Privacy Policy – max885

1. Who We Are

"max885", "the Operator", "we", "us", or "our" refers to the licensed entity operating max885.app under an international gaming authority licence. max885 is the data controller in respect of personal data collected through the platform. Our principal place of business is in Kuala Lumpur, Malaysia.

This Privacy Policy is to be read together with the max885 Terms & Conditions. Capitalised terms not defined here have the meaning given to them in the Terms & Conditions.

For all privacy-related enquiries, you may contact our data protection contact at: [email protected]

2. Personal Data We Collect

max885 collects personal data through the following channels: account registration, identity verification (KYC), deposit and withdrawal transactions, gameplay activity, customer support interactions, and your use of the platform generally.

max885 does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or health data, except where the collection of health-related information is directly relevant to a responsible gaming assessment and is provided voluntarily by the Member.

3. How We Use Your Personal Data

max885 uses personal data collected from Members for the following purposes:

• Account management: Creating and maintaining your max885 account, verifying your identity at registration and during KYC review, and managing your account settings and preferences;
• Payment processing: Processing deposits and withdrawals via your chosen payment method (including Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, Visa, and Mastercard) and maintaining accurate financial records;
• Legal and regulatory compliance: Fulfilling obligations under the max885 international gaming authority operating licence, including anti-money laundering (AML) checks, age verification (21+), responsible gaming monitoring, and mandatory reporting to authorities;
• Platform security: Detecting, preventing, and investigating fraud, account takeover, bonus abuse, and other prohibited conduct;
• Customer support: Responding to enquiries, resolving disputes, and providing technical assistance;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to Members who have not opted out — you may withdraw consent at any time by updating your account preferences or contacting support;
• Platform improvement: Analysing aggregated and anonymised usage data to improve platform performance, game selection, and user experience.

max885 does not use personal data for automated decision-making that produces legal or similarly significant effects, except where required to process self-exclusion requests or enforce account restrictions under the operating licence.

4. Legal Basis for Processing

max885 processes personal data under one or more of the following legal bases:

• Contractual necessity: Processing required to perform the contract between max885 and the Member, including account creation, payment processing, and game services;
• Legal obligation: Processing required to comply with applicable laws and the conditions of the international gaming authority operating licence, including AML obligations, age verification, and mandatory reporting;
• Legitimate interests: Processing carried out in pursuit of max885's legitimate interests in operating a secure and commercially viable platform, fraud prevention, and platform analytics — where those interests are not overridden by the Member's data protection rights;
• Consent: Processing for marketing communications, where applicable law requires consent as the basis — consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Third-Party Disclosure

max885 does not sell, rent, or trade personal data. We may share personal data with the following categories of recipient, strictly on a need-to-know basis:

• Payment processors: Malaysian banks and e-wallet operators (Touch n Go, Boost, Maybank, CIMB, Public Bank) and international card networks (Visa, Mastercard) for the purpose of processing deposits and withdrawals;
• KYC and identity verification providers: Third-party services used to verify identity documents and conduct age and AML screening in accordance with licence requirements;
• Game studios and platform providers: RNG-certified game studios whose titles are hosted on max885 receive aggregated, non-personally-identifying data for game operation and RTP monitoring purposes;
• Regulatory and law enforcement authorities: Where required by law, regulation, court order, or the international gaming authority operating licence — including mandatory AML disclosures;
• Professional advisers: Lawyers, auditors, and insurers under obligations of confidentiality, where necessary for the operation of the business.

All third-party processors engaged by max885 are bound by data processing agreements that require them to handle personal data only in accordance with max885's instructions and applicable data protection law.

