Privacy Policy mbi360 – Personal Data Protection for Malaysian Players

This Privacy Policy applies to all personal information that mbi360 collects across various channels, including the mbi360.best website, any related mobile applications, communications via email or live chat, and your interactions with our customer support team.

Mbi360 is the data controller for the personal information you provide to us. This means we are responsible for ensuring your information is processed lawfully, fairly, and transparently in accordance with the PDPA 2010 and any related legislation in force in Malaysia.

This Policy should be read together with Terms & Conditions mbi360 and Responsible Gaming Policy us. Together, these three documents form a comprehensive protection framework for every mbi360 member in Malaysia.

Mbi360 follows a data minimisation principle — we only collect information that is strictly necessary to deliver our services safely and lawfully. The information we collect falls into two main categories:

Information You Provide Directly:

• Registration Information: Full name, identification card number (MyKad), date of birth, active Malaysian phone number and email address.
• KYC Verification Information: Copy of MyKad (front and back), proof-of-address documents such as a recent bank statement or utility bill.
• Payment Information: Malaysian bank account details, eWallet account numbers (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay) and FPX transaction records. mbi360 does not directly store credit or debit card information.
• Communications: Live chat session content, support emails, and any feedback you submit to mbi360.

Information Collected Automatically:

• Technical Data: IP address, device type, operating system, web browser type and version, time zone and language settings.
• Usage Data: Pages visited, time spent, bets placed, matches and markets viewed, clicks and interactions with platform elements.
• Location Data: General location based on IP address for the purpose of verifying that you are in Malaysia and to meet geographic compliance requirements.
• Cookie & Session Data: Login session information, functional cookies, and analytics as described in the Cookie Policy section.

Mbi360 uses your personal information for specific, legitimate purposes that are directly related to the provision of our betting platform services to you. These purposes are as follows:

• Account Management: Creating and managing your mbi360 account, verifying your identity, processing deposits and withdrawals via FPX and Malaysian eWallets, and managing VIP programmes and bonuses.
• Service Provision: Enables you to place bets on football, badminton, e-sports, poker, slots, and Live Casino, including bet settlement processing, Cash Out, and all related platform functions.
• Security & Fraud Prevention: Detecting and preventing unauthorised access, fraud, collusion, money laundering, and other harmful activities that could affect you or other mbi360 members.
• Legal Compliance: To fulfil our obligations under the PDPA 2010, anti-money laundering (AML) laws, and any directives from relevant Malaysian authorities.
• Customer Support: Answering enquiries, resolving complaints, and providing technical assistance via live chat, WhatsApp, and email in Bahasa Melayu.
• Platform Improvements: Analysing aggregated usage patterns (without identifying individuals) to improve the user experience, introduce new features, and ensure the platform runs smoothly.
• Marketing Communications: Sending information about promotions, new bonuses, and platform updates — only where you have given consent to receive such communications at the time of registration.

Mbi360 will not use your personal information for any purpose beyond those stated above without first obtaining your consent. If you wish to withdraw consent for any specific purpose (such as marketing communications), you may do so without affecting your core account services.

Mbi360 does not sell, rent or trade your personal information to any third party. However, there are limited circumstances in which we may need to share your information with certain parties for legitimate purposes:

• Payment Processors: Required transaction information is shared with payment service providers such as Malaysian banks (for FPX), Touch 'n Go, GrabPay, DuitNow, Boost, and ShopeePay solely for the purpose of processing your deposits and withdrawals. These providers are bound by their own strict privacy and security policies.
• Legal Compliance: Where required by Malaysian law or a valid court order, mbi360 may be obligated to disclose personal information to the Royal Malaysia Police (PDRM), Bank Negara Malaysia, the Companies Commission of Malaysia (SSM), or other relevant authorities.
• Technical Service Providers: Software and technical infrastructure providers for mbi360 who act as data processors under our instructions only, bound by strict data protection agreements and not permitted to use your data for their own purposes.
• Fraud Prevention: Minimum necessary information may be shared with third-party fraud detection services to protect all mbi360 members from criminal activity.

In all data-sharing scenarios, mbi360 ensures that the receiving party has equivalent security measures in place and is contractually or legally bound to protect the information received in accordance with PDPA 2010.

