How mega338 Handles Your Data
Six core commitments that define how we treat your personal information on every interaction with the platform.
Data Minimisation
We collect only the personal data that is strictly necessary for account operation, identity verification, fraud prevention, and regulatory compliance. We do not collect data speculatively or beyond what each defined purpose requires.
No Data Selling
mega338 does not sell, rent, or trade your personal information to third parties for marketing purposes. Your data belongs to you. We share it only where legally required or where your explicit consent has been obtained.
Encryption & Security
All personal data transmitted between your device and our platform is protected by industry-standard 256-bit SSL encryption. Data at rest is stored in secured, access-controlled environments with strict internal authorisation policies.
Your Rights, Respected
You have the right to access, correct, export, and request deletion of your personal data at any time. Requests are processed by our data team within a reasonable timeframe. Contact us via live chat or email to exercise your rights.
Defined Retention Periods
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Account data is typically retained for a defined period following account closure.
Transparent Updates
When this Privacy Policy is materially amended, registered players are notified via the platform or by email. We maintain a clear version history and effective date at the top of this document so you always know the current status.
Introduction
This Privacy Policy ("Policy") is published by mega338 ("we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://mega338.lat ("the Platform"). This Policy governs the collection, processing, storage, use, and disclosure of personal data relating to individuals who access or use the Platform ("Players", "Users", "You").
mega338 is committed to protecting the privacy and personal data of all users. We process personal data in accordance with internationally recognised data protection principles, including the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.
By registering an Account with mega338, accessing the Platform, or otherwise engaging with our services, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. This Policy should be read alongside our Terms & Conditions, which are incorporated herein by reference.
This Policy was last updated on 1 January 2026. If you have any concerns about how your data is handled, please contact our data team at [email protected] before using the Platform.
Definitions
The following defined terms are used throughout this Privacy Policy:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, or online identifiers. |
| Processing | Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction. |
| Data Controller | The entity that determines the purposes and means of processing personal data. For all Platform users, mega338 is the Data Controller. |
| Data Processor | A third party that processes personal data on behalf of mega338 under a data processing agreement, such as a payment gateway or identity verification service. |
| Consent | A freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data. |
| KYC | Know Your Customer — the mandatory identity verification process applied to all Account holders for regulatory and fraud prevention compliance. |
| Cookies | Small text files placed on your device by the Platform to enable functionality, session management, analytics, and personalisation. |
Data Controller Details
The Data Controller responsible for your personal data is mega338, the operator of the Platform at https://mega338.lat. mega338 operates under an international online gaming licence and is incorporated in its operating jurisdiction.
For all data protection related enquiries, rights requests, or complaints, you may contact mega338's designated data contact via our support channels:
- Live Chat: Available 24 hours a day, 7 days a week via the Platform interface — the fastest method for urgent privacy-related matters.
- Email: [email protected] — for formal data subject access requests or written complaints. Allow up to 30 days for a full written response.
Players accessing the Platform from Malaysia should note that Malaysia's Personal Data Protection Act 2010 (PDPA) may apply to certain data processing activities. mega338 strives to maintain data handling standards consistent with globally recognised privacy frameworks, including but not limited to the General Data Protection Regulation (GDPR) principles, as a baseline standard.
Personal Data We Collect
mega338 collects personal data in the following categories, depending on how you interact with the Platform:
4.1 Registration & Identity Data
- Full legal name as it appears on government-issued identification.
- Date of birth (used for 21+ age verification).
- Email address and mobile phone number.
- Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).
- Username and encrypted password credentials.
4.2 Identity Verification (KYC) Data
- Copies of government-issued photo identification (e.g., MyKad, Passport).
- Proof of residential address documents.
- Source-of-funds documentation where required by our compliance framework.
- Biometric or selfie verification data where required by our identity verification provider.
4.3 Financial & Transaction Data
- Payment method details (e.g., bank account details for Maybank, CIMB, Public Bank, Hong Leong FPX transfers; e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow).
- Transaction history including deposits, withdrawals, and bonus credits.
- Cryptocurrency wallet addresses where applicable.
4.4 Technical & Usage Data
- IP address and device identifiers.
- Browser type, version, and operating system.
- Platform session data including login timestamps, session duration, and pages accessed.
- Geolocation data at the jurisdiction level (country/region, not precise GPS).
- Game and betting activity logs for integrity monitoring and dispute resolution.
4.5 Communications Data
- Records of live chat transcripts, email correspondence, and support ticket history.
