merah888 Privacy Policy

1. Who We Are and How to Contact Us

merah888 operates the online gaming platform accessible at merah888.club (the "Platform"). For the purposes of data protection law, merah888 is the data controller in respect of personal data collected from Players and visitors to the Platform.

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at:

Email: [email protected]
Platform: merah888.club
Response time: Within 30 days of receipt of a verifiable request

2. Personal Data We Collect

merah888 collects the following categories of personal data from Players and, where applicable, from visitors to the Platform who have not yet registered an account:

Category	Examples	When Collected
Identity Data	Full name, date of birth, MyKad / passport number, selfie or photo ID	Registration, KYC verification
Contact Data	Malaysian mobile number (+60), email address	Registration, account updates
Financial Data	Payment method details (e-wallet IDs, bank account info), transaction amounts, deposit/withdrawal history	Deposits, withdrawals, AML checks
Technical Data	IP address, device type, browser type and version, operating system, screen resolution, time zone	Each session automatically
Usage Data	Pages visited, games played, bet history, session duration, click patterns, feature usage	Each session automatically
Communications Data	Support chat transcripts, email correspondence, feedback submissions	When you contact support
Responsible Gaming Data	Deposit limits set, self-exclusion requests, session time preferences	When you use RG tools

merah888 does not intentionally collect special category data (e.g., health data, racial or ethnic origin, political opinions) except where strictly necessary for regulatory compliance and with an appropriate legal basis.

3. How We Collect Your Data

3.1 Directly from You

The majority of personal data merah888 holds about you is provided directly by you during the account registration process, identity verification (Know Your Customer / KYC), deposit and withdrawal transactions, responsible gaming tool configuration, and communications with our support team.

3.2 Automatically

When you access and use the Platform, merah888's systems automatically collect technical and usage data through cookies, web server logs, and similar tracking technologies. This collection occurs irrespective of whether you are logged into your Account. Detailed information about cookies is provided in Section 7 of this Policy.

3.3 From Third Parties

merah888 may receive data about you from third-party identity verification providers, fraud prevention databases, payment processors, and — where applicable — publicly available sources. This information is used solely to verify your identity, prevent fraud, and comply with anti-money laundering obligations.

4. How We Use Your Personal Data

merah888 uses your personal data for the following purposes:

• Account creation and management — to register your account, verify your identity, maintain your account credentials, and communicate important account notifications.
• Service delivery — to enable you to place bets, play games, make deposits and withdrawals, access promotions, and use all features of the merah888 Platform.
• Identity verification and KYC compliance — to satisfy our obligations under applicable anti-money laundering, counter-terrorist financing, and gaming licensing regulations before processing withdrawals.
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited conduct on the Platform.
• Responsible gaming — to administer deposit limits, session controls, cool-off periods, and self-exclusion requests, and to identify Accounts displaying patterns consistent with problem gambling.
• Customer support — to respond to your queries, resolve complaints, and improve our support processes.
• Platform improvement — to analyse usage patterns, test features, fix bugs, and improve the overall merah888 experience for Malaysian players.
• Marketing — subject to your consent and applicable law, to send you promotional information about merah888 offers, bonuses, and new games by email or SMS. You may withdraw marketing consent at any time.
• Legal and regulatory compliance — to comply with applicable laws, respond to lawful requests from authorities, and exercise or defend legal claims.

5. Legal Basis for Processing

merah888 processes your personal data on the following legal bases:

• Contractual necessity — processing required to perform the contract between you and merah888, including account operation, payment processing, and game delivery.
• Legal obligation — processing required to comply with applicable AML, KYC, gaming licensing, and data protection regulations.
• Legitimate interests — processing for fraud prevention, security, platform improvement, and responsible gaming monitoring, where these interests are not overridden by your rights.
• Consent — processing for direct marketing communications, where we have obtained your prior consent. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

merah888 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality obligations:

• Payment processors and e-wallet providers — Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, and USDT processing partners — to facilitate deposits and withdrawals.
• Identity verification and KYC providers — third-party services that assist merah888 in verifying Player identities and screening against sanctions lists.
• Game software providers — licensed game studios (e.g., Evolution Gaming, Pragmatic Play, PG Soft) that operate game sessions on the Platform. These providers may process technical and game session data to deliver game functionality.
• IT and cloud infrastructure providers — companies that provide server hosting, database management, and content delivery services on behalf of merah888.
• Regulatory authorities and law enforcement — where merah888 is required to disclose data by law, court order, or a request from a competent regulatory or law enforcement authority.
• Professional advisers — lawyers, accountants, and auditors, where necessary for the conduct of merah888's business and subject to professional confidentiality obligations.

