Privacy Policy —
How menang18 Protects Your Data

1. Introduction

This Privacy Policy ("Policy") describes how menang18 ("we", "us", "our", "the Platform") — the online gaming platform accessible at menang18.cam — collects, processes, stores, and protects the personal data of its users ("you", "User", "Player") in connection with the provision of our online casino, sports betting, and related gaming services.

menang18 is committed to handling personal data responsibly, in accordance with applicable international data protection standards and the requirements of our gaming licence. We take the privacy of our Malaysian and international users seriously and have designed our data practices around the principles of transparency, minimisation, and security.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together govern your use of the menang18 Platform.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information that identifies or could reasonably identify a living individual, directly or indirectly. This includes name, identification number, email address, IP address, financial data, and device identifiers.
• "Processing" — Any operation performed on personal data, including collection, storage, organisation, retrieval, use, disclosure, transmission, or deletion.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For this Policy, menang18 acts as the Data Controller in respect of User data.
• "Data Processor" — Any third party engaged by menang18 to process personal data on its behalf, including payment gateway operators, cloud hosting providers, and fraud detection services.
• "Cookies" — Small data files placed on a User's device by the Platform for functionality, analytics, and session management purposes.
• "KYC Data" — Identity verification documents and associated personal data collected as part of the Know Your Customer process, including copies of identification documents and proof of address.
• "Sensitive Data" — A subset of personal data warranting heightened protection, including financial details, government identification numbers, and any data relating to health (relevant in the context of responsible gambling assessments).

3. Personal Data We Collect

We collect personal data across several categories, each serving a defined purpose. The following sets out the types of data we collect from registered Players and visitors to the Platform:

4. How We Collect Your Data

We collect personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, or contacting our support team.
• Automated collection: Technical data such as IP address, device identifiers, and session data collected automatically when you access the Platform via cookies and server logs.
• Payment providers: Transaction confirmation data shared with us by payment processors including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong when you deposit or withdraw funds.
• Third-party verification services: Identity and address verification data returned by KYC processing services engaged to assist with document authentication.
• Fraud and AML detection systems: Risk signals and behavioural data generated by our fraud detection and anti-money-laundering monitoring tools as required by our licensing obligations.

5. How We Use Your Personal Data

menang18 processes your personal data solely for the following defined purposes. We do not use your data for any purpose incompatible with those listed below:

1. Account creation and management: To register, verify, and maintain your Account, including enforcing our one-account-per-player policy and age restriction requirements.
2. Service delivery: To provide access to casino games, sports betting markets (including Liga Super Malaysia, EPL, and UFC), lottery, and other Platform features.
3. Payment processing: To facilitate MYR deposits and withdrawals via your chosen payment method, including reconciliation, dispute handling, and fraud prevention.
4. Identity verification (KYC): To comply with our licensing obligations, verify your identity, confirm your age (21+), and meet anti-money-laundering requirements.
5. Responsible gambling monitoring: To identify patterns of problematic gambling behaviour, apply self-exclusion requests, and enforce deposit limits where requested.
6. Customer support: To handle your queries, complaints, and requests submitted via live chat, email, or other support channels.
7. Security and fraud prevention: To protect the Platform and its users from fraudulent activity, bonus abuse, account takeovers, and other security threats.
8. Legal compliance: To fulfil obligations under applicable law, including record-keeping requirements, regulatory reporting, and responses to lawful authority requests.
9. Platform analytics: To understand how users interact with the Platform, improve user experience, and optimise performance — using aggregated, anonymised data where possible.
10. Service communications: To send you account-related communications including transaction confirmations, security alerts, and policy updates.

6. Legal Basis for Processing

Our processing of your personal data is grounded in one or more of the following legal bases, depending on the purpose of processing:

• Contractual necessity: Processing required to perform the contract between you and menang18 — i.e., operating your Account and delivering gaming services.
• Legal obligation: Processing required to comply with applicable laws, including anti-money-laundering legislation, data retention requirements, and regulatory reporting obligations attached to our gaming licence.
• Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, security monitoring, platform analytics, and improving service quality, provided these interests are not overridden by your rights and freedoms.
• Consent: Where required by applicable law, we will seek your explicit consent before processing — for instance, before sending marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Third-Party Disclosure

menang18 does not sell your personal data to any third party. We may share your data with the following categories of recipients, strictly limited to what is necessary for the stated purpose:

• Payment service providers: Entities facilitating your MYR transactions, including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency processors. These parties receive only the data necessary to process your transaction.
• KYC and identity verification providers: Third-party services engaged to authenticate identity documents. Document data shared is subject to contractual data processing agreements.
• Fraud prevention and AML services: Specialist providers engaged to monitor transaction activity for signs of fraud or money laundering, as required under our licensing obligations.
• Cloud infrastructure and hosting providers: Providers of secure server infrastructure used to host the Platform and store data. All providers are bound by data processing agreements.
• Regulatory and law enforcement authorities: Where required by law, court order, or regulatory direction, we may disclose personal data to competent authorities. We will notify you where legally permissible to do so.
• Professional advisers: Lawyers, auditors, and accountants who require access to data in the course of providing professional services to menang18, bound by professional confidentiality obligations.

