miga88 Privacy Policy

1. About This Privacy Policy

This Privacy Policy ("Policy") applies to all personal data processed by miga88 ("we," "us," or "our") in connection with your use of the miga88 platform, accessible at miga88.co and its associated subdomains and services ("Platform").

miga88 acts as the data controller in respect of the personal data described in this Policy. This means we determine the purposes and means by which your personal data is processed. Where we engage third parties to process data on our behalf, those parties act as data processors and are contractually bound to process data only on miga88's instructions and in accordance with applicable data protection requirements.

This Policy should be read alongside the miga88 Terms & Conditions, which are available at miga88.co/terms-conditions. By using the miga88 Platform, you acknowledge that you have read and understood this Policy.

2. Personal Data We Collect

miga88 collects the following categories of personal data, depending on how you interact with the Platform:

We collect only the data that is necessary for the purposes described in this Policy. We do not knowingly collect sensitive personal data (such as health information or biometric data) except where specifically required for responsible gaming compliance (e.g., vulnerability assessments) and where you have provided explicit consent.

3. How We Collect Personal Data

miga88 collects personal data through the following means:

• Direct collection — information you provide when registering your miga88 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account profile.
• Automated collection — technical and usage data collected automatically via cookies, log files, and similar tracking technologies when you access and interact with the miga88 Platform.
• Third-party sources — identity verification data from licensed KYC and anti-money laundering (AML) service providers; fraud and risk data from payment processors; and publicly available data where relevant to regulatory compliance obligations.
• Payment processors — transaction confirmation data from Touch 'n Go eWallet, DuitNow, Boost, FPX banking partners, and card payment networks when you deposit or withdraw funds.

4. Purposes of Processing

miga88 processes your personal data for the following purposes:

• To create, manage, and administer your miga88 account, including identity verification and KYC compliance.
• To process deposits, withdrawals, and in-platform transactions via your chosen payment method (Touch 'n Go eWallet, DuitNow, Boost, FPX, card payments, etc.).
• To provide access to and operate the miga88 gaming products, including the Sportsbook, Live Casino, Slots, Toto 4D, and Table Games.
• To comply with our legal and regulatory obligations, including anti-money laundering (AML) requirements, responsible gaming obligations, and reporting requirements imposed by our licensing authority.
• To detect, investigate, and prevent fraud, cheating, money laundering, and other prohibited conduct.
• To operate and improve responsible gaming tools including deposit limits, loss limits, session controls, and self-exclusion facilities.
• To communicate with you about your account, transactions, security alerts, and service updates.
• To send marketing communications (with your consent or where a legitimate interest applies), including promotional offers, bonus notifications, and platform updates. You may opt out at any time.
• To analyse Platform usage and improve the miga88 user experience through aggregated, anonymised analytics.
• To respond to and resolve customer support enquiries.

5. Legal Basis for Processing

miga88 processes your personal data on the following legal bases:

• Performance of a contract — processing necessary to provide the miga88 services to you under the Terms & Conditions you have accepted (account management, payment processing, game provision).
• Legal obligation — processing necessary to comply with AML regulations, KYC requirements, responsible gaming obligations, and regulatory reporting requirements imposed by our licensing authority.
• Legitimate interests — processing for fraud prevention, platform security, abuse detection, internal analytics, and service improvement, where these interests are not overridden by your data protection rights.
• Consent — processing for marketing communications (where applicable) and the use of non-essential cookies. You may withdraw consent at any time.

6. Data Sharing and Disclosure

miga88 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. miga88 may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment service providers — Touch 'n Go eWallet (TnG Digital Sdn Bhd), Boost, GrabPay, DuitNow, FPX banking partners, Visa, and Mastercard, for the processing of deposits and withdrawals.
• Identity verification and KYC providers — licensed third-party services that verify your identity documents and conduct AML screening as required by our regulatory obligations.
• Game content providers — licensed studios such as Pragmatic Play, PG Soft, Spadegaming, and Evolution Gaming, to the extent necessary to provide access to their gaming products within the miga88 Platform.
• IT and infrastructure providers — cloud hosting, content delivery, and cybersecurity service providers operating under contractual data processing agreements.
• Regulatory and law enforcement authorities — where required by applicable law, court order, or a request from a competent authority.
• Professional advisers — lawyers, auditors, and accountants operating under legal professional privilege and confidentiality obligations.

