Privacy Policy — MCD88

Section 01

Introduction

This Privacy Policy ("Policy") issued by the operator of the MCD88 platform ("MCD88", "we", "us", or "our"), accessible at mcd88.click and any associated subdomains or mobile-optimised interfaces (collectively, the "Platform"). It describes how MCD88 collects, receives, uses, stores, shares, transfers, and otherwise processes personal data relating to individuals who visit, register on, or otherwise interact with the Platform ("you", "User", or "Member").

MCD88 is committed to handling personal data responsibly and in accordance with applicable data protection principles. By registering an account, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. Where this Policy conflicts with any other document, this Policy shall govern matters of personal data processing.

Section 02

Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person. This includes name, email address, phone number, payment details, device identifiers, and IP address, among others.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" — MCD88, as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — any third party that processes Personal Data on behalf of MCD88 pursuant to a data processing agreement, such as payment service providers and KYC verification partners.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose.
• "Sensitive Personal Data" — Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, health data, biometric data, or data concerning criminal convictions and offences.
• "Cookies" — small text files placed on your device by the Platform for the purposes of session management, analytics, preference retention, and targeted communications.

Section 03

Personal Data We Collect

MCD88 collects Personal Data from multiple sources and across various stages of your interaction with the Platform. The categories of data we collect are described below.

3.1 Data Provided Directly by You

When you register an Account, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions, you may provide the following data:

3.2 Data Collected Automatically

When you access or use the Platform, certain technical and behavioural data is collected automatically through cookies, log files, and similar technologies:

• IP address and approximate geolocation derived from IP;
• Browser type, version, and language settings;
• Operating system and device type (desktop, mobile, tablet);
• Pages visited, session duration, click paths, and navigation patterns;
• Referring URL (the page that directed you to the Platform);
• Game play logs, wager history, and associated timestamps;
• Login timestamps and failed authentication attempts.

3.3 Data from Third Parties

MCD88 may receive Personal Data about you from third parties in the following circumstances:

• Payment Processors: Transaction confirmation data from Touch'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank (via FPX and DuitNow), and USDT TRC20 network confirmations;
• KYC/AML Providers: Identity verification results, sanctions screening outcomes, and politically exposed person (PEP) check results from our third-party verification partners;
• Fraud Detection Partners: Risk scores and fraud indicators to protect the integrity of our platform and all Members' accounts.

Section 04

Data Processing & Purposes

MCD88 processes your Personal Data for specific, defined purposes. The table below summarises the primary processing activities, the data involved, and the applicable legal basis:

Section 05

Legal Basis for Processing

MCD88 relies on one or more of the following legal bases when processing your Personal Data:

5.1 Contract Performance

Where processing is necessary to perform the contract between you and MCD88 (i.e., the provision of the Platform and associated services), we process your data on the basis of contractual necessity. This applies to account creation, deposit and withdrawal processing, game delivery, and customer support.

5.2 Legal Obligation

Where processing is required to comply with applicable laws, regulations, or regulatory directions — including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and responsible gambling directives — MCD88 processes your data on the basis of legal obligation. We are not able to waive or limit this processing at your request.

5.3 Legitimate Interests

Where processing serves the legitimate interests of MCD88 or a third party, and those interests are not overridden by your fundamental rights and freedoms, we process data on the basis of legitimate interests. This applies to fraud prevention, platform security, internal analytics, and service improvement activities. MCD88 conducts a legitimate interests assessment (LIA) for each relevant processing activity to ensure the balance test is satisfied.

5.4 Consent

Where processing is based on your consent — principally for marketing communications and non-essential cookie placement — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. You may withdraw marketing consent by contacting our support team or using the unsubscribe mechanism in any promotional communication.

Section 06

Data Sharing & Disclosure

MCD88 does not sell, rent, or trade your Personal Data. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

6.1 Service Providers (Data Processors)

MCD88 engages veted third-party service providers to process data on our behalf. These providers are bound by data processing agreements that impose obligations equivalent to those in this Policy. Categories of processors include:

• Payment processors — Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank (FPX/DuitNow), and cryptocurrency network operators (USDT TRC20);
• KYC and identity verification — third-party identity document verification and sanctions screening providers;
• Fraud prevention — risk management and fraud detection platforms;
• Cloud infrastructure — hosting, database, and content delivery network (CDN) providers;
• Customer support tooling — live chat and ticketing systems.

6.2 Regulatory and Law Enforcement Authorities

MCD88 may disclose Personal Data to regulatory bodies, law enforcement agencies, courts, or government authorities where required to do so by applicable law, court order, or formal regulatory request. MCD88 will, where legally permissible, inform you of such a disclosure.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of MCD88's assets, your Personal Data may be transferred to the successor entity as part of the transaction. You will be notified of any such transfer via a prominent notice on the Platform or by email to your registered address prior to your data becoming subject to a different Privacy Policy.

Section 07

International Data Transfers

MCD88 operates a globally distributed technical infrastructure. As a result, your Personal Data may be stored on or transmitted through servers located outside of Malaysia. Where Personal Data is transferred internationally, MCD88 takes appropriate steps to ensure that the transfer is subject to adequate safeguards, which may include:

• Data processing agreements that incorporate internationally recognised data protection clauses;
• Transfer to jurisdictions that provide an adequate level of data protection as recognised by applicable authorities;
• Implementation of appropriate technical and organisational security measures at the receiving location.

