Privacy Policy —
How mbi98 Protects Your Data

This Privacy Policy ("Policy") describes how mbi98.cam ("mbi98", "the Company", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "the Player", "the User") who access or use the mbi98 online gaming and sports betting platform available at https://mbi98.cam and any associated services.

mbi98 is committed to handling your personal data responsibly, with full respect for your privacy and in compliance with applicable data protection legislation. We recognise that as a Malaysian player, you entrust us with sensitive personal and financial information, and we take that responsibility seriously.

By registering an account, depositing funds, placing wagers, or otherwise using the mbi98 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not use the mbi98 Platform.

In this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including name, identity number, contact details, financial account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, mbi98.cam.
• "Data Processor" means any third party that processes Personal Data on behalf of the Data Controller under a formal data processing agreement.
• "KYC Data" means identity verification documentation collected as part of the Know Your Customer process, including government-issued identification such as the Malaysian MyKad or passport.
• "Cookies" means small data files placed on a user's device by a website for the purposes of session management, preference storage, analytics, and security.
• "Account" means the registered player account created by you on the mbi98 Platform.
• "Special Category Data" means sensitive Personal Data including health and wellbeing information, which may be processed by mbi98 in the context of responsible gambling self-exclusion requests or problem gambling disclosures.

mbi98 collects the following categories of personal data from players and platform visitors:

We do not collect payment card numbers directly. All card-based transactions, where applicable, are processed through certified third-party payment processors using tokenisation. We receive only a transaction reference and status notification.

mbi98 collects personal data through the following channels and mechanisms:

• Direct Provision: Data you provide during Account registration, KYC submission, deposit/withdrawal requests, live chat interactions, email support, or any other direct communication with mbi98.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, device fingerprints, browser data, session activity logs, and cookie data (see Section 9).
• Payment Processors: Transaction confirmations, payment method verification results, and fraud screening outcomes from our payment partners — including FPX, DuitNow, and licensed e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay).
• Identity Verification Services: Confirmation and screening results from third-party KYC and anti-money laundering (AML) screening providers where applicable.
• Gaming Platform Providers: Game session data, RNG outcomes, and relevant gaming activity logs from our licensed game and sportsbook software providers.
• Analytics Tools: Aggregated and anonymised platform usage data from analytics services deployed on the mbi98 website to help us understand how players interact with our service.

mbi98 processes your personal data one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our obligations to you under the Terms and Conditions — including account management, deposit handling, withdrawal processing, and providing access to gaming services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, know-your-customer (KYC) regulations, age verification, and record-keeping mandates.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud detection and prevention, information security, platform analytics, and responsible gambling monitoring — where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, informed consent — for example, the use of non-essential analytics cookies or the provision of personalised promotional communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

mbi98 uses your personal data for the following specific purposes:

• Creating and managing your Account, including identity verification and account security administration.
• Processing deposits and withdrawals via Malaysian banking and e-wallet channels — Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX.
• Providing access to gaming, sports betting, and live casino services on the Platform.
• Fulfilling KYC and AML obligations in accordance with applicable regulatory requirements.
• Detecting, investigating, and preventing fraudulent activity, cheating, collusion, and other prohibited conduct.
• Administering bonuses, promotions, and loyalty programme benefits.
• Responding to customer support inquiries and resolving disputes.
• Monitoring compliance with our Responsible Gambling Policy, including administering self-exclusion and deposit limit requests.
• Conducting platform analytics to improve the quality, performance, and security of our service.
• Sending service-related notifications, including deposit confirmations, withdrawal updates, security alerts, and policy change notifications.
• Complying with legal orders, regulatory requests, court orders, or law enforcement inquiries.

mbi98 does not sell, rent, or otherwise commercially exploit your personal data. We disclose personal data to third parties only in the following circumstances and for the purposes described:

• Payment Processors: Your financial data (bank account number, e-wallet identifier transaction amount) is shared with licensed payment service providers — including those operating FPX, DuitNow, Touch 'n Go eWallet, Boost, and GrabPay infrastructure — solely to process your deposit and withdrawal requests.
• KYC & AML Screening Providers: Identity documentation and personal details are shared with licensed third-party KYC and anti-money laundering screening services for the purpose of verifying your identity and screening against regulatory watchlists.
• Gaming Software Providers: Session data and game activity logs are shared with our licensed gaming and sportsbook software providers as technically necessary to deliver game outcomes and betting services.
• Customer Support Platforms: Communications data is processed through secure third-party customer support infrastructure to facilitate live chat and email support operations.
• Analytics Providers: Aggregated and anonymised usage data may be processed by third-party analytics platforms to help us understand Platform performance. No individually identifiable data is shared for this purpose.
• Regulatory and Law Enforcement Authorities: Personal data may be disclosed to relevant Malaysian regulatory bodies, law enforcement agencies, or judicial authorities where required by applicable law, court order, or regulatory directive. mbi98 will notify you of any such disclosure where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of the Company's assets, personal data held by mbi98 may be transferred as part of that transaction, subject to equivalent privacy protections being maintained by the acquiring entity.