7. International Data Transfers

Some of miga88's service providers and game content partners are located outside Malaysia. Where personal data is transferred to countries that may not provide an equivalent level of data protection, miga88 ensures that appropriate safeguards are in place, such as contractual clauses requiring the recipient to protect personal data to a standard consistent with applicable data protection principles.

8. Data Retention

miga88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the satisfaction of legal, regulatory, accounting, and reporting obligations. In general:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in accordance with AML and regulatory record-keeping requirements.
• KYC documents are retained for the period required by our licensing authority, typically five (5) years from the date of verification or account closure, whichever is later.
• Self-exclusion records are retained for the duration of the exclusion period and for a further five (5) years to prevent re-registration during the exclusion period.
• Customer support communications are retained for three (3) years from the date of the last interaction.
• Technical and usage data collected via cookies is retained in accordance with the cookie retention periods set out in our cookie settings, typically no longer than 13 months.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised.

9. Cookies and Tracking Technologies

miga88 uses cookies and similar tracking technologies (including pixel tags and local storage) on the Platform for the following purposes:

• Essential cookies — strictly necessary for the operation of the Platform, including maintaining your miga88 login session, security tokens, and load balancing. These cannot be disabled without affecting Platform functionality.
• Functional cookies — remember your preferences such as language settings, previously played games, and display preferences.
• Analytics cookies — collect aggregated, anonymised data about how visitors use the miga88 Platform, which pages are most visited, and where users encounter difficulties, to help us improve the experience.
• Marketing cookies — used (with your consent) to deliver relevant promotional content and track the effectiveness of miga88's marketing activities.

You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies will affect your ability to use the miga88 Platform normally, including the miga88 login function.

10. Your Data Protection Rights

Subject to applicable law and regulatory limitations, you have the following rights in relation to your personal data held by miga88:

• Right of access — request a copy of the personal data miga88 holds about you.
• Right to rectification — request correction of inaccurate or incomplete personal data.
• Right to erasure — request deletion of your personal data in certain circumstances, subject to overriding legal and regulatory retention obligations.
• Right to restriction — request that miga88 restricts the processing of your data in certain circumstances.
• Right to data portability — receive your personal data in a structured, commonly used machine-readable format where technically feasible.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact miga88's data protection team at the contact address set out in Section 15 of this Policy. miga88 will respond to verified requests within 30 days. We may require identity verification before processing your request.

11. Children's Privacy

The miga88 Platform is strictly not intended for or directed at individuals under the age of 21. miga88 does not knowingly collect personal data from anyone under 21 years of age. If miga88 becomes aware that personal data has been collected from a person under 21, such data will be deleted and the associated account suspended immediately. If you believe that a person under the age of 21 has provided personal data to miga88, please contact us immediately.

12. Security Measures

miga88 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and the miga88 Platform.
• One-way cryptographic hashing of account passwords — passwords are never stored in plaintext.
• Tokenisation of financial data — payment card and e-wallet credentials are replaced with secure tokens and never stored in raw form on miga88 servers.
• Access control policies restricting database and system access to authorised personnel only.
• Regular security assessments, penetration testing, and vulnerability scanning.
• SMS OTP two-factor authentication available to all miga88 members and enforced for sensitive account actions.
• Login attempt monitoring and account lockout policies to prevent brute-force attacks.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights, miga88 will notify affected individuals and relevant authorities in accordance with applicable regulatory requirements.

13. Third-Party Links

The miga88 Platform may contain references to third-party services (such as payment processors and game providers). miga88 is not responsible for the privacy practices of third parties and encourages you to review the privacy policies of any third-party services you interact with in connection with your miga88 account.

14. Changes to This Privacy Policy

miga88 reserves the right to update or modify this Privacy Policy at any time. The revised Policy will be published at miga88.co/privacy-policy with the updated effective date. For material changes affecting how we process your personal data, miga88 will endeavour to provide notice to registered members. Your continued use of the miga88 Platform after publication of a revised Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

15. Contact & Data Requests

For privacy-related enquiries, data subject access requests, or to exercise any of your data protection rights, please contact the miga88 data protection team: