Introduction
This Privacy Policy ("Policy") is issued by Mostplay ("We", "Us", "Our", "Mostplay"), the operator of the online casino and sports betting platform accessible at mostplay.casa ("the Platform", "the Website"). This Policy applies to all registered players, website visitors, and any other individuals whose personal data is processed by Mostplay in connection with the provision of our Services.
Mostplay is committed to protecting the privacy and security of personal data belonging to our players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations from which Malaysian players access our Platform. We process personal data responsibly, in accordance with applicable data protection legislation and in a manner that respects the trust you place in us as your online gaming provider.
This Policy should be read in conjunction with our Terms & Conditions, which govern your overall use of the Mostplay platform. By registering an account or continuing to use our Services, you acknowledge that you have read and understood this Privacy Policy.
Definitions
For the purposes of this Privacy Policy, the following terms carry the meanings defined below:
| Term | Definition |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a living individual, directly or indirectly. This includes names, identification numbers, contact details, location data, and online identifiers. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, alteration, disclosure, erasure, or any combination thereof. |
| "Data Controller" | Mostplay, as the entity that determines the purposes and means of processing personal data collected through the Platform. |
| "Data Subject" | The living individual to whom personal data relates — in the context of this Policy, primarily registered players and website visitors. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose. |
| "Third Party" | Any natural or legal person other than Mostplay or the Data Subject, including payment processors, KYC verification providers, and game studio licensors. |
| "KYC" | Know Your Customer — the identity and address verification process required before processing player withdrawals. |
Personal Data We Collect
Mostplay collects personal data that is necessary and proportionate to the operation of a licensed online gaming and sports betting platform. We do not collect data beyond what is required for the purposes described in this Policy.
When you create a Mostplay account, we collect the following information:
- Full legal name as it appears on your official identity document;
- Date of birth (for age verification — players must be 21 years or older);
- Registered email address;
- Mobile phone number;
- Preferred currency (MYR for Malaysian players);
- Username and encrypted password.
To comply with anti-money laundering (AML) obligations and to verify your identity before processing withdrawals, we collect:
- Copy of government-issued photo identification (Malaysian MyKad, Driver's Licence, or Passport);
- Proof of residential address (utility bill, bank statement, or official correspondence dated within three months);
- Selfie photograph holding the identity document;
- Where required under Enhanced Due Diligence: source of funds documentation, employment details, or bank statements.
When you make deposits or request withdrawals, we process:
- Payment method identifiers (e.g., masked Touch 'n Go eWallet account reference, Boost wallet ID, Maybank/CIMB/Public Bank account fragment, DuitNow/FPX reference numbers, USDT TRC20 wallet address);
- Transaction amounts in MYR (or USDT equivalent at time of transaction);
- Transaction timestamps, reference codes, and processing status records.
- Game session logs including games played, wager amounts, win/loss outcomes, and session durations;
- Sports betting selections, market types, and settlement records;
- Bonus and promotion claim history, including wagering requirement progress;
- VIP tier status and loyalty programme activity.
- IP address and approximate geographic location derived from IP;
- Device type, operating system, and browser version;
- Session identifiers, login timestamps, and access logs;
- Cookie identifiers and similar tracking technologies (see Section 8).
- Records of live chat conversations with our support team;
- Email correspondence sent to or from [email protected];
- In-platform notifications read/acknowledged records;
- Responsible gambling tool preferences and self-exclusion requests.
How We Collect Personal Data
Mostplay collects personal data through the following channels:
- Directly from you: Information you provide when creating an account, completing KYC, initiating transactions, contacting support, or setting responsible gambling preferences.
- Automatically via the Platform: Technical data collected through cookies, server logs, and similar technologies when you access and use the Website (see Section 8).
- From payment service providers: Transaction confirmation data from Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, and USDT blockchain explorers.
- From KYC verification partners: Identity verification outcomes and flags from third-party identity verification service providers retained by Mostplay.
- From fraud prevention and AML screening services: Risk assessment scores and watchlist screening results from compliance service providers.