8. Data Retention Periods

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention guidelines apply:

• Account data: Retained for the duration of your active Account, and for a period of up to 5 years following account closure, to comply with anti-money-laundering record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from the date of account closure or last transaction, in accordance with international AML obligations.
• Transaction records: Financial transaction logs are retained for 7 years to support audit, dispute resolution, and regulatory compliance requirements.
• Support communications: Chat and email records retained for up to 3 years to support complaint handling and quality assurance processes.
• Technical/analytics data: Anonymised or aggregated analytics data may be retained indefinitely. Identifiable technical data (e.g., IP logs) is retained for up to 12 months.
• Marketing consent records: Retained for the duration of your consent or until withdrawn, plus a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

9. Security Measures

menang18 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and our servers
• Encryption at rest for sensitive data categories, including financial data and KYC documents
• Role-based access controls ensuring staff can only access data necessary for their specific function
• Two-factor authentication requirements for all administrative system access
• Regular penetration testing and security audits by independent third-party specialists
• Intrusion detection and real-time anomaly monitoring across all platform infrastructure
• Secure, encrypted backup systems with geographically distributed storage
• Staff data protection training and binding confidentiality obligations for all personnel

10. Cookies & Tracking Technologies

The menang18 Platform uses cookies and similar tracking technologies to support the functionality of the site, maintain your session, and improve user experience. The following categories of cookies may be used:

• Strictly necessary cookies: Essential for the Platform to function. These enable session management, authentication, and security features. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional cookies: Store your preferences such as language settings, display options, and remembered login details (where you have opted in to "Remember Me" functionality).
• Analytics cookies: Collect anonymised data about how users navigate the Platform, which pages are most visited, and how long sessions last. This data is used in aggregate form to improve Platform performance.
• Security cookies: Used by our fraud detection systems to identify suspicious access patterns and protect your account from unauthorised activity.

You may configure your browser settings to block or delete cookies. However, please note that disabling strictly necessary cookies may prevent the Platform from functioning correctly, and may prevent you from accessing your account. We do not use third-party advertising cookies or cross-site tracking cookies.

11. Your Data Subject Rights

Subject to applicable law and certain conditions, you hold the following rights in relation to your personal data held by menang18. We will respond to valid requests within 30 calendar days of receipt:

Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is used.

Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected.

Right to Erasure ("Right to Be Forgotten"): You may request that we delete your personal data where there is no longer a legitimate reason for us to retain it. Please note that certain data must be retained to comply with legal obligations (e.g., AML record-keeping requirements), even after account closure.

Right to Restriction: You may request that we suspend processing of your data in certain circumstances, such as while the accuracy of the data is contested.

Right to Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your data in a structured, machine-readable format.

Right to Object: You may object to processing carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.

To exercise any of these rights, please contact us via live chat or at [email protected]. We may require identity verification before processing your request.

12. Minors & Age Verification

The menang18 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. All accounts are subject to identity verification to confirm minimum age compliance.

In the event that we discover, through our KYC process or otherwise, that a registered User is under 21 years of age, we will immediately:

• Suspend and permanently close the Account
• Void all gameplay and transactions conducted while underage
• Arrange return of any deposited real-money funds
• Securely delete all personal data associated with the underage Account, except where retention is required by law

If you believe a minor has registered an account on the Platform, please contact us immediately at [email protected].

13. International Data Transfers

As an internationally licensed platform, menang18 may transfer personal data to, and process it in, countries outside Malaysia. When such transfers occur, we ensure that appropriate safeguards are in place to protect your data, including:

• Contractual clauses binding the recipient to equivalent data protection standards
• Transfers only to jurisdictions or organisations providing an adequate level of protection
• Assessment of the recipient country's legal framework before any transfer is approved

14. Amendments to This Privacy Policy

menang18 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. The date of the most recent revision is always indicated at the top of this page under "Last Updated".

Where changes are material — for example, where we introduce a new category of data collection or a new purpose for processing — we will notify registered users via their registered email address or through a prominent in-platform notification prior to the change taking effect.

Your continued use of the Platform after a revised Privacy Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any update, you should cease using the Platform and may request account closure.

15. Contact Us — Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us through the following channels: