million8 Privacy Policy

1. Who We Are

million8 ("we", "us", "our") operates the online casino and sportsbook platform accessible at million8.lat (the "Platform"). million8 is an internationally operated gaming service that accepts registrations from English-speaking players in Malaysia who are aged 21 years and above. References to "million8", "the Platform" or "our services" throughout this Privacy Policy refer collectively to the website, its sub-pages, mobile-optimised versions, and any associated account tools.

As the operator of the Platform, million8 acts as the data controller in respect of personal data collected from players. This means we determine the purposes and means of processing your personal information as described below.

2. Scope of This Privacy Policy

This Privacy Policy applies to all personal data that million8 collects, processes, stores, or transmits in connection with:

• registration and maintenance of a player account on the Platform;
• deposits, withdrawals, and payment processing via local Malaysian payment methods including Touch n Go eWallet, Boost, Maybank, CIMB Bank, Public Bank, Visa/Mastercard, and bank transfer;
• participation in any game, bet, promotion, tournament, or bonus offered on the Platform;
• use of customer support services, including live chat and email communication;
• browsing or accessing the million8 website, including through cookies and similar tracking technologies.

This policy does not govern third-party websites that may be linked from our platform, nor does it apply to data collected by payment processors operating under their own privacy notices.

3. Personal Data We Collect

million8 collects personal data in two ways: information you provide to us directly, and information we collect automatically when you use the Platform.

3.1 Data You Provide Directly

• Identity data: Full legal name, date of birth, nationality, and copy of a government-issued identification document (required for Know Your Customer / KYC verification).
• Contact data: Email address, Malaysian mobile number, and mailing address.
• Account credentials: Username and a hashed, encrypted version of your chosen password. million8 does not store passwords in plain text.
• Financial data: Bank account or e-wallet identifiers used for deposits and withdrawals. million8 does not store full card numbers; card payments are tokenised by our payment processor.
• Responsible Gaming data: Deposit limits, session limits, self-exclusion requests, and any other voluntary restrictions you set within your account.
• Support correspondence: Records of live chat sessions, emails, and any supporting documents submitted to our customer support team.

3.2 Data Collected Automatically

• Technical data: IP address, device type, operating system, browser version, and screen resolution.
• Usage data: Pages visited, games played, bets placed, session duration, click paths, and referral source.
• Cookie data: Session identifiers, preference cookies, and analytics identifiers as described in Section 7 of this policy.
• Geolocation data: Country and general region, derived from your IP address. million8 does not collect precise GPS location.

4. How We Use Your Personal Data

million8 uses personal data for the following purposes:

1. Account creation and management: To register and maintain your million8 account, verify your identity in accordance with KYC obligations, and manage your account preferences.
2. Service delivery: To process bets, casino game sessions, deposits, and withdrawals, including communication of transaction confirmations.
3. Regulatory compliance: To comply with anti-money-laundering (AML) obligations, responsible gaming requirements, and any applicable legal and regulatory requirements. million8 may be required to verify the source of funds for large transactions.
4. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account takeovers, collusion, and other security incidents that could affect you or other players.
5. Customer support: To respond to your enquiries, process complaints, and maintain a record of our interactions for quality assurance.
6. Promotions and bonuses: To administer promotional campaigns, welcome bonuses, reload offers, and loyalty programmes that you have opted into. million8 does not send unsolicited promotional communications.
7. Platform improvement: To analyse aggregate usage patterns, improve game performance, personalise the user experience, and develop new features.
8. Legal proceedings: To establish, exercise, or defend legal claims involving million8 or its players where necessary.

million8 does not use automated decision-making processes — including profiling — that produce legal or similarly significant effects on players without human review.

5. Legal Bases for Processing

million8 processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform our obligations to you under the Terms & Conditions that govern your account, including delivering gaming services and processing payments.
• Legal obligation: Processing is necessary to comply with applicable AML legislation, KYC requirements, and any lawful requests from regulatory authorities.
• Legitimate interests: Processing is necessary for our legitimate interests in operating a secure, commercially viable gaming platform — for example, fraud detection, platform analytics, and security monitoring — where those interests are not overridden by your rights.
• Consent: Where we rely on your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time by contacting us at the email address in Section 13 or by adjusting your browser settings.

6. Disclosure of Your Personal Data

million8 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We may disclose your data only in the following circumstances:

• Service providers: Payment processors, KYC/identity verification providers, fraud detection services, cloud infrastructure providers, and customer support platform vendors. All such providers are bound by data processing agreements that restrict their use of your data to the specific services they provide to million8.
• Regulatory and law enforcement authorities: Where million8 is legally required or compelled by a court order, regulatory directive, or law enforcement request to disclose personal data, we will do so in accordance with applicable law. Where permitted, we will notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of the million8 business, personal data held by us may be transferred to the acquiring entity as part of that transaction. We will notify affected players before any such transfer takes effect.
• With your consent: In circumstances not covered above, million8 will seek your explicit consent before disclosing your personal data to any third party.

million8 does not transfer personal data outside of the jurisdictions in which we operate except where necessary to provide the service (for example, where a cloud infrastructure provider maintains servers in multiple regions). Any cross-border data transfers are conducted under appropriate safeguards, including standard contractual clauses or equivalent mechanisms.

