related purposes.
- "Sensitive Data" means personal data that warrants enhanced protection, including financial data, identity documents, and data relating to problem gambling indicators.
03 Data We Collect
Mahkota888 collects personal data through several channels in connection with the operation of the Platform. The categories of data we collect include the following:
3.1 Registration Data
When you create an account, we collect your full legal name, date of birth, email address, mobile phone number, and chosen login credentials. This information is required to establish your identity, verify your eligibility to use the Platform, and maintain your account.
3.2 Identity Verification (KYC) Data
To comply with applicable anti-money laundering obligations and age verification requirements, we may collect copies of government-issued identity documents (such as your MyKad or passport), proof of residential address (such as a utility bill or bank statement), and where required, evidence of source of funds. KYC data is processed by our compliance team and retained in accordance with applicable statutory requirements.
3.3 Financial Transaction Data
We collect records of all deposits and withdrawals processed through the Platform, including the payment method used (such as DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong, or USDT TRC20), transaction amounts in MYR, timestamps, and transaction reference numbers. We do not store full payment card details — card processing is handled by PCI DSS-compliant third-party payment processors.
3.4 Gaming Activity Data
We maintain records of all wagers placed, games played, bet amounts, outcomes, and account balances. This data is used for account management, dispute resolution, responsible gambling monitoring, and fraud prevention. It may also be used in aggregate, anonymised form for product analytics.
3.5 Technical & Device Data
When you access the Platform, we automatically collect technical data including your IP address, browser type and version, operating system, device identifiers, screen resolution, referring URL, session duration, and pages visited. This data is used for security monitoring, fraud detection, and platform performance optimisation.
3.6 Communications Data
We retain records of all communications between you and our support team, including live chat transcripts, WhatsApp message histories (where consent is given), and email correspondence. These records are used for quality assurance, dispute resolution, and staff training purposes.
| Data Category | Examples | Primary Purpose |
|---|---|---|
| Registration Data | Name, email, phone number, DOB | Account creation, age verification |
| KYC Data | MyKad copy, passport, proof of address | Identity verification, AML compliance |
| Financial Data | Transaction history, payment methods, MYR amounts | Payment processing, fraud prevention |
| Gaming Activity | Bets, game history, account balance | Account management, responsible gambling |
| Technical Data | IP address, device ID, browser type | Security, fraud detection, analytics |
| Communications | Live chat logs, email records | Support, quality assurance, disputes |
04 How We Use Your Data
Mahkota888 uses personal data for the following purposes, each of which is underpinned by a legitimate legal basis as described in Section 5 below:
- Account Management: To create, maintain, and administer your Mahkota888 account, including processing deposits, withdrawals, and bonus credits.
- Identity & Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity in accordance with our KYC procedures.
- Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct on the Platform.
- Legal & Regulatory Compliance: To meet our obligations under applicable anti-money laundering laws, data protection legislation, and any lawful requests from competent regulatory authorities.
- Responsible Gambling: To monitor gaming patterns and identify Users who may be experiencing gambling-related harm, and to provide appropriate support tools and interventions.
- Customer Support: To respond to your enquiries, resolve disputes, and provide assistance through our live chat, WhatsApp, and email support channels.
- Marketing Communications: To send promotional offers, bonus notifications, and platform updates where you have provided consent or where we have a legitimate interest in doing so. You may opt out at any time.
- Platform Improvement: To analyse usage patterns in aggregate, anonymised form to improve the performance, functionality, and user experience of the Platform.
05 Legal Basis for Processing
All personal data processing carried out by Mahkota888 is grounded in one or more of the following lawful bases:
- Contractual Necessity: Processing that is necessary for the performance of the contract between you and Mahkota888, including account registration, payment processing, and service delivery.
- Legal Obligation: Processing required to comply with applicable law, including KYC and AML obligations, data retention requirements, and responses to lawful regulatory enquiries.
- Legitimate Interests: Processing that is necessary for the pursuit of legitimate interests of Mahkota888, including fraud prevention, security monitoring, and internal analytics, where those interests are not overridden by your rights and freedoms.
- Consent: Processing based on your freely given, specific, and informed consent — in particular for direct marketing communications and non-essential cookies. You may withdraw consent at any time without detriment to your account.
06 Data Sharing & Disclosure
Mahkota888 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:
- Payment Service Providers: Including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong, for the purpose of processing your financial transactions. These providers are independently regulated and are bound by their own data protection obligations.
- Identity Verification Partners: Third-party KYC and AML service providers engaged to assist with document verification and sanctions screening.
- Game Software Providers: Where a game is provided by a third-party studio, technical data necessary for game delivery — such as session tokens — may be transmitted to that provider. No directly identifying personal data is shared beyond what is strictly necessary.
- Regulatory and Law Enforcement Authorities: Where we are legally required to disclose information to a competent authority, we will do so in strict compliance with applicable law. Where permitted, we will notify you of such disclosure.
