Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by MBI999 ("the Company", "we", "us", or "our"), the operator of the online gaming platform accessible at https://mbi999.cam (the "Platform"). This Policy sets out the basis on which we collect, use, store, disclose, and otherwise process personal data obtained from individuals who register as players, visit our Platform, or otherwise interact with our services ("you", "your", or "the Player").

MBI999 operates as an English-language platform serving players primarily in Malaysia and internationally. We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection legislation. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

By registering a player account, making a deposit, or otherwise using the MBI999 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not accept this Policy, you must cease using the Platform and close your account.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, date of birth, contact details, payment information, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, storage, use, transmission, amendment, or deletion.
• "Data Controller" — MBI999, which determines the purposes and means of processing personal data obtained through the Platform.
• "Data Processor" — any third party that processes personal data on behalf of MBI999 under a formal data processing agreement (e.g., payment service providers, KYC verification partners).
• "Consent" — a freely given, specific, informed, and unambiguous indication of the Player's agreement to the processing of their personal data for a stated purpose.
• "KYC" — Know Your Customer; the identity and age verification process mandatory for all MBI999 players prior to withdrawal processing.
• "Cookies" — small text files placed on a player's device by the Platform for functional, analytical, or security purposes.
• "Special Category Data" — sensitive personal data including health information, financial condition data, or any data that may indicate a player's vulnerability requiring additional responsible gambling protections.

3. Data We Collect

MBI999 collects personal data through several channels: directly from players during registration and account management, automatically through your use of the Platform, and from third-party service providers used to verify your identity or process your transactions.

MBI999 does not intentionally collect special category data. However, where a player voluntarily discloses health-related information (for example, when requesting self-exclusion due to gambling-related harm), such information is processed with heightened care and used solely to action the player's responsible gambling request.

4. How We Use Your Personal Data

MBI999 processes your personal data for the following purposes:

4.1 Account Management & Service Delivery

We use your identity and contact data to create and maintain your player account, authenticate your login sessions, process your deposits and withdrawals via Malaysian payment methods (including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank), and provide access to all gaming features available on the Platform.

4.2 Identity Verification (KYC)

We process identity and KYC document data to verify that you are who you claim to be, to confirm that you meet the minimum age requirement of 21 years, and to comply with our obligations under applicable anti-money laundering (AML) and counter-terrorist financing (CTF) regulations. KYC data is retained for a minimum of five (5) years following account closure, as required by applicable regulatory standards.

4.3 Fraud Prevention & Security

Technical data (IP address, device fingerprint, geolocation) and financial transaction data are processed to detect and prevent fraudulent activity, unauthorised account access, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions. Automated risk-scoring systems are used to flag unusual account behaviour; flagged accounts are reviewed by our compliance team.

4.4 Responsible Gambling Monitoring

Gaming activity data is processed to monitor for indicators of problem gambling behaviour. Where our systems identify patterns consistent with at-risk play — such as extended session durations, rapidly escalating wager sizes, or frequent late-night sessions — our responsible gambling team may proactively reach out to offer support tools. This processing is carried out in the legitimate interest of player welfare.

4.5 Marketing Communications

Where you have provided explicit consent during registration or through your account communication preferences, we may send you marketing emails or in-platform notifications about promotions, bonuses, and new features on MBI999. You may withdraw consent for marketing communications at any time by adjusting your account preferences or by contacting our support team. Withdrawal of marketing consent does not affect the processing of data for account management or legal compliance purposes.

4.6 Legal & Regulatory Compliance

We process personal data as necessary to comply with applicable laws, regulations, and the requirements of our licensing authority, including responding to lawful requests from regulators, law enforcement agencies, and courts with jurisdiction over our operations.

5. Legal Basis for Processing

MBI999 relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing required to perform the contract between MBI999 and the Player, including account creation, transaction processing, and service delivery.
• Legal Obligation: Processing required to comply with AML/CTF regulations, licensing conditions, KYC requirements, and lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, responsible gambling monitoring, and analytics — where such interests are not overridden by the Player's data protection rights.
• Consent: Processing for marketing communications and optional analytics cookies, where you have given freely withdrawn, specific, informed consent. You may withdraw this consent at any time without penalty.

6. Data Sharing & Disclosure

MBI999 does not sell, rent, or trade your personal data to third-party marketing organisations under any circumstances. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: Financial institutions and payment processors facilitating your transactions — including DuitNow operators, FPX gateway providers, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network operators — receive the minimum data necessary to process and verify your transactions.
• KYC & Identity Verification Partners: Accredited third-party identity verification services may process your KYC documents on our behalf under formal data processing agreements that require them to meet equivalent data protection standards.
• Game Software Providers: Third-party game studios whose gaming products are made available on the MBI999 Platform may receive technical session data (but not personally identifiable financial data) for game delivery and RNG certification purposes.
• Regulatory Authorities & Law Enforcement: We are legally obligated to disclose personal data to relevant government bodies, regulators, and law enforcement agencies when required to do so by applicable law, court order, or regulatory directive.
• Professional Advisers: Lawyers, auditors, insurers, and other professional advisers who require access to player data in connection with the provision of professional services to MBI999, subject to strict confidentiality obligations.

