mbi365 Privacy Policy

1. Introduction

mbi365 ("we", "us", "our", "the Platform") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains what personal data we collect from you as a User of the mbi365 online casino and sports betting platform, the purposes for which we collect and use that data, the lawful basis on which we rely to process it, and the rights available to you in relation to your personal data.

The mbi365 platform serves registered users across Malaysia, including players in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and other locations. Our payment infrastructure integrates with Malaysian financial services providers — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks (Maybank, CIMB, Public Bank, Hong Leong Bank), and USDT TRC20 — and the collection of payment-related data is necessary to facilitate deposits and withdrawals in a secure and compliant manner.

We operate under applicable data protection principles, including the principles of transparency, data minimisation, purpose limitation, accuracy, storage limitation, integrity, and accountability. We take these obligations seriously and have implemented organisational and technical measures designed to give effect to them in practice.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, IP address, and device identifiers.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means mbi365, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of mbi365, subject to a data processing agreement.
• "User" / "you" means any registered individual who has created an account on mbi365.cam or who accesses the Platform.
• "KYC" means the Know Your Customer identity verification process undertaken by mbi365 to verify User identity and comply with regulatory obligations.
• "Cookies" means small text files placed on your device by the Platform for purposes including session management, analytics, and personalisation.
• "PDPA" means the Personal Data Protection Act 2010 of Malaysia, the primary data protection legislation applicable to personal data processing activities in Malaysia.

3. Categories of Personal Data We Collect

mbi365 collects the following categories of personal data in the course of providing its services:

3.1 Registration and Identity Data

• Full legal name
• Date of birth
• Malaysian IC (MyKad) number, Driver's License number, or Passport number
• Email address
• Malaysian mobile phone number
• Preferred currency (MYR or USDT)
• Username and encrypted password

3.2 KYC Verification Data

• Scanned copies or photographs of government-issued identity documents
• Proof of residential address (utility bills, bank statements, or telecommunications bills not more than three months old)
• Selfie photographs taken while holding an identity document
• Screenshots or statements verifying registered payment method ownership

3.3 Financial and Transaction Data

• Deposit transaction amounts and timestamps
• Withdrawal requests, amounts, and processing records
• Payment method identifiers (e-wallet account IDs, bank account numbers partially masked, USDT wallet addresses)
• Transaction reference numbers
• Account balance records

3.4 Gaming and Betting Activity Data

• Game session records including game titles played, session duration, and stake amounts
• Sports betting history including markets wagered, stake amounts, and outcomes
• Bonus activations, wagering progress, and promotional participation records
• Win and loss records

3.5 Technical and Device Data

• IP address and geolocation data derived therefrom
• Device type, operating system, and browser type
• Session cookies and session tokens
• Login timestamps and session duration records
• Platform interaction logs for security and fraud detection purposes

3.6 Communications Data

• Records of live chat communications with our support team
• Email correspondence received from or sent to Users
• Support ticket content and resolution notes
• Any voluntary feedback or survey responses submitted

4. How We Collect Your Personal Data

mbi365 collects your personal data through the following channels:

• Direct collection: Information you provide voluntarily when registering an account, completing KYC verification, making deposits or withdrawals, or contacting our support team.
• Automated collection: Technical data collected automatically when you access the Platform, including IP addresses, device identifiers, and session activity logs generated through cookies and server logging systems.
• Payment processors: Transaction confirmation data relayed to us by payment service providers when you deposit or withdraw funds via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or USDT TRC20.
• Third-party verification services: Identity verification confirmation data from KYC processing partners used to validate the authenticity of submitted identification documents.
• Fraud prevention systems: Risk signals and device fingerprint data from anti-fraud and AML (anti-money laundering) screening systems employed to protect the Platform's integrity.

5. Legal Basis for Processing Personal Data

mbi365 processes your personal data on the basis of one or more of the following lawful grounds:

Processing Purpose	Legal Basis
Account registration and service provision	Contractual necessity — performance of the User Agreement
KYC identity verification	Legal obligation — anti-money laundering and regulatory compliance requirements
Processing deposits and withdrawals	Contractual necessity — fulfilment of payment transaction obligations
Fraud detection and platform security	Legitimate interests — protecting the Platform and its Users from financial crime
Responsible gambling monitoring and intervention	Legal obligation and legitimate interests — player protection obligations
Marketing communications	Consent — freely given, specific, and withdrawable at any time
Customer support and dispute resolution	Contractual necessity and legitimate interests
Regulatory record-keeping	Legal obligation — applicable international gaming and financial regulations

6. How We Use Your Personal Data

mbi365 uses the personal data we collect for the following specific purposes:

• To create, verify, and administer your mbi365 Account.
• To process deposits and withdrawals via your selected payment methods.
• To fulfil our Know Your Customer (KYC) obligations and verify your age, identity, and the source of your funds where required.
• To detect, prevent, and investigate fraudulent activity, money laundering, bonus abuse, and other forms of misuse of the Platform.
• To monitor and enforce our responsible gambling commitments, including applying deposit limits, initiating cool-off periods where appropriate, and identifying patterns of gambling behaviour that may indicate a problem.
• To provide customer support in response to your queries, complaints, and account-related requests.
• To communicate with you regarding your Account, including transaction confirmations, security alerts, and important policy updates.
• To send you promotional and marketing communications regarding mbi365 bonuses, events, and offers — where you have provided consent to receive such communications.
• To analyse and improve Platform performance, game offering, user experience, and payment processing efficiency using aggregated and anonymised data analytics.
• To comply with applicable legal and regulatory obligations, including the retention of records as required by anti-money laundering regulations.

7. Data Sharing & Disclosure to Third Parties

mbi365 does not sell, rent, or trade your personal data to third parties. We share your personal data only in the following limited circumstances:

7.1 Service Providers and Data Processors

We engage trusted third-party service providers who process personal data on our behalf under binding data processing agreements that impose confidentiality and security obligations equivalent to those we apply internally. Categories of processors include:

• Payment processing partners (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banking networks, USDT TRC20 blockchain networks)
• KYC and identity verification technology providers
• Anti-fraud and anti-money laundering screening platforms
• Cloud infrastructure and secure data hosting providers
• Customer support platform software providers
• Email and SMS communication delivery services

7.2 Regulatory and Legal Disclosure

mbi365 may disclose personal data to competent regulatory authorities, law enforcement agencies, or other governmental bodies where we are required to do so by law, court order, or regulatory direction. We will endeavour to notify you of such disclosures where we are legally permitted to do so.

7.3 Business Transfers

In the event that mbi365 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide advance notice via the Platform in the event of such a transfer and ensure that the receiving entity is bound by commitments equivalent to those in this Privacy Policy.

7.4 With Your Consent

In circumstances not covered by the above, mbi365 will seek your explicit prior consent before disclosing your personal data to any third party.

8. International Data Transfers

The mbi365 Platform serves users primarily in Malaysia and operates infrastructure that may be located in multiple jurisdictions. In connection with the provision of our services, personal data may be transferred to and processed in countries outside Malaysia.

Where such transfers occur, mbi365 implements appropriate safeguards to ensure that your personal data receives a level of protection consistent with applicable data protection standards, including through the use of contractual clauses, data processing agreements with service providers, and data transfer impact assessments where applicable.

By using the mbi365 Platform, you acknowledge and consent to the transfer of your personal data to and processing in jurisdictions outside Malaysia where necessary for the provision of our services.

9. Data Retention

mbi365 retains personal data for periods determined by the purposes for which it was collected and by applicable legal retention requirements. The following general retention guidelines apply:

• Account registration and KYC data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the transaction in accordance with applicable financial record-keeping regulations.
• Gaming activity logs: Retained for a period of three (3) years for responsible gambling monitoring and dispute resolution purposes.
• Customer support communications: Retained for a period of three (3) years from the date of the interaction.
• Marketing consent records: Retained for the duration of your account and for a period of two (2) years following account closure or withdrawal of consent.
• Technical and session logs: Retained for a period of twelve (12) months for security and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted using industry-standard data erasure methods, or anonymised such that it can no longer be associated with an identifiable individual.