- Feedback, survey responses, and account preferences you provide voluntarily.
We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, or health data, unless directly relevant to a responsible gambling assessment requested by the Player.
Purposes of Processing & Legal Basis
mega338 processes your personal data only for defined, legitimate purposes. The table below sets out the primary processing activities, their purpose, and the applicable legal basis:
| Purpose | Description | Legal Basis |
|---|---|---|
| Account Management | Creating, maintaining, and administering your Account and related services. | Contractual necessity |
| Identity Verification (KYC) | Verifying your identity, age (21+), and eligibility to use the Platform. | Legal obligation / Contractual necessity |
| Payment Processing | Processing deposits and withdrawals via MYR-denominated payment methods. | Contractual necessity |
| Fraud Prevention | Detecting, investigating, and preventing fraudulent transactions, bonus abuse, and money laundering. | Legitimate interest / Legal obligation |
| Regulatory Compliance | Meeting obligations under our gaming licence and applicable laws, including record-keeping requirements. | Legal obligation |
| Customer Support | Responding to your enquiries, complaints, and support requests. | Contractual necessity / Legitimate interest |
| Responsible Gambling | Monitoring gameplay patterns for signs of problematic behaviour and administering self-exclusion tools. | Legal obligation / Legitimate interest |
| Platform Improvement | Analysing aggregated usage data to improve platform performance, user experience, and product offerings. | Legitimate interest |
| Marketing Communications | Sending promotional offers, bonus notifications, and platform updates to opted-in Players. | Consent |
Data Sharing & Disclosure
mega338 does not sell, rent, or commercially share your personal data with third parties for their own marketing purposes. We disclose personal data only in the following limited circumstances:
6.1 Service Providers and Data Processors
We engage third-party service providers acting as Data Processors to support the operation of the Platform. These include:
- Payment gateway and e-wallet processors (including DuitNow, FPX, and e-wallet providers such as Touch 'n Go eWallet, Boost, and GrabPay).
- Identity verification and KYC technology providers.
- Cloud hosting and data centre infrastructure providers.
- Cybersecurity and fraud detection service providers.
- Customer support platform providers.
All Data Processors are bound by contractual data processing agreements that restrict their use of your data to the specific services they provide to mega338 and prohibit any independent use or disclosure.
6.2 Legal and Regulatory Disclosures
mega338 may disclose personal data to competent authorities, regulators, or law enforcement bodies where required to do so by applicable law, court order, or binding regulatory requirement. This includes anti-money laundering (AML) reporting obligations under our gaming licence conditions.
6.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets involving mega338, personal data held about Platform users may be transferred to the acquiring entity as part of that transaction. Players will be notified prior to any such transfer where required by applicable law.
mega338 will never proactively disclose your personal data to third parties for purposes other than those described in this Policy without your explicit prior consent.
International Data Transfers
mega338 operates as an international platform. As such, personal data collected from Malaysian players may be transferred to, stored in, and processed in jurisdictions outside Malaysia. These may include the jurisdiction in which mega338 is incorporated and licenced, as well as the locations of our third-party service providers.
Where personal data is transferred internationally, mega338 takes steps to ensure that appropriate data protection safeguards are in place, including contractual clauses that require the recipient to handle data with equivalent protections to those described in this Policy.
By registering an Account and using the Platform, Malaysian players explicitly consent to the international transfer of their personal data for the purposes described in this Policy.
Data Retention Periods
mega338 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as is required by applicable law or our gaming licence obligations. The following indicative retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account Registration Data | Duration of active Account, plus 5 years following Account closure. |
| KYC Identity Documents | Duration of active Account, plus 7 years following Account closure (regulatory requirement). |
| Financial Transaction Records | 7 years from the date of each transaction (AML compliance requirement). |
| Support & Chat Records | 3 years from the date of each support interaction. |
| Technical Usage Logs | 12 months from the date of generation, unless required for an ongoing investigation. |
| Marketing Consent Records | Duration of consent, plus 3 years from consent withdrawal for audit purposes. |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data lifecycle management procedures.
Security Measures
mega338 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These include:
- Encryption in Transit: All data transmitted between your device and our platform is encrypted using TLS (Transport Layer Security) with 256-bit SSL certificates.
- Encryption at Rest: Sensitive data fields stored in our databases, including financial data and identity document references, are encrypted using industry-standard algorithms.
- Access Controls: Access to personal data within mega338 is restricted on a strict need-to-know basis. All internal access is logged and subject to periodic audit.
