mb8my Privacy Policy for Malaysian Players

Introduction and Scope

This Privacy Policy describes how mb8my ("we", "our", "us", or "the platform") collects, uses, stores, discloses, transfers, and protects personal information relating to individuals who access or use mb8my, including registered players, individuals undergoing account verification, persons who contact support, and visitors to the mb8my website.

Personal data means any information that identifies or can reasonably identify a living individual, either on its own or in combination with other information held by mb8my or accessible to it. This policy applies to all personal data processed in connection with an mb8my account or use of any mb8my product, including online casino, live dealer rooms, sports betting markets, promotions, loyalty programmes, and customer support interactions.

Where mb8my provides links or integrations to third-party payment providers — such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB, DuitNow, or FPX — those providers operate under their own privacy policies. mb8my is not responsible for the privacy practices of independent payment networks or banking institutions. Players should review those providers' policies directly.

Definitions

The following terms carry the meanings set out below throughout this Privacy Policy:

• Account holder / player / member: The individual who registers and maintains an mb8my account.
• Personal data: Any information relating to an identified or identifiable natural person, including name, contact details, identity documents, financial data, device identifiers, and behavioural or transactional records.
• Processing: Any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• Controller: The entity that determines the purposes and means of processing personal data — in the context of mb8my accounts, this refers to mb8my.
• Processor / Service provider: An entity that processes personal data on mb8my's behalf and under its instruction, subject to contractual obligations and security requirements.
• Consent: A freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• Sensitive personal data: Categories of data warranting heightened protection, such as identity document numbers, financial account details, biometric identifiers, or health-related information.

Personal Data We Collect

mb8my collects personal data through a number of channels, including account registration forms, identity verification submissions, payment transactions, gameplay and betting activity, device interactions, and direct communications with support.

3.1 Registration and Account Data

When you register with mb8my, we collect your legal name, date of birth, residential address, email address, mobile telephone number, nationality, and chosen username. This data is required to create and maintain your account and to verify age eligibility. Malaysian players are required to be at least 21 years old to register.

3.2 Identity Verification (KYC) Data

To comply with applicable identification obligations, mb8my may request copies of your