7. Cookies and Similar Technologies

million8 uses cookies and similar client-side storage technologies on the Platform. A cookie is a small text file placed on your device when you visit a website. The table below summarises the categories of cookies we use:

• Strictly necessary cookies: Essential to the operation of the Platform. These include session authentication tokens that keep you logged in to your million8 account and security cookies that protect against cross-site request forgery. These cookies cannot be disabled without impairing core platform functionality.
• Functional cookies: Used to remember your preferences, such as your chosen language, display settings, and responsible gaming limits. Disabling these cookies may reduce the personalisation of your experience.
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate the Platform, which pages they visit, and which features they use. This data helps million8 improve the platform and user experience. These cookies do not identify you personally.
• Marketing and preference cookies: Used, with your consent, to identify you as a returning visitor and to tailor promotional content shown on the Platform to your interests. You may withdraw consent for these cookies at any time through your browser settings.

Most web browsers allow you to view, manage, and delete cookies through the browser's settings menu. Please note that disabling strictly necessary cookies may prevent you from accessing your million8 account. For guidance on managing cookies in your specific browser, refer to the browser's official help documentation.

8. Data Retention

million8 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to any longer retention periods required by law. The following retention principles apply:

• Active accounts: Personal data associated with an active million8 account is retained for the duration of the account's existence plus a minimum of five (5) years following permanent account closure, in accordance with standard AML record-keeping obligations.
• KYC documents: Identity verification documents are retained for a minimum of five (5) years from the date of submission, as required under applicable anti-money-laundering legislation.
• Transaction records: Records of deposits, withdrawals, and betting activity are retained for a minimum of five (5) years from the date of each transaction.
• Support correspondence: Records of customer support interactions are retained for three (3) years from the date of the last interaction, unless the matter is subject to ongoing legal proceedings.
• Marketing data: Where you have consented to receive marketing communications, we retain the data necessary to send those communications until you withdraw consent. Upon withdrawal, your data is removed from our marketing lists within a reasonable time, not exceeding thirty (30) days.

When personal data is no longer required, million8 will securely delete or anonymise it in a manner that prevents reconstruction or re-identification.

9. Your Rights in Respect of Personal Data

As a data subject, you hold the following rights in relation to personal data that million8 holds about you. To exercise any of these rights, please contact us using the details provided in Section 13. million8 will respond to verified requests within thirty (30) days, or within such other period as may be required by applicable law.

1. Right of access: You have the right to request a copy of the personal data that million8 holds about you, along with information about how that data is used and with whom it is shared.
2. Right to rectification: If any personal data held by million8 is inaccurate or incomplete, you have the right to request that we correct or complete it without undue delay.
3. Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to overriding legal obligations — for example, AML regulations that require us to retain certain records.
4. Right to restriction of processing: You may request that million8 restrict the processing of your personal data in certain circumstances — for example, while we verify the accuracy of data you have contested.
5. Right to data portability: Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
6. Right to object: You have the right to object to processing carried out on the basis of legitimate interests. million8 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.
7. Right to withdraw consent: Where million8 relies on your consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

million8 will not discriminate against you for exercising any of these rights. If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in the jurisdiction applicable to your circumstances.

10. Security Measures

million8 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your browser and our servers;
• Encryption of sensitive data fields at rest, including passwords, identity documents, and payment credentials;
• Role-based access controls limiting internal access to personal data to authorised personnel who require it to perform their duties;
• Regular security assessments, vulnerability scans, and penetration testing conducted by qualified security professionals;
• Multi-factor authentication requirements for administrative access to systems that process personal data;
• Incident response procedures designed to contain, investigate, and remediate data security incidents promptly.

While million8 takes these measures seriously, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, million8 will notify you without undue delay in accordance with applicable data protection law. You can help keep your account secure by using a strong, unique password and by enabling any two-factor authentication options available in your million8 account settings.

11. Minors and Age Restriction

million8 is strictly an adults-only platform. Access to, and registration on, the Platform is limited to individuals who are 21 years of age or older. This age restriction reflects Malaysian social norms and the age threshold applicable to casino-style gambling activities.

million8 does not knowingly collect personal data from individuals under the age of 21. As part of our KYC process, all players are required to verify their age before being permitted to deposit funds or participate in any real-money game or bet. Where million8 identifies or reasonably suspects that a registered account belongs to a person under 21, that account will be suspended immediately and any balance returned in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a minor has registered on the Platform without authorisation, please contact us immediately at the email address in Section 13 so that we may take appropriate action.

For more information about our commitment to responsible gaming and tools available to help you manage your gambling activity, please visit our Responsible Gaming page.

12. Changes to This Privacy Policy

million8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we offer. When we make material changes to this policy, we will:

• update the "Last reviewed" date shown at the top of this page;
• display a prominent notice on the Platform informing registered players of the update; and
• where the change materially affects your rights, send a direct notification to the email address associated with your million8 account.

Your continued use of the Platform after any updated Privacy Policy becomes effective constitutes your acknowledgement of the changes. If you do not agree with the revised policy, you should discontinue use of the Platform and may request account closure by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how million8 protects your personal data.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data that million8 holds about you, please contact our data privacy team using the details below. We aim to acknowledge all enquiries within two (2) business days and to provide a substantive response within thirty (30) days.

• Email: [email protected]
• Subject line: Privacy Policy Enquiry — [Your Registered Username]
• Response time: Up to 30 days for formal data subject requests

Please note that to protect your privacy and security, million8 may need to verify your identity before processing any data access, correction, or deletion request. We may ask you to provide proof of identity consistent with the KYC documentation held on your account.

This Privacy Policy is governed by and construed in accordance with the laws applicable to the jurisdiction in which million8 operates. Any disputes arising from or in connection with this Privacy Policy shall be subject to the dispute resolution provisions set out in our Terms & Conditions.