Privacy Policy — How mbi66 Handles Your Personal Data

1Introduction

This Privacy Policy (hereinafter referred to as "the Policy") is issued by mbi66 (the "Company", "Platform", "we", "us", or "our"), the operator of the online gaming and sports betting platform accessible at mbi66.cam. This Policy applies to all personal data collected, processed, stored, and transmitted in connection with your use of the mbi66 platform and any related services.

mbi66 is committed to handling your personal information with transparency, integrity, and care. This Policy is designed to give you a complete and clear understanding of our data practices so you can make informed decisions about your engagement with the platform. It applies to all users of the mbi66 platform, including registered account holders and visitors browsing mbi66.cam from Malaysia, Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations.

By registering an account, making a deposit, placing a bet, or otherwise using any service offered by mbi66, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. This Policy should be read in conjunction with our Terms & Conditions, which govern the overall use of the mbi66 platform.

2Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of the processing of personal data. In this context, the Data Controller is mbi66.
• "Data Processor" means any natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller.
• "Data Subject" means the identified or identifiable natural person to whom personal data relates — in this context, you, the User.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they, by a statement or a clear affirmative action, signify agreement to the processing of personal data relating to them.
• "KYC" (Know Your Customer) refers to the identity and document verification process required under anti-money laundering and platform integrity obligations.
• "Sensitive Data" refers to special categories of personal data that require a heightened level of protection, including but not limited to health information, financial data, and identity documents.

3Data Controller Identity

mbi66 acts as the Data Controller with respect to all personal data collected through the mbi66.cam platform. As Data Controller, mbi66 determines the purposes for which your personal data is processed and ensures that all processing activities are carried out in accordance with applicable international data protection standards.

mbi66 operates under an international gaming licence issued by a recognised offshore jurisdiction. While the platform is specifically tailored to serve Malaysian users — including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — it operates under the data protection framework applicable within its licensing jurisdiction, complemented by adherence to recognised international data protection principles.

For all data-related queries, requests, or complaints, the Data Controller may be contacted through the details provided in Section 16 of this Policy.

4Personal Data We Collect

4.1 Data You Provide Directly

When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions, you provide us with personal data. This includes:

• Identity Data: Full legal name, date of birth, gender, and nationality as recorded on your government-issued identification document (e.g., MyKad, passport).
• Contact Data: Email address, mobile phone number, and residential address (including city and postcode).
• KYC Documentation: Copies of identity documents (front and back of MyKad or equivalent international passport), proof of address, and payment method verification screenshots as required by our KYC process.
• Financial Data: Payment method details relevant to deposits and withdrawals, including bank account numbers, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), and cryptocurrency wallet addresses (where applicable).
• Support Communications: Records of correspondence with our customer support team, including chat logs and email exchanges.

4.2 Data Collected Automatically

When you access or use the mbi66 platform, certain technical and behavioural data is collected automatically through cookies, log files, and tracking technologies:

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile, tablet, desktop), screen resolution, and language settings.
• Usage Data: Pages visited, time spent on each page, game sessions initiated, betting and wagering activity, deposit and withdrawal history, and navigation patterns within the platform.
• Location Data: Approximate geolocation derived from your IP address, used for fraud detection and jurisdictional compliance purposes. We do not collect precise GPS location data.
• Session Data: Login timestamps, session duration, and account activity logs maintained for security audit purposes.

4.3 Data from Third Parties

In certain circumstances, mbi66 may receive personal data about you from third-party sources, including:

• Payment processors and banking partners (e.g., FPX providers, Maybank, CIMB, Public Bank, Hong Leong) for the purpose of verifying and processing transactions;
• Identity verification service providers engaged to assist with KYC document authentication;
• Fraud detection and anti-money laundering screening databases;
• Self-exclusion registries where you have previously enrolled.

5Legal Basis for Processing

mbi66 processes your personal data on the basis of one or more of the following legal grounds, depending on the specific processing activity:

6How We Use Your Personal Data

mbi66 uses personal data collected about you for the following purposes, in each case limited to what is necessary and proportionate:

6.1 Account Services

To create, manage, and maintain your player account; to process deposits and withdrawals; to verify your identity and age (21+ requirement); to send transactional communications (account confirmations, withdrawal notifications, security alerts); and to administer your VIP tier status and loyalty rewards.

6.2 Regulatory Compliance

To fulfil anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) obligations as required by applicable international regulatory frameworks. This includes verifying the source of funds for large deposits and maintaining transaction records as required by law.

6.3 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, including the identification of multiple accounts, chargeback abuse, and coordinated betting schemes. To monitor for suspicious transaction patterns and to verify that users are not accessing the platform from Restricted Jurisdictions using VPN or proxy services.

6.4 Platform Operation & Improvement

To diagnose and resolve technical issues; to analyse platform usage patterns and optimise the user experience; to test new features and improvements before deployment; and to generate aggregate, anonymised analytics reports that do not identify individual users.

6.5 Responsible Gambling

To monitor betting patterns for indicators of problem gambling; to enforce self-imposed deposit limits and session restrictions; to administer self-exclusion requests; and to provide access to responsible gambling resources where appropriate.

6.6 Marketing (Consent-Based Only)

Where you have provided explicit consent, we may send you promotional communications about mbi66 products, bonuses, and special offers. You may withdraw your consent to marketing communications at any time by contacting our support team or using the opt-out mechanism in any marketing email.

7Data Sharing & Third-Party Disclosure

mbi66 does not sell your personal data. We may share your personal data with third parties only in the following circumstances and subject to strict contractual data protection obligations:

7.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers who process data on our behalf under written data processing agreements. These include:

• Payment Processing Partners: Payment gateways and banking partners including FPX service operators, Touch 'n Go, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency processing platforms — for the purpose of executing deposits and withdrawals in MYR and supported cryptocurrencies.
• KYC & Identity Verification Providers: Third-party identity verification services engaged to authenticate identity documents submitted as part of the KYC process.
• IT Infrastructure Providers: Cloud hosting, database management, and cybersecurity providers who maintain the technical infrastructure of the mbi66 platform.
• Customer Support Platforms: Live chat and ticketing system providers that facilitate our 24/7 customer support operations.
• Fraud Detection Services: Specialised AML and fraud screening providers that assist in identifying suspicious activity patterns.

7.2 Legal Obligations

mbi66 may disclose personal data to law enforcement agencies, regulatory authorities, or courts where we are legally compelled to do so by a valid legal process (such as a court order, subpoena, or statutory requirement). In such cases, we will disclose only the minimum data required to satisfy the legal obligation.

7.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of the mbi66 business, personal data held by the platform may be transferred to the acquiring entity as part of the transaction, subject to the acquiring entity assuming equivalent data protection obligations under this Policy.

8International Data Transfers

Given that mbi66 operates under an international gaming licence and engages service providers located in multiple jurisdictions, your personal data may be transferred to and processed in countries outside Malaysia. These transfers may include data processing in jurisdictions with varying levels of data protection legislation.

Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection, mbi66 implements appropriate safeguards to ensure that your data remains protected to a standard consistent with the principles set out in this Policy. Such safeguards include:

• Contractual data protection clauses incorporated into agreements with all third-party data processors;
• Technical security measures (encryption, access controls) applied uniformly regardless of processing location;
• Periodic review and due diligence assessments of third-party processor security practices.

By using the mbi66 platform, you acknowledge and consent to the international transfer of your personal data in the manner described above.

9Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device by a website when you visit it. They allow the website to recognise your device on subsequent visits and to remember information about your session, preferences, and activity.

9.2 Categories of Cookies Used by mbi66

• Strictly Necessary Cookies: Essential for the operation of the platform. These include session authentication cookies, security tokens, and load balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your language preferences, display settings, and login state to provide a personalised and consistent experience across sessions.
• Analytics Cookies: Allow us to understand how users navigate the platform — which pages are visited most frequently, where users encounter friction, and how game sessions are initiated. Data collected via analytics cookies is aggregated and anonymised where possible.
• Security Cookies: Used to detect and prevent fraudulent activity, including automated bot access and account takeover attempts. These operate in the background and do not affect your browsing experience.

9.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the mbi66 platform. Your browser's help documentation will explain how to manage cookie settings for your specific browser.

10Data Retention

mbi66 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by applicable legal, regulatory, or contractual obligations. The following general retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted using industry-standard data erasure methods, or permanently anonymised so that it can no longer be associated with an identifiable individual.

11Data Security

mbi66 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser or device and the mbi66 platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Encryption at Rest: Sensitive personal data and financial records stored on our servers are encrypted using AES-256 encryption.
• Access Controls: Access to personal data systems is restricted to authorised personnel on a strict need-to-know basis. All staff access is subject to multi-factor authentication and is logged for audit purposes.
• Security Monitoring: Our infrastructure is subject to continuous security monitoring, intrusion detection, and periodic penetration testing by independent security specialists.
• Incident Response: mbi66 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay through available contact channels.

While mbi66 takes extensive measures to protect your data, no transmission over the internet or electronic storage system is completely secure. You also bear responsibility for maintaining the security of your account credentials. Please ensure you use a strong, unique password and enable any available two-factor authentication features.

12Your Data Subject Rights

Subject to applicable law and the limitations described below, you hold the following rights in relation to the personal data that mbi66 holds about you. To exercise any of these rights, please contact our support team using the details provided in Section 16.

12.1 Right of Access

You have the right to request a copy of the personal data that mbi66 holds about you, together with information about how that data is processed. We will respond to a verified subject access request within thirty (30) days of receipt.

12.2 Right to Rectification

You have the right to request the correction of any inaccurate or incomplete personal data held about you. You may update certain account details directly through your account settings; for other corrections, please contact our support team.

12.3 Right to Erasure

You may request the deletion of your personal data where: (a) it is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) the data has been unlawfully processed. Note that this right is subject to limitations — where we are required by law (e.g., AML obligations) to retain data, we may decline an erasure request in respect of that data.

12.4 Right to Restriction

You may request that we restrict the processing of your data in certain circumstances — for example, while you contest the accuracy of data or while an objection to processing is being determined.

12.5 Right to Data Portability

Where data is processed by automated means on the basis of your consent or for the performance of a contract, you have the right to receive that data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another data controller where technically feasible.

12.6 Right to Object

You have the right to object to the processing of your personal data where that processing is based on our legitimate interests. Upon receipt of a valid objection, mbi66 will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.

12.7 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place prior to withdrawal.

13Children & Minors

The mbi66 platform is strictly intended for individuals aged 21 years and above. mbi66 does not knowingly collect personal data from persons below the age of 21. If we become aware that personal data has been collected from a person under the age of 21, we will immediately suspend that account and delete the associated personal data, subject to any retention obligations that may arise from the investigation of the underage access.

14Third-Party Links & Services

The mbi66 platform may contain references to or integrations with third-party services, including payment processors, identity verification providers, and live chat support tools. This Privacy Policy applies exclusively to data processed by mbi66 in its capacity as Data Controller. It does not extend to the data practices of third-party service providers, who operate under their own independent privacy policies.

mbi66 is not responsible for the privacy practices of third-party processors, although we do impose contractual data protection obligations on all processors engaged to handle data on our behalf. We encourage you to review the privacy policies of any third-party payment or identity service you interact with as part of using the mbi66 platform.

15Changes to This Privacy Policy

mbi66 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material — meaning they affect your rights or the fundamental nature of our data processing activities — we will endeavour to notify you in advance via the email address registered on your account or by posting a prominent notice on the platform.

Minor changes (such as clarifications of existing practice or correction of typographical errors) may be made without advance notice. The effective date at the top of this Policy will be updated to reflect the date on which revisions take effect.

Your continued use of the mbi66 platform following the effective date of any revised Privacy Policy constitutes your acknowledgment and acceptance of the updated terms. If you disagree with any revision, you should cease using the platform and may request account closure in accordance with our Terms & Conditions.

The most current version of this Privacy Policy will always be available at mbi66.cam/privacy-policy. Historical versions are available upon written request.

16Contact Us & Complaints

If you wish to exercise any of your data subject rights, have a question about this Privacy Policy, or wish to make a complaint about the manner in which mbi66 has processed your personal data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the platform interface at mbi66.cam. This is the fastest way to reach a member of the support team for routine queries.
• Email: [email protected] — for formal data subject requests, written complaints, or documentation submissions. Please mark the subject line as "Privacy Request" or "Data Complaint" to ensure prompt routing to the relevant team. Typical response time is within 1 business day.

We take all privacy complaints seriously. Upon receipt of a complaint, mbi66 will:

1. Acknowledge receipt of the complaint within two (2) business days;
2. Investigate the matter thoroughly and in good faith;
3. Provide a substantive written response within thirty (30) days of the initial complaint.