- Professional Advisers: Including lawyers, auditors, and insurers, in connection with the operation of our business, subject to professional confidentiality obligations.
07 International Data Transfers
The operation of the Platform may involve the transfer of personal data to servers or service providers located outside Malaysia. Where such transfers occur, Mahkota888 ensures that appropriate safeguards are in place to maintain the same standard of data protection that applies within Malaysia, including through the use of contractual data transfer agreements with receiving parties.
All game servers and primary user data infrastructure are hosted in data centres that maintain ISO 27001 certification and are subject to regular independent security audits. Data transmitted to payment processors operating in Malaysia — including FPX and DuitNow — remains within the Malaysian financial system for domestic transaction processing.
08 Data Retention
Mahkota888 retains personal data only for as long as is necessary for the purposes for which it was collected, or for as long as required by applicable law. The following general retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account Registration Data | Duration of account + 5 years post-closure | Contractual obligation, legal compliance |
| KYC Documents | 5 years from last transaction date | AML statutory requirement |
| Financial Transaction Records | 7 years from transaction date | Statutory accounting and AML obligations |
| Gaming Activity Logs | 3 years from account closure | Dispute resolution, responsible gambling |
| Support Communications | 2 years from interaction date | Quality assurance, dispute resolution |
| Technical / Device Logs | 12 months rolling | Security monitoring, fraud detection |
| Marketing Preferences | Until consent withdrawn or account closed | Consent-based processing |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be attributed to an identified or identifiable individual.
09 Security Measures
Mahkota888 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:
- Encryption: All data in transit is protected by TLS 1.3 encryption. Sensitive data at rest is encrypted using AES-256 standard encryption.
- Access Controls: Access to personal data is restricted on a strict need-to-know basis. All internal access is authenticated, role-limited, and fully logged for audit purposes.
- Two-Factor Authentication: All staff accessing production systems are required to use multi-factor authentication. Users may enable 2FA on their accounts via account settings.
- Penetration Testing: Our platform infrastructure undergoes independent third-party security assessments at least twice annually.
- Incident Response: We maintain a documented data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected users without undue delay.
You are responsible for maintaining the confidentiality of your own account credentials. Mahkota888 will never ask you to share your password via live chat, email, or any other channel.
10 Cookies & Tracking Technologies
The Platform uses cookies and similar tracking technologies to provide functionality, maintain your session, remember your preferences, and gather analytical data about Platform usage. The following categories of cookies are used:
- Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing Platform functionality.
- Functional Cookies: Used to remember your preferences such as language selection and display settings. These persist between sessions to improve your experience.
- Analytical Cookies: Used to collect anonymised data about how Users interact with the Platform — including pages visited, session duration, and navigation paths — to help us improve performance and usability.
- Marketing Cookies: Used, with your consent, to personalise promotional content and measure the effectiveness of marketing campaigns. These may be set by our trusted partner networks.
You may manage your cookie preferences through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the Platform.
11 Your Rights
Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data Mahkota888 holds about you:
- Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is used and with whom it is shared.
- Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete.
- Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where no overriding legitimate grounds for retention exist. Note that statutory retention obligations may limit the scope of this right.
- Right to Restrict Processing: You may request that we restrict the processing of your data in certain circumstances, such as where you contest its accuracy or have objected to processing pending verification of our grounds.
- Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity.
- Right to Object: You may object to processing based on legitimate interests at any time. You may also withdraw consent for marketing communications at any time via your account settings or by contacting support.
To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14 of this Policy. We will respond to all verified requests within 14 calendar days. We may need to verify your identity before processing a request.
12 Minors & Age Restriction
The Platform is strictly intended for adults aged 21 years and above. Mahkota888 does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account.
If you are a parent or guardian and believe that a minor in your care has registered on the Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.
13 Policy Amendments
Mahkota888 reserves the right to update this Privacy Policy at any time. Where amendments are material — for example, changes to the categories of data collected, the purposes of processing, or the rights available to you — we will provide reasonable advance notice via email and a prominent notice on the Platform prior to the updated Policy taking effect.
Non-material amendments (such as typographical corrections or clarifications that do not affect the substance of the Policy) may be made without prior notice. The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically.
Your continued use of the Platform following any amendment constitutes acceptance of the revised Policy. If you do not agree with any amendment, you must discontinue use of the Platform and request account closure before the revised Policy takes effect.
14 Contact Us & Data Protection Officer
If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which Mahkota888 processes your personal data, you may contact us through any of the following channels. All data protection enquiries and data subject rights requests should be directed to our Data Protection Officer.
Please mark your message "Data Protection Enquiry" or "Data Subject Request" so it is routed to the appropriate team. We respond within 14 calendar days of receiving a verified request.
Available in English, Bahasa Melayu, and Mandarin. Average response time: 3–5 minutes. For urgent account security matters, live chat is the fastest channel.