Mrluck Privacy Policy — Member Personal Data Protection

Mrluck collects your personal data through several means depending on how you interact with our platform. The information collected falls into three main categories:

A. Information You Provide Directly

• Full name as stated on your official identification document.
• National identification card (MyKad) or passport number for the KYC process.
• Date of birth for age verification.
• Email address and Malaysia mobile number.
• Bank account or digital wallet details (bank name, account number) for deposits and withdrawals.
• Account passwords are stored in hashed form and cannot be read by anyone, including mrluck staff.
• Any information you share when contacting our customer support team.

B. Information Collected Automatically

• IP address and geographic location information (state/city level only).
• Device type, operating system, and web browser version used.
• Session data including pages visited, access times, and session duration.
• Gaming activity records including bets, wins, and transaction history.
• Cookie data and similar tracking technologies (further details in Section 7).

C. Information from Trusted Third Parties

• Identity verification information from the KYC service providers we use.
• Fraud prevention data from third-party security systems integrated with our platform.

Every piece of data we collect has a clear and specific purpose. mrluck uses your personal information for the following purposes:

Mrluck will not use your personal data for any purpose other than those stated above without first obtaining your explicit consent.

Mrluck processes your personal data on valid legal bases under Malaysia's Personal Data Protection Act 2010 (PDPA). These bases are:

• Contract performance: Data processing required to provide you with online gaming services as requested when you registered your account.
• Legal obligation: Data processing required to comply with KYC requirements, anti-money laundering (AML), and financial reporting obligations set out by law.
• Legitimate interest: Processing for the purposes of platform security, fraud prevention, and improvement of our services.
• Consent: For marketing and promotional communications, we only send you information if you have given explicit consent during registration or through your account settings.

Mrluck does not sell or disclose your personal data to third parties for their own commercial purposes. However, there are limited situations where we need to share your information with the following parties:

• Payment service provider: Transaction information required to process your deposits and withdrawals via your chosen bank or digital wallet.
• KYC service provider: Identity verification data required to comply with anti-money laundering (AML) requirements.
• Game software provider: Minimum game session data required to operate live casino and slot games from third-party providers integrated with our platform.
• Relevant authority: When required by court order, police investigation, or instruction from a lawful authority under Malaysian law.
• Auditors and legal advisors: In situations requiring compliance review or professional advice, subject to strict confidentiality agreements.

All third parties we work with are required to comply with data protection standards equal to or higher than mrluck's own standards. We conduct regular compliance reviews of all our service providers.

Mrluck continually invests in the latest cybersecurity infrastructure to ensure your personal data remains protected at all times. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS encryption for all data communications between your browser and mrluck servers.
• Passwords are stored using the strong bcrypt hashing algorithm — no one, including our staff, can read your password.
• Two-factor authentication (2FA) is available for all member accounts as an additional security layer.
• 24/7 security monitoring by an automated intrusion detection system (IDS).
• Regular penetration testing by independent cybersecurity firms.
• Role-based access control (RBAC) for all mrluck internal staff.
• Regularly encrypted data backups at geographically separate data centres.

Mrluck only retains your personal data for as long as necessary to fulfil the purposes stated in this privacy policy or as required by applicable law.

• Active account data: Retained for the duration your account is active and for a minimum period of 5 years after account closure for financial regulatory compliance purposes.
• Financial transaction records: Retained for 7 years in compliance with Malaysia's anti-money laundering legal requirements.
• Customer support communication logs: Retained for 3 years from the date of last interaction.
• Session data and access logs: Retained for 12 months for security and fraud detection purposes.
• Marketing data (with consent): Retained until you withdraw consent or close your account.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in a manner that ensures it can no longer be linked to your identity.

Mrluck uses cookies and similar tracking technologies to enhance the user experience, maintain login sessions, and analyse platform usage patterns. The types of cookies we use are:

• Essential cookies: Required for core platform functions such as login verification and session security. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: Collecting anonymous information about how users interact with the platform to help us improve performance and usability.
• Functional cookies: Remembering your preferences such as language, region, and display settings to provide a more personalised experience.
• Analytics cookies: Used by our internal analytics tools to understand navigation patterns and platform activity in aggregate.

You may manage or disable cookies through your web browser settings at any time. Please note that disabling essential cookies may affect your ability to access certain features of the mrluck platform.

As an online platform operating globally, there are situations where your personal data may be processed or stored on servers located outside Malaysia. When such data transfers occur, mrluck ensures adequate protection through:

• Binding data processing agreements with all overseas service providers.
• Use of internationally recognised standard contractual clauses for cross-border data transfers.
• Selecting service providers located in countries with equivalent or higher levels of data protection.
• Data encryption in transit and at rest for all international transfers.

Mrluck does not transfer members' personal data to countries without adequate data protection without appropriate additional safeguards in place.

The mrluck platform is strictly for individuals aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we find that we have collected personal data from an individual under the age of 18, we will take immediate action to:

• Closing the account in question immediately.
• Deleting all related personal data from our systems.
• Reporting the incident to the relevant authorities if necessary.

If you believe a child has registered an account at mrluck, please contact our support team immediately so that corrective action can be taken without delay.

Mrluck reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, new technologies, legal requirements, or other operational reasons.

When we make material amendments, we will:

• Updating the "Last Updated" date at the top of this page.
• Displaying a prominent notice on the mrluck homepage for a minimum period of 14 days.
• Sending notification emails to all active members for amendments that significantly affect their privacy rights.

Your continued use of the mrluck platform after any amendments take effect will be considered as your acceptance of the latest version of this Privacy Policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the mrluck Data Protection Officer (DPO) team is ready to assist:

• Live Chat: Available 24/7 via the chat icon at the bottom corner of the mrluck website and app.
• Privacy Email: [email protected] (response time within 48 business hours)
• General Support Email: [email protected]

We are committed to addressing every privacy-related request seriously and within a reasonable timeframe. For more information regarding the platform's terms of use, please visit the page Terms and Conditions us. For responsible gaming guidance, please visit Responsible Gaming. FAQs are also available on the FAQ us.