At mi88, protecting your personal information is a fundamental part of how we operate. This Privacy Policy explains what data we collect from Malaysian players, how we use it, who we may share it with, how long we retain it, and what rights you have over it. We ask that you read this document carefully alongside our Terms & Conditions.
Six core commitments that underpin every data decision we make at mi88.
We collect only the personal data that is necessary for the specific purposes described in this Policy — account management, payment processing, identity verification, and regulatory compliance. We do not collect data speculatively or beyond operational need.
All personal data stored on mi88 infrastructure is encrypted at rest. All data transmitted between your device and our servers is protected by 256-bit TLS/SSL encryption. Access to personal data is restricted to authorised personnel on a need-to-know basis.
mi88 does not sell, rent, or trade your personal data to unaffiliated third parties for their independent marketing or commercial purposes. Data shared with third parties is limited to service providers operating under contractual data protection obligations.
You have the right to access, correct, and in defined circumstances request the deletion of your personal data. Requests are handled within 30 days of receipt. See Section 9 of this Policy for the complete list of your data rights and how to exercise them.
We retain personal data only for as long as it is required for the purposes for which it was collected, or as required under our gaming license obligations and applicable anti-money laundering laws. Retention periods are specified in Section 8 of this Policy.
We will notify you of any material changes to this Privacy Policy with reasonable advance notice, either by email or by a prominent notice on the Platform. Continued use of mi88 after the effective date of changes constitutes acceptance of the revised Policy.
This Privacy Policy ("Policy") describes how mi88 ("the Company", "we", "us", "our") collects, processes, stores, and discloses personal data obtained from individuals ("Player", "you", "your") who access or use the mi88 online gaming platform, including its associated websites, mobile-optimised interfaces, and related services (collectively, the "Platform").
The Company is committed to protecting the privacy and security of the personal data it holds. This Policy has been prepared in accordance with the data protection and privacy obligations imposed by the Company's international gaming license and applicable data protection standards. While mi88 primarily serves players based in Malaysia — including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and throughout the country — this Policy applies to all registered users globally.
By creating a mi88 account or otherwise using the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not use the Platform.
Policy Scope: This Policy applies to personal data collected through the mi88 Platform only. It does not govern data practices of third-party websites, payment processors, or services linked from or integrated with the Platform, each of which operates under its own privacy policies.
For the purposes of this Policy, the following terms have the meanings set out below:
The Company collects the following categories of personal data in connection with your use of the Platform:
| Category | Examples | Required? |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government ID number (e.g., MyKad) | Mandatory (KYC) |
| Contact Data | Email address, phone number, residential address | Mandatory |
| Financial Data | Payment method details (e-wallet ID, bank account suffix), transaction history, deposit and withdrawal records in MYR | Mandatory |
| Account Data | Username, encrypted password, account preferences, communication settings, VIP tier status | Mandatory |
| Technical Data | IP address, device type, operating system, browser type, session identifiers, login timestamps | Automatic |
| Usage Data | Games played, bet history, wagering patterns, session duration, pages visited within the Platform | Automatic |
| Communications Data | Records of live chat conversations, email correspondence, and support ticket content | Where applicable |
| Responsible Gambling Data | Deposit limits set, self-exclusion requests, session limit preferences, responsible gambling assessment responses | Where applicable |
The Company collects personal data through the following methods:
You provide personal data directly when you register an Account on the Platform, complete identity verification (KYC), submit a deposit or withdrawal request, contact customer support, respond to surveys or promotional offers, or set responsible gambling preferences within your Account settings.
When you interact with the Platform, we automatically collect Technical Data and Usage Data via server logs, cookies, web beacons, pixel tags, and similar technologies. This data is collected passively as part of normal Platform operation and does not require active input from you. See Section 10 for details on cookies and how to manage them.
We may receive personal data from third-party sources in limited circumstances, including:
The Company processes your personal data for the following purposes:
The Company may share your personal data with trusted third-party service providers who assist in operating the Platform. These include payment processors, KYC and identity verification providers, fraud detection services, cloud infrastructure providers, customer support technology platforms, and email delivery services. All such service providers are engaged under contractual data processing agreements that restrict their use of your data to the purposes for which it was shared.
Personal data may be shared within the Company's corporate group where necessary for the purposes described in Section 5, subject to the same data protection standards as set out in this Policy.
The Company may disclose personal data to competent regulatory, law enforcement, or judicial authorities where required to do so by applicable law, court order, or the conditions of its gaming license. In such cases, the Company will disclose only the minimum data necessary to satisfy the legal obligation and will, where legally permitted to do so, notify the affected Player.
In the event of a merger, acquisition, or sale of substantially all of the Company's assets, personal data held by the Company may be transferred to the successor entity as part of that transaction. Affected Players will be notified by email or by a prominent Platform notice prior to the transfer taking effect.
