mahkota8 Privacy Policy

mahkota8 ("mahkota8", "we", "us", "our") operates the online gaming platform accessible at mahkota8.win ("Platform"). This Privacy Policy describes how mahkota8 collects and processes personal data relating to individuals who register accounts, access games, transact, or otherwise interact with the Platform ("you", "your", "Player").

mahkota8 takes the privacy of its players seriously. We collect only the personal data that is necessary to provide our services, fulfil our regulatory obligations, and improve the Platform experience. We do not sell personal data to third parties for their own marketing purposes.

By registering a mahkota8 account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Policy should be read alongside the mahkota8 Terms & Conditions and Responsible Gaming Policy.

Last Updated: 1 January 2026.

mahkota8 collects personal data through several channels: directly from you during registration and gameplay, automatically through your use of the Platform, and from third-party service providers where permitted. The categories of personal data we collect include:

mahkota8 does not collect special category data (as defined under applicable data protection law) except where required by our regulatory obligations — for example, where a player discloses a gambling-related vulnerability in the context of a responsible gaming interaction.

mahkota8 uses the personal data it collects for the following purposes:

• Account Management: To create, verify, and administer your mahkota8 account, including processing your registration, authenticating your identity at login, and managing account preferences.
• Service Delivery: To provide access to the mahkota8 gaming lobby, process deposits and withdrawals in MYR, settle bets, and deliver bonus and promotional entitlements to your account.
• Regulatory Compliance: To fulfil mahkota8's KYC, AML, and responsible gaming obligations under our international gaming licence, including age verification, identity verification, and transaction monitoring.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, collusion, bonus abuse, money laundering, and unauthorised account access.
• Customer Support: To respond to your enquiries, process complaints, and maintain records of support interactions for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour and to administer player protection tools including deposit limits and self-exclusion.
• Platform Improvement: To analyse aggregated usage data and improve the functionality, game library, and user experience of the mahkota8 Platform.
• Marketing Communications: Where you have provided consent or where we have a legitimate interest, to send you information about mahkota8 promotions, new games, and relevant offers. You may opt out of marketing communications at any time via your account settings.

mahkota8 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our obligations under the mahkota8 Terms & Conditions, including account management, gameplay, and payment processing.
• Legal Obligation: Processing required to comply with our obligations under applicable gaming licence conditions, AML regulations, and KYC requirements.
• Legitimate Interests: Processing carried out for mahkota8's legitimate business interests, including fraud prevention, security monitoring, and Platform improvement, where these interests are not overridden by your data protection rights.
• Consent: Processing for optional purposes such as marketing communications, where we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

mahkota8 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following circumstances and with the following categories of recipients:

• Game Providers: Technical data and session identifiers are shared with licensed game providers (e.g., live casino studio operators, slot providers) to the minimum extent necessary to deliver game sessions and resolve disputes.
• Payment Processors: Financial data is shared with payment processors including FPX-connected banks, Touch 'n Go eWallet, Boost, and card payment networks to facilitate deposits and withdrawals in MYR.
• KYC & AML Service Providers: Identity and document data may be shared with third-party identity verification providers to fulfil our KYC obligations under our gaming licence.
• Fraud Prevention Services: Technical and usage data may be shared with fraud detection and cybersecurity service providers to protect the integrity of the mahkota8 Platform.
• Regulatory Authorities: mahkota8 may be required to disclose personal data to gaming regulators, law enforcement agencies, or other competent authorities in response to lawful requests or as required by our licence conditions.
• Professional Advisers: Legal, audit, and compliance advisers who are bound by professional confidentiality obligations may access personal data where necessary in the course of providing their services.

All third-party service providers with whom mahkota8 shares personal data are required to process that data only for the specified purpose, in accordance with our instructions, and under contractual data protection obligations consistent with applicable law.

The mahkota8 Platform uses cookies and similar tracking technologies to support Platform functionality, maintain your login session, and analyse usage patterns. The categories of cookies used include:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, game lobby filters, and responsible gaming tool configurations.
• Analytics Cookies: Used to collect aggregated data about how players use the mahkota8 Platform, enabling us to identify pages with technical issues and improve the overall experience. Analytics data is processed in aggregated, anonymised form where possible.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies may prevent certain features of the mahkota8 Platform from functioning correctly. mahkota8 does not use advertising or cross-site tracking cookies.

mahkota8 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or our gaming licence conditions.

As a general rule, mahkota8 applies the following retention periods:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Support Communications: Retained for a minimum of three (3) years from the date of the interaction.
• Marketing Consent Records: Retained until withdrawal of consent plus one (1) year to evidence compliance.

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with mahkota8's data disposal procedures.

mahkota8 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• SSL/TLS encryption on all pages of the mahkota8 Platform for data in transit.
• Encryption of sensitive data fields (including financial data and authentication credentials) at rest.
• Role-based access controls limiting internal access to personal data to personnel with a legitimate operational need.
• Regular security assessments and penetration testing of Platform infrastructure.
• Incident response procedures to detect, contain, and report data security incidents in a timely manner.

Notwithstanding these measures, no transmission of data over the internet or electronic storage system is guaranteed to be completely secure. mahkota8 cannot warrant absolute security, but we are committed to maintaining appropriate safeguards and continuously reviewing our security posture.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, mahkota8 will notify affected players in accordance with the notification obligations applicable under our licensing framework.

Subject to applicable data protection law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights in relation to your personal data held by mahkota8:

• Right of Access: The right to request a copy of the personal data mahkota8 holds about you and information about how it is processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to retention obligations that override this right.
• Right to Restriction: The right to request that mahkota8 restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: The right to receive personal data you have provided to mahkota8 in a structured, commonly used, machine-readable format.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting prior processing.

To exercise any of these rights, please contact mahkota8 via live chat or email at [email protected]. We will respond to verified requests within 30 days. We may need to verify your identity before processing your request.

mahkota8 operates under international gaming licensing and its infrastructure, service providers, and data processors may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, mahkota8 takes steps to ensure that appropriate safeguards are in place, including contractual data protection obligations with receiving parties consistent with applicable data protection standards.

By using the mahkota8 Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside your country of residence. mahkota8 will take reasonable steps to ensure that any such transfer is carried out in a manner consistent with the protections described in this Privacy Policy.

The mahkota8 Platform is strictly restricted to individuals who are 21 years of age or older. mahkota8 does not knowingly collect personal data from individuals under the age of 21. If mahkota8 becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, that data will be deleted and the associated account will be permanently closed with any balance forfeited.

If you have reason to believe that a person under the age of 21 has provided personal data to mahkota8, please contact us immediately at [email protected].

mahkota8 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, Platform features, or applicable law. Material changes will be communicated to registered players via email to their registered address or via a prominent notice on the Platform prior to the change taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the mahkota8 Platform following notification of a material change constitutes acknowledgement of the revised Policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or mahkota8's handling of your personal data, please contact our support team through the following channels:

• Live Chat: Available 24/7 via the on-site widget. Average response time: 3–5 minutes.
• Email: [email protected] — responses within 24 hours on business days.

mahkota8 will investigate all data privacy complaints and respond within 30 days. If you are not satisfied with the outcome of mahkota8's internal complaints process, you may refer your complaint to the relevant supervisory authority or gaming regulatory body applicable under mahkota8's international gaming licence.