Privacy Policy

1. Scope & Application

This Policy applies to all personal data processed by mbi365 in connection with the operation of the mbi365 Platform and related services. It applies to all registered players, prospective players who visit mbi365.one without registering, and individuals who communicate with mbi365 via email, live chat, or any other channel.

This Policy does not apply to the data practices of third-party game providers, payment processors, or other external service providers whose services you may access via the mbi365 Platform. Those entities maintain their own independent privacy policies, and mbi365 is not responsible for their data practices. mbi365 selects third-party partners who meet appropriate data protection standards and binds them contractually to data processing obligations consistent with this Policy.

2. Data We Collect

2.1 Registration & Identity Data

When you create a mbi365 account, we collect the personal information you provide, which includes: full legal name; date of birth; residential address (including state and postcode within Malaysia); email address; mobile telephone number (Malaysian number); username; and, following KYC verification, a copy of your government-issued photo identification document (Malaysian MyKad or passport) and proof of address.

2.2 Financial Data

To process deposits and withdrawals, mbi365 collects payment-related information, which may include: e-wallet identifiers (e.g., Touch 'n Go eWallet registered number, Boost account details); bank account or FPX details; DuitNow QR registration information; and transaction records including amounts, timestamps, and payment method references. mbi365 does not store full payment card numbers or card security codes on its own systems.

2.3 Gaming & Behavioural Data

mbi365 records all gaming activity conducted through your account, including: game titles played; bet amounts and outcomes; session start and end times; bonus claims and wagering progress; and cumulative win/loss records. This data is used for account management, regulatory compliance, responsible gaming monitoring, and personalisation purposes.

2.4 Technical & Device Data

When you access the mbi365 Platform, we automatically collect certain technical data, including: IP address; device type, model, and operating system; browser type and version; referring URL; session duration and page navigation patterns; and geolocation data (country and city level, derived from IP address).

2.5 Communications Data

If you contact mbi365 via live chat, email, or any other support channel, we retain records of those communications, including the content of messages, timestamps, and the support agent who handled your query. Communications data is retained for quality assurance, dispute resolution, and regulatory compliance purposes.

3. How We Collect Data

mbi365 collects personal data through the following means:

• Directly from you: information you provide during registration, KYC verification, deposit/withdrawal requests, contact form submissions, and support interactions.
• Automatically: technical and behavioural data collected via server logs, cookies, and similar tracking technologies when you use the Platform.
• From third parties: identity verification data from KYC/AML service providers; fraud risk signals from payment processors; age verification confirmations from identity verification bureaus.
• From public sources: sanctions list screening data from publicly maintained databases, as required under anti-money laundering obligations.

4. How We Use Your Data

mbi365 uses your personal data for the following purposes:

• Account administration: creation, maintenance, and closure of your mbi365 Account; authentication of your identity on login.
• Service delivery: processing deposits and withdrawals; providing access to gaming services; settling bets; applying bonus credits.
• Legal & regulatory compliance: age verification; KYC/AML screening; reporting obligations to regulatory authorities; responding to lawful requests from law enforcement.
• Fraud prevention & security: detecting and preventing fraudulent transactions, bonus abuse, multi-accounting, and other prohibited activity; maintaining the integrity of the Platform.
• Responsible gaming: monitoring gaming patterns for signs of problem gambling; implementing deposit limits, loss limits, and self-exclusion requests; contacting players who may be at risk.
• Personalisation: tailoring the game lobby, promotional offers, and content to your demonstrated preferences and play history.
• Marketing communications: sending promotional emails and notifications about mbi365 offers, bonuses, and new game releases, where you have provided consent or where permitted under applicable law. You may opt out at any time.
• Customer support: responding to queries, complaints, and disputes; maintaining records of interactions for quality control.
• Analytics & product improvement: aggregated analysis of Platform usage patterns to improve performance, usability, and game selection.

5. Legal Basis for Processing

mbi365 processes your personal data on the following legal grounds under the Malaysian Personal Data Protection Act 2010 and applicable data protection principles:

• Contractual necessity: processing required to fulfil the contract between mbi365 and you as a registered player (account administration, service delivery, payments).
• Legal obligation: processing required to comply with applicable law, including AML/KYC regulations, age verification requirements, and regulatory reporting.
• Legitimate interests: fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — where such interests are not overridden by your rights.
• Consent: marketing communications and personalisation activities, where consent is the applicable legal ground. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

6.1 Service Providers & Data Processors

mbi365 shares personal data with trusted third-party service providers who process data on our behalf under strict contractual data processing agreements. These include: KYC and identity verification providers; payment processors and e-wallet operators (Touch 'n Go, Boost, GrabPay, DuitNow, FPX, and banking partners); game software providers (who receive session data necessary to operate games); cloud infrastructure and hosting providers; customer support platform operators; and fraud detection and cybersecurity service providers.

6.2 Regulatory & Legal Disclosure

mbi365 may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or other government bodies where required by applicable law, lawful order, or regulation. Such disclosures will be limited to the minimum data required to satisfy the legal obligation.