We do not sell your data. mi88 does not sell, rent, or otherwise commercially exploit your personal data for the benefit of third parties outside of the service provider relationships described in this section.
mi88 is an internationally operated platform. The processing and storage of your personal data may involve transfer to, and processing in, countries other than Malaysia. Specifically, data may be processed in the country or jurisdiction where the Company's gaming license is issued, and in countries where our cloud infrastructure and service providers are located.
When personal data is transferred outside of Malaysia, the Company takes steps to ensure that appropriate safeguards are in place to protect the data, which may include:
By using the Platform, you acknowledge and consent to the transfer of your personal data in the manner described in this section.
The Company retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods:
| Data Category | Retention Period | Basis |
|---|---|---|
| Identity & KYC Data | 5 years after account closure | Gaming license obligation; AML compliance |
| Financial Transaction Records | 5 years after the relevant transaction | AML compliance; legal obligation |
| Account & Contact Data | Duration of account + 2 years after closure | Contractual; legitimate interests |
| Technical & Usage Data | 13 months from collection | Legitimate interests (analytics, fraud detection) |
| Customer Support Communications | 3 years from last interaction | Legitimate interests (dispute resolution) |
| Responsible Gambling Records | 5 years after account closure | Gaming license obligation |
| Marketing Consent Records | Until consent withdrawn + 1 year | Legal obligation (consent evidence) |
Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.
Subject to the limitations described below, registered Players have the following rights in respect of their personal data held by mi88:
Request a copy of the personal data we hold about you, and information about how it is processed.
Request correction of inaccurate or incomplete personal data held in your Account.
Request deletion of your personal data where it is no longer necessary for the purposes collected, subject to legal retention obligations.
Request that processing of your data be restricted while a query or complaint is under investigation.
Receive your personal data in a structured, machine-readable format where technically feasible and legally permissible.
Object to processing based on legitimate interests, including direct marketing. Withdrawal of marketing consent takes effect immediately.
To exercise any of the rights listed above, please contact the mi88 Data Protection team via the live chat or email address provided in Section 14. The Company will respond to valid requests within thirty (30) calendar days. In complex cases, this period may be extended by a further sixty (60) days, and you will be informed of any extension within the initial 30-day window.
Please note that certain rights may be limited where the requested erasure or restriction of processing conflicts with a legal obligation — for example, the requirement to retain KYC and transaction records under the Company's gaming license and applicable AML laws.
Cookies are small text files placed on your device when you visit the Platform. They allow the Platform to recognise your device, remember your preferences, maintain your session, and collect analytical data about how the Platform is used.
Most modern browsers allow you to control cookie settings through their settings menus. You may block or delete cookies at any time; however, disabling strictly necessary cookies may affect the functionality of the Platform, including your ability to log in and place wagers.
The Company reserves the right to modify this Privacy Policy at any time. Material changes — such as new data collection purposes, changes to third-party sharing, or changes to your rights — will be communicated to you by email to your registered address and by a prominent notice on the Platform no fewer than seven (7) days before the changes take effect.
The date at the top of this Policy reflects the date on which the current version became effective. Continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you must cease using the Platform and may request account closure and the return of your available balance in accordance with the Terms & Conditions.
The Platform is strictly intended for individuals aged 21 years and above. mi88 does not knowingly collect, process, or store personal data relating to persons under the age of 21. Where the Company becomes aware that personal data has been collected from a person under 21 — whether through failure of the KYC process, misrepresentation by the individual, or any other means — it will immediately:
If you are a parent or guardian and believe a person under the age of 21 has created an Account on mi88 or accessed the Platform, please contact us immediately via the details in Section 14.
The Company has implemented a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include 256-bit SSL/TLS encryption for data in transit, encryption at rest for sensitive data stores, access control systems, intrusion detection monitoring, and regular security audits.
In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected Players, the Company will:
You are responsible for maintaining the security of your own Account credentials. mi88 will never ask you to provide your password by email, live chat, or phone. If you receive any communication purportedly from mi88 requesting your password, please treat it as fraudulent and report it to our support team immediately.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mi88, please contact our Data Protection team using the details below:
Data Protection Contact:
Email: [email protected]
Subject Line: Data Privacy Request — [Your Username]
Live Chat: Available 24/7 via the in-platform chat widget
Response Target: Initial acknowledgement within 48 hours; substantive response within 30 days.
If you are dissatisfied with the Company's response to your privacy query or complaint, you may escalate your concern to the data protection supervisory authority relevant to the jurisdiction of the Company's gaming license. The Company will provide details of the applicable supervisory authority upon request.
We take all privacy complaints seriously and will investigate every valid concern with appropriate thoroughness and in a timely manner. We are committed to resolving disputes in good faith.