Privacy Policy

This Privacy Policy (hereinafter "the Policy") sets out the manner in which mari88 (hereinafter "we", "us", "our", or "the Platform") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals who register as players, visit the Platform at https://mari88.cam, or otherwise interact with any of our services.

mari88 is committed to protecting the privacy of all individuals whose personal data we handle. We process personal data only where we have a lawful basis to do so, and we implement appropriate technical and organisational measures to protect that data against unauthorised access, loss, destruction, or disclosure.

This Policy applies to all personal data processed by mari88 in connection with the use of our online casino and sports betting services, including data provided directly by players during registration and KYC verification, data collected automatically through your use of the Platform, and data received from third-party service providers.

This Policy should be read together with our Terms & Conditions, which set out the contractual basis of your relationship with mari88. In the event of any inconsistency between this Policy and the Terms & Conditions, the Terms & Conditions shall prevail in matters of contract, and this Policy shall prevail in matters of data protection.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, restriction, erasure, or destruction.
• "Data Subject" means the natural person to whom personal data relates — in the context of this Policy, this refers primarily to registered players and website visitors.
• "Data Controller" means mari88, which determines the purposes and means of processing personal data.
• "Data Processor" means a third party that processes personal data on behalf of mari88 in accordance with our written instructions.
• "Cookies" means small text files placed on your device by the Platform to facilitate session management, analytics, and personalisation.
• "KYC" means Know Your Customer — the identity and document verification process conducted as part of account registration and withdrawal processing.

The categories of personal data that mari88 may collect and process are set out in the table below. Collection is limited to data that is necessary and proportionate to the stated purpose.

mari88 collects personal data through the following channels:

The majority of personal data we hold is provided directly by you during account registration, KYC document submission, customer support interactions, and when completing deposit or withdrawal requests. This includes all identity data, contact data, financial data, and verification documents listed in Section 3.

When you access or use the Platform, we automatically collect technical data through server logs, cookies, and similar tracking technologies. This data is used for session management, fraud detection, security monitoring, and platform performance optimisation. See Section 8 for full details on our use of cookies.

We may receive personal data from authorised third-party service providers in the following circumstances:

• Identity verification agencies that assist with KYC and age verification processes.
• Payment processors and financial institutions, including Malaysian payment providers (FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay) and cryptocurrency network operators, who provide transaction confirmation data.
• Fraud detection and anti-money laundering screening services that cross-reference player data against publicly available watchlists.
• Analytics service providers that supply aggregated and anonymised data regarding Platform usage patterns.

mari88 processes personal data for the following specific purposes:

• Account Administration: Creating, maintaining, and managing your player account, including authentication, account recovery, and account security monitoring.
• Identity & Age Verification: Confirming that you are aged 21 or above and that your identity matches the information provided at registration, in compliance with our responsible gambling obligations and regulatory requirements.
• Payment Processing: Processing deposits and withdrawals via your chosen payment method, including Malaysian payment channels such as Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency channels (BTC, ETH, USDT).
• Regulatory Compliance: Meeting our anti-money laundering (AML), counter-terrorism financing (CTF), and other legal obligations, including transaction monitoring, suspicious activity reporting, and record-keeping.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, multi-accounting, cheating, and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: Responding to your queries, resolving disputes, and administering complaints through our live chat and email support channels.
• Responsible Gambling: Monitoring gaming activity for indicators of problem gambling and administering deposit limit, self-exclusion, and session control requests as part of our responsible gambling programme.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may opt out at any time by contacting support or updating your Account preferences.
• Platform Improvement: Analysing usage patterns and player feedback to improve the user experience, fix technical issues, and develop new features.

mari88 processes personal data only where a lawful basis for doing so exists. The applicable legal bases under recognised data protection principles are as follows:

• Contractual Necessity: Processing that is necessary for the performance of our contract with you — i.e., providing the gaming services you have registered to use, processing your deposits and withdrawals, and administering your account.
• Legal Obligation: Processing required to comply with our legal and regulatory obligations, including KYC verification, AML monitoring, transaction record-keeping, and responding to lawful requests from competent authorities.
• Legitimate Interests: Processing for fraud prevention, platform security, product improvement, and responsible gambling monitoring, where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided freely given, specific, and informed consent. You may withdraw consent at any time.

mari88 does not sell, rent, or otherwise make your personal data available to third parties for their own commercial purposes. We disclose personal data only in the following circumstances:

We engage carefully selected third-party service providers who process personal data on our behalf, strictly under our written instructions and subject to appropriate data processing agreements. These providers include:

• Payment processing partners (including Malaysian payment rails and cryptocurrency processors) for the purpose of executing your financial transactions.
• Identity verification and KYC service providers.
• Cloud hosting and infrastructure providers who store Platform data in secure, encrypted environments.
• Customer support platform providers that facilitate our live chat and ticketing systems.
• Fraud detection and AML screening service providers.

We may disclose personal data to competent governmental, regulatory, or law enforcement authorities where we are legally required or compelled to do so — for example, in response to a court order, regulatory investigation, or where required by our AML/CTF compliance obligations. We will notify affected players of such disclosures to the extent permitted by law.