For Malaysian members, data relating to payment processing via Maybank, CIMB, Public Bank, Hong Leong Bank, and DuitNow is processed within Malaysia's domestic banking infrastructure to the extent possible, subject to those institutions' own technical architectures.

Section 08

Data Retention

MCD88 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. The following general retention principles apply:

• Active Account Data: Retained throughout the period your Account remains open and active on the Platform.
• Transaction Records: Retained for a minimum of five (5) years following the date of the relevant transaction, in accordance with applicable AML record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years following Account closure or the date of the last transaction, whichever is later.
• Support Communications: Retained for three (3) years from the date of the relevant interaction, unless linked to an ongoing dispute or regulatory investigation.
• Marketing Data: Retained until you withdraw consent or until the data is no longer required for the purpose which consent was given, whichever is earlier.
• Log Files and Technical Data: Typically retained for twelve (12) months on rolling basis, unless a security investigation or legal obligation requires extended retention.

Following the expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to any individual.

Section 09

Data Security

MCD88 implements a comprehensive set of technical and organisational measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and MCD88 servers is encrypted using 256-bit SSL/TLS protocols;
• Encryption at Rest: Sensitive Personal Data stored in our databases is encrypted using AES-256 or equivalent standard;
• Access Controls: Personal Data is accessible only to authorised personnel on a strict need-to-know basis, enforced through role-based access controls;
• Multi-Factor Authentication: Internal systems holding Personal Data are protected by multi-factor authentication requirements;
• Regular Security Audits: MCD88 conducts periodic security assessments, penetration testing, and vulnerability scans of its technical infrastructure;
• Incident Response: A documented data breach response plan is maintained, including defined escalation procedures and member notification protocols.

Section 10

Cookies & Tracking Technologies

MCD88 uses cookies and similar tracking technologies (collectively, "Cookies") on the Platform. Cookies are small text files stored on your device that help us deliver a better, more personalised experience. The categories of Cookies we use are described below:

10.1 Strictly Necessary Cookies

These Cookies are essential for the Platform to function and cannot be disabled. They enable core functionality such as session management (keeping you logged in), shopping cart functionality, and security features. No consent is required for these Cookies.

10.2 Performance and Analytics Cookies

These Cookies collect anonymised or pseudonymised information about how visitors use the Platform — which pages are most visited, where users encounter errors, and how navigation flows are used. This data is used solely to improve the Platform. These Cookies require your consent where applicable.

10.3 Functionality Cookies

These Cookies remember choices you make (such as your language preference or game lobby display settings) to provide a more personalised experience. They do not track your browsing activity outside of the MCD88 Platform.

10.4 Managing Your Cookie Preferences

You may manage your Cookie preferences at any time through your browser settings. Most modern browsers allow you to refuse Cookies, delete existing Cookies, or receive a notification before a Cookie is placed. Please note that disabling certain Cookies may affect the functionality of the Platform. Instructions for managing Cookies in popular browsers are available through those browsers' respective help documentation.

Section 11

Your Data Rights

Subject to applicable law and the specific circumstances of your request, you hold the following rights in relation to your Personal Data held by MCD88. To exercise any of these rights, please contact our support team via live chat or email with a clear description of your request. We will respond within thirty (30) calendar days.

Section 12

Minors & Age Policy

The MCD88 Platform is strictly intended for individuals aged21 years and above. MCD88 does not knowingly collect Personal Data from individuals below this age threshold. Age verification is a mandatory component of the KYC process, and any Account found to belong to an individual below the minimum age will be immediately suspended and any associated data handled in accordance with our legal obligations.

If you are a parent or guardian and believe that your child has registered an Account or provided Personal Data on the Platform, please contact us immediately via live chat or our support email address. We will investigate the matter promptly and take appropriate action, including the deletion of any data collected from the minor and the closure of any associated Account.

Section 13

Third-Party Links & Services

The Platform may contain references to or integrations with third-party services, including payment gateways (Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow/FPX) and game content providers. When you interact with these third-party services, you do so subject to their own privacy policies and terms of service, over which MCD88 has no control.

MCD88 is not responsible for the privacy practices or content of any third-party service. We encourage you to review the privacy policies of any third party with whom you interact through or in connection with the Platform. The inclusion of a payment method or service on the Platform does not constitute an endorsement of that party's data practices.

Section 14

Policy Amendments

MCD88 reserves the right to amend, update, or replace this Privacy Policy at any time. Where amendments are material — meaning they alter the nature, scope, or purpose of personal data processing in a way that may be to your detriment — we will notify you via a prominent notice on the Platform or by email to your registered address at least fourteen (14) days prior to the change taking effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically to remain informed of our current data practices. Your continued use of the Platform following any amendment constitutes your acceptance of the revised Policy.

If you disagree with any amendment to this Policy, you should cease using the Platform and contact our support team to exercise any applicable rights regarding your Personal Data, including the right to erasure where no mandatory retention obligation applies.

Section 15

Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact MCD88 through the following channels:

• Live Chat: Available 24/7 on the Platform — recommended for fastest response. Average wait time: 3–5 minutes. Available in English, Bahasa Melayu, and Mandarin Chinese.
• Email: [email protected] (plain text — not a clickable link). Include "Privacy Enquiry" in the subject line for routing to the appropriate team. Response within 48–72 hours for privacy-related requests.

When submitting a request to exercise any of the data rights described in Section 11, please include your registered Account username or email address and a clear description of your request. Identity verification may be required before we can process certain requests, to ensure the security of your data and the accuracy of our response.