Privacy Policy
How MegaKaya Protects Your Data

This Privacy Policy ("Policy") is issued by MegaKaya ("MegaKaya", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at megakaya.cam ("Platform"). This Policy governs how MegaKaya collects, processes, stores, and protects personal data relating to individuals who access or use our Platform ("you", "User", "Player").

MegaKaya is committed to handling your personal data with integrity, transparency, and appropriate security. We process personal data only for clearly defined and legitimate purposes, and we do not engage in any practice that involves selling, renting, or commercially sharing your personal information with unrelated third parties.

This Policy applies to all personal data processing activities carried out by MegaKaya in connection with the Platform, including account registration, identity verification, payment processing, customer support, and promotional communications. By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of this Privacy Policy, the following terms shall bear the meanings set out below:

MegaKaya collects the following categories of personal data, depending on your interaction with the Platform:

3.1 Registration & Account Data

• Full legal name
• Date of birth (to verify that you are 21 years of age or older)
• Residential address
• Email address
• Mobile phone number
• Username and encrypted password hash

3.2 Identity Verification (KYC) Data

• Government-issued identification number (e.g., Malaysian MyKad number)
• Copies of identification documents (front and back)
• Selfie or video for liveness verification where required
• Proof of address documentation where requested

3.3 Financial & Payment Data

• Payment method identifiers (e.g., registered Touch 'n Go eWallet number, Maybank account number, CIMB account details, DuitNow proxy)
• Transaction history including deposits, withdrawals, and wager records
• MYR balance information

3.4 Technical & Usage Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser information
• Session duration and navigation patterns on the Platform
• Game play logs and betting history
• Login timestamps and activity records

3.5 Communication Data

• Content of live chat conversations with our support team
• Email correspondence
• Feedback submitted through support channels

MegaKaya collects personal data through the following means:

1. Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or otherwise interact with the Platform.
2. Automatically — through cookies, server logs, and similar technologies when you access and navigate the Platform. This includes IP address, device information, and behavioural data.
3. From third-party payment providers — when you initiate a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or banking partners, relevant transaction confirmation data is passed to MegaKaya to reconcile your Account.
4. From identity verification service providers — where we use third-party KYC tools to assist in validating identity documents.

MegaKaya processes your personal data only for the specific, legitimate purposes described below:

MegaKaya processes personal data on the following legal grounds, depending on the nature and purpose of the processing activity:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions accepted by you, including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and regulatory record-keeping obligations.
• Legitimate interests: Processing carried out in MegaKaya's legitimate interests, including fraud prevention, Platform security, and service improvement — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing and promotional communications, where you have opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

MegaKaya does not sell, rent, or trade your personal data. We may share your personal data with third parties only in the limited circumstances described below:

• Payment service providers: Data necessary to process deposits and withdrawals is shared with authorised payment processors including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and the relevant banking institutions (Maybank, CIMB, Public Bank, Hong Leong Bank, RHB Bank).
• KYC and identity verification providers: Identity documents and verification data may be shared with authorised third-party KYC service providers solely for the purpose of conducting identity verification on MegaKaya's behalf.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory direction, MegaKaya may be required to disclose personal data to competent authorities. We will only do so to the extent legally required.
• Professional advisers: Legal counsel, auditors, and other professional service providers may have access to personal data strictly to the extent required to provide their services to MegaKaya, subject to appropriate confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of MegaKaya's business, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

MegaKaya's operations and certain technology infrastructure may involve the transfer of personal data to servers or service providers located outside of Malaysia. Where such transfers occur, MegaKaya takes steps to ensure that appropriate safeguards are in place to protect your personal data to a standard consistent with this Policy.

These safeguards may include contractual clauses requiring the recipient to maintain appropriate data security standards, or reliance on recognised equivalency frameworks where applicable. If you have questions about the safeguards applicable to a specific data transfer, please contact us using the details in Section 16.

MegaKaya retains personal data for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable law. The following general principles apply:

• Active Account data: Retained for the duration of your Account's active status.
• KYC and identity verification records: Retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulatory requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, consistent with applicable record-keeping obligations.
• Support and communication records: Retained for a period of two (2) years following the closure of each support interaction.
• Marketing opt-in records: Retained until you withdraw consent for marketing communications.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an individual.

MegaKaya uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you access the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cannot be disabled without significantly affecting Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, previously selected payment method, and display preferences.
• Analytics cookies: Used to collect anonymised data about how players navigate the Platform, which pages are visited most frequently, and where errors occur. This data is used to improve the Platform experience. MegaKaya does not use analytics data to build individual advertising profiles.

You may configure your browser to block or delete cookies. However, disabling strictly necessary cookies will impair your ability to use core Platform features including login and payment processing. Analytics and functional cookies can generally be blocked without affecting core functionality.

You hold meaningful rights over your personal data. MegaKaya is committed to facilitating the exercise of these rights in a timely and transparent manner. The rights available to you include:

To exercise any of the above rights, please contact MegaKaya's support team via live chat or at the email address provided in Section 16. We may require identity verification before processing data requests to protect your Account security. We will respond to all verified requests within a reasonable timeframe and, where feasible, within 30 days of receipt.

MegaKaya's Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data from individuals below this age threshold. Age verification is conducted as a mandatory step in our KYC process.

If MegaKaya becomes aware that personal data has been collected from an individual who does not meet our minimum age requirement, the relevant Account will be immediately suspended, all collected data will be deleted, and any funds deposited will be returned to the source payment method where possible. If you believe that a minor has registered an Account on MegaKaya, please contact our support team immediately.

MegaKaya implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and MegaKaya's servers.
• Encrypted password storage — passwords are never stored in plain text. Only cryptographic hashes are retained.
• Access controls — access to personal data by MegaKaya staff is granted on a strict need-to-know basis, with access logs maintained and regularly reviewed.
• Two-factor authentication (2FA) — available to all players and recommended for all Account holders.
• Regular security assessments — the Platform undergoes periodic security reviews to identify and address vulnerabilities.

Notwithstanding these measures, no method of electronic transmission or storage is 100% secure. MegaKaya cannot guarantee absolute security, but undertakes to promptly notify affected players in the event of a data breach that is likely to result in a material risk to their rights or interests.

The MegaKaya Platform does not contain links to third-party websites for general browsing purposes. Where third-party payment processors — such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX banking interfaces — are invoked during the deposit or withdrawal process, you will be interacting directly with those providers' own interfaces.

MegaKaya is not responsible for the privacy practices of those third-party services. We recommend that you review the privacy policies of any third-party payment provider you interact with. The MegaKaya Privacy Policy applies solely to data collected and processed by MegaKaya itself.

MegaKaya reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify registered players by email or by posting a prominent notice on the Platform prior to the change taking effect. The "Last Reviewed" date at the top of this page will be updated to reflect each revision.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. We encourage you to review this Policy periodically to remain informed of how we handle your personal data.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or have a concern regarding how your personal data is being handled by MegaKaya, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the MegaKaya Platform — the fastest way to reach our support team.
• Email: [email protected] (displayed as plain text — not a clickable link)

MegaKaya's support team serves players across all of Malaysia — including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, and Shah Alam. We aim to acknowledge all privacy-related enquiries within one (1) business day and to resolve them as promptly as possible.