Lawful Basis for Processing
Mostplay processes personal data only where there is a recognised lawful basis for doing so. The principal bases relied upon are set out below:
| Lawful Basis | Processing Activities Covered |
|---|---|
| Contract Performance | Account registration, processing deposits and withdrawals, delivering gaming services, managing bonuses and VIP tiers, resolving payment disputes. |
| Legal Obligation | KYC identity verification, AML screening and transaction monitoring, age verification, record-keeping required by financial regulatory frameworks. |
| Legitimate Interests | Platform security, fraud detection, responsible gambling monitoring, service improvement analytics, customer support quality management. |
| Consent | Marketing communications (where you have opted in), use of non-essential cookies and analytics tracking technologies. |
How We Use Your Personal Data
Personal data collected by Mostplay is used for the following purposes:
- Creating, maintaining, and securing your Mostplay player account;
- Authenticating your identity at login and during sensitive account actions;
- Processing deposits and withdrawals in MYR via Malaysian payment channels;
- Crediting and managing bonus offers, promotions, and VIP loyalty rewards;
- Providing customer support via live chat and email.
- Verifying that players meet the minimum age requirement of 21 years;
- Conducting Know Your Customer (KYC) identity verification before processing withdrawals;
- Monitoring transactions for suspicious activity consistent with money laundering patterns;
- Screening player identities against relevant watchlists and sanctions databases;
- Maintaining records required by anti-money laundering regulations for a minimum of five years.
- Monitoring player activity to identify potential signs of problem gambling behaviour;
- Enforcing self-exclusion requests, deposit limits, and loss limit settings applied by players;
- Communicating responsible gambling resources and support information where appropriate;
- Complying with any regulatory responsible gambling obligations applicable to our operation.
- Detecting and preventing account takeover attempts, identity fraud, and payment fraud;
- Identifying and acting against bonus abuse, multi-accounting, and collusion;
- Maintaining system integrity and investigating suspected Terms & Conditions violations.
- Analysing aggregated and anonymised usage patterns to improve platform performance and user experience;
- Evaluating game popularity and sportsbook market preferences to inform content decisions;
- Measuring the effectiveness of promotional campaigns.
Data Sharing & Disclosure
Mostplay does not sell, rent, or license your personal data to third-party advertisers or data brokers under any circumstances. Personal data is shared with third parties only in the limited circumstances described below:
- Payment Service Providers: We share transaction data with payment processors — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX operators — to the minimum extent necessary to execute your deposit and withdrawal instructions.
- Identity Verification (KYC) Partners: We transmit identity document images and personal details to our KYC verification service provider solely for the purpose of identity verification. These partners are contractually bound to process data only on our instructions and not for their own purposes.
- AML & Fraud Prevention Services: Certain player data may be processed through third-party compliance screening services for AML monitoring, fraud detection, and sanctions list screening.
- Game Studio Licensors: Game studios providing games through the Mostplay platform may receive anonymised game session data (wager amounts, outcomes) for RNG audit and technical support purposes. No personally identifiable information is shared with game studio partners beyond what is technically necessary.
- Legal & Regulatory Authorities: Mostplay will disclose personal data to law enforcement agencies, regulatory bodies, or courts when legally required to do so by valid legal process, court order, or binding regulatory directive.
- Corporate Transactions: In the event of a merger, acquisition, or asset sale involving Mostplay, player data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.
Cookies & Tracking Technologies
Mostplay uses cookies and similar tracking technologies to operate, secure, and improve the Platform. A cookie is a small text file stored on your device when you visit the Website. We use the following categories of cookies:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Session authentication, account security, fraud prevention, and core platform functionality. The Platform cannot function properly without these cookies. | No — essential to service |
| Functional | Remembering language preferences, notification settings, and responsible gambling tool configurations you have set on your account. | No — service enhancement |
| Analytics | Anonymised usage tracking to measure page performance, identify technical issues, and understand which features players use most on mobile and desktop. | Yes — opt-in |
| Marketing | Tracking promotional campaign effectiveness. Mostplay does not serve third-party advertising; these cookies are used for internal promotion measurement only. | Yes — opt-in |
You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies may impair your ability to log in or use core platform features. Disabling analytics or marketing cookies will not affect your ability to play games or make transactions.
Data Retention
Mostplay retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or to comply with applicable legal, regulatory, and contractual obligations. The following general retention guidelines apply:
- Active Account Data: Retained for the duration of your active account relationship with Mostplay, plus a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements.
- KYC Identity Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable regulatory obligation.
- Financial Transaction Records: Retained for a minimum of five (5) years to satisfy financial record-keeping requirements applicable to payment processing in connection with MYR transactions.
- Gaming Activity Logs: Retained for a minimum of two (2) years for responsible gambling monitoring, dispute resolution, and regulatory reporting purposes.
- Customer Support Communications: Retained for two (2) years from the date of the last communication, to enable resolution of any subsequent related queries or disputes.
- Marketing Consent Records: Retained until withdrawn by the player, or for three (3) years from the last recorded interaction if consent is not actively renewed.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.
Data Security
Mostplay implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:
- Transport Layer Security (TLS/SSL): All data transmitted between your device and the Mostplay platform is encrypted using current industry-standard TLS protocols. Look for the padlock icon in your browser address bar when accessing the Website.
- Data Encryption at Rest: Sensitive personal data and KYC documents stored on our systems are encrypted at rest using AES-256 encryption.
- Access Controls: Internal access to player personal data is restricted on a strict need-to-know basis. Staff with access to sensitive player data are subject to confidentiality obligations and regular security training.
- Password Security: Account passwords are stored using irreversible cryptographic hashing. Mostplay never stores passwords in plaintext and our staff cannot retrieve your password — only a reset is possible.
- Intrusion Detection: Our infrastructure is monitored continuously for suspicious access patterns, with automated alerts and incident response procedures in place.
- Third-Party Security Standards: All third-party service providers who process player data on our behalf are vetted for compliance with equivalent data security standards prior to onboarding.
User Rights
As a data subject, you have a number of rights with respect to your personal data held by Mostplay. These rights are described below and may be exercised by contacting us through the channels listed in Section 15.
Mostplay will respond to data subject rights requests within thirty (30) calendar days of receipt. Where a request is particularly complex or numerous, we may extend this period by a further two months, with notification of the extension provided within the initial thirty-day window. Responses to verified requests are provided free of charge for reasonable requests.
International Data Transfers
In the course of operating the Mostplay platform, certain personal data may be transferred to, stored, or processed in jurisdictions outside of Malaysia. This may occur when our third-party service providers (such as KYC verification partners, cloud infrastructure providers, or compliance screening services) are based in or operate servers in other countries.
Where such transfers take place, Mostplay implements appropriate safeguards to ensure that your personal data receives a level of protection consistent with this Privacy Policy and applicable data protection standards. These safeguards include: contractual data processing agreements incorporating standard data protection clauses, ensuring recipient jurisdictions have adequate data protection frameworks, and applying technical security controls to all transmitted data.
Player financial data relating to MYR transactions through Malaysian payment providers (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank) is processed primarily within Malaysia's financial infrastructure and is not routinely transferred internationally.
Children's Privacy
The Mostplay platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store personal data relating to individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately suspend the associated account and take steps to delete the data in question.
Parents or guardians who have reason to believe that a minor has registered an account on Mostplay are encouraged to contact us immediately via live chat or at [email protected] so that appropriate action can be taken promptly.
Amendments to This Policy
Mostplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. The "Last Updated" date at the top of this document will be revised each time a new version is published.
Where amendments are material — meaning they affect your rights or change how your personal data is used in a significant way — Mostplay will provide advance notice of at least fourteen (14) calendar days before the changes take effect. Notice will be provided via email to your registered address and/or through a prominent notice displayed on the Platform upon login.
Your continued use of the Mostplay platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the amended Policy, you have the right to close your account and request erasure of your personal data in accordance with Section 11 of this Policy.
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Mostplay, please contact us through one of the following channels:
- Live Chat: Available 24 hours a day, 7 days a week directly through the Mostplay platform. This is the fastest channel for urgent privacy queries.
- Email (plain text — not a link): [email protected] — for formal data subject rights requests, please use the subject line "Privacy Request" and include your registered account username.
When submitting a data subject rights request, please include your full name, registered email address, and a description of your specific request. We may need to verify your identity before processing certain requests to protect against unauthorised access to your data.