Madrid88 Privacy Policy – Member Data Protection in Malaysia

Policy Introduction & Scope

This Privacy Policy is published by madrid88 and applies to all members using the madrid88 platform at madrid88.click or any related applications. It explains how madrid88 collects, uses, stores, protects, and shares your personal information in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

By registering an account or using any madrid88 service, you confirm that you have read and understood this Privacy Policy and consent to madrid88 processing your personal data as described herein. If you do not agree with any aspect of this policy, please discontinue use of the madrid88 platform.

Madrid88 takes data privacy seriously — not merely because the law requires it, but because we believe the trust you place in us must be honoured with full integrity. Every piece of information you provide — from your phone number at registration, to payment details via Touch 'n Go eWallet or DuitNow, to your betting activity records on the platform — is information you have entrusted to us, and we do not take that responsibility lightly.

Data We Collect

Madrid88 collects your personal data through several channels – directly from you when you register or use the platform, automatically via tracking technologies, and in some cases from legitimate third-party sources. Below is a full breakdown of the data we collect:

Madrid88 does not collect sensitive information such as health data, religious beliefs, or political affiliations. MyKad numbers are only collected during the identity verification process for withdrawals and are stored in encrypted format.

How We Use Your Data

Every use of your data has a legitimate and reasonable purpose. madrid88 uses your personal data for the following:

• Account Management: Creating and managing your member account, processing registration, verifying your identity, and keeping your account secure from unauthorised access.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, DuitNow, FPX (Maybank2u, CIMB Clicks), GrabPay, Boost, or ShopeePay, and processing winning withdrawals to your bank account or e-wallet in Malaysian Ringgit (MYR).
• Service Provision: Giving you access to all madrid88 games and services, including Live Casino, Malaysia Super League and EPL Sports Betting, badminton, e-sports, cricket, and live matches.
• Legal Compliance: Meeting our obligations under Malaysian law, including anti-money laundering (AML) requirements, operating licence compliance, and reporting to authorities when required.
• Platform Security: Detecting and preventing fraud, system abuse, multiple accounts, and suspicious activity that could compromise the safety of the platform and other members.
• Responsible Gaming: Monitoring usage patterns to identify signs of problem gambling and providing appropriate intervention or support, such as betting limits and self-exclusion tools.
• Service Communications: Sending you important notifications related to your account, platform changes, policy updates, and information relevant to your use of the platform.
• Marketing (with consent): If you have agreed to receive marketing communications, we will send you information about relevant madrid88 promotions, bonuses, and latest offers based on your interests. You may unsubscribe at any time.
• Platform Improvements: Analysing usage patterns on an aggregate (not individual) basis to improve the design, performance, and overall experience of the madrid88 platform.

Legal Basis for Data Processing

Under Malaysia's PDPA 2010, madrid88 processes your personal data on the following bases:

• Consent: For marketing activities and promotional communications, we rely on the explicit consent you provide at registration or subsequently through your communication preference settings. You may withdraw this consent at any time.
• Contractual Obligation: The majority of data processing is necessary to fulfil the agreement you entered into with madrid88 upon registration – that is, to provide the betting services you requested, process payments, and manage your account.
• Legal Obligation: Certain data processing is mandatory under Malaysian law – for example, retaining financial transaction records for the period prescribed under anti-money laundering legislation, or disclosing information to authorities pursuant to a court order.
• Legitimate Interest: For the purposes of platform security, fraud prevention, and service improvement, madrid88 relies on legitimate business interests, provided those interests do not override your fundamental rights and interests as a member.

Sharing Data with Third Parties

Madrid88 does not sell or trade your personal data. However, in the course of operating the platform, we share necessary data with the following categories of third parties, all under strict confidentiality and data protection agreements:

• Payment Service Providers: Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost, and ShopeePay operators receive the information required to process your deposit and withdrawal transactions. This is limited strictly to the data needed to complete each transaction.
• Game Software Providers: Evolution, Pragmatic Play, SA Gaming, Playtech, and other providers receive only the minimum data required to grant you access to their games — typically a masked member ID, not your real name or full financial details.
• Sports Data Providers: Sports data platforms that support odds display and match results receive only the data necessary to deliver real-time services, without exposing your personal identity.
• Legal Authorities: Law enforcement agencies, courts, or regulatory bodies may receive your data when required by Malaysian law or a valid court order. madrid88 will not disclose your data to any authority without a solid legal basis.
• Technical Service Providers: Server hosting companies, cybersecurity services, and technical infrastructure providers that support the operation of our platform. All such providers are bound by data processing agreements that require them to maintain protection standards equivalent to those of madrid88.

