mbi999 Privacy Policy

1. Introduction and Data Controller

This Privacy Policy ("Policy") describes how mbi999 ("mbi999", "we", "us", "our") collects, processes, stores, and discloses personal data in connection with the operation of the mbi999 online gaming platform, accessible at mbi999.app ("the Platform").

mbi999 acts as the data controller in respect of personal data collected directly from players through the registration process, account management activities, and use of the Platform. For the purposes of this Policy, "personal data" means any information relating to an identified or identifiable natural person, as that term is understood under applicable data protection legislation.

By accessing the mbi999 Platform or submitting personal information during registration, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not create an account or continue to use the mbi999 Platform.

2. Personal Data We Collect

mbi999 collects personal data through several channels, including direct submission by the player during registration, automatic collection through your use of the Platform, and from third parties in certain limited circumstances. The categories of personal data collected by mbi999 include:

• Identity data: Full legal name, date of birth, nationality, and government-issued identification number (e.g. Malaysian MyKad number or passport number);
• Contact data: Mobile phone number, email address, and residential address;
• Financial data: Payment method details submitted for deposit and withdrawal processing (e.g. Touch n Go eWallet account identifier, DuitNow-linked bank account details, Maybank or CIMB account details); full card numbers are never stored by mbi999;
• Technical data: IP address, browser type and version, device identifiers, operating system, time zone setting, and session logs;
• Usage data: Information about how you use the mbi999 Platform, including pages visited, game sessions played, bets placed, deposit and withdrawal history, and time spent on the Platform;
• Communications data: Records of your correspondence with the mbi999 customer support team, including live chat transcripts and email communications;
• Verification documents: Copies of identity documents submitted as part of the Know Your Customer ("KYC") verification process.

mbi999 does not intentionally collect special category personal data (such as health data, racial or ethnic origin, or religious beliefs) except where this is strictly necessary for responsible gaming assessment purposes, and only with your explicit consent in such circumstances.

3. How mbi999 Uses Your Personal Data

mbi999 processes your personal data on the following legal bases and for the following purposes:

• Contract performance: To create and manage your mbi999 account, process deposits and withdrawals in MYR, and deliver the gaming services you have requested;
• Legal obligation: To comply with anti-money laundering ("AML") and counter-terrorism financing ("CTF") obligations, including identity verification, transaction monitoring, and regulatory reporting to competent authorities; to enforce age verification requirements (21+ only);
• Legitimate interests: To detect and prevent fraud, cheating, and bonus abuse; to improve the mbi999 Platform and user experience; to conduct platform security monitoring and technical maintenance;
• Consent: To send marketing communications about mbi999 promotions, bonuses, and new game releases where you have opted in to receive such communications. You may withdraw consent for marketing communications at any time by contacting mbi999 support;
• Responsible gaming obligations: To monitor player behaviour for indicators of problem gambling and to administer self-exclusion and deposit limit requests in accordance with mbi999's responsible gaming programme.

mbi999 will not use your personal data for any purpose incompatible with the purposes listed above without obtaining your prior consent.

4. Disclosure of Personal Data to Third Parties

mbi999 does not sell your personal data to third parties. mbi999 may disclose your personal data to the following categories of recipients in the circumstances described below:

• Payment processors and e-wallet providers: Financial data is shared with payment service providers (including Touch n Go, DuitNow, and participating Malaysian banks) strictly to the extent necessary to process your transactions;
• Game providers: Technical identifiers (not your full identity data) may be shared with licensed game studios operating games on the mbi999 Platform for the purpose of resolving game disputes and technical issues;
• KYC and identity verification providers: Identity documents may be shared with third-party verification service providers engaged by mbi999 to conduct KYC checks in compliance with AML obligations;
• Regulatory and law enforcement authorities: mbi999 will disclose personal data to competent regulatory authorities, law enforcement agencies, and courts where required to do so by applicable law or valid legal process;
• IT and infrastructure providers: Technical personal data may be accessible to mbi999's hosting and infrastructure service providers under contractual data processing agreements that impose obligations equivalent to those in this Policy.

All third parties to whom mbi999 discloses personal data are contractually required to maintain appropriate technical and organisational security measures and to process the data only for the specified purpose.

5. Data Retention

mbi999 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Account data and transaction records are retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, whichever is later, in compliance with AML record-keeping obligations;
• KYC verification documents are retained for the period required under the applicable international gaming authority licensing conditions and AML regulations;
• Live chat and email communications with the mbi999 support team are retained for three (3) years;
• Technical and usage data collected for platform security and fraud prevention purposes is retained for twelve (12) months from the date of collection unless a longer retention period is required for an active investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with mbi999's data destruction procedures.

6. Security Measures

mbi999 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the mbi999 Platform;
• Encryption at rest for sensitive data stored in mbi999's databases;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular security audits and penetration testing conducted by independent third parties;
• Two-factor authentication available for all player accounts as an additional security layer.

Notwithstanding the above, no method of transmission over the internet or electronic storage is completely secure. mbi999 cannot guarantee absolute security and shall not be liable for breaches that result from circumstances beyond its reasonable control, provided that mbi999 has implemented the security measures described in this section.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, mbi999 will notify affected players and relevant authorities as required under applicable law.

7. Your Data Rights

Subject to applicable data protection legislation, you have the following rights in respect of your personal data held by mbi999:

• Right of access: You may request a copy of the personal data mbi999 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where mbi999 no longer has a lawful basis for processing it, subject to mbi999's legal retention obligations;
• Right to restrict processing: You may request that mbi999 temporarily suspend processing of your data in certain circumstances;
• Right to data portability: You may request a copy of your personal data in a structured, machine-readable format;
• Right to object: You may object to processing carried out on the basis of legitimate interests, including for direct marketing purposes.

To exercise any of the above rights, please contact the mbi999 data protection team at support@mbi999.app. mbi999 will respond to all valid data subject requests within 30 calendar days. We may require proof of identity before processing any such request.

8. Cookies and Tracking Technologies

The mbi999 Platform uses cookies and similar tracking technologies to operate core platform functions, analyse usage patterns, and, where consented, to deliver relevant promotional content. The categories of cookies used by mbi999 are as follows:

• Strictly necessary cookies: Required for the Platform to function, including session management, login state, and security cookies. These cannot be disabled;
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate the mbi999 Platform, enabling mbi999 to identify and resolve usability issues;
• Preference cookies: Store your language and display preferences across sessions;
• Marketing cookies: Only set with your explicit consent, these cookies enable mbi999 to present relevant promotional content based on your platform usage.

You may manage or withdraw consent for non-essential cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the mbi999 Platform.

9. Contact and Complaints

If you have any questions, concerns, or complaints regarding mbi999's handling of your personal data, please contact us at support@mbi999.app. Our customer support team is available 24/7 via live chat and will direct data protection enquiries to the appropriate team member.

mbi999 commits to acknowledging all data protection complaints within 5 business days and providing a substantive response within 30 calendar days. Where a complaint cannot be resolved through mbi999's internal process, you may have the right to escalate the matter to the applicable supervisory authority under the relevant data protection legislation in your jurisdiction.

mbi999 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or the mbi999 Platform's data processing activities. The revised Policy will be published on mbi999.app with an updated effective date. Your continued use of the Platform following publication of an updated Policy constitutes acceptance of the revised terms.