Mbi99 Privacy Policy – Protection of Malaysian Players' Personal Data

This Privacy Policy describes how mbi99 ("we", "platform") collects, processes, stores and protects your personal information when you use the website, mobile application and all services provided by mbi99.

This policy applies to all users of the platform mbi99, including unregistered visitors, registered members, active players, and former members whose accounts have been closed. By accessing or using the platform mbi99, you consent to the collection and use of information as described in this Privacy Policy.

This Privacy Policy should be read in conjunction with Terms & Conditions mbi99, which together form the complete agreement between you and our platform.

mbi99 collects various categories of personal data depending on how you interact with our platform. Below is a detailed breakdown of what we collect and why:

We only collect data that is strictly necessary for the stated purposes. mbi99 does not collect sensitive data categories such as medical information, political views, or religious beliefs.

mbi99 uses personal data collected solely for legitimate, stated purposes. We do not use your data for any other purpose without first obtaining your consent. The primary purposes for which data is used are as follows:

• Account Management: Creating and maintaining your account at mbi99, including identity verification, password management and two-factor authentication.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as managing withdrawals to your Malaysian bank account or eWallet.
• Gaming Services Provision: Running all slot games, Live Casino, sports betting on football (Malaysia Super League, EPL), badminton, cricket, e-sports, lottery, and jackpot titles available on the platform.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, multiple account ownership, and any unauthorised use of the platform.
• Service Communications: Sending important notifications regarding your account, transactions, changes to terms and security matters via email or SMS.
• Legal Compliance: To fulfil applicable legal obligations, including Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.
• Platform Improvements: Analysing usage patterns to improve the user experience, develop new features and optimise platform performance mbi99.
• Responsible Gaming: Monitoring betting patterns to identify players who may need responsible gaming support.

mbi99 does not sell, rent, exchange, or disclose your personal data to third parties for their own marketing or commercial purposes. However, there are limited situations where we need to share data with certain parties to ensure our platform operates smoothly and securely:

• Payment Service Providers: Payment processors handling Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow and FPX transactions receive only the data required to process the relevant transaction.
• Game Software Providers: Game development companies receive the gaming data necessary to operate the games provided on the platform mbi99. They are bound by strict data protection agreements.
• Identity Verification Services: Verified third-party KYC providers help us confirm member identities in line with legal compliance requirements.
• Legal Authority: mbi99 will disclose personal data when required to do so by law, court order or the directive of a relevant authority. In such circumstances, we will notify you if we are legally permitted to do so.
• Business Transfer: If mbi99 involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction, subject to continued privacy protections and notification to you.

All third parties that receive data from mbi99 bound by data protection agreements that require them to handle your information to a standard equal to or higher than our own privacy practices.

mbi99 implement multiple layers of technical and organisational security controls to protect your personal data from unauthorised access, use, disclosure, alteration, or destruction.

The key security measures we practise are as follows:

• 256-bit SSL encryption for all data in transit between your device and our servers mbi99.
• Data encryption at rest for all sensitive information stored in our databases.
• Role-based access control (RBAC) ensuring staff can only access the data required for their specific responsibilities.
• Two-factor authentication (2FA) for all internal access to systems containing user data.
• 24/7 security monitoring by a dedicated cybersecurity team.
• Regular penetration testing conducted by independent security experts.
• A clearly defined incident response procedure to address any security breaches swiftly and effectively.
• Mandatory privacy and security awareness training for all staff mbi99.

Platform mbi99 uses cookies and similar tracking technologies to ensure proper platform functionality, enhance the user experience and analyse usage patterns. The types of cookies we use are as follows:

You can manage your cookie settings through your web browser settings at any time. However, disabling essential cookies may affect platform functionality mbi99 and may cause certain features to function incorrectly.

mbi99 retains your personal data only for as long as necessary for the purpose it was collected, or as required by law. The specific retention periods are as follows:

• Active Account Data: Retained for the duration your account remains active and for 5 years after account closure for legal compliance and audit purposes.
• Financial Transaction Data: Retained for 7 years in accordance with applicable accounting requirements and anti-money laundering (AML) compliance obligations in Malaysia.
• Game Log Data: Retained for 2 years from the date of the gaming session for dispute resolution and game audit purposes.
• Support Communication Data: Customer support conversation records are retained for 3 years for service reference and training purposes.
• Technical Data (Logs): System and security logs are retained for 1 year, after which they are automatically anonymised or deleted.

Once the applicable retention period has expired, your personal data will be securely deleted or anonymised using methods that ensure it cannot be recovered or re-linked to your identity.

If you request account deletion before the legally mandated minimum retention period has elapsed, we will inform you of the applicable deletion timeframe and ensure your data is not used for any purpose other than legal compliance.

As the owner of your personal data, you have certain rights protected under applicable data protection legislation. mbi99 committed to respecting and facilitating the exercise of these rights:

• Right of Access: You have the right to obtain a copy of the personal data we hold about you. Requests can be submitted via email to support@mbi99.xyz and will be processed within 30 days.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request a correction. Some data can be updated directly from your account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data. This right is subject to our legal obligations to retain certain data.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data under certain circumstances, such as when you are contesting the accuracy of that data.
• Data Portability Right: You have the right to receive the personal data you have provided to us in a machine-readable format, and to transfer that data to another operator.
• Right to Object: You have the right to object to the processing of your personal data for certain purposes, including direct marketing.

To exercise any of the rights above, please contact the privacy team mbi99 at support@mbi99.xyz. We will verify your identity before processing any request to safeguard the security of your data. All requests will be handled within 30 days of receipt.

Platform mbi99 is intended for users aged 18 and above only. We do not knowingly collect, store or process personal data of individuals under the age of 18.

All prospective members are required to confirm that they are at least 18 years of age at the time of registration. mbi99 conducts age verification during the KYC (Know Your Customer) process to confirm this age declaration.

If we discover that we have collected personal data from someone under the age of 18, we will immediately take the following steps:

• Closing the relevant account immediately.
• Erasing all data related to the individual from our systems.
• Returning any remaining account balance to the rightful party.

If you believe we may have collected data from a child or minor, please contact us immediately at support@mbi99.xyz.

All financial transactions on mbi99 — whether deposits or withdrawals — are processed through secure, encrypted payment channels. We use trusted and recognised Malaysian payment methods.

Important things to understand about data privacy in the context of payments:

• We do not store full debit or credit card details in our systems. Any card information processed is handled directly by PCI-DSS certified payment processors.
• Data shared with payment providers (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, CIMB Clicks) is limited strictly to the information required to process the relevant transaction.
• We maintain transaction records containing the amount, date, transaction type, and payment method used, for audit purposes, legal compliance, and the resolution of any disputes.
• All transactions are linked to your account, and these records can be requested for review through the data access process described in Section 8 above.

mbi99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, the services we offer, legal requirements, or other legitimate reasons.

When we make material amendments to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page.
• Notifying all active members via their registered email address at least 14 days before any material amendments take effect.
• Displaying a clear notice on the platform's main page mbi99 about upcoming amendments.

Continued use of the platform mbi99 after the effective date of any amendment to this Privacy Policy will be deemed as your acceptance of the updated terms.

If you do not agree with any amendments to this Privacy Policy, you have the right to close your account and request data deletion in accordance with the procedure set out in section 8.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by mbi99, please do not hesitate to contact us.

Privacy team and customer support mbi99 is available in Bahasa Malaysia and operates 24 hours a day, 7 days a week. We are committed to responding to all privacy-related enquiries within 48 business hours.

For formal requests relating to data rights (access, correction, deletion, portability), please send an email to support@mbi99.xyz with the subject line "Personal Data Request" and clearly state the type of request along with your account information for identity verification.

Average response time for privacy enquiries is under 5 minutes via live chat and under 24 hours via email.