Privacy Policy

Introduction

This Privacy Policy ("Policy") is issued by Maha168 ("the Company", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://maha168.cam ("the Platform"). It governs the collection, use, storage, disclosure, and protection of personal data submitted by or collected from all persons ("you", "your", "User") who access, register on, or otherwise interact with the Platform.

Maha168 is committed to handling your personal information responsibly, transparently, and in compliance with applicable data protection principles. This Policy is incorporated by reference into our Terms & Conditions and forms part of your agreement with us when you use the Platform.

By registering an account, depositing funds, or continuing to use the maha168 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

Definitions

For the purposes of this Privacy Policy, the following terms are defined as follows:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifiers, or factors specific to that person's identity.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" means the Company, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party engaged by the Company to process Personal Data on its behalf, under a binding data processing agreement.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Cookies" means small text files placed on your device by the Platform to store information about your session, preferences, or browsing behaviour.
• "KYC Data" means identity verification documents and related information collected as part of the Know Your Customer process, including copies of government-issued identification and proof of address.
• "Sensitive Data" means a special category of Personal Data including health information, financial details beyond standard transaction records, or biometric data, which is processed only where strictly necessary and with heightened safeguards.

Data We Collect

Maha168 collects the following categories of personal data from users of the Platform:

How We Collect Data

Maha168 collects personal data through the following channels and mechanisms:

• Direct submission: Information you provide when registering an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or updating your profile settings.
• Automated technical collection: When you access the Platform, our servers automatically record Technical Data including your IP address, browser and device details, and navigation behaviour. This is collected via server logs, cookies, and similar technologies.
• Payment processors: When you make a deposit via Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong Bank, or USDT TRC20, our payment service providers transmit transaction confirmation data to us. We do not store full payment card or full bank account numbers.
• KYC and identity verification providers: Where we use third-party identity verification services to validate documents you submit, those providers may return processed verification results to us for storage against your account record.
• Fraud detection systems: Automated risk-scoring systems may process Technical Data and Account Activity Data to detect unusual patterns associated with fraud, multi-accounting, or money laundering.

Data Processing & Legal Basis

Maha168 processes your personal data only where a valid lawful basis exists under applicable data protection law. The following table sets out the primary lawful bases on which we rely for each category of processing activity:

How We Use Your Data

Maha168 uses your personal data for the following specific purposes:

1. Account administration: To create, maintain, secure, and close your maha168 account; to authenticate your identity at login; and to process changes to your account settings.
2. Transaction processing: To process MYR deposits and withdrawals via your chosen payment method, and to maintain accurate financial records of all transactions on your account.
3. Identity verification (KYC): To verify your age, identity, and the source of funds used in transactions, as required for compliance with applicable regulations and to protect against fraud.
4. Responsible gambling compliance: To monitor gambling behaviour patterns that may indicate problem gambling; to apply deposit limits, session restrictions, or self-exclusion where requested or required; and to provide referrals to support resources.
5. Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct on the Platform.
6. Customer support: To respond to your queries, complaints, and support requests via live chat and email.
7. Platform improvement: To analyse aggregated usage data and improve the functionality, performance, and user experience of the maha168 Platform.
8. Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications, or where we have a legitimate interest as an existing customer. You may opt out at any time via your account settings or by contacting support.
9. Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from regulatory authorities or law enforcement agencies, and enforce our Terms & Conditions.

Data Sharing & Disclosure

Maha168 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. We may share your data only in the following limited circumstances:

• Payment processors: To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency processors. These processors are contractually obligated to handle your data securely and only for the specified payment purpose.
• Identity verification providers: To conduct KYC document checks. These providers act as Data Processors under binding agreements and may not use your data for independent purposes.
• Fraud detection and risk management providers: To screen transactions and account activity for indicators of fraud, money laundering, or prohibited conduct.
• Game content providers: Game studios powering the maha168 Platform may receive anonymised session data (e.g., game round IDs and outcomes) for technical settlement purposes. Personally identifiable information is not shared with game studios unless required for dispute resolution.
• Legal and regulatory authorities: Where required by applicable law, court order, or formal request from a regulatory body, law enforcement agency, or financial intelligence unit, we may be obligated to disclose your personal data. We will notify you of such disclosure where legally permitted to do so.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, your personal data may be transferred to the acquiring entity, subject to the same or equivalent privacy protections as set out in this Policy.

