Privacy Policy

Mahkota8 ("we", "us", "our") operates the online sports betting and casino gaming platform accessible at mahkota8.cam. This Privacy Policy ("Policy") sets out in detail how Mahkota8 collects, receives, uses, stores, shares, transfers, and protects the personal information of all individuals who access or use our Platform, including registered players, account applicants, and website visitors (collectively referred to as "you", "your", "User", or "Player").

Mahkota8 serves a substantial player base across Malaysia, including major cities such as Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and surrounding areas. We handle personal data responsibly and in compliance with applicable international data protection standards and the regulatory requirements of the jurisdictions in which we operate.

This Policy applies to all personal data collected through: the mahkota8.cam website; any mobile-optimised version of our Platform; our customer support channels including live chat and email; and any other interaction you have with Mahkota8 as an organisation.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — Mahkota8, the entity that determines the purposes and means of processing personal data.
• "Data Processor" — any third party that processes personal data on behalf of Mahkota8 under a contractual arrangement, such as payment processing partners or KYC verification service providers.
• "KYC" — Know Your Customer; the identity and address verification process required by anti-money laundering regulations and responsible gambling compliance obligations.
• "Cookies" — small text files stored on your device by the Platform to enable functionality, improve performance, and support analytics.
• "Platform" — the mahkota8.cam website and all associated services, interfaces, and systems operated by Mahkota8.
• "Sensitive Personal Data" — a subset of personal data warranting heightened protection, including identity document numbers, financial account details, and biometric data where applicable.

Mahkota8 collects the following categories of personal data:

3.1 Registration & Account Data

• Full legal name as it appears on government-issued identification.
• Date of birth (to verify the 21+ age requirement).
• Email address and mobile phone number.
• Username and encrypted password.
• Preferred currency (Malaysian Ringgit — MYR / RM is the default for Malaysian players).
• Country and city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya).

3.2 Identity Verification (KYC) Data

• Copy of a valid government-issued ID: Malaysian MyKad (front and back), Passport, or Driver's Licence.
• Proof of address document: utility bill, bank statement, or official letter dated within three months.
• Selfie photograph holding your ID, used solely to confirm document ownership.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers.
• Payment method details: e-wallet account references (Touch 'n Go eWallet, Boost, GrabPay), FPX bank reference codes, DuitNow transfer identifiers, Maybank / CIMB / Public Bank account last-four digits (where required for reconciliation).
• Cryptocurrency wallet addresses used for BTC or USDT transactions.
• Bonus and promotional credit records.

3.4 Usage & Behavioural Data

• Betting history, game session logs, and wagering patterns.
• Login timestamps, IP addresses, and device identifiers.
• Pages visited, features used, and time spent on the Platform.
• Customer support interaction records, including live chat transcripts and email correspondence.

3.5 Technical Data

• Browser type and version, operating system, and device type.
• Referring URL and exit pages.
• Session duration and click-stream data.

Mahkota8 collects personal data through the following mechanisms:

4.1 Direct Collection

Data you provide directly to Mahkota8 during the account registration process; KYC document submission; payment and withdrawal requests; completion of responsible gambling tools (deposit limit settings, self-exclusion requests); customer support interactions via live chat, email, or messaging channels.

4.2 Automated Collection

When you use the Platform, certain data is collected automatically through technical systems including server logs, cookies, pixel tags, and analytics tools. This includes your IP address, device fingerprint, session data, and browsing behaviour on the Platform.

4.3 Third-Party Sources

Mahkota8 may receive supplementary data from authorised third-party sources, including: identity verification and fraud screening service providers used to support KYC processes; payment processing partners for transaction confirmation and fraud detection; publicly available regulatory watchlists used for AML (anti-money laundering) compliance screening.

Mahkota8 processes personal data only where a valid legal basis exists under applicable data protection law. The following legal bases apply to our principal processing activities:

• Performance of a Contract: Processing your account data, transaction records, and KYC information is necessary to provide you with the Services you have registered for and to fulfil our contractual obligations to you.
• Legal Obligation: Mahkota8 is required by anti-money laundering regulations, responsible gambling compliance requirements, and applicable financial regulations to collect and retain certain categories of personal data, including KYC documentation and transaction records.
• Legitimate Interests: Mahkota8 processes certain usage and technical data on the basis of legitimate interests, including fraud prevention, platform security, product improvement, and business analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: For optional processing activities — such as marketing communications, promotional notifications, and non-essential cookies — Mahkota8 relies on your express consent. You may withdraw consent for these activities at any time.

Mahkota8 uses your personal data for the following purposes:

6.1 Account Management & Service Delivery

• Creating, maintaining, and managing your Mahkota8 account.
• Processing deposits and withdrawals through your preferred Malaysian payment methods, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, BTC, and USDT.
• Delivering the sports betting, live casino, slots, lottery, arcade, and esports services available on the Platform.
• Administering VIP tier membership, birthday bonuses, referral rewards, and other loyalty programme benefits.

6.2 Regulatory Compliance & Fraud Prevention

• Conducting identity verification (KYC) as required by anti-money laundering and responsible gambling regulations.
• Screening against applicable AML watchlists and sanctions databases.
• Detecting, investigating, and preventing fraudulent transactions, bonus abuse, multi-accounting, and other prohibited conduct.
• Enforcing age restrictions (21+ minimum) and self-exclusion programmes.

6.3 Platform Improvement & Analytics

• Analysing aggregated usage patterns to improve Platform performance, usability, and game content.
• Conducting A/B testing and user experience research to enhance the betting and gaming experience.
• Monitoring platform stability, server performance, and security integrity.

6.4 Customer Support

• Providing assistance in English, Bahasa Melayu, and Mandarin through live chat, email, and other support channels.
• Maintaining records of support interactions for training, quality assurance, and dispute resolution purposes.

Mahkota8 does not share your personal data with third parties except in the following limited, controlled circumstances:

7.1 Authorised Service Providers (Data Processors)

We engage third-party service providers who act as Data Processors under binding contractual agreements that require them to handle your data solely for the purposes specified by Mahkota8 and in compliance with applicable data protection standards. These categories of processors include:

• Payment processing partners facilitating DuitNow, FPX, e-wallet, bank transfer, and cryptocurrency transactions.
• Identity verification (eKYC) service providers who verify the authenticity of identity documents submitted during the KYC process.
• Cloud infrastructure and hosting service providers who store Platform data in secure data centres.
• Fraud detection and AML screening technology providers.
• Customer support platform providers (for live chat and ticketing systems).
• Analytics and platform performance monitoring tools.

7.2 Legal & Regulatory Disclosure

Mahkota8 may disclose personal data to competent regulatory authorities, law enforcement agencies, or courts when required to do so by applicable law, court order, or regulatory directive. Such disclosures are made only to the extent necessary to comply with the specific legal obligation.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Mahkota8's assets, personal data held by Mahkota8 may be transferred to the relevant successor entity, subject to the same level of data protection as described in this Policy. Affected players will be notified of any such transfer.

The Mahkota8 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to improve performance, and to support analytics. The following types of cookies are used:

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features, including your account and payment processing.

Mahkota8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account Data: Retained for the duration of the active account relationship and for a minimum period of five (5) years following account closure, as required by applicable AML and regulatory record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of the last transaction or account activity, in accordance with AML retention requirements.
• Transaction Records: Retained for a minimum of seven (7) years for financial audit and regulatory compliance purposes.
• Usage & Behavioural Data: Retained for up to twenty-four (24) months from the date of collection, after which it is aggregated or anonymised.
• Customer Support Records: Retained for up to three (3) years from the date of the interaction.
• Marketing Consent Records: Retained for the period of the consent relationship plus three (3) years as evidence of valid consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with industry best practices.

Mahkota8 implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security programme includes:

• Encryption: All data transmitted between your device and the Mahkota8 Platform is encrypted using 256-bit SSL/TLS protocols. Data at rest in our storage systems is encrypted using industry-standard AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorised Mahkota8 personnel and Data Processors on a strict need-to-know basis. All internal access is logged and audited.
• Two-Factor Authentication (2FA): Available to all registered Players as an additional layer of account security. Mahkota8 strongly recommends enabling 2FA on your account.
• Fraud Monitoring: A dedicated 24/7 fraud monitoring system continuously analyses transaction patterns and account activity to detect and respond to suspicious behaviour in real time.
• Penetration Testing: Regular third-party security assessments and penetration testing are conducted to identify and remediate vulnerabilities in Platform infrastructure.
• Incident Response: Mahkota8 maintains a documented data breach incident response plan. In the event of a data breach affecting your personal data, we will notify affected Players and relevant regulatory authorities within the timeframes required by applicable law.

Subject to applicable data protection law, you hold the following rights over your personal data held by Mahkota8. To exercise any of these rights, please contact our support team via live chat or by email at support@mahkota8.cam with your account details and a clear description of your request.

• Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held by Mahkota8.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Restriction: You may request that Mahkota8 restrict the processing of your personal data in certain circumstances, for example while a correction request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the processing of your personal data where Mahkota8 relies on legitimate interests as the legal basis, including processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Mahkota8 will respond to all valid data rights requests within 30 days of receipt. Complex requests may require up to 60 days, in which case we will notify you of the extended timeframe. Mahkota8 may request proof of identity before processing your request to ensure data is not disclosed to unauthorised parties.

The Mahkota8 Platform is strictly intended for use by persons who are 21 years of age or older. Mahkota8 does not knowingly collect, solicit, or process the personal data of any person under the age of 21.

Age verification checks are performed during the account registration process and during KYC verification. Any account found to have been opened by a person under 21 years of age will be immediately closed, all funds will be dealt with in accordance with our Terms & Conditions, and all personal data associated with that account will be deleted in accordance with applicable legal requirements.

If you have reason to believe that a person under 21 years of age has registered an account on the Mahkota8 Platform, please notify us immediately via our support team so that we can take prompt action. We also support the use of parental control software to prevent underage access to online gambling platforms.

The Mahkota8 Platform may contain references to third-party payment methods, service providers, and technology partners. These third-party services operate independently under their own privacy policies and data processing practices. Mahkota8 is not responsible for the privacy practices or content of any third-party service provider, and this Privacy Policy does not extend to any data you provide directly to a third-party service in connection with your use of their platform.

Mahkota8 selects third-party Data Processors based on their demonstrated commitment to data security and their compliance with applicable data protection standards. All processors are bound by written data processing agreements prior to handling any Mahkota8 player data.

Mahkota8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, regulatory requirements, or Platform features. When material changes are made to this Policy, we will update the "Effective Date" at the top of this page and, where appropriate, notify registered Players via email or an in-platform notification.

We encourage you to review this Privacy Policy periodically to stay informed about how Mahkota8 protects your personal data. Your continued use of the Platform following publication of any amended Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests regarding this Privacy Policy, the way Mahkota8 processes your personal data, or to exercise any of your data rights as described in Section 11 of this Policy, please contact us through any of the following channels:

• Email: support@mahkota8.cam (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week, directly through the Platform. Average response time is 3 to 5 minutes.
• Support Languages: English, Bahasa Melayu, and Mandarin (中文).

When submitting a data rights request, please include: your full account username or registered email address; a clear description of your request; and a copy of a government-issued ID to verify your identity and ensure we are responding to the correct data subject.