Any third party that receives personal data from merah888 is required to handle it securely and in accordance with applicable data protection law and merah888's contractual requirements.

7. Cookies and Tracking Technologies

7.1 What Are Cookies

Cookies are small text files placed on your device when you visit the merah888 Platform. They allow the Platform to recognise your device across sessions, maintain your login state, and collect analytical data about usage patterns.

7.2 Types of Cookies We Use

• Strictly necessary cookies — essential for the Platform to function. These include session authentication cookies that keep you logged in. These cookies cannot be disabled.
• Functional cookies — remember your preferences (e.g., language settings, responsible gaming limits) to personalise your experience.
• Analytical cookies — collect aggregated data about how Players navigate the Platform. This data helps merah888 identify usability issues and improve the player experience.
• Marketing cookies — used, subject to your consent, to display relevant merah888 promotional content. These cookies do not track you across third-party websites.

7.3 Managing Cookies

You may configure your browser to refuse or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly, including maintaining your login session. For detailed browser-specific cookie management instructions, consult your browser's help documentation.

8. Data Retention

merah888 retains personal data for as long as your Account remains active and for a period thereafter as required by applicable law, gaming licensing obligations, and AML regulations. The following general retention periods apply:

• Account and identity data — retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction data — retained for a minimum of five (5) years following each transaction.
• Communications data — support transcripts and correspondence retained for three (3) years following resolution.
• Technical and usage data — retained for up to twenty-four (24) months on an aggregated or pseudonymised basis.

Where personal data is no longer required for the purpose for which it was collected and retention is not required by law, merah888 will securely delete or anonymise it.

9. Data Security

merah888 implements and maintains appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the merah888 servers.
• Encrypted storage of sensitive financial and identity data at rest.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular security audits and penetration testing by independent third parties.
• Multi-factor authentication requirements for administrative access to production systems.

Despite merah888's security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for the security of your own device and internet connection.

10. Your Data Protection Rights

Subject to applicable law, you have the following rights in respect of your personal data held by merah888. To exercise any of these rights, please submit a written request to [email protected].

merah888 will respond to all verified data rights requests within thirty (30) days. We may request proof of identity before processing a request.

11. International Data Transfers

The merah888 Platform is operated under international gaming licensing, and personal data may be processed by merah888 or its service providers in jurisdictions outside Malaysia. Where personal data is transferred outside of Malaysia, merah888 ensures that appropriate safeguards are in place — such as contractual data protection clauses — to protect your data in a manner equivalent to the protections afforded under applicable Malaysian data protection law.

12. Children's Privacy and the 21+ Restriction

The merah888 Platform is strictly intended for adults aged 21 years and above. merah888 does not knowingly collect personal data from individuals under the age of 21. If merah888 becomes aware that an Account has been registered by or for a person under 21, the Account will be immediately suspended, all data associated with the Account will be reviewed, and the matter handled in accordance with merah888's age verification and safeguarding obligations.

If you believe that a person under the age of 21 has registered an Account with merah888, please contact us immediately at [email protected].

13. Changes to This Privacy Policy

merah888 reserves the right to update this Privacy Policy at any time. Where changes are material, merah888 will provide notice to registered Players via the email address associated with their Account or through an on-Platform notification. The "Last updated" date at the top of this document indicates when the most recent version was published. Continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgment of the changes.

14. Contact and Complaints

For all privacy-related queries, data rights requests, or complaints, please contact merah888 in writing:

Email: [email protected]
Subject line: Privacy Request / Data Rights
Response time: Within 30 calendar days of receipt

If you are not satisfied with merah888's response to a privacy complaint, you may have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.