- Two-Factor Authentication: Account holders are offered two-factor authentication (2FA) as an additional layer of login security.
- Vulnerability Management: Our security team conducts regular penetration testing, vulnerability assessments, and security patches on an ongoing basis.
- Incident Response: mega338 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected players in accordance with our regulatory obligations.
While mega338 implements robust security controls, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials. Suspected unauthorised access should be reported to us immediately.
Cookies & Tracking Technologies
mega338 uses cookies and similar tracking technologies on the Platform to enable core functionality, maintain your session, and gather aggregated analytics data that helps us improve the user experience for players across Malaysia.
The following categories of cookies are used on the Platform:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Essential for the Platform to function. Enables login sessions, security tokens, and page navigation. | Session |
| Functional | Remembers your preferences (language, currency display, notification settings) for a more personalised experience. | Up to 12 months |
| Analytics | Collects aggregated, anonymised data on Platform usage patterns to inform product improvements. No personally identifiable data is associated. | Up to 24 months |
| Security | Supports fraud detection, bot prevention, and account integrity monitoring. | Session to 6 months |
Strictly necessary and security cookies cannot be disabled as they are essential to Platform operation. You may manage functional and analytics cookies through your browser settings. Disabling non-essential cookies will not affect your ability to access and use the Platform.
Your Data Subject Rights
As a data subject, you hold a number of rights in relation to your personal data held by mega338. These rights are described below, along with how you may exercise them:
Right of Access
Request a copy of all personal data mega338 holds about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data where no legal basis for retention exists.
Right to Restriction
Request that processing of your data be limited in certain circumstances.
Right to Portability
Receive a structured, machine-readable copy of data you have provided to us.
Right to Object
Object to processing based on legitimate interests, including direct marketing.
To exercise any of the above rights, please contact our support team via live chat or at [email protected]. We will acknowledge your request within 5 business days and respond in full within 30 days. Where a request is complex or numerous, this period may be extended by a further 60 days with prior notification.
Please note that certain rights are subject to exceptions. For example, the right to erasure does not apply where we are required to retain data for regulatory compliance — such as KYC records required under our gaming licence conditions.
Minors & Age Verification
The mega338 Platform is strictly prohibited for use by individuals under the age of 21 years. We do not knowingly collect personal data from anyone under this age threshold.
All Account registrations are subject to mandatory age verification as part of the KYC process. Where mega338 becomes aware that personal data has been collected from an individual who is under 21 years of age, that data will be deleted promptly and the Account will be permanently closed.
Parents and guardians who believe that a minor has registered an Account or provided personal data to mega338 should contact us immediately at [email protected] so that the matter can be investigated and resolved without delay.
For players aged 21 and above only. Providing false date of birth information during registration constitutes a material breach of our Terms & Conditions and may result in permanent Account closure and forfeiture of all funds.
Amendments to This Policy
mega338 reserves the right to amend, update, or replace any provision of this Privacy Policy at any time. The "Last Updated" date displayed at the top of this page will reflect the date on which the most recent material revision was made.
Where amendments are material — meaning they substantially change how your personal data is collected or used — mega338 will make reasonable efforts to notify registered Players via the Platform notification system or by email to the address associated with your Account. It remains your responsibility to review this Policy periodically.
Your continued use of the Platform following the posting of any revised Privacy Policy constitutes your acceptance of those revisions. If you do not agree to the amended Policy, you should cease use of the Platform and contact our support team to close your Account.
Contact Us
For any questions, concerns, data subject rights requests, or formal complaints in relation to this Privacy Policy or mega338's data handling practices, please contact us through the following channels:
- Live Chat: Available 24 hours a day, 7 days a week via the Platform. This is the most efficient method for time-sensitive privacy matters such as urgent data deletion or suspected data breach reports.
- Email: [email protected] — for formal data subject access requests, written complaints, or policy clarification queries. Please include "Privacy Request" in your subject line. We aim to acknowledge all emails within 5 business days and provide a substantive response within 30 days.
mega338 serves players across Malaysia including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and beyond. Our support team is available in English around the clock and is trained to handle privacy-related enquiries with appropriate confidentiality and care.
If you are unsatisfied with mega338's response to a privacy concern, you may have the right to escalate your complaint to a relevant data protection authority in your jurisdiction. In Malaysia, this would be the Department of Personal Data Protection (JPDP) under the Personal Data Protection Act 2010.