Privacy Policy

1 Introduction

This Privacy Policy ("Policy") sets out how merah888 ("we", "us", "our", "the Platform") collects, processes, stores, shares, and protects the personal data of users ("you", "Player", "User") who access and use the merah888 online gaming platform available at https://merah888.cam and any related services, mobile interfaces, or promotional channels operated under the merah888 brand.

merah888 takes the privacy of its players seriously. We are committed to processing personal data in a lawful, fair, and transparent manner, and to implementing appropriate technical and organisational measures to protect your information against unauthorised access, loss, or disclosure.

This Policy applies to all personal data collected through your use of the merah888 platform, including data provided during account registration, identity verification, financial transactions, customer support interactions, and general platform activity. It applies equally to players accessing the platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations.

2 Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, contact details, identification documents, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, merah888.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller under contractual obligations.
• "Data Subject" means the identified or identifiable natural person whose personal data is being processed — in this context, you, the registered player.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for one or more specified purposes.
• "KYC" (Know Your Customer) means the identity verification process conducted in compliance with applicable anti-money laundering and gaming licensing requirements.
• "Cookies" means small text files placed on your device by websites to store information about your browsing activity and preferences.

3 Data Controller

merah888 acts as the Data Controller in respect of all personal data collected through the merah888 platform. As Data Controller, merah888 is responsible for determining the purposes for which your personal data is processed and for ensuring that such processing is carried out in accordance with this Policy and applicable data protection frameworks.

merah888 operates the platform under an international gaming licence. While merah888 processes data primarily in connection with its gaming and sports betting services, it also engages approved third-party Data Processors — including payment gateway providers, identity verification services, and technology infrastructure providers — to assist in delivering platform services. All such processors are contractually bound to process data only as instructed by merah888 and to maintain appropriate security standards.

4 Data We Collect

merah888 collects personal data from you through several channels, including data you provide directly during account registration and use of platform services, data generated automatically through your platform activity, and data obtained from third-party verification and payment service providers.

The following table summarises the categories of personal data we collect and the primary contexts in which they are gathered:

merah888 does not intentionally collect special categories of sensitive personal data (such as health data, biometric data, or racial/ethnic origin) unless such data is voluntarily provided by you in the context of a responsible gambling disclosure or a support request, in which case it will be handled with heightened confidentiality and used solely for the stated support purpose.

5 Purposes of Data Processing

merah888 processes your personal data for the following specific purposes:

1. Account Creation and Management: To create, maintain, authenticate, and manage your merah888 player account, including processing login credentials and account preferences.
2. Identity Verification (KYC): To verify your identity and age in compliance with our international gaming licensing obligations and to prevent fraudulent account creation.
3. Payment Processing: To process deposits and withdrawals in MYR through supported payment channels including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank, and to maintain accurate financial transaction records.
4. Platform Service Delivery: To provide live casino, sports betting, slots, and other gaming services accessible through your registered account.
5. Fraud Prevention and AML Compliance: To detect, investigate, and prevent fraudulent activity, money laundering, and other financial crime in compliance with international AML standards applicable under our gaming licence.
6. Responsible Gambling Monitoring: To monitor gaming behaviour for indicators of problem gambling and to enforce responsible gambling tools including deposit limits, loss limits, and self-exclusion measures.
7. Customer Support: To respond to your queries, complaints, and support requests in a timely and effective manner.
8. Legal and Regulatory Compliance: To comply with applicable laws, regulations, and our gaming licensing obligations, including record-keeping requirements.
9. Platform Improvement: To analyse platform usage data in aggregate form to improve the functionality, performance, and user experience of the merah888 platform.
10. Marketing Communications: To send promotional offers, bonus notifications, and platform updates to players who have provided explicit marketing consent. You may withdraw this consent at any time.

6 Legal Basis for Processing

merah888 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to perform the contract between you and merah888 — including account management, payment processing, and delivery of gaming services — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with applicable laws and our licensing obligations — including KYC identity verification, AML record-keeping, and age enforcement — is carried out on the basis of legal obligation.
• Legitimate Interests: Processing for purposes such as fraud prevention, platform security, and aggregate analytics is carried out on the basis of merah888's legitimate business interests, provided that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications and non-essential cookies is carried out on the basis of your explicit consent. You may withdraw consent for marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

merah888 does not sell, rent, or share your personal data with third parties for their own commercial marketing purposes. We share personal data only in the limited circumstances described below:

• Payment Service Providers: Financial transaction data is shared with our integrated payment processors — including FPX gateway operators, e-wallet providers (Touch 'n Go, Boost, GrabPay), and banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank) — solely to process your deposits and withdrawals.
• Identity Verification Providers: KYC documentation and identity data may be shared with third-party identity verification service providers engaged by merah888 to perform document authentication and liveness checks.
• Technology and Infrastructure Providers: Technical data and platform usage data may be processed by our hosting, cloud infrastructure, and cybersecurity service providers. All such providers operate under data processing agreements with merah888.
• Gaming Licence Authorities: We may be required to disclose player data to our gaming licence authority as part of regulatory audits, compliance reporting, or dispute resolution processes.
• Law Enforcement and Legal Authorities: We will disclose personal data to law enforcement agencies, regulators, or courts where required to do so by applicable law, court order, or in connection with the investigation of fraud, money laundering, or other criminal activity.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of merah888's business, your personal data may be transferred to the successor entity, subject to equivalent privacy protections.

8 International Data Transfers

As an internationally licensed gaming platform, merah888 may transfer your personal data to service providers and infrastructure partners located in countries outside your country of residence, including countries that may not provide the same level of statutory data protection as Malaysia.