6.3 No Sale of Personal Data

mbi365 does not sell, rent, or trade your personal data to any third-party marketer or data broker. Period.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of mbi365's assets, personal data held by mbi365 may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and your data will remain subject to privacy protections at least equivalent to those described in this Policy.

7. International Data Transfers

As an online platform serving Malaysian players, some of mbi365's service providers may be located outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide equivalent levels of data protection, mbi365 implements appropriate safeguards, such as contractual data protection clauses binding the recipient to obligations consistent with this Policy and applicable Malaysian data protection law. By using the mbi365 Platform, you acknowledge and consent to such transfers as described in this Policy.

8. Data Retention

mbi365 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following principles:

• Active accounts: data is retained for the duration of the account relationship and for a minimum of 5 years following account closure, to satisfy AML record-keeping obligations.
• Transaction records: financial transaction data is retained for a minimum of 7 years to comply with financial record-keeping requirements.
• KYC documents: identity and verification documents are retained for a minimum of 5 years post-account closure in accordance with regulatory requirements.
• Support communications: retained for 3 years following the resolution of the relevant matter.
• Marketing consent records: records of consent and opt-out requests are retained indefinitely to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any individual.

9. Cookies & Tracking Technologies

9.1 What We Use

The mbi365 Platform uses cookies and similar technologies (local storage, session tokens, pixel tags) to operate the Platform effectively and to improve your experience. Categories of cookies used include:

• Strictly necessary cookies: essential for Platform operation (session authentication, security tokens, load balancing). These cannot be disabled without impairing basic Platform functionality.
• Functional cookies: remember your preferences such as language, game lobby sorting, and "remember me" login status.
• Analytics cookies: aggregate and anonymised data about how players navigate and interact with the Platform, used to identify usability improvements.
• Marketing cookies: used to measure the effectiveness of promotional campaigns. These are only active where you have provided consent.

9.2 Managing Cookies

You may manage or disable non-essential cookies via your browser settings. Please note that disabling certain cookies may affect the functionality of the mbi365 Platform. For strictly necessary cookies, no opt-out mechanism is available as they are integral to Platform security and operation.

10. Your Data Rights

Under the Malaysian Personal Data Protection Act 2010 and applicable data protection principles, you have the following rights in relation to your personal data held by mbi365:

• Right of access: you may request a copy of the personal data mbi365 holds about you. mbi365 will respond within 21 days of receiving a valid access request.
• Right of correction: you may request correction of inaccurate or incomplete personal data. You may update certain data (email address, phone number) directly via your Account Settings.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing. This includes unsubscribing from marketing communications.
• Right to prevent processing for direct marketing: you may opt out of direct marketing at any time by using the unsubscribe mechanism in marketing emails or by contacting support.
• Right to request deletion: subject to legal and regulatory retention requirements, you may request that mbi365 delete your personal data. Note that data subject to mandatory regulatory retention periods cannot be deleted until those periods have expired.

To exercise any of these rights, please contact mbi365 at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing the request.

11. Security Measures

mbi365 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS encryption on all data transmitted between your device and mbi365 servers.
• Encryption of sensitive data fields (passwords, payment identifiers) at rest using industry-standard algorithms.
• Role-based access controls limiting mbi365 staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability scanning of Platform infrastructure.
• Two-factor authentication available for all registered player accounts.
• Automated intrusion detection and anomaly monitoring systems operating on a 24/7 basis.
• Secure deletion procedures for data that has reached the end of its retention period.

No internet-based platform can guarantee absolute security. In the event of a data breach that is likely to result in a high risk to your rights, mbi365 will notify affected individuals and relevant authorities in accordance with applicable legal requirements.

12. Children's Privacy

The mbi365 Platform is strictly intended for adults aged 21 years and above. mbi365 does not knowingly collect personal data from persons under 21. Age verification is conducted as part of the registration process, and KYC verification confirms age before withdrawal privileges are activated.

13. Third-Party Links

The mbi365 Platform may contain references to third-party game providers and services. mbi365 is not responsible for the privacy practices or content of any third-party platforms accessible via links or integrations on the Platform. We encourage you to review the privacy policies of any third-party services you interact with. This Policy applies solely to data processed by mbi365 in connection with the mbi365 Platform.

14. Changes to This Privacy Policy

mbi365 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. Material changes will be communicated to registered players via email to the address on file and/or via a prominent notice on the Platform at least 7 days before the changes take effect.

The effective date at the top of this Policy reflects the most recent revision. Your continued use of the mbi365 Platform following notification of changes constitutes acceptance of the revised Policy. If you do not accept the revised Policy, you should stop using the Platform and request account closure per the procedure described in our Terms & Conditions.

We recommend that you review this Policy periodically to stay informed of how mbi365 handles your personal data.

15. Contact & Complaints

For questions, requests, or complaints relating to this Privacy Policy or mbi365's data practices, please contact our Data Protection team: