Privacy Policy — MBI99

This Privacy Policy (the "Policy") is issued by MBI99 (referred to herein as "mbi99", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at https://mbi99.cam (the "Platform"). This Policy applies to all individuals who access, browse, or use the Platform, including registered account holders and unregistered visitors.

mbi99 is committed to protecting the privacy and personal data of all users. This Policy sets out in clear, accessible terms the categories of personal data we collect, the purposes for which we process that data, the legal bases on which we rely, the circumstances in which we may share data with third parties, and the rights available to you in respect of your personal information.

By creating an account on mbi99, making a deposit, or continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood its contents. This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial data, and online identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Subject" — the identified or identifiable natural person to whom the Personal Data relates; in most contexts under this Policy, this means you, the registered member or Platform visitor.
• "Controller" — the entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, mbi99 is the Controller in respect of all Personal Data processed through the Platform.
• "Third Party" — any entity other than mbi99 and the Data Subject, including payment processors, identity verification providers, analytics partners, and regulatory authorities.
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their Personal Data for one or more specified purposes.

mbi99 collects Personal Data across several categories depending on how you interact with the Platform. The following table summarises the primary categories and examples of data collected:

mbi99 collects Personal Data through the following channels:

4.1 Directly from You

The majority of Personal Data held by mbi99 is provided by you directly when you register an account, complete our identity verification process, make a deposit or withdrawal request, contact our support team, or respond to a promotional communication.

4.2 Automatically Through Platform Use

When you access the Platform, certain Technical Data and Usage Data is collected automatically through server logs, cookies, and similar tracking technologies. This includes information about the device and browser you are using, your IP address, the pages you visit, and the duration of your session. See Section 10 for our full Cookies Policy.

4.3 From Third Parties

mbi99 may receive Personal Data about you from third parties in limited circumstances, including identity verification agencies (to confirm information you have provided), payment service providers (such as Maybank, CIMB, Public Bank, Touch 'n Go, Boost, and GrabPay partner networks, for transaction confirmation), and fraud prevention services where we have a legitimate interest in preventing financial crime on the Platform.

mbi99 processes your Personal Data only for specific, legitimate purposes. These purposes include:

• Account administration: creating, managing, and maintaining your mbi99 account, including authentication and security.
• Service delivery: enabling you to access games, place bets, make deposits, and request withdrawals in MYR through supported payment methods.
• Identity and age verification: confirming that you meet the minimum age requirement of 21 years and verifying your identity in compliance with our KYC obligations.
• Financial processing: facilitating deposits and withdrawals, maintaining transaction records, and reconciling account balances.
• Legal and regulatory compliance: meeting our obligations under anti-money-laundering (AML), counter-terrorism financing (CTF), and other applicable laws.
• Responsible gambling: monitoring account activity to identify patterns that may indicate problem gambling behaviour, and applying player protection tools where appropriate.
• Security and fraud prevention: detecting, investigating, and preventing fraudulent transactions, collusion, and other forms of misconduct on the Platform.
• Customer support: handling your enquiries, complaints, and account-related requests.
• Platform improvement: analysing aggregated usage data to improve the performance, reliability, and user experience of the Platform.
• Marketing communications: sending you promotional offers, bonus notifications, and Platform updates, subject to your communication preferences and where you have provided the requisite consent.

mbi99 processes your Personal Data only where it has a valid legal basis for doing so. The legal bases we rely upon are as follows:

• Contractual necessity: Processing that is necessary for the performance of the contract between you and mbi99, including account management, game access, payment processing, and the provision of customer support.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML and CTF obligations, age and identity verification requirements, and responses to lawful requests from regulatory authorities.
• Legitimate interests: Processing carried out in furtherance of mbi99's legitimate business interests, including fraud detection and prevention, Platform security, responsible gambling monitoring, and internal analytics — where these interests are not overridden by your rights and freedoms.
• Consent: Where mbi99 relies on your consent as the legal basis for processing (principally in respect of direct marketing communications), you have the right to withdraw that consent at any time without prejudice to the lawfulness of processing carried out prior to withdrawal. You may update your marketing preferences through your account settings at any time.

mbi99 does not sell, rent, or trade your Personal Data to any third party for their own commercial purposes. We disclose your data to third parties only in the following limited circumstances:

7.1 Payment Service Providers

To process your deposits and withdrawals, mbi99 shares the minimum necessary transaction and identity data with our payment service providers. These include e-wallet processors (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), bank networks (including Maybank, CIMB, Public Bank, Hong Leong Bank via FPX infrastructure), and cryptocurrency processing services for BTC, ETH, USDT, and BNB transactions.

7.2 Identity Verification and AML Partners

mbi99 uses specialist third-party identity verification and anti-money-laundering screening services to fulfil its KYC obligations. These providers receive the data necessary to perform identity checks and may cross-reference information against watchlists and sanctions databases.

7.3 Regulatory Authorities

mbi99 may disclose Personal Data to government agencies, law enforcement bodies, or financial intelligence units where required to do so by applicable law, court order, or regulatory direction. We will notify affected users of such disclosures wherever we are legally permitted to do so.

7.4 Technology and Infrastructure Providers

mbi99 uses third-party technology providers for cloud hosting, data storage, analytics, customer support tooling, and security services. These providers act as processors on our behalf and are contractually bound to process your data only in accordance with our instructions and this Policy.

All third parties with whom mbi99 shares Personal Data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than the specific service they provide to mbi99.

mbi99 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account relationship with mbi99 plus a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the relevant transaction to comply with applicable financial record-keeping requirements.
• Customer support records: Retained for three (3) years from the date of your last interaction with our support team, or until the resolution of any ongoing dispute, whichever is later.
• Marketing data and preferences: Retained until you withdraw your consent or request deletion, subject to any overriding legal retention obligation.
• Technical and usage data: Typically retained for twelve (12) months in identifiable form, following which it may be aggregated and anonymised for analytical purposes.

Upon the expiry of applicable retention periods, mbi99 will securely delete or anonymise your Personal Data in accordance with our internal data management procedures.

You have the following rights in respect of your Personal Data held by mbi99. These rights may be exercised by contacting our Data Protection team at the details provided in Section 14. We will respond to all verified requests within thirty (30) days.

mbi99 uses cookies and similar tracking technologies (including pixels and local storage) to operate the Platform, maintain your session, personalise your experience, and gather analytics data. The following categories of cookies are in use on the Platform:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and fraud prevention identifiers. They cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences, such as language settings, display options, and notification preferences. Disabling these cookies may reduce the personalisation of your experience.
• Performance and Analytics Cookies: Used to collect aggregated information about how users navigate the Platform, which pages are visited most frequently, and where errors occur. This data helps us improve Platform performance.
• Marketing Cookies: Used where you have provided consent to receive personalised promotional communications. These cookies track your interaction with mbi99 content to help us deliver more relevant offers.

You may manage your cookie preferences through your browser settings. Please note that disabling all cookies may prevent certain features of the Platform from functioning correctly. Continuing to use the Platform without adjusting your browser cookie settings constitutes consent to the use of strictly necessary and functional cookies.

mbi99 implements a comprehensive range of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform
• Encryption of sensitive data fields (including financial data and identity document copies) at rest
• Two-factor authentication (2FA) availability for all registered accounts
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis
• Regular independent security penetration testing and vulnerability assessments
• Continuous monitoring of Platform infrastructure for anomalous activity and intrusion attempts
• Incident response procedures for the containment, investigation, and notification of personal data breaches within required timeframes

The mbi99 Platform is strictly intended for adults aged 21 years and above. mbi99 does not knowingly collect Personal Data from any individual under the age of 21. If we become aware that Personal Data has been collected from a person under the minimum age of 21 — whether through our own verification processes or through a report — we will immediately suspend the associated account, delete all related Personal Data, and take such further action as may be required.

If you are a parent or guardian and believe that a person under the age of 21 in your care has created an account on mbi99, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

mbi99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legal requirements, or the features and services offered on the Platform. The date of the most recent update is displayed at the top of this page.

Where a material change is made to this Policy — for example, a change that affects the way we use your Personal Data or the rights available to you — mbi99 will provide advance notice via the email address registered to your account, or via a prominent notice displayed on the Platform, before the change takes effect.

Your continued use of the Platform following the notification of a material change constitutes acceptance of the revised Policy. If you do not agree to any change, you should cease using the Platform and contact our support team to close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which mbi99 processes your Personal Data, please contact us through the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request" as applicable.
• Live Chat: Available 24/7 via the chat widget on the Platform. Average response: under 90 seconds.
• Response time for privacy requests: We aim to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within 30 days.