Cookies & Tracking Technologies

Maha168 uses cookies and similar tracking technologies (including web beacons and local storage) to operate the Platform effectively and improve your experience. Cookies are small text files stored on your device by your browser when you visit the Platform.

The types of cookies we use include:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These enable core functions such as user authentication, session management, and security. They cannot be disabled without affecting Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised information about how users navigate and interact with the Platform. This helps us identify popular content, diagnose technical issues, and improve the overall user experience.
• Functional Cookies: Allow the Platform to remember your preferences, such as language settings, display preferences, and previously visited sections, to provide a more personalised experience.
• Marketing & Targeting Cookies: Used only where you have provided explicit consent. These may track your browsing activity across sessions to deliver relevant promotional content. You may withdraw consent at any time.

You may manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies will affect the functionality of the maha168 Platform. For detailed browser-level instructions, refer to the help documentation of your browser (Chrome, Firefox, Safari, Edge, etc.).

Data Retention

Maha168 retains your personal data only for as long as is necessary for the purposes set out in this Policy and as required by applicable legal and regulatory obligations. The following general retention principles apply:

• Account data: Retained for the duration of your active account relationship with us, and for a minimum of five (5) years following account closure, to meet anti-money laundering record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from the date of the last transaction on your account, in accordance with applicable financial regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, for financial auditing and regulatory compliance purposes.
• Customer support communications: Retained for up to three (3) years from the date of the interaction, to support dispute resolution and service improvement.
• Marketing preferences and communications: Retained until you withdraw your consent or for up to two (2) years from your last interaction with promotional content.
• Technical / server log data: Generally retained for twelve (12) months for security monitoring and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Where anonymisation is applied, the resulting data may be retained for statistical or research purposes without restriction.

Data Security

Maha168 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encrypted storage of sensitive personal data and financial records on secured servers.
• Role-based access controls ensuring that only authorised staff access personal data on a strict need-to-know basis.
• Multi-factor authentication for internal administrative access to data systems.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Staff training on data protection obligations and information security best practices.
• Incident response procedures to identify, contain, and remediate any personal data breach.

Your Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by maha168. To exercise any of these rights, please contact our support team via live chat or by email at [email protected]. We will respond to all verified requests within 30 days.

Please note that certain rights may be limited or cannot be fulfilled where the processing is required to comply with a legal obligation — for example, we cannot delete KYC records that we are legally required to retain. We will always explain any applicable limitations clearly when responding to your request.

Minors & Age Restriction

The maha168 Platform and all associated gambling services are strictly intended for persons aged 21 years and above. We do not knowingly collect or process personal data from any individual under the age of 21.

Age verification is performed as part of the account registration and KYC processes. Any account found to be held by a person under the age of 21 will be immediately closed, all associated data will be deleted in accordance with our retention obligations, and any account balance will be returned to the verified deposit source where possible.

If you are a parent or guardian and believe that a minor in your care has registered an account on maha168, please contact our support team immediately via live chat so that we can take appropriate action. For players aged 21 and above only.

International Data Transfers

Maha168 operates with the assistance of service providers whose infrastructure and personnel may be located outside Malaysia. Where personal data is transferred to, accessed from, or processed in a jurisdiction outside your country of residence, we take steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Policy.

These safeguards may include contractual data protection clauses, standard contractual agreements, or reliance on the data protection laws applicable in the receiving jurisdiction. By using the maha168 Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions that may have different data protection standards than those in your country of residence, subject to the safeguards described above.

Policy Amendments

Maha168 reserves the right to update, revise, or amend this Privacy Policy at any time to reflect changes in applicable law, data processing practices, or Platform functionality. The "Last Updated" date at the top of this document will be revised accordingly.

Where material changes are made to this Policy — particularly changes that affect how we collect, use, or share your personal data — we will notify registered users via the email address on file or by displaying a prominent notice on the Platform prior to the changes taking effect.

Your continued use of the maha168 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must discontinue your use of the Platform and may request account closure in accordance with our Terms & Conditions.

Contact Us

If you have any questions, concerns, or requests in connection with this Privacy Policy, or if you wish to exercise any of your data subject rights, please contact the maha168 data support team through the following channels:

• Live Chat: Available 24/7 directly on the maha168 Platform — the recommended channel for urgent data requests.
• Email: [email protected] — for written data subject access requests and formal privacy correspondence.

We will acknowledge all data subject requests within five (5) business days and aim to resolve them within thirty (30) calendar days. For complex requests, we may extend the response period by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it.