Privacy Policy — How MeritBet Handles Your Personal Data

1. Introduction

MeritBet ("we", "us", "our", "the Platform") is the operator of the online gaming and sports betting platform accessible at meritbet.click. We take the privacy and data security of our users ("you", "the Player", "Data Subject") seriously, and we are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles.

This Privacy Policy ("Policy") sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed. It applies to all users of the MeritBet website, mobile application, and associated services, including players based in Malaysia and other jurisdictions where the Platform is accessible.

This Policy should be read alongside MeritBet's Terms & Conditions and our Responsible Gambling Policy.

2. Definitions

For the purpose of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, identity document details, and payment information.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, MeritBet.
• "Data Processor" means a third party that processes Personal Data on behalf of MeritBet, under contractual obligation and in accordance with our instructions.
• "KYC Data" means identity verification documentation collected as part of the Know Your Customer process, including government-issued ID and proof of address.
• "Sensitive Personal Data" means a subset of Personal Data warranting heightened protection, including financial account details, identity document numbers, and any data relating to a natural person's identity as required under applicable law.

3. Personal Data We Collect

MeritBet collects the following categories of personal data in the course of providing its services:

3.1 Registration & Account Data

• Full legal name
• Date of birth (required to verify 21+ age eligibility)
• Email address
• Mobile phone number
• Preferred username and encrypted password
• Country of residence and, where provided, Malaysian city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam)

3.2 Identity Verification (KYC) Data

• Government-issued photo identification (Malaysian MyKad, passport, or driving licence)
• Proof of residential address (utility bill, bank statement, or official correspondence issued within the last 90 days)
• Proof of payment method ownership (where required for withdrawal verification)
• Selfie or live facial verification image (where required by our compliance process)

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts in MYR or cryptocurrency equivalent
• Payment method identifiers (e.g., masked bank account references, e-wallet account IDs for Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB, Public Bank, DuitNow, FPX)
• Cryptocurrency wallet addresses where crypto deposits or withdrawals are used
• Bonus and promotional transaction history

3.4 Gaming & Betting Activity Data

• Wager history, game session records, and bet settlement data
• Login and session timestamps and duration
• Responsible gambling settings including deposit limits and self-exclusion status

3.5 Technical & Device Data

• IP address and approximate geolocation
• Browser type, operating system, and device identifiers
• Referring URL and onsite navigation data (collected via cookies and similar technologies)

3.6 Communications Data

• Records of support interactions conducted via live chat
• Email correspondence where you contact us directly
• Promotional communication preferences and opt-in records

4. How We Collect Your Data

MeritBet collects your personal data through the following means:

5. Lawful Basis for Processing

MeritBet processes your personal data on one or more of the following lawful bases, depending on the specific processing activity:

1. Contractual Necessity: Processing is necessary for the performance of the contract between you and MeritBet — including account registration, deposit and withdrawal processing, game participation, and customer support.
2. Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including KYC and anti-money laundering (AML) requirements under our international gaming licence conditions.
3. Legitimate Interests: Processing is conducted for MeritBet's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and aggregate analytics — provided those interests are not overridden by your data protection rights.
4. Consent: Where processing is based on consent (such as sending promotional communications), we will obtain your explicit consent before processing and will provide a clear mechanism for you to withdraw that consent at any time.

6. How We Use Your Personal Data

MeritBet uses the personal data we collect for the following specific purposes:

• To create, manage, and maintain your MeritBet account
• To verify your identity and age (21+ mandatory minimum) as part of the KYC process
• To process deposits and withdrawals via supported Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, FPX) and cryptocurrency networks
• To administer sports betting, casino games, and all other wagering activities on the Platform
• To manage bonus and promotional programmes, including birthday bonuses and referral rewards
• To deliver customer support via live chat and email channels
• To monitor platform activity for fraud, collusion, bot usage, and other prohibited conduct as defined in the Terms & Conditions
• To comply with anti-money laundering (AML) obligations and report suspicious transactions where legally required
• To operate MeritBet's responsible gambling programme, including monitoring for at-risk behaviour and administering self-exclusion requests
• To send promotional communications where you have provided consent to receive them
• To conduct aggregate, anonymised analytics to improve platform performance and user experience

7. Data Sharing & Disclosure

MeritBet does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following limited and controlled circumstances:

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to assist in the delivery of our services. These include KYC and identity verification providers, payment processors (including e-wallet and bank transfer intermediaries supporting DuitNow, FPX, and other Malaysian payment infrastructure), fraud detection providers, and cloud hosting and data storage providers. All service providers operate under binding data processing agreements that restrict their use of your data to the specific service they are contracted to provide.

7.2 Regulatory and Legal Disclosure

MeritBet may be required to disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by our gaming licence conditions or by applicable law. We will disclose only the minimum data required and, where lawfully permissible, will notify the affected player.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of MeritBet's business assets, personal data held on the Platform may form part of the transferred assets. In such circumstances, we will notify affected players and ensure that the acquiring entity is bound by data protection obligations equivalent to those in this Policy.