In all data-sharing instances, madrid88 ensures that only the minimum necessary data is shared, and all recipients are bound by the relevant confidentiality obligations.

Security & Data Protection

Madrid88 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL Encryption: All data transmitted between your device and madrid88's servers is encrypted using TLS 1.3 with 256-bit key length — the same standard used by leading Malaysian banks.
• Encryption of Data at Rest: Sensitive data stored in madrid88's databases, including financial information and MyKad numbers, is encrypted using AES-256 even when at rest.
• Strict Access Controls: Only madrid88 staff with a legitimate business need may access member personal data, and every access is logged for audit purposes. Two-factor authentication is mandatory for all internal system access.
• Firewall & Threat Detection System: madrid88's infrastructure is protected by multi-layered firewalls and an intrusion detection and prevention system (IDS/IPS) that monitors traffic around the clock.
• Regular Security Audits: madrid88 conducts penetration testing and security audits by certified independent experts at least once a year to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Procedure: madrid88 maintains documented data incident response procedures. In the event of a data breach that may affect you, we will notify you and the relevant authorities within the timeframe prescribed by law.

Data Retention Period

Madrid88 does not retain your personal data longer than necessary for the purposes outlined in this policy or as required under Malaysian law. Our data retention guidelines are as follows:

Once the retention period expires, data will be securely deleted or permanently anonymised so that it can no longer be associated with you. Early deletion requests may be submitted but could be subject to legal retention obligations that prevent immediate removal.

Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and data protection best practices, you as a madrid88 member have the following rights regarding your personal data:

• Right of Access: You have the right to obtain a copy of the personal data we hold about you. Access requests will be processed within 30 business days and the data will be sent to your registered email address.
• Right to Rectification: If any data we hold is inaccurate or incomplete, you have the right to request a correction. Changes to critical information such as phone numbers or payment details will require identity verification for your security.
• Right to Erasure: You may request the deletion of your personal data when it is no longer required for the original purpose of collection, you withdraw your consent, or madrid88 has no other valid legal basis for processing. Such requests may not be fully fulfilled where a legal obligation to retain the data exists.
• Right to Restrict Processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while you are disputing the accuracy of your data or while we are reviewing your deletion request.
• Right to Data Portability: You may request a copy of the data you have provided to us in a machine-readable format (such as CSV or JSON) for transfer to another service provider.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. For processing based on legitimate interests, you may object if you have grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the validity of any processing that took place prior to the withdrawal.

To exercise any of the rights above, please send a written request to support@madrid88.click with the subject line "Data Rights Request" along with the full details of your request. We will acknowledge receipt within 3 business days and complete the request within 30 business days.

Cookies & Tracking Technologies

Madrid88 uses cookies and similar tracking technologies to enhance your experience and ensure the platform functions properly. Here is an overview of the types of cookies we use:

• Essential Cookies (Required): These cookies are required for core platform functions such as login sessions, security, and remembering your language preference. Without them, the madrid88 platform cannot operate. These cookies cannot be disabled.
• Performance & Analytics Cookies: These cookies collect information about how you use the platform – pages visited, session duration, and errors encountered. The information is used in aggregate to improve platform performance. All data collected is anonymised.
• Functional Cookies: These cookies remember your preferences such as your preferred odds format (decimal, fractional, or American), display language, and other display settings to provide a more personalised experience.
• Security Cookies: These cookies help us detect suspicious activity, prevent fraud, and protect your account from unauthorised access. They also help us verify that you are a real person and not an automated bot.

You can manage your cookie settings through your web browser. However, disabling certain cookies may limit the functionality of the madrid88 platform. Full details on how to manage cookies are available in your browser's help section (Chrome, Safari, Firefox, or Edge).

Please note that madrid88 does not use third-party cookies for advertising or cross-site profiling purposes. All tracking technologies we use are strictly limited to the madrid88.click domain.

Contact Us & Privacy Complaints

If you have any questions, concerns, or complaints regarding madrid88's Privacy Policy or how we handle your personal data, please contact madrid88's Data Protection Officer (DPO) through the following channels:

• Email: support@madrid88.click (with the subject line "Privacy Complaint" or "Personal Data Enquiry")
• Live Chat: Available directly on the madrid88 platform, 24 hours a day, 7 days a week

We are committed to acknowledging receipt of your enquiry within 3 business days and providing a full response within 14 business days for standard cases, or sooner for urgent matters.

If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under PDPA 2010. We encourage you to contact madrid88 first, as most issues can be resolved quickly through our support channels.