6. Cookies & Tracking Technologies

max885 uses cookies and similar technologies on its platform for the following purposes:

• Strictly necessary cookies: Session management, authentication state, and security tokens — these cannot be disabled as they are required for the platform to function;
• Functional cookies: Remembering your language preference, display settings, and responsible gaming tool configurations;
• Analytics cookies: Aggregated, anonymised data on how Members use the platform, used to identify performance issues and improve the user experience. No personally identifying information is included in analytics data.

max885 does not use third-party advertising cookies or cross-site tracking technologies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent the platform from functioning correctly.

7. Data Retention

max885 retains personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with legal and regulatory obligations. Specific retention periods include:

• Account and identity data: Retained for a minimum of 5 years following account closure, as required by the international gaming authority operating licence and applicable AML regulations;
• Transaction and financial records: Retained for a minimum of 7 years for tax and regulatory compliance purposes;
• Gaming activity data: Retained for 5 years following the relevant game session or bet settlement;
• Customer support communications: Retained for 3 years following the closure of the relevant support case;
• Marketing consent records: Retained for the duration of the consent and for 1 year following withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Data Security

max885 implements technical and organisational measures appropriate to the risk level of the data processed to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between the Member's device and the max885 platform;
• Encryption of sensitive data fields (including financial data and identity document copies) at rest;
• Role-based access controls limiting staff access to personal data to those with a demonstrable operational need;
• Regular penetration testing and security audits conducted by independent third parties;
• Multi-factor authentication for staff access to production systems containing personal data;
• Incident response procedures that include notification obligations where a data breach affects Members' rights and freedoms.

In the event of a data breach that is likely to result in a risk to Members' rights and freedoms, max885 will notify affected Members and relevant authorities in accordance with applicable law.

9. Your Data Rights

Subject to applicable law and the requirements of the max885 operating licence, Members have the following rights in respect of their personal data:

• Right of access: You may request a copy of the personal data max885 holds about you;
• Right of rectification: You may request correction of inaccurate or incomplete personal data;
• Right of erasure: You may request deletion of your personal data, subject to max885's legal retention obligations under the operating licence and AML regulations — data required for compliance cannot be deleted on request;
• Right to restrict processing: You may request that max885 restrict the processing of your data in certain circumstances;
• Right to data portability: Where processing is based on consent or contract, you may request your data in a structured, machine-readable format;
• Right to object: You may object to processing based on legitimate interests, including profiling for marketing purposes;
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time — withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, contact max885 support via Live Chat or at [email protected]. max885 will respond to verified requests within 30 days. Requests may require identity verification before processing.

10. Children's Privacy

The max885 platform is strictly restricted to individuals aged 21 and above. max885 does not knowingly collect personal data from persons under 21. Age verification is conducted at registration and during the KYC process. If max885 becomes aware that personal data has been collected from a person under 21, that account will be immediately closed, the data deleted, and any balance forfeited in accordance with the Terms & Conditions.

If you believe a person under 21 has registered an account on max885, please contact support immediately at [email protected].

11. Cross-Border Data Transfers

Some of the third-party service providers engaged by max885 — including game studios, payment processors, and KYC verification services — may process personal data outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, max885 ensures that appropriate safeguards are in place, including contractual protections that require the recipient to handle data to standards equivalent to those applicable in Malaysia.

12. Changes to This Privacy Policy

max885 may update this Privacy Policy from time to time to reflect changes in law, regulatory requirements, or platform operations. Where a material change is made, max885 will notify active Members via the email address registered to their account at least 14 days before the change takes effect. The current version of this Policy will always be available at max885.app/privacy-policy.

Continued use of the max885 platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

13. Contact & Complaints

For all privacy-related enquiries, data subject rights requests, or complaints regarding max885's handling of personal data, please contact:

• Live Chat: 24/7 via the help icon in your account dashboard
• Email: [email protected]
• Support Hours: 8:00 AM – 2:00 AM MYT daily
• Address: Kuala Lumpur, Malaysia

If you are not satisfied with max885's response to your complaint, you may have the right to lodge a complaint with the relevant data protection authority in Malaysia or the jurisdiction of the operating licence.