In the event of a merger, acquisition, or sale of all or a material part of the assets of mari88, player personal data may be transferred to the acquiring entity as part of that transaction, subject to the same or equivalent privacy protections.

mari88 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function, including session authentication, security tokens, and load balancing. These cannot be disabled without preventing Platform functionality.
• Functional Cookies: Used to remember your preferences (such as language and game lobby settings) to personalise your experience across sessions.
• Analytics Cookies: Collect anonymised information about how visitors use the Platform to help us understand usage patterns and improve performance. We use this data in aggregate form only.
• Security & Fraud Detection Cookies: Used to identify and flag unusual access patterns that may indicate fraudulent activity or unauthorised account access attempts.

You may configure your browser to refuse or delete cookies; however, doing so may impair your ability to use certain features of the Platform, including session persistence and personalised game lobby settings. Strictly necessary cookies cannot be refused as they are essential to Platform operation.

mari88 retains personal data for the minimum period necessary to fulfil the purposes set out in this Policy, subject to the following retention principles:

• Account data and KYC documents are retained for the duration of your Account and for a minimum of five (5) years following Account closure, in compliance with our AML and regulatory record-keeping obligations.
• Transaction records (deposits, withdrawals, betting history) are retained for a minimum of five (5) years to satisfy financial record-keeping requirements.
• Customer support communications are retained for two (2) years from the date of the last interaction unless a complaint or dispute is outstanding, in which case records are retained until final resolution.
• Marketing consent records are retained for as long as you hold an Account, and for one (1) year following Account closure or the withdrawal of consent, whichever is later.
• Technical logs (server access logs, session data) are retained for a maximum of twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Where legal proceedings or regulatory investigations are ongoing, retention periods may be extended until the conclusion of those proceedings.

mari88 implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data in transit between your device and our Platform servers.
• AES-256 encryption for sensitive personal data stored at rest in our databases.
• Two-factor authentication (2FA) available to all players for account login security.
• Role-based access controls limiting internal access to personal data to only those staff whose job function requires it.
• Regular security audits and penetration testing by qualified third-party security professionals.
• Automated monitoring systems that detect and alert on unusual access patterns or potential data breaches in real time.
• Staff training on data protection obligations and secure data handling practices.

While we take our security obligations seriously, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your Account credentials and for ensuring that you access the Platform only through secure networks. If you suspect that your Account has been compromised, you must contact our support team immediately.

Subject to applicable law and the limitations described in this Policy, you have the following rights with respect to your personal data held by mari88:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being used.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data held in your Account at any time, either directly through your Account settings or by contacting support.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain data under AML, regulatory, and contractual requirements.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data while we verify it.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another service provider where technically feasible.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis, including for marketing communications.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact our data protection team at the details provided in Section 16. We will respond to all verifiable requests within thirty (30) days of receipt. Where a request is complex or numerous, we may extend this period by a further thirty (30) days with prior notification. We may require you to verify your identity before acting on a data rights request to protect against unauthorised access to your personal data.

The mari88 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. The 21+ minimum age requirement is a core element of our responsible gambling policy and is enforced through our KYC verification process.

If we discover or are notified that we have inadvertently collected personal data from an individual under 21 years of age, we will take immediate steps to delete that data and close the associated Account. Any balances or winnings associated with an underage Account will be handled in accordance with our Terms & Conditions.

If you have reason to believe that a person under the age of 21 has registered an Account with mari88, please contact our support team immediately.

The mari88 Platform may contain links to or integrations with third-party services such as payment gateways (including Malaysian payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX), game content providers, and analytics platforms. This Privacy Policy applies solely to personal data processed directly by mari88.

Third-party services integrated with or linked from the Platform operate under their own privacy policies and data protection practices, for which mari88 accepts no responsibility. We encourage you to review the privacy policies of any third-party service with which you interact through the Platform, particularly those involved in payment processing and identity verification.

In the course of operating a global online gaming platform, personal data processed by mari88 may be transferred to and stored in jurisdictions outside of Malaysia. Such transfers may occur in the context of cloud server infrastructure, third-party payment processors operating internationally, or game content providers whose servers are located outside Malaysia.

Where personal data is transferred internationally, mari88 takes reasonable steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to the protections applicable in the jurisdiction of collection. These safeguards may include contractual data transfer agreements, processing in jurisdictions with adequate data protection regimes, or other appropriate mechanisms.

mari88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform services. The "Last Updated" date at the top of this page will be revised accordingly.

Where we make a material change to this Policy — for example, a change to the categories of data we collect, the purposes for which we use it, or the third parties with whom we share it — we will notify registered players via the email address associated with their Account and will display a prominent notice on the Platform for a reasonable period following the change.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with a material change, you may request Account closure in accordance with our Terms & Conditions.

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by mari88, please contact our data protection team through the following channels:

We commit to acknowledging all data protection enquiries within five (5) business days and to providing a substantive response within thirty (30) days.