7. Data Retention

MBI999 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of the account relationship and for a period of five (5) years following account closure.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification, in accordance with AML/CTF regulatory requirements.
• Transaction Records: Retained for seven (7) years from the date of the relevant transaction, as required by financial record-keeping obligations.
• Support Communications: Retained for three (3) years from the date of the communication.
• Marketing Consent Records: Retained for the duration of consent plus three (3) years to demonstrate compliance in the event of a regulatory inquiry.
• Technical Logs & Security Data: Retained for twelve (12) months unless retained for longer periods in connection with an active fraud or compliance investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with MBI999's data lifecycle management procedures.

8. Data Security

MBI999 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and MBI999's servers is protected by industry-standard TLS (Transport Layer Security) encryption. Our Platform enforces HTTPS across all pages.
• Encryption at Rest: Sensitive personal data stored on MBI999's servers — including KYC documents and financial data — is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to personal data is restricted to authorised personnel on a strictly need-to-know basis. All staff with access to player data undergo regular data protection training and are bound by confidentiality obligations.
• Two-Factor Authentication (2FA): MBI999 supports and recommends two-factor authentication for all player accounts. Players are encouraged to enable 2FA through their account security settings.
• Penetration Testing & Vulnerability Scanning: Our Platform and infrastructure undergo regular security assessments, including penetration testing by qualified third-party security specialists.
• Incident Response: In the event of a data breach that poses a risk to the rights and freedoms of affected players, MBI999 will notify affected individuals and relevant regulatory authorities within the timeframes required by applicable law.

9. Cookies & Tracking Technologies

MBI999 uses cookies and similar tracking technologies to ensure the proper functioning of the Platform, remember your preferences, and analyse how our services are used. We do not use advertising cookies or deploy third-party tracking pixels for audience targeting.

You may manage or withdraw consent for optional cookies at any time by adjusting your browser settings. Most modern browsers allow you to block or delete cookies through their privacy or settings menus. Please note that disabling strictly necessary or functional cookies may impair your ability to use the Platform effectively.

10. International Data Transfers

MBI999 operates under international licensing and may engage service providers or data processors based in jurisdictions outside Malaysia. Where personal data is transferred to a country that does not provide an equivalent level of data protection to Malaysia's PDPA, MBI999 will implement appropriate safeguards prior to any such transfer, which may include:

• Standard contractual clauses binding recipient processors to data protection standards equivalent to those applied within Malaysia;
• Transfers to jurisdictions with adequacy decisions or equivalent internationally recognised data protection frameworks;
• Binding corporate rules where applicable within our group of affiliated entities.

MBI999 will not transfer personal data internationally where doing so would place the Player's rights and freedoms at material risk. Players may request information about the safeguards applicable to any specific international transfer of their data by contacting our support team.

11. Your Rights as a Data Subject

Subject to applicable law and certain regulatory exceptions (such as the obligation to retain KYC data for AML compliance purposes), you have the following rights in relation to your personal data held by MBI999:

To exercise any of the above rights, please contact our Data Protection team by email (plain text — not a clickable link): [email protected]. Please include your full name, registered email address, and a clear description of your request. We will respond within 30 days of receiving a valid, complete request.

12. Minors & Age Verification

The MBI999 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory component of MBI999's KYC process; players must provide documentary proof of age before withdrawal privileges are activated.

If MBI999 becomes aware that personal data has been collected from an individual under the age of 21, we will promptly close the account, return any deposits to the source payment method, void any associated winnings, and securely delete the personal data in question in accordance with our data retention procedures. If you believe that a minor has accessed or registered an account on MBI999, please contact our support team immediately.

13. Third-Party Services & Links

The MBI999 Platform integrates third-party services to deliver certain functionalities — including payment processing (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank), KYC verification, and game software provision. Each such provider operates under its own privacy policy and data handling practices, which MBI999 cannot fully control.

MBI999 conducts due diligence on all third-party processors and contractually requires them to apply data protection standards equivalent to those described in this Policy. However, we strongly encourage you to review the privacy policies of any third-party service you interact with in connection with using MBI999.

This Policy does not extend to any third-party websites, platforms, or services that may be referenced in general educational or informational content on MBI999. MBI999 bears no responsibility for the privacy practices of third-party operators.

14. Policy Amendments

MBI999 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or operational requirements. Where changes are material, MBI999 will notify registered players by email or via prominent in-platform notice prior to the changes taking effect. Non-material clarifications may be made without prior notice.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. We encourage you to review this Policy periodically. Your continued use of the Platform following notification of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you must cease using the Platform and request account closure.

15. Contact & Data Requests

For all privacy-related enquiries, data subject access requests, consent withdrawals, or data deletion requests, please contact MBI999 using the details below. Our Data Protection team will respond to all enquiries within 30 calendar days of receipt of a complete and valid request.

• Email (plain text): [email protected]
• Subject Line: Please use "Privacy Request – [Your Registered Email]" to ensure prompt routing to the Data Protection team
• Live Chat: Available 24/7 through the MBI999 Platform — select "Privacy / Data Request" from the support category menu
• Response Commitment: Standard data subject requests acknowledged within 72 hours; substantively responded to within 30 calendar days