7.4 Consent-Based Sharing

Other than as described above, MeritBet will not share your personal data with any third party without your prior explicit consent.

8. Cookies & Similar Technologies

MeritBet uses cookies and similar browser-based technologies to operate and improve the Platform. A cookie is a small text file placed on your device by a website you visit. We deploy the following categories of cookies:

MeritBet does not use advertising cookies, third-party retargeting cookies, or social media tracking pixels. You may manage cookie preferences through your browser settings. Declining non-essential cookies will not prevent you from using the Platform, though some functional preferences may not be retained across sessions.

9. Data Retention

MeritBet retains personal data only for as long as is necessary for the purposes for which it was collected, subject to the following retention principles:

• Active Accounts: Personal data associated with an active account is retained for the duration of the account's active status plus any mandatory post-closure retention period required under our licensing obligations.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years following account closure, in accordance with standard AML compliance requirements applicable to internationally licensed gaming operators.
• Transaction Records: Financial transaction records (deposit and withdrawal history, bonus transactions) are retained for a minimum of five (5) years to satisfy regulatory record-keeping requirements.
• Customer Support Communications: Support interaction records are retained for three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Inactive Accounts: Where an account has been inactive for 24 consecutive months, MeritBet may contact the account holder to confirm whether they wish to retain their account. Accounts confirmed as no longer required will be closed and personal data anonymised or deleted where no legal retention obligation applies.

10. International Data Transfers

MeritBet operates with a globally distributed technical infrastructure. As a result, your personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, MeritBet ensures that appropriate safeguards are in place to protect your data, including:

• Data processing agreements with all third-party processors incorporating binding data protection obligations
• Use of hosting and cloud infrastructure providers operating under internationally recognised security and compliance certifications
• Restriction of data transfers to jurisdictions that maintain adequate data protection standards

11. Your Data Rights

Subject to applicable law and our legitimate regulatory obligations, you have the following rights in respect of the personal data MeritBet holds about you:

1. Right of Access: You may request a copy of the personal data we hold about you. We will respond to verified access requests within 30 days.
2. Right of Rectification: Where your personal data is inaccurate or incomplete, you may request that we correct or update it. Basic account information (name, email, phone number) can be updated through your Account settings.
3. Right to Erasure: You may request deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other lawful basis for processing; or (c) you object to processing and there are no overriding legitimate grounds. Note that erasure requests may not be fulfilled where we are required to retain data under our legal and regulatory obligations.
4. Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed.
5. Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You may object to processing based on MeritBet's legitimate interests at any time. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
7. Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact MeritBet's data protection team via the live chat support facility available on the Platform, or by written request to our support email address. We may require identity verification before processing a data rights request.

12. Data Security

MeritBet implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers
• Encryption of sensitive data fields at rest within our database infrastructure
• Multi-factor authentication for platform administrator access to systems handling personal data
• Regular penetration testing and vulnerability assessments conducted by independent security professionals
• Role-based access controls ensuring that internal staff can only access personal data to the extent necessary for their specific role
• Documented incident response procedures for managing and reporting data security incidents

Notwithstanding the above, no system of data security is entirely infallible. In the event of a data security incident that is likely to result in a high risk to your rights and freedoms, MeritBet will notify affected individuals without undue delay in accordance with applicable notification obligations.

13. Children & Minors

MeritBet's services are strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory component of our account registration and KYC process, and accounts found to belong to individuals under the age of 21 will be closed immediately.

If you believe that we have inadvertently collected personal data from a person under the age of 21, please contact our support team immediately via live chat. We will investigate and take appropriate action, including deletion of the relevant data, without delay.

14. Third-Party Links

The MeritBet Platform does not contain links to external third-party websites in its standard navigation. However, where third-party payment processors or identity verification providers are involved in processing your transaction or KYC request, your interaction with those providers' interfaces may be subject to their own separate privacy policies. MeritBet is not responsible for the data practices of third-party providers, though we vet all partners for compliance with reasonable data protection standards before engagement.

15. Updates to This Privacy Policy

MeritBet reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or our licensing obligations. When we make material changes to this Policy, we will:

• Update the "Effective Date" at the top of this document
• Notify active account holders via the Platform's notification system or via email to your registered address
• Where required, seek fresh consent for any new processing activities that require it

Continued use of the MeritBet Platform following the publication of an updated Privacy Policy constitutes your acknowledgement and acceptance of the revised terms. We encourage you to review this Policy periodically.

16. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how MeritBet has handled your personal data, please contact us using the following channels:

• Live Chat: Available 24/7 directly on the MeritBet platform — the fastest way to reach our support and data protection team
• Email (no-reply correspondence): [email protected]

We take all privacy complaints seriously and will investigate each matter thoroughly. If you are dissatisfied with our response, you retain the right to escalate your complaint to the relevant supervisory authority in your jurisdiction.