Privacy Policy

1Introduction

This Privacy Policy ("Policy") is published by Merah88 ("we", "us", "our", "Platform"), the operator of the online casino and sports betting platform accessible at merah88.cam. This Policy describes how Merah88 collects, uses, stores, shares, and protects the personal data of users ("User", "you", "your") who access or use our services.

Merah88 provides its services to Malaysian players and other eligible users across the region, accepting payments in Malaysian Ringgit (MYR) via locally recognised payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank, as well as major cryptocurrency networks. The nature of these services requires us to collect and process certain personal and financial data in order to operate safely and in compliance with our licensing obligations.

By registering an account on Merah88 or continuing to use the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the platform immediately.

2Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, email address, residential address, national identity number, payment details, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, the Data Controller is Merah88.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement.
• "KYC Data" means identity verification documents and information submitted by Users pursuant to Merah88's Know Your Customer requirements, including government-issued identification, proof of address, and supporting photographs.
• "Cookies" means small text files stored on a User's device by the platform for the purposes of session management, analytics, and user experience improvement.
• "Service" means the Merah88 platform, website, games, sports betting markets, and all associated features and functionalities accessible at merah88.cam.

3Data We Collect

Merah88 collects personal data through several channels: information provided directly by you during registration and account use, information collected automatically through your use of the platform, and information received from third-party service providers involved in payment processing and identity verification.

4How We Use Your Data

Merah88 processes your personal data for the following purposes:

• Account administration — creating, maintaining, and managing your Merah88 account, including password reset and account recovery processes;
• Identity verification and KYC compliance — verifying that you meet eligibility requirements including the 21+ age requirement and are not located in a Prohibited Jurisdiction;
• Payment processing — facilitating deposits and withdrawals via your chosen payment method, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency networks;
• Anti-money laundering (AML) and fraud prevention — monitoring transactions and account activity for suspicious patterns and complying with our obligations under applicable AML frameworks;
• Customer support — responding to your queries, complaints, and requests via live chat and email support;
• Regulatory compliance — meeting our obligations under international gaming licensing requirements and applicable data protection legislation;
• Platform improvement — analysing usage data to improve platform performance, user interface, and game selection;
• Responsible gambling — monitoring play patterns that may indicate problem gambling behaviour, and administering deposit limits, cooling-off periods, and self-exclusion requests;
• Marketing communications — sending promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may opt out at any time via your Account settings or by contacting support.

5Legal Basis for Processing

Merah88 processes your personal data on the following legal grounds:

6Data Sharing & Disclosure

Merah88 does not sell, rent, or trade your personal data to any third party for independent commercial use. We share personal data with third parties only in the circumstances listed below, and only to the extent necessary for the specified purpose.

• Payment processors and gateway providers — we share transaction data with our payment service partners (including operators of e-wallet networks, FPX infrastructure, bank transfer systems, and cryptocurrency processing services) solely for the purpose of processing your deposits and withdrawals;
• Identity verification service providers — we share KYC documentation with our identity verification platform partners for the purpose of conducting document authenticity checks;
• Game content providers — aggregated, non-personally identifiable data relating to game sessions may be shared with our licensed game studio partners for regulatory reporting purposes;
• Regulatory and law enforcement authorities — we may be required to disclose personal data to licensing regulators, law enforcement agencies, or courts of competent jurisdiction where required by applicable law or a valid legal order;
• Professional advisers — legal counsel, auditors, and compliance consultants may access personal data on a strictly confidential basis in connection with the provision of their professional services to Merah88.

7Cookies & Tracking Technologies

Merah88 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies we use are described below.

• Strictly Necessary Cookies — these cookies are essential for the platform to function and cannot be disabled. They include session authentication cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery (CSRF) attacks.
• Analytics Cookies — these cookies collect anonymous, aggregated data about how users interact with the Merah88 platform, including pages visited, time on page, and error events. This data is used solely to improve platform performance and does not identify individual users.
• Functional Cookies — these cookies remember your preferences such as language settings and previously selected payment methods, providing a more personalised experience on return visits.

Merah88 does not use third-party advertising or cross-site tracking cookies. You can control cookie settings through your browser preferences. Please note that disabling strictly necessary cookies may impair your ability to use the platform.

8Data Retention

Merah88 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, and for as long as is required by our regulatory and legal obligations. The general retention periods applicable to key data categories are as follows:

• Account Data — retained for the duration of your account plus a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations;
• KYC Documents — retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later;
• Transaction Records — retained for a minimum of five (5) years from the date of the relevant transaction;
• Technical Logs — retained for up to twelve (12) months for security and fraud investigation purposes, after which they are anonymised or deleted;
• Support Communications — retained for up to three (3) years from the date of the last communication, or until any associated dispute is resolved, whichever is later.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

9Data Security

Merah88 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: all data exchanged between your browser or app and Merah88 servers is encrypted using TLS 1.2 or higher. The presence of HTTPS in your browser address bar confirms active encryption;
• Encryption at rest: personal data stored in Merah88 databases and file systems is encrypted using AES-256 encryption;
• Access controls: access to personal data is restricted to authorised personnel on a strictly need-to-know basis, enforced through role-based access control and multi-factor authentication for administrative systems;
• Intrusion detection and monitoring: platform infrastructure is subject to continuous automated security monitoring, with alerts for anomalous access patterns or potential data exfiltration;
• Penetration testing: Merah88 commissions periodic external security assessments of its platform infrastructure.

10Your Rights

Subject to applicable law and regulatory constraints, you have the following rights in relation to your personal data held by Merah88. To exercise any of these rights, please submit a written request to our support team using the contact details in Section 14. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days.

11Minors & Age Restriction

Merah88 is strictly for users aged 21 years and above. The platform does not knowingly collect or process personal data belonging to persons under the age of 21. Age verification is conducted as part of the KYC process for all registered users prior to the activation of withdrawal privileges.

In the event that Merah88 becomes aware that personal data has been collected from an individual under the age of 21, the relevant account will be suspended immediately, and all personal data associated with that account will be securely deleted in accordance with applicable law, except where retention is required for regulatory compliance or law enforcement purposes.

12International Data Transfers

Merah88 operates globally and may transfer your personal data to servers and service providers located outside of Malaysia. Where such international transfers occur, Merah88 takes appropriate steps to ensure that your data is afforded a level of protection consistent with internationally recognised data protection standards, including through the use of contractual safeguards with our Data Processors.

By using the Merah88 platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia in connection with the operation of our services.

13Changes to This Policy

Merah88 reserves the right to update or modify this Privacy Policy at any time. When material changes are made, we will notify registered users via email to the address registered on their Account, and we will update the "Last Updated" date at the top of this page.

Your continued use of the Merah88 platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should close your account and cease using the platform before the effective date of the revised Policy.

14Contact Us

For privacy-related enquiries, data access requests, complaints, or any other matter relating to this Privacy Policy, please contact the Merah88 privacy team using the details below. All privacy matters are treated with strict confidentiality.

We aim to acknowledge all privacy requests within 5 business days and to provide a substantive response within 30 calendar days. For complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

Merah88 serves players across Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and Kota Kinabalu — and our support team is available in English to assist with any privacy-related concerns.