10. Cookies & Similar Tracking Technologies

mbi365 uses cookies and similar tracking technologies to operate the Platform, enhance user experience, and collect analytical data. The following categories of cookies are used:

10.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They include session management cookies that maintain your logged-in status, security tokens, and cookies that remember your selected language or currency preferences. These cookies cannot be disabled without impairing the functionality of the Platform.

10.2 Performance and Analytics Cookies

These cookies collect aggregated, anonymised data about how users navigate and interact with the Platform — including pages visited, time spent, and errors encountered. This data helps us identify areas for improvement. Analytics data is not linked to individually identifiable Users.

10.3 Functional Cookies

These cookies remember your preferences and personalisation settings — for example, your preferred game category, notification settings, or display preferences — to provide a more tailored experience during future visits.

10.4 Security and Fraud Prevention Cookies

These cookies assist in detecting and preventing fraudulent activity, bot access, and suspicious login patterns. They are necessary for the security of the Platform and cannot be disabled.

11. Security Measures

mbi365 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All personal data is stored using AES-256 encryption at rest. All data transmitted between your browser and the Platform is protected using TLS 1.2 or higher (HTTPS), identifiable by the padlock icon in your browser's address bar.
• Access controls: Access to personal data is restricted to authorised mbi365 personnel on a need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Two-factor authentication (2FA): Available for all User accounts. We strongly encourage all mbi365 members to enable 2FA to provide an additional layer of protection for their accounts.
• Penetration testing: The Platform undergoes regular security assessments and penetration testing by qualified independent security professionals.
• Incident response: mbi365 maintains a documented security incident response procedure. In the event of a data breach that poses a risk to Users, we will notify affected individuals and applicable authorities within the timeframe required by applicable law.

12. Your Rights in Relation to Your Personal Data

Subject to applicable data protection law, you have the following rights in relation to the personal data mbi365 holds about you:

To exercise any of the above rights, please contact us via live chat or email at [email protected]. We may need to verify your identity before processing your request. We will respond to all verified requests within thirty (30) calendar days. Complex or high-volume requests may require up to sixty (60) days, in which case we will notify you of the extended timeline.

13. Children's Privacy — 21+ Platform

The mbi365 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Account registration requires confirmation of age eligibility, and KYC verification includes age verification through government-issued identity documents.

If we become aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you believe that mbi365 may have inadvertently collected data from a minor, please contact us immediately at [email protected].

14. Third-Party Links & Services

The mbi365 Platform may contain references to or integrations with third-party services — including payment service providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-connected banking platforms — whose privacy practices are governed by their own respective privacy policies.

When you interact with a third-party payment service during a deposit or withdrawal transaction, you are subject to the privacy practices of that third-party provider in addition to this Privacy Policy. mbi365 is not responsible for the privacy or security practices of third-party providers. We encourage you to review the privacy policies of any third-party services you use in connection with your mbi365 account.

15. Amendments to This Privacy Policy

mbi365 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or platform features. Material amendments will be communicated to registered Users via email notification and a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page reflects the most recent revision. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with any amendment, you must cease using the Platform and contact our support team to arrange account closure.

We recommend reviewing this Privacy Policy periodically to remain informed of how mbi365 handles your personal data.

16. Contact Us & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or the manner in which mbi365 processes your personal data, please contact our support team in the first instance:

mbi365 commits to acknowledging all privacy-related queries within two (2) business days and to providing a substantive response within thirty (30) calendar days. Where a request is complex or involves a large volume of data, we will notify you within the initial thirty-day period and provide an estimated extended response timeline.

If you remain unsatisfied with our response to your privacy complaint, you may escalate your concern to the relevant data protection authority in your jurisdiction. Malaysian residents may refer to the guidelines and resources published by the Department of Personal Data Protection Malaysia (PDPD) for further information regarding your rights under the Personal Data Protection Act 2010.