All financial transactions on mbi98 are conducted in Malaysian Ringgit (MYR). The following Malaysian payment methods are supported, each subject to the respective provider's data processing practices in addition to mbi98's obligations under this Policy:

• Online Banking (FPX): Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, RHB. Your banking credentials are entered directly within the respective bank's secure interface — they are never received, stored, or processed by mbi98.
• DuitNow Transfers: Your registered mobile number or MyKad number associated with a DuitNow-linked bank account. Processing is conducted through the Bank Negara Malaysia-supervised PayNet network.
• E-Walets: Touch 'n Go eWallet, Boost, GrabPay. Your e-wallet mobile number is shared with the relevant licensed e-wallet provider to process transactions. mbi98 does not store full e-wallet credentials.

mbi98 retains transaction records — including amounts, timestamps, payment method types, and transaction reference numbers — for a minimum period of seven (7) years in compliance with applicable AML and financial record-keeping requirements. This retention period may be extended where required by regulatory authority or ongoing investigation.

mbi98 uses cookies and similar tracking technologies on the Platform. Cookies are small data files stored on your device that help us operate the Platform securely, remember your preferences, and understand how the Platform is used. The following categories of cookies are deployed:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Enable the Platform to remember your preferences, such as your preferred language, display settings, and last visited sections.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors interact with the Platform — including pages visited, session duration, and navigation patterns. This data is used solely to improve Platform performance and user experience.
• Security Cookies: Used to assist with fraud detection, device fingerprinting for suspicious activity monitoring, and session integrity verification.

You may manage or restrict non-essential cookies through your browser settings. However, please note that disabling strictly necessary cookies will prevent you from accessing the Platform. Your browser or device settings may also be used to manage cookie preferences at the device level.

mbi98 retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account Data: Retained for the duration of your Account, plus a minimum of five (5) years following account closure, to satisfy regulatory record-keeping and AML obligations.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, in accordance with applicable anti-money laundering regulatory requirements. Extended periods may apply where mandated by authority.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, for regulatory compliance and audit purposes.
• Customer Support Communications: Retained for three (3) years following the resolution of the relevant support interaction, or longer if the matter is subject to ongoing dispute or investigation.
• Technical and Usage Data: Retained for up to twelve (12) months for security and performance analytics purposes, after which it is anonymised or deleted.
• Marketing Consent Records: Retained until consent is withdrawn, plus a period of three (3) years for record-keeping purposes.

Upon expiry of the applicable retention period, personal data is either securely deleted, anonymised, or pseudonymised in accordance with mbi98's internal data lifecycle management procedures.

mbi98 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes, but is not limited to:

• 256-bit SSL/TLS encryption across all Platform connections, ensuring that data transmitted between your device and our servers is protected in transit.
• Encryption of personal and financial data at rest within our secure database infrastructure.
• Role-based access controls (RBAC) limiting access to personal data within our organisation on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments of our systems and Platform infrastructure.
• Multi-factor authentication requirements for all administrative and sensitive operational systems.
• Real-time transaction monitoring for fraud detection and AML compliance screening.
• Formal incident response and data breach notification procedures, designed to contain any security incident and notify affected parties as quickly as possible.

As a player on the mbi98 Platform, you hold the following rights in respect of your personal data. These rights are exercisable by contacting our Data Protection team through the support channels described in Section 16.

mbi98 will respond to all valid data rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further two months, with notification provided to you within the initial thirty-day period. We will verify your identity before processing any data rights request to prevent unauthorised disclosure.

Please note that certain rights are subject to limitations. For example, the right to erasure does not apply where retention is required to comply with a legal obligation — such as AML record-keeping requirements — or to establish, exercise, or defend legal claims.

The mbi98 Platform is strictly intended for individuals aged21 years and above. We do not knowingly collect or process personal data from any person under this age. Account registration by persons under 21 years of age is expressly prohibited under our Terms and Conditions.

mbi98 implements age verification controls as part of the account registration and KYC processes to prevent underage access. Where we discover, or are notified, that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated Account.

If you believe that a person under the age of 21 has registered an Account on the mbi98 Platform, please contact us immediately at the details provided in Section 16 of this Policy.

The operation of the mbi98 Platform may require the transfer of personal data to service providers and infrastructure hosted in jurisdictions outside of Malaysia. Where such transfers occur, mbi98 takes all reasonable steps to ensure that your personal data remains protected to a standard equivalent to that provided under applicable Malaysian data protection law.

Safeguards we employ to protect internationally transferred data include, but are not limited to:

• Contractual data processing agreements incorporating standard data protection clauses with all third-party processors.
• Due diligence assessments of the data protection frameworks applicable in the destination jurisdiction.
• Technical safeguards — including encryption in transit and at rest — applied to all data regardless of transfer destination.

You may request information regarding the specific safeguards applied to international transfers of your personal data by contacting us at the details in Section 16.

mbi98 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, the services we offer, or applicable legal or regulatory requirements. All revisions will be published on this page with an updated effective date.

Where changes are material — meaning they substantially affect how we collect, use, or share your personal data — we will provide advance notification to registered players via their registered email address, and will display a prominent notice on the Platform for a reasonable period following the change.

Your continued use of the mbi98 Platform following publication of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept the revised terms, you should cease using the Platform and contact our support team to discuss your account options.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the manner in which mbi98 processes your personal data, or if you wish to exercise any of your data protection rights as described in Section 12, please contact us through the following channels. Our Data Protection team responds to all enquiries within five (5) business days.

• Live Chat: Available24/7 on the mbi98.cam Platform — the fastest channel for most enquiries, with average initial response times of 3–5 minutes.
• Email: [email protected] — for formal data protection requests, please include your Account username, the nature of your request, and a copy of your identity document for verification purposes.
• WhatsApp: Available via live chat on the Platform — current WhatsApp contact details are provided through the live chat interface.

Support is available in English, Bahasa Melayu, and Chinese, 24 hours a day, 7 days a week, operating on Malaysia Time (MYT). For platform-related policy questions, you may also visit our FAQ page.