M777 Privacy Policy – Personal Data Protection Commitment Malaysian Members

M777 collects various categories of data from members during registration, platform use and financial transaction processing. All data collection is carried out on the basis of legitimate operational requirements and applicable legal compliance in Malaysia. The categories of data we collect are as follows:

M777 may also collect additional data when you interact with our customer support team — including live chat transcripts, call records (where applicable), and email correspondence. This data is retained for service quality control and dispute resolution purposes.

All data collected through the m777 platform is stored on servers located in regions that comply with international data protection standards. Data is not stored on unsecured private servers or shared with any party without legitimate justification.

M777 processes member personal data on several valid legal bases — including contract performance (to provide platform services), legal compliance (PDPA 2010, AML requirements), legitimate interests (platform security and fraud prevention), and member consent (for marketing communications).

The personal data of m777 members is used for the following purposes:

• Account Management: Creating, verifying, and managing your member account on the m777 platform, including registration processing, OTP verification, password resets, and profile management.
• Financial Transaction Processing: Processing deposits and withdrawals in Malaysian Ringgit (MYR) securely and accurately via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay and FPX (Maybank2u, CIMB Clicks).
• Identity Verification (KYC): To comply with Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements mandated by Malaysian financial regulations.
• Fraud Detection & Prevention: Identifying and stopping fraudulent activity, multiple account ownership, unauthorised payment methods, and any other misuse of the platform.
• Responsible Gaming: Monitoring betting patterns to identify signs of problem gambling and providing timely early intervention in line with m777's responsible gaming policy.
• Customer Support: Providing technical support, resolving disputes and addressing member enquiries efficiently based on your account history and transaction records.
• Service Communications: Sending important account notifications, transaction confirmations, policy updates and security information to your registered phone number or email address.
• Marketing (with Consent): Sending promotional information, bonus offers, exclusive rewards and the latest m777 news — only if you have consented to receive such communications, with the option to unsubscribe at any time.

M777 does not sell, rent or trade members' personal data to any third party for their own marketing purposes. However, in the course of operating the platform safely and efficiently, m777 may share member data with a limited set of third-party categories as follows:

• Payment Service Providers: Certified payment gateways that process Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX transactions on behalf of m777. These providers only receive data necessary to process your transaction and are bound by strict data protection agreements with m777.
• Game Providers: Casino and sports game providers that power the gaming platform within m777 (such as live casino and slots providers) may receive session data necessary for technical operations. These providers do not receive members' full financial or identity information.
• Identity Verification Services (KYC): Third-party KYC service providers who assist us in verifying member identities to meet AML legal requirements. Information shared is strictly limited to what is necessary for verification purposes only.
• Regulatory Authority: m777 is required to disclose certain data to Malaysian government authorities or licensed regulatory bodies when lawfully requested under applicable law. m777 will comply with any court order or lawful request submitted by the competent authorities.
• Cybersecurity Provider: Companies that assist m777 in detecting and preventing fraud, cyberattacks and other unauthorised activities. Any data shared is either anonymised or limited to the necessary technical information only.

Should m777 be involved in a merger, acquisition or asset sale involving member data, members will be notified via an in-platform notice and email at least 30 days before any data transfer takes place. Members will be given the option to close their account if they do not consent to the transfer.

M777 continually invests in robust data security infrastructure to protect your personal information from unauthorised access, disclosure, alteration or destruction. Key security measures we have in place include:

• 256-bit SSL/TLS Encryption: All communications between your device and m777's servers are encrypted using 256-bit SSL/TLS protocol — the same standard used by major Malaysian banking institutions such as Maybank and CIMB.
• Data Encryption at Rest: Personal data stored in m777's databases is encrypted using the AES-256 algorithm — ensuring data remains unreadable even in the event of an unexpected security incident.
• Role-Based Access Control: Access to member data within m777's internal systems is restricted based on job role. Only staff who require access to carry out their specific duties are granted permission — and all access is logged for audit purposes.
• Two-Factor Authentication (2FA) for Staff: All m777 staff with access to systems containing member data are required to use 2FA when logging in. This prevents unauthorised access even in the event that a staff member's password is compromised.
• Regular Penetration Testing: m777 conducts penetration testing by independent security specialists at least once a year to identify and address vulnerabilities in our systems before they can be exploited.
• 24/7 Threat Monitoring: m777's automated security monitoring system operates around the clock to detect unusual activity, intrusion attempts, and cyber threats in real time.

