Privacy Policy

This Privacy Policy (hereinafter referred to as "Policy" or "Privacy Policy") describes how mbi8win (hereinafter referred to as "mbi8win", "we", "us", or "our"), the operator of the online gaming and entertainment platform accessible at https://mbi8win.cam, collects, uses, discloses, stores, and protects the personal data of individuals who access or use our platform (hereinafter referred to as "User", "Player", "Member", or "you").

This Policy applies to all personal data processed in connection with your use of the mbi8win platform, including but not limited to data collected during account registration, identity verification (KYC), payment processing, gaming activity, customer support interactions, and marketing communications (where you have consented to receive them).

This Privacy Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overall agreement governing your use of the mbi8win platform. In the event of any conflict between this Policy and the Terms & Conditions in relation to data protection matters, this Policy shall prevail.

By registering for an account on mbi8win or by continuing to use our services, you acknowledge that you have read and understood this Privacy Policy and you consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not use the mbi8win platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, location data, and online identifiers.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of the processing of personal data. For users of the mbi8win platform, the Data Controller is mbi8win.
• "Data Processor" means a natural or legal person which processes personal data on behalf of the Data Controller, such as a payment service provider or cloud hosting provider.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data for one or more specific purposes.
• "KYC" means Know Your Customer — the identity and age verification process conducted by mbi8win to satisfy anti-money laundering, counter-terrorism financing, and age-restriction obligations.
• "Cookies" means small text files placed on your device by the mbi8win platform for the purposes of session management, analytics, and platform functionality.

mbi8win acts as the Data Controller in respect of all personal data collected and processed through the mbi8win platform at https://mbi8win.cam. As the Data Controller, mbi8win is responsible for determining the purposes for which and the manner in which personal data is processed.

Where mbi8win engages third-party service providers (Data Processors) to process personal data on its behalf — for example, payment gateway operators, identity verification services, cloud infrastructure providers, or customer support platforms — mbi8win enters into appropriate data processing agreements with those providers to ensure that personal data is handled in accordance with applicable data protection law and consistent with the principles set out in this Policy.

For all data protection enquiries, requests, and complaints, please contact mbi8win through the channels listed in Section 15 (Contact Us) of this Policy.

4.1 Categories of Personal Data

mbi8win collects personal data across several categories, depending on your interaction with our platform. The following table summarises the main categories of personal data we collect and the typical context in which they are obtained:

4.2 Data Not Collected

mbi8win does not intentionally collect or process sensitive personal data (also known as special category data) including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or health data, except where strictly required and permitted by applicable law — for example, where responsible gambling obligations require us to record a self-exclusion request linked to a stated gambling disorder.

4.3 Data Provided by Third Parties

mbi8win may receive personal data about you from third-party sources in limited circumstances, including identity verification service providers (for KYC purposes), fraud detection and anti-money laundering screening platforms, and payment processing partners (e.g., FPX, DuitNow network operators). Such data is handled in accordance with this Policy and subject to appropriate safeguards.

mbi8win processes personal data only for specific, documented purposes and only where a valid legal basis for that processing exists. The following table describes the primary processing purposes and the applicable legal basis for each:

6.1 Third-Party Service Providers

mbi8win shares personal data with carefully selected third-party service providers who assist us in delivering our services. These providers act as Data Processors on our behalf and are contractually obligated to process data only in accordance with our instructions and in compliance with applicable data protection law. Categories of third-party processors include:

• Payment processors and financial institutions: including FPX network operators, DuitNow, and e-wallet integration partners (Touch 'n Go eWallet, Boost, GrabPay) — for the purpose of processing deposits and withdrawals.
• Identity verification and KYC service providers: for the automated or assisted verification of identity documents and age.
• Cloud hosting and infrastructure providers: for the secure hosting of the mbi8win platform and associated data systems.
• Customer support software providers: for the management of live chat, email support, and ticket systems.
• Fraud detection and anti-money laundering platforms: for compliance screening against financial crime risk lists.
• Game content providers: certain game providers may receive limited session data (e.g., player account identifier, game session tokens) for the technical operation of their games — these providers do not receive full identity or financial data.

6.2 Regulatory and Law Enforcement Disclosure

mbi8win may be required to disclose personal data to regulatory authorities, law enforcement agencies, financial intelligence units, or courts of competent jurisdiction where required by applicable law, a valid court order, or a legitimate regulatory directive. In such cases, mbi8win will disclose only the minimum data necessary to satisfy the legal requirement and will notify the data subject where permitted by law to do so.

6.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of the assets of mbi8win, personal data held by mbi8win may be transferred to the acquiring entity as part of the transaction. In such circumstances, Players will be notified of the transfer and of any changes to the data controller's identity prior to the transfer taking effect, and Players will retain their rights under this Policy.

6.4 No Sale of Personal Data

mbi8win does not sell, rent, or otherwise commercially transfer your personal data to third-party advertisers, data brokers, or marketing platforms. Any sharing of data is limited to the categories and purposes described in this Section 6.

In the course of providing its services, mbi8win may transfer personal data to servers, data centres, or service providers located outside of Malaysia. Such transfers may occur in connection with cloud hosting infrastructure, game content delivery networks, or the use of international KYC and fraud screening platforms.

