mega63 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how mega63 ("mega63", "we", "us", "our") collects, processes, stores, discloses, and protects personal data in connection with your use of the mega63 platform accessible at mega63.app and all associated services (collectively, the "Platform"). This Policy applies to all registered players, visitors to the Platform, and any individual whose personal data is submitted to mega63 in connection with account registration, KYC verification, payment transactions, or support interactions. By using the Platform, you confirm your acceptance of this Policy as updated from time to time.

mega63 is committed to handling personal data in accordance with applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. We do not engage in the sale of personal data to third parties.

2. Data Controller

mega63 acts as the data controller with respect to personal data collected from Players and visitors through the Platform. For all data protection enquiries, including requests to exercise data subject rights, please contact our data protection team via [email protected] or through the live chat facility on the Platform.

3. Personal Data We Collect

mega63 collects the following categories of personal data:

3.1 Identity Data

• Full legal name as appearing on a government-issued identification document.
• Date of birth (for age verification purposes — Players must be 21 or older).
• Nationality and country of residence.
• Copies of government-issued photo identification (e.g., Malaysian MyKad, passport) submitted during KYC verification.
• Proof of address documentation (e.g., utility bill, bank statement).

3.2 Contact Data

• Email address registered to the Account.
• Mobile phone number registered to the Account.

3.3 Financial Data

• E-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay) used for deposits or withdrawals.
• Bank account numbers (for FPX and bank transfer transactions).
• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers.
• Wagering and gaming activity records.

3.4 Technical Data

• IP address and approximate geolocation at time of login and transaction.
• Device type, operating system, browser type, and version.
• Session duration and Platform usage activity logs.

3.5 Communications Data

• Records of live chat, email, and WhatsApp support communications submitted to mega63.
• Feedback, survey responses, and complaint records.

4. How We Collect Personal Data

mega63 collects personal data through the following means:

• Direct submission: Information you provide during account registration, KYC verification, payment transactions, or when contacting support.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, and usage logs, via cookies and server-side logging.
• Third-party sources: Identity verification data may be supplemented by information from KYC and anti-money-laundering verification service providers in connection with our regulatory compliance obligations.

5. Purposes and Legal Basis for Processing

mega63 processes personal data for the following purposes and on the following legal bases:

• Account creation and management — Performance of contract. We process identity and contact data to establish and administer your Account.
• Age and identity verification (KYC) — Legal obligation. Gaming regulations require us to verify that all Players are aged 21 or above and to conduct anti-money-laundering checks before processing withdrawals.
• Payment processing — Performance of contract. We process financial data to credit deposits and process withdrawal requests.
• Responsible gaming — Legitimate interest / legal obligation. We process gaming activity data to identify and respond to indicators of problem gambling behaviour, consistent with our responsible gaming obligations.
• Platform security and fraud prevention — Legitimate interest. We process technical data to detect and prevent unauthorised access, fraud, and abuse of the Platform.
• Regulatory compliance and legal proceedings — Legal obligation / legitimate interest. We retain transaction and identity records for the periods required by applicable gaming authority and anti-money-laundering regulations.
• Customer support — Performance of contract / legitimate interest. We process communications data to provide support services.
• Marketing communications — Consent. We send promotional emails and notifications only to players who have opted in to receive them.

6. Disclosure of Personal Data

mega63 does not sell personal data to third parties. We may disclose personal data to the following categories of recipients, in each case subject to contractual data protection obligations:

• Payment service providers: E-wallet operators (Touch 'n Go eWallet, Boost, GrabPay) and banking networks (FPX) to process deposits and withdrawals.
• KYC and AML service providers: Identity verification and anti-money-laundering screening providers engaged to fulfil our regulatory obligations.
• Game software providers: Game studios whose titles are accessible on the Platform may receive technical session data necessary to deliver game content.
• IT and infrastructure providers: Cloud hosting, security monitoring, and communications platform providers engaged to operate the Platform infrastructure.
• Regulatory authorities: Gaming authorities, financial intelligence units, and law enforcement agencies where disclosure is required by applicable law, court order, or regulatory directive.

