Mr8 Privacy Policy – Data Protection Your Privacy Is Our Priority

1 Introduction

Mr8 ("we", "Platform", or "mr8") respects the privacy of all users and members of our platform. This Privacy Policy explains in detail how we collect, use, disclose, store, and protect your personal information when you use our website, mobile app, and all services offered under the mr8 brand.

This document is prepared in accordance with the requirements of the Malaysia Personal Data Protection Act (PDPA) 2010 and international data protection standards. We believe transparency is the foundation of trust, and we are committed to ensuring you always know how your data is managed.

This policy applies to all individuals who access or use the mr8 platform, including unregistered visitors, registered members, and former members whose data remains in our system.

2 Data We Collect

Mr8 collects various types of personal information for legitimate purposes in order to provide quality services to our members. The data collected covers the following categories:

Registration & Identity Data:

• Full name as stated on official identification documents
• Date of birth and gender
• Identity card number (MyKad) or passport number
• Email address and mobile number
• Passwords stored in encrypted (hashed) format

Financial & Payment Data:

• Bank account holder name and bank account number
• Bank name and branch code
• Deposit and withdrawal transaction history
• Registered e-wallet details (Touch 'n Go, GrabPay, and others)

Usage & Technical Data:

• IP address and approximate geolocation data
• Device type, operating system, and app version
• Login history and session activity
• Game behaviour data and betting records
• Cookie data and device identifiers

KYC (Identity Verification) Data:

• Copy of submitted identity document
• Copy of bank statement or proof of address
• Selfie image for facial verification (if requested)

3 How We Use Your Data

All data collected by mr8 is used solely for legitimate, stated purposes. We do not use your data for any other purpose without your prior consent:

• Account Management: Create and manage your member account, including the registration process, identity verification, and account recovery.
• Transaction Processing: Process deposits, withdrawals, and all financial transactions accurately and securely.
• Security & Fraud Prevention: Detect and prevent fraudulent activity, money laundering, and unauthorised access to your account.
• Legal Compliance: Fulfil applicable legal and regulatory obligations, including reporting requirements to the relevant authorities.
• Customer Support: Provide technical support and address your enquiries or complaints effectively.
• Service Improvement: Analyse aggregated (non-individual) usage patterns to improve the platform and user experience.
• Marketing Communications: Send information about promotions, bonuses, and exclusive offers — only if you have agreed to receive them.
• Responsible Gaming: Monitor gameplay patterns to identify signs of problem gambling and offer appropriate assistance.

4 Sharing Information with Third Parties

Mr8 does not sell, rent, or trade members' personal data to any party for commercial purposes. However, we may share certain information in the following limited situations:

• Service Providers: Third parties that help us operate the platform — such as payment providers, game software providers, and cloud service providers — are all bound by strict confidentiality agreements.
• Legal Requirements: When required by law or court order, we may be obligated to disclose information to the relevant authorities.
• Crime Prevention: In cases involving fraud, money laundering, or other financial crimes, we will cooperate fully with law enforcement agencies.
• Business Transfers: In the event of a merger, acquisition, or asset transfer, user data may be transferred — but you will be notified in advance.

5 Data Security

Protecting your personal data is mr8's highest priority. We implement multiple layers of technical and organizational security controls to safeguard your information against unauthorized access, disclosure, modification, or destruction:

• Data Encryption in Transit: All communications between your device and our servers are secured by TLS 1.3 protocol with 256-bit SSL certificates.
• Data Encryption at Rest: Sensitive data such as banking information and KYC documents is encrypted at rest within our database.
• Two-Factor Authentication (2FA): We provide and encourage the use of 2FA on all accounts for an added layer of security.
• Continuous Monitoring: Our systems are monitored 24 hours a day, 7 days a week to detect any unusual activity or intrusion attempts.
• Regular Security Audits: Penetration testing and security audits are conducted regularly by independent security experts.
• Internal Access Controls: Access to member data by mr8 staff is restricted on a need-to-know basis.

While we make every effort to protect your data, no security system can be guaranteed 100% secure. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities within the timeframe required by law.

6 Cookie Policy

Mr8 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. The following are the types of cookies we use:

You can manage or delete cookies at any time through your web browser settings. Please note that disabling certain cookies may affect platform functionality. Essential cookies cannot be disabled as they are required for security and core platform operations.

7 International Data Transfers

In the course of its operations, mr8 may need to store or process your personal data outside Malaysia, particularly for cloud infrastructure services and international technology providers we engage.

Any such data transfers are carried out with adequate safeguards to ensure a level of protection equivalent to that provided under Malaysia's PDPA, including:

• Use approved standard contractual clauses for international data transfers
• Ensure that data recipients in other countries are subject to equivalent data protection laws
• Execute data processing agreements with all third-party service providers

8 Data Storage & Deletion

Mr8 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by applicable law.

• Active Account Data: Retained for the duration that your account remains active on the mr8 platform.
• Post-Account Closure Data: Certain information such as transaction records and KYC documents are retained for a minimum of 7 years after account closure, in accordance with financial and anti-money laundering legal requirements.
• Security Logs: Retained for 90 days for security investigation and audit purposes.
• Marketing Data: Deleted within 30 days of you withdrawing consent for marketing communications.

When data is no longer needed and there is no legal obligation to retain it, mr8 will securely delete or anonymise it using industry-recognised disposal methods.

9 Your Rights as a User

As a data subject under Malaysia's PDPA, you have certain rights regarding your personal data held by mr8. Below is a summary of your rights:

To exercise any of the above rights, please contact our privacy team via live chat or mr8's official email. We will process your request within 30 business days. Please note that certain requests may be subject to specific legal limitations.

10 Changes to This Privacy Policy

Mr8 reserves the right to modify, update, or amend this Privacy Policy at any time to reflect changes in our operational practices, new legal requirements, or improvements in how we protect your data.

When we make significant changes to this policy, we will notify you via:

• Pop-up notifications or banners within the mr8 platform
• Email to the address registered in your account
• Prominent announcements on our website's home page

The "Updated" date at the top of this document reflects the date of the most recent changes. We encourage you to review this page periodically to stay informed of our latest privacy practices.

Continued use of the mr8 platform after policy changes take effect constitutes acceptance of the latest version of this Privacy Policy.

11 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the mr8 privacy team is ready to assist you.

This Privacy Policy takes effect from January 2026 and supersedes all previous versions.