The security of your personal data is mbi360's top priority. We continually invest in best-in-class technology and procedures to keep your information safe at all times:

• 256-bit SSL Encryption: All data transmitted between your device and mbi360's servers is fully encrypted using the latest Transport Layer Security (TLS).
• Data-at-Rest Encryption: Sensitive information stored in our databases, including KYC details and financial records, is encrypted at rest using AES-256.
• Layered Access Controls: Only mbi360 staff with a legitimate business need who have passed background checks are permitted to access personal data. All access is logged and audited.
• 24/7 Threat Monitoring: Our threat detection system monitors for suspicious activity around the clock and will automatically lock an account if an abnormal access pattern is detected.
• Regular Penetration Testing: mbi360 undergoes regular penetration testing by independent cybersecurity experts to identify and address vulnerabilities before they can be exploited.
• Two-Factor Authentication (2FA): We offer a 2FA option for members who wish to add an extra layer of security to their account beyond just a password.

While we take all reasonable steps to protect your data, no system can guarantee absolute 100% security. We therefore also encourage you to take your own protective measures, such as using a strong password, not sharing your login credentials, and logging out of your account after each session — especially on shared devices.

Mbi360 uses cookies and similar tracking technologies to keep the platform running smoothly, enhance the user experience and understand how our members use the platform. The following are the types of cookies we use:

You can manage your cookie settings through your web browser at any time. Please note that disabling necessary cookies may affect the functionality of the mbi360 platform and could cause login or account security issues.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal information held by mbi360. We are committed to making it straightforward for you to exercise these rights:

To exercise any of the rights above, contact the mbi360 Data Privacy Officer by email at privacy@mbi360.best or via live chat on the platform. Please include your account number and the nature of your request. mbi360 will verify your identity before processing any data-related request to ensure that no unauthorised party can access your information.

Mbi360 retains your personal information only for as long as necessary to fulfil the original purpose for which it was collected, or for the minimum period required under applicable Malaysian law.

• Active Account: Data is retained for the duration that your mbi360 account remains active and is used on an ongoing basis to deliver our services.
• Financial & Betting Records: Retained for a minimum of 7 years from the transaction date, in line with Malaysian tax and AML legal requirements.
• KYC Information: Retained for the duration of the active account period plus 7 years after account closure for regulatory compliance purposes.
• Inactive Accounts: Inactive account data exceeding 180 days will be retained for up to 2 years from the date of inactivity, after which data no longer required by law will be securely deleted.
• Marketing Information: Data used solely for marketing purposes will be deleted within 30 days of your withdrawal of consent.

When data is no longer needed and the minimum retention period has passed, mbi360 will securely delete or anonymise that data using methods that ensure it cannot be recovered.

The mbi360 platform is strictly restricted to individuals aged 18 and above. mbi360 does not knowingly collect personal information from children or minors under the age of 18.

If we discover or are notified that we have inadvertently collected information from a minor, we will take the following steps immediately:

• Immediately closing the associated account.
• Permanently deleting all personal information associated with that individual from our systems.
• Returning any deposited funds through an appropriate and secure method.
• Notifying the relevant authorities where necessary for the protection of minors.

Mbi360 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new technologies, legal requirements or other legitimate purposes. Any material changes will be communicated to you via:

• A clear notice within the mbi360 platform for at least 14 days prior amendment takes effect.
• Email to the address registered on your account (for significant amendments).
• Updating the "Last Updated" date at the top of this document.

Your continued use of the mbi360 platform after any amendment takes effect constitutes your acceptance of the updated Policy. If you do not agree with any changes, you have the right to close your account before the effective date of those amendments without penalty.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Previous versions of the Privacy Policy are available upon request by contacting the mbi360 privacy team.

If you have any questions, concerns, or complaints regarding how mbi360 handles your personal information, you may contact our Data Privacy Officer through the following channels:

• Privacy Email: privacy@mbi360.best – for all PDPA-related enquiries, data access requests, and privacy complaints.
• General Support Email: support@mbi360.best – for general enquiries, including questions about this Privacy Policy.
• Live Chat: Available 24/7 within the mbi360 platform in Bahasa Melayu for immediate enquiries.

Our Data Privacy Officer will acknowledge receipt of your request within 24 working hours and provide a full response within 48 business hours for standard requests. Requests involving in-depth investigations may take up to 30 working days, and we will notify you if this is the case.

If you are dissatisfied with mbi360's response to your privacy concerns, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) under the Ministry of Communications and Digital. We encourage you to reach out to us first, as we are committed to resolving all concerns internally in a satisfactory and timely manner.