Where personal data is transferred outside of Malaysia, mbi8win takes appropriate steps to ensure that an adequate level of data protection is maintained, consistent with the requirements of the Malaysian Personal Data Protection Act 2010 (PDPA) and applicable standards. These steps may include:

• Entering into standard contractual clauses or equivalent data transfer agreements with the recipient;
• Transferring data only to jurisdictions that are recognised as providing an adequate level of data protection;
• Obtaining the data subject's explicit consent to the transfer, where required and applicable.

For further information regarding the specific safeguards applied to any particular international data transfer, please contact our data protection team using the details set out in Section 15 of this Policy.

mbi8win retains personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable law or regulatory obligation. The following general retention guidelines apply:

• Account and Identity Data: Retained for the duration of the active account relationship, and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations applicable to online gaming operators.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of submission, or from the date of account closure, whichever is later, in compliance with applicable financial crime prevention regulations.
• Transaction and Financial Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with financial record-keeping requirements.
• Gaming Activity Logs: Retained for a minimum of three (3) years from the date of the activity, for responsible gambling monitoring, dispute resolution, and audit purposes.
• Customer Support Communications: Retained for two (2) years from the date of the most recent interaction, unless a longer retention period is required for ongoing dispute resolution or legal proceedings.
• Marketing Preferences and Consent Records: Retained for the duration of the account and for three (3) years following withdrawal of consent or account closure, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data that has been anonymised in a manner that cannot reasonably be used to re-identify an individual falls outside the scope of this Policy.

Subject to applicable law and regulatory limitations, you have the following rights with respect to your personal data held by mbi8win. You may exercise any of these rights by contacting our data protection team using the details in Section 15:

10.1 Types of Cookies Used

mbi8win uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the platform, including session authentication, login state management, and security functions. These cookies cannot be disabled without affecting your ability to use the platform.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred currency display, and other personalisation options that enhance your experience on mbi8win.
• Analytics Cookies: Used to collect aggregate, anonymised data about how users interact with the platform, including page visit frequency, session duration, and navigation paths. This information is used to improve platform performance and user experience.
• Security Cookies: Used to detect and prevent fraudulent access, multiple account registration, and other security threats, including through device fingerprinting technologies.

10.2 Managing Cookies

You may control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling strictly necessary cookies will impair or prevent access to the mbi8win platform. Instructions for managing cookies are available in your browser's help documentation.

Please note that mbi8win does not use third-party advertising cookies or serve targeted advertising based on your gaming behaviour to third-party advertising networks.

mbi8win implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. Key measures include:

• Transport Layer Security (TLS / SSL): All data transmitted between your device and the mbi8win platform is encrypted using 256-bit TLS encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo background screening and receive data protection training.
• Two-Factor Authentication (2FA): Available for all Player accounts and mandatory for all internal administrative access to systems containing personal data.
• Intrusion Detection and Monitoring: The mbi8win infrastructure is monitored continuously for anomalous access patterns, intrusion attempts, and other security events.
• Payment Data Handling: Full payment card and bank account details are never stored on mbi8win servers. Payment processing is handled exclusively by PCI DSS-compliant third-party payment processors.
• Incident Response: mbi8win maintains a documented data breach response plan. In the event of a data breach that is likely to result in a risk to the rights and freedoms of data subjects, mbi8win will notify affected individuals and relevant authorities in accordance with applicable law.

The mbi8win platform is strictly intended for individuals aged 21 years and above. mbi8win does not knowingly collect, process, or retain personal data of individuals under the age of 21. Our registration and KYC processes are designed to verify the age of all applicants before account activation is completed.

Where mbi8win becomes aware or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will take immediate steps to close the relevant account, return any deposited funds where feasible, and securely delete the personal data of the underage individual from our systems, subject to any mandatory legal retention obligations.

If you are a parent or guardian and you believe that a person under the age of 21 has registered an account on mbi8win, please contact our support team immediately via live chat or email. We will investigate and respond promptly.

The mbi8win platform may contain references to third-party services, including payment providers such as Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, and DuitNow. When you use these payment services, you will interact with their own platforms and be subject to their respective privacy policies and terms of service.

mbi8win is not responsible for the privacy practices, data handling, or content of any third-party service, platform, or website that is separate from the mbi8win platform. We encourage you to review the privacy policies of any third-party services you use in connection with your mbi8win account.

mbi8win reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. The date of the most recent revision is displayed prominently at the top of this page.

Where changes are material — meaning they may significantly affect your rights or the way in which your personal data is processed — we will notify registered Players via the email address associated with their account or via a prominent notice on the platform, with reasonable advance notice where practicable.

Your continued use of the mbi8win platform following the publication of an amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the amended Policy, you must cease using the platform and may close your account by contacting our support team.

For all data protection enquiries, data subject rights requests, privacy complaints, or general questions about this Privacy Policy, please contact the mbi8win data protection team through the following channels:

• Live Chat: Available 24/7 via the mbi8win platform. Please state that your enquiry relates to a data protection or privacy matter so that your message is directed to the appropriate team. Average response time under 5 minutes.
• Email: [email protected] — please use the subject line "Privacy / Data Protection Enquiry" for faster routing. We aim to respond to data protection emails within 48 hours.
• Languages Supported: Enquiries may be submitted in English, Bahasa Melayu, or Chinese (Mandarin or Cantonese). All formal data subject rights requests should, where possible, be submitted in English for processing efficiency.

mbi8win commits to acknowledging all data subject rights requests within 5 business days of receipt, and to responding substantively to requests within 21 calendar days, extendable to a maximum of 60 days for complex requests with prior written notice to the data subject.