7. International Data Transfers

Some of the service providers engaged by mega63 may process personal data outside Malaysia. Where personal data is transferred internationally, mega63 ensures that appropriate safeguards are in place, including contractual data processing agreements incorporating standard data protection clauses, to ensure that the data receives a level of protection equivalent to that applicable in Malaysia. Transfers to recipients in jurisdictions that do not provide an adequate level of data protection are conducted only with appropriate contractual safeguards in place.

8. Data Retention

mega63 retains personal data for the following minimum periods, or for longer if required by applicable law or ongoing regulatory proceedings:

• Account and identity data: For the duration of the Account relationship and for a minimum of five (5) years following Account closure, as required by anti-money-laundering regulations applicable to gaming operators.
• Transaction and gaming activity records: A minimum of five (5) years from the date of the transaction.
• Support communications: Three (3) years from the date of the most recent communication in each thread.
• Technical and access logs: Twelve (12) months on a rolling basis, unless extended in connection with a security investigation.

Following expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

9. Cookies and Tracking Technologies

mega63 uses the following categories of cookies and similar technologies on the Platform:

• Strictly necessary cookies: Required for Platform functionality, including session authentication, login state management, and security token validation. These cannot be disabled without impairing Platform operation.
• Analytics cookies: Aggregate, anonymised usage statistics collected to understand how players navigate the Platform and to improve user experience. Individual player activity is not profiled for advertising purposes.
• Preference cookies: Store non-sensitive interface preferences such as language selection and display settings.

mega63 does not use behavioural advertising cookies or share cookie data with advertising networks. You may manage or disable non-essential cookies through your browser settings, though this may affect some Platform functionality.

10. Security Measures

mega63 implements the following technical and organisational security measures to protect personal data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and mega63 servers.
• AES-256 encryption for personal and financial data stored at rest in our databases.
• Role-based access controls ensuring that staff access to personal data is restricted to personnel with a legitimate operational need.
• Two-factor authentication required for all internal administrative access to systems holding personal data.
• Regular third-party penetration testing and vulnerability assessments.
• Incident response procedures for personal data breaches, including regulatory notification where required.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their mega63 Account.

11. Your Data Subject Rights

Subject to applicable law and regulatory retention requirements, Players and visitors have the following rights in respect of personal data held by mega63:

• Right of access: You may request a copy of the personal data mega63 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to regulatory retention obligations that may require us to retain certain data.
• Right to restriction: You may request that processing of your personal data be restricted pending resolution of an accuracy dispute or objection.
• Right to data portability: You may request a machine-readable copy of personal data you have provided to mega63 for processing based on contract or consent.
• Right to object: You may object to processing based on legitimate interests, including direct marketing.

To exercise any of the above rights, contact the mega63 support team via live chat or at [email protected]. We will respond to verified requests within 30 days. Identity verification will be required before processing any data subject request.

12. Children and Minors

The mega63 Platform is strictly intended for individuals aged 21 and above. mega63 does not knowingly collect personal data from individuals under the age of 21. If mega63 determines that a registered account is held by or on behalf of an individual under the age of 21, the Account will be immediately suspended, any balance forfeited, and all personal data associated with the Account will be deleted. If you believe a minor has registered an account on the Platform, please notify us immediately at [email protected].

13. Marketing Communications

mega63 will only send promotional emails, SMS messages, or in-Platform notifications to players who have opted in to receive marketing communications. You may withdraw your marketing consent at any time by updating your communication preferences in Account settings or by contacting support. Withdrawal of marketing consent does not affect the lawfulness of processing conducted prior to the withdrawal, and does not affect processing conducted on other legal bases such as contract performance or legal obligation.

14. Changes to This Privacy Policy

mega63 reserves the right to update this Privacy Policy at any time. Where changes are material, registered Account holders will be notified via the email address on file at least seven (7) days before the changes take effect. The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Policy. We encourage Players to review this Policy periodically.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mega63, please contact us via:

• Live chat: Available 24/7 on the mega63 Platform (avg. response under 5 minutes)
• Email: [email protected]

Please do not include sensitive account credentials (passwords, full card numbers) in email correspondence. Our support team will never ask for your password.