Where personal data is transferred to third-party processors in other jurisdictions, merah888 ensures that appropriate safeguards are in place to protect your data, including contractual data processing agreements that require recipient parties to comply with data protection standards equivalent to those applied by merah888.

By registering an account and using the merah888 platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia in accordance with the safeguards described in this Policy.

9 Data Retention

merah888 retains personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable legal or regulatory obligations.

The following general retention periods apply:

• Account Data: Retained for the duration of your active account relationship with merah888, plus a minimum of five years following account closure to comply with AML record-keeping requirements.
• KYC Documentation: Retained for a minimum of five years from the date of verification, or such longer period as may be required by our gaming licence authority.
• Financial Transaction Records: Retained for a minimum of five years to comply with international financial record-keeping standards applicable under our gaming licence.
• Customer Support Communications: Retained for a period of two years following resolution of the relevant support interaction, unless the matter involves an ongoing dispute or legal proceeding.
• Technical and Usage Data: Typically retained for up to 12 months, after which it is anonymised or deleted.
• Marketing Preference Data: Retained until you withdraw consent or request erasure, or for up to three years following your last active marketing interaction.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data. Anonymised aggregate data may be retained indefinitely for statistical and analytical purposes.

10 Cookies & Tracking Technologies

merah888 uses cookies and similar tracking technologies on the platform to improve functionality, remember user preferences, and analyse platform usage. The following categories of cookies are used:

• Essential Cookies: Strictly necessary for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without impairing core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and account customisation options. These enhance the user experience but are not strictly necessary.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the platform — such as pages visited, session duration, and navigation patterns — to help us improve the platform experience.
• Responsible Gambling Cookies: Used to track and enforce deposit limits, session time reminders, and self-exclusion measures set by you within the responsible gambling tools section of your account.

You may manage your cookie preferences through your browser settings. Please note that disabling essential cookies will affect the functionality of the platform, including the ability to log in and maintain an authenticated session. Disabling non-essential cookies will not affect your ability to use core platform features.

11 Security Measures

merah888 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• Encryption: All data in transit between your device and the merah888 platform is protected by 256-bit SSL/TLS encryption. Sensitive personal data and payment information stored on our systems is encrypted at rest.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Employee access to player data is governed by role-based access control policies and is logged and audited.
• Two-Factor Authentication: merah888 offers optional two-factor authentication for player accounts to provide an additional layer of login security.
• Intrusion Detection: Our platform infrastructure is monitored by real-time intrusion detection and prevention systems designed to identify and respond to suspicious activity.
• Vulnerability Management: merah888 conducts regular security assessments, penetration testing, and software update cycles to address identified vulnerabilities promptly.
• Staff Training: All merah888 personnel who handle personal data receive regular training on data protection obligations and information security best practices.

While merah888 employs industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying merah888 promptly if you suspect that your account has been compromised.

12 Protection of Minors

The merah888 platform is strictly intended for adults aged 21 years and above. merah888 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process, and accounts found to have been registered by individuals under 21 will be immediately closed and any deposited funds returned.

If merah888 discovers that personal data has been collected from a person under the age of 21 without proper age verification having occurred, the relevant data will be deleted promptly and the account closed. If you are a parent or guardian and believe that a minor may have registered an account on merah888, please contact our support team immediately via live chat or the contact email provided in Section 16.

13 Your Rights as a Data Subject

Subject to applicable data protection frameworks and certain legal limitations, you hold the following rights in respect of your personal data held by merah888:

• Right of Access: You have the right to request a copy of the personal data that merah888 holds about you, along with information about how that data is being processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held by merah888. You may update certain account information directly through your Account settings at any time.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may require merah888 to retain certain data for a defined period following account closure.
• Right to Restriction of Processing: You have the right to request that merah888 restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where such processing is based on merah888's legitimate interests. merah888 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact merah888's data protection team using the contact details provided in Section 16 of this Policy. Requests will be acknowledged within 5 business days and substantively responded to within 30 calendar days. We may require verification of your identity before processing a data subject request.

14 Marketing Communications

Where you have provided explicit consent to receive marketing communications, merah888 may contact you via email, SMS, or in-platform notifications to inform you of promotional offers, bonus opportunities, new game launches, sports betting enhancements, and other platform updates relevant to your account.

You may withdraw your marketing consent and opt out of all promotional communications at any time through the following methods:

• Updating your communication preferences in the Account settings section of the platform.
• Clicking the unsubscribe link included in any marketing email sent by merah888.
• Contacting our customer support team via live chat or email and requesting removal from all marketing lists.

Please note that withdrawal of marketing consent does not affect the receipt of transactional and service communications that are necessary for the operation of your account — such as deposit confirmation notices, withdrawal processing updates, KYC verification requests, and responsible gambling tool confirmations. These service communications are not marketing in nature and are sent on the basis of contractual necessity.

15 Amendments to This Policy

merah888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in data protection law, licensing requirements, or our internal data processing practices. Where a material change is made to this Policy, merah888 will provide reasonable advance notice through a prominent platform notification or by email to the address registered to your account.

The version of this Policy bearing the most recent "Last Updated" date at the top of this page supersedes all prior versions. We recommend reviewing this Policy periodically to remain informed of how your personal data is being handled. Your continued use of the merah888 platform following the effective date of any amendment constitutes acceptance of the revised Policy.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or merah888's data processing activities — including requests to exercise your data subject rights — please contact our team through the following channels:

For responsible gambling related enquiries, including self-exclusion requests, deposit limit adjustments, or access to problem gambling support resources, please visit our dedicated Responsible Gambling page for full information on available tools and support options.