In the event of a data security incident involving member personal data, m777 is committed to notifying affected members within 72 hours of becoming aware of the incident, in line with international data protection best practices. Notification will be sent via email and/or in-platform notification, with details on what occurred, the data affected, and the steps taken.

The m777 platform uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance and ensure account security. Cookies are small text files stored on your device when you visit the m777 platform.

The types of cookies used by m777 are as follows:

• Essential Cookies (Required): Required for core m777 platform functionality — including maintaining your login session, remembering language preferences, and keeping your account secure. These cookies cannot be disabled as they are essential for the platform to operate.
• Performance & Analytics Cookies: Helps us understand how members use the m777 platform — which pages are visited most, time spent in each section, and navigation flow. This data is used in aggregated, non-identifiable form to improve the interface and user experience.
• Functional Cookies: Remembering your preferences and personal settings — such as your configured betting limits, preferred odds display, and notification settings — so you don't have to reconfigure them each time you log in.
• Security Cookies: Used by m777's fraud detection system to identify devices used to log in, flag access attempts from unusual locations, and protect your account against takeover.

M777 uses first-party analytics services (not third-party advertising trackers) to analyse platform traffic and usage patterns. All analytics data is processed in anonymised form and used solely for platform improvement and member experience purposes.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and m777's Privacy Policy, you have the following rights regarding the personal data we hold about you. We are committed to respecting and facilitating the exercise of these rights:

M777 retains member personal data only for as long as necessary for the purpose it was collected, or as required under applicable Malaysian law. m777's data retention policy is as follows:

• Active Account Data: For as long as your account remains active on the m777 platform, your personal data is retained to ensure you can use all platform features without interruption.
• After Account Closure: Identity data and basic account information are retained for 5 years after account closure to comply with legal requirements and resolve any outstanding disputes.
• Financial Transaction Records: Deposit, withdrawal, and betting history in MYR are retained for a minimum of 6 years from the transaction date, in accordance with Malaysia's Anti-Money Laundering (AML) legal requirements.
• Security Logs: Technical logs including access records, fraud detection logs and internal audit records are retained for 2 years for security and investigation purposes.
• KYC Records: Identity verification documents (MyKad or passport copies) are retained for 5 years after the business relationship ends, in accordance with Malaysia's KYC requirements.
• Support Communications: Live chat transcripts, support emails, and call records are retained for 2 years for quality control and dispute resolution purposes.

Once the applicable retention period has lapsed, data is securely deleted using methods that ensure it cannot be recovered. For data stored in physical format, appropriate secure destruction procedures are carried out. m777 conducts regular reviews of its data inventory to ensure that data no longer required is deleted in accordance with this retention schedule.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how m777 handles your personal data, you may reach us through the following channels:

• Privacy Email: privacy@m777.asia (for privacy enquiries and data rights requests)
• General Support Email: support@m777.asia (for general account-related inquiries)
• Live Chat: Available 24/7 directly within the m777 platform after logging in
• WhatsApp & Telegram: Contact us via the phone number listed in the "Contact Us" section after logging in to your m777 account

If you are not satisfied with how m777 has handled your privacy complaint, you have the right to lodge a complaint with the relevant data protection authority in Malaysia. m777 will cooperate fully with any official investigation conducted by the competent authorities.

M777 reserves the right to update this Privacy Policy from time to time to reflect changes in data handling practices, legal requirements, or technology. Any material changes will be communicated to members via in-platform notifications and/or email at least 14 days before the changes take effect. The "Updated" date at the top of this document reflects the latest version currently in force.