Privacy Policy

1 Introduction

This Privacy Policy (hereinafter "Policy") describes how MZPlay (referred to herein as "MZPlay", "we", "our", or "us"), the operator of the online casino and sports betting platform accessible at https://mzplay.cam (the "Platform"), collects, processes, stores, shares, and protects the personal data of individuals who access or use the Platform ("Users", "Players", or "you").

This Policy forms an integral part of MZPlay's overall legal framework, alongside the Terms & Conditions. By registering an account on or accessing the Platform, you acknowledge that you have read and understood this Policy, and you consent to the collection and processing of your personal data as described herein.

MZPlay is committed to processing personal data responsibly, lawfully, and transparently. This Policy is drafted in plain English and structured to be accessible to all registered players, including those based in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and across Malaysia.

Scope: This Policy applies to personal data collected through the MZPlay website, mobile interface, support channels (live chat, email), and any associated services. It does not apply to third-party websites or services that may be linked from the Platform, each of which operates under its own privacy terms.

2 Definitions

For the purposes of this Policy, the following definitions apply:

"Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, date of birth, payment details, IP address, and device identifiers.
"Processing" means any operation performed on personal data, including collection, storage, use, transmission, deletion, or any combination thereof.
"Data Controller" means MZPlay, as the entity that determines the purposes and means of processing personal data collected via the Platform.
"Data Processor" means a third party that processes personal data on MZPlay's behalf, subject to contractual data processing obligations.
"Consent" means a freely given, specific, informed, and unambiguous indication of the User's agreement to the processing of their personal data for a stated purpose.
"KYC" means Know Your Customer — the identity and age verification process required of all registered Players prior to withdrawal access being granted.
"Cookies" means small data files placed on a User's device by the Platform to enable session management, preferences, and analytical functions.
"Sensitive Personal Data" means data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data — none of which MZPlay intentionally collects, except where health-related disclosures arise in the context of responsible gambling assessments.

3 Data We Collect

MZPlay collects personal data across several categories, depending on the nature of your interaction with the Platform. The categories and specific data points are detailed below:

Category	Data Points	Purpose	Retention
Identity	Full name, date of birth, nationality, government-issued ID (MyKad, passport)	Account registration, age & identity verification (KYC)	5 years post-closure
Contact	Email address, Malaysian mobile number, city of residence	Account communications, security alerts, support	5 years post-closure
Financial	Payment method type (Touch 'n Go, Boost, GrabPay, FPX, crypto wallet address), transaction history, deposit/withdrawal amounts in MYR or cryptocurrency equivalent	Payment processing, AML compliance, dispute resolution	7 years post-transaction
Technical	IP address, device type, browser, operating system, session timestamps	Security monitoring, fraud prevention, platform optimisation	2 years
Behavioural	Pages visited, games played, bet history, session duration, deposit frequency	Responsible gambling monitoring, personalisation, analytics	3 years
Communications	Support chat transcripts, email correspondence, complaint records	Support quality, dispute records, regulatory compliance	5 years
Preferences	Language settings, notification preferences, self-imposed deposit/session limits	Platform personalisation, responsible gambling tools	Duration of account + 1 year

What We Do Not Collect: MZPlay does not collect or store raw card numbers, full bank account numbers, or payment authentication credentials. All payment data is routed through PCI-compliant third-party payment processors. MZPlay receives only tokenised references and transaction metadata necessary for reconciliation and dispute resolution.

4 How We Collect Your Data

MZPlay collects personal data through the following channels and mechanisms:

Direct Submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting support via live chat or email, or submitting a complaint.
Automated Collection: Technical and behavioural data collected automatically through your interaction with the Platform — including cookies, session tracking, server logs, and device fingerprinting used for fraud detection.
Payment Processors: Transaction metadata and payment method identifiers provided by third-party payment processors (such as those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency transactions) upon the completion of a deposit or withdrawal.
Identity Verification Services: Where MZPlay uses a third-party KYC or identity verification service provider to validate the authenticity of documents submitted during the verification process, data may be shared with and returned from that provider.
Support Interactions: Communications you initiate through live chat, email, or any other support channel are recorded and retained as part of the account record.

5 Data Processing & Use

MZPlay processes your personal data for the following specific and identified purposes:

Account Management: Creating, maintaining, and administering your MZPlay Account, including applying deposit limits, managing VIP tier status, and processing promotional eligibility.
Age & Identity Verification: Fulfilling KYC obligations to confirm that you are aged 21 or above and that your account is registered in your legal name with valid identification. This is a mandatory obligation under MZPlay's international licensing requirements.
Payment Processing: Facilitating deposits and withdrawals via supported Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX via Maybank, CIMB, Public Bank, Hong Leong, and others) and cryptocurrency channels (BTC, ETH, USDT TRC20).
Fraud Detection & Security: Monitoring account activity for indicators of fraud, multi-accounting, bonus abuse, money laundering, and other prohibited conduct. Technical data (IP addresses, device identifiers, behavioural patterns) is used as part of this monitoring.
Anti-Money Laundering (AML) Compliance: Conducting transaction monitoring and, where required by MZPlay's licensing obligations, reporting suspicious activity to appropriate authorities.
Responsible Gambling: Analysing account behaviour to identify potential indicators of problem gambling, and — where applicable — triggering intervention outreach, applying account restrictions, or enforcing self-exclusion requests.
Customer Support: Responding to enquiries, processing complaints, and maintaining records of communications for quality assurance and dispute resolution purposes.
Platform Improvement: Using aggregated and anonymised behavioural data to improve Platform performance, game selection, and user experience — including mobile experience for players across Malaysia.
Marketing Communications: Where you have provided explicit consent, sending promotional communications about MZPlay offers, bonus campaigns, and new game releases. You may withdraw consent to marketing communications at any time through Account Settings.

6 Lawful Basis for Processing

Each processing activity conducted by MZPlay is grounded in one or more of the following lawful bases:

Contractual Necessity: Processing required to deliver the services described in MZPlay's Terms & Conditions — including account creation, KYC, payment processing, and game access.
Legal Obligation: Processing required to comply with MZPlay's obligations under its international gaming licence — including AML transaction monitoring, KYC identity verification, and record-keeping mandated by the licensing authority.
Legitimate Interests: Processing conducted in pursuit of MZPlay's legitimate operational interests — including fraud prevention, security monitoring, internal analytics, and platform improvement — where these interests are not overridden by Users' privacy rights.
Consent: Processing conducted on the basis of your explicit and freely given consent — primarily marketing communications and optional personalisation features. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing

MZPlay does not sell personal data to third parties. Personal data may be shared with third parties only in the following circumstances, and only to the extent strictly necessary:

Payment Service Providers: Personal and transactional data is shared with licensed payment processors to facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks. These processors are bound by contractual data processing obligations and applicable data protection standards.
Identity Verification Providers: Identity documents and personal data submitted during KYC may be shared with certified third-party identity verification service providers for document authentication and fraud screening.
Game Studio Providers: Limited technical data (session tokens, game round identifiers) may be shared with licensed game studio partners to enable game delivery, resolve technical disputes, and maintain game integrity records.
Licensing Authority: MZPlay may be required under its international gaming licence to share account data, transaction records, and KYC documentation with the licensing regulator upon request or as part of routine compliance audits.
Law Enforcement & Legal Process: Where required by applicable law, court order, or lawful request from a competent authority, MZPlay may disclose personal data to law enforcement agencies or other government bodies. MZPlay will endeavour to notify the relevant User where legally permissible to do so.
Business Transfers: In the event of a merger, acquisition, or sale of substantially all of MZPlay's assets, personal data may be transferred to the acquiring entity, subject to the acquirer agreeing to honour this Privacy Policy or providing equivalent protections.

8 International Data Transfers

MZPlay operates under an international online gaming licence and uses data processors and infrastructure providers that may be located outside Malaysia. Personal data collected from Malaysian users may therefore be transferred to, stored in, or processed in jurisdictions outside Malaysia.

Where personal data is transferred internationally, MZPlay takes reasonable steps to ensure that the receiving entity maintains equivalent data protection standards, including through the use of contractual safeguards with third-party service providers.

By registering on MZPlay, you acknowledge that your personal data may be transferred internationally as described herein. Malaysian users are encouraged to review the data protection landscape applicable to their use of the Platform, noting that Malaysia's Personal Data Protection Act 2010 (PDPA) may have application to certain aspects of data processing concerning Malaysian residents.

9 Data Retention

MZPlay retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The indicative retention periods set out in the data table in Section 3 above apply.

Upon closure of a MZPlay Account, personal data will be retained for a minimum period of five (5) years to satisfy MZPlay's obligations under its international gaming licence and applicable anti-money laundering requirements. Financial transaction records are retained for a minimum of seven (7) years. Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised.

Where you have exercised your right to erasure (see Section 12), MZPlay will delete or anonymise your personal data unless retention is required to comply with a legal obligation, defend against legal claims, or fulfil MZPlay's regulatory compliance requirements — in which case data will be retained for the minimum period necessary for that specific purpose.

10 Cookies & Tracking Technologies

MZPlay uses cookies and similar tracking technologies (including session tokens, local storage, and analytics scripts) on its Platform for the following purposes:

Essential Cookies: Required for the Platform to function — session authentication, security tokens, and user preference persistence. These cookies cannot be disabled without impairing Platform functionality.
Analytical Cookies: Used to collect anonymised or aggregated data about how Users interact with the Platform — pages visited, session durations, game categories accessed. This data informs Platform improvement decisions and is not used for individual profiling.
Security Cookies: Used in conjunction with fraud detection systems to identify unusual access patterns, multi-accounting attempts, and automated bot activity.
Preference Cookies: Used to remember User preferences such as language settings, display configurations, and responsible gambling tool settings between sessions.

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will affect the Platform's ability to maintain your login session and may impair full functionality. MZPlay does not currently use third-party advertising cookies or cross-site tracking technologies.

11 Security Measures

MZPlay implements a range of technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:

Encryption: All data transmitted between Users and the Platform is encrypted via 256-bit SSL/TLS. Data at rest is encrypted using AES-256 on production servers.
Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and undergo data protection training.
Two-Factor Authentication: Two-factor authentication (2FA) is available to all registered Users for Account login and is strongly recommended, particularly for accounts with high deposit or withdrawal activity.
Penetration Testing: MZPlay conducts regular third-party security assessments to identify and remediate vulnerabilities in its Platform infrastructure.
Incident Response: MZPlay maintains a formal data breach response procedure. In the event of a data breach that poses a risk to Users' rights, MZPlay will notify affected Users and the relevant regulatory authority within the timeframe required by applicable law.
Payment Security: Payment data is processed exclusively through PCI-DSS compliant service providers. No raw card or full bank account data is stored on MZPlay's infrastructure.

User Responsibility: While MZPlay implements robust security measures, Users are responsible for maintaining the security of their Account credentials. MZPlay recommends using a strong, unique password and enabling 2FA. If you suspect unauthorised access to your Account, contact support immediately via live chat.

12 Your Rights

As a User of MZPlay, you hold the following rights in relation to your personal data. These rights are exercisable by contacting MZPlay support, subject to verification of your identity and applicable legal limitations:

Right of Access

You have the right to request a copy of the personal data MZPlay holds about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared. Access requests will be responded to within 30 days.

Right to Rectification

Where personal data held by MZPlay is inaccurate or incomplete, you have the right to request correction. You may update certain account details directly in Account Settings; changes to identity or KYC documentation require submission of updated verification documents.

Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing was unlawful. This right is subject to MZPlay's retention obligations under applicable licensing and AML requirements, which may necessitate retaining certain data for defined periods.

Right to Restriction

You may request that MZPlay restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.

Right to Portability

Where processing is based on consent or contractual necessity, and is carried out by automated means, you have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.

Right to Object

You may object to processing based on legitimate interests or for direct marketing purposes. Where an objection is raised, MZPlay will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment or defence of legal claims.

Right to Withdraw Consent

Where processing is based on your consent (for example, marketing communications), you may withdraw consent at any time via Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

Exercising Your Rights: To exercise any of the above rights, contact MZPlay support via live chat (24/7) or by email at [email protected] (plain text — not a clickable link). Identity verification will be required before a request is actioned. MZPlay will respond within 30 calendar days. Complex requests may be extended to 60 days with prior notification.

13 Minors & Age Verification

MZPlay strictly prohibits the use of its Platform by individuals under the age of 21. The Platform is intended solely for adults aged 21 and above. MZPlay enforces mandatory KYC identity and age verification for all registered Accounts, and will permanently close any Account where an individual is found to be under 21 years of age, with any associated balance forfeited.

MZPlay does not knowingly collect or process personal data from individuals under the age of 21. If MZPlay becomes aware that personal data from an individual under 21 has been inadvertently collected — for example, via a registration using falsified identity documents — that data will be deleted promptly, the Account closed, and the incident reported where required under applicable licensing obligations.

If you believe that a person under 21 has registered on or is accessing MZPlay, please contact support immediately via live chat so that the matter can be investigated and the Account closed without delay.

14 Amendments to This Policy

MZPlay reserves the right to amend this Privacy Policy at any time. Where amendments are material in nature, MZPlay will provide reasonable advance notice to registered Users via email to the address associated with their Account, or via prominent notice on the Platform.

The most current version of this Policy is always available at https://mzplay.cam/privacy-policy. The "Last Updated" date at the top of this document reflects the date of the most recent revision. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

Where an amendment would materially affect how previously collected data is processed, MZPlay will seek fresh consent where required by applicable law, rather than relying on acceptance through continued use.

15 Contact & Complaints

For any queries relating to this Privacy Policy, your personal data, or to exercise any of the rights described in Section 12, please contact MZPlay through the following channels:

Live Chat: Available 24 hours a day, 7 days a week, directly on the MZPlay Platform. Support is available in English, Bahasa Melayu, and Mandarin.
Email: [email protected] — please note this is displayed as plain text only and is not a clickable link. Copy the address manually to use it.

Privacy-related requests submitted by email will be acknowledged within 48 hours and actioned within 30 calendar days, subject to identity verification. Complex or high-volume requests may be extended to 60 days with prior written notification.

If you are not satisfied with MZPlay's response to a privacy complaint, you may escalate the matter to the relevant supervisory authority under MZPlay's international operating licence. Malaysian Users who believe their personal data has been processed in violation of the Personal Data Protection Act 2010 (PDPA) may also seek independent legal advice regarding their rights under Malaysian law.

Responsible Gambling & Data: Data collected for responsible gambling monitoring purposes is handled with particular sensitivity. If you are concerned about how your gambling behaviour data is being used, or wish to discuss your responsible gambling account settings, visit MZPlay's dedicated Responsible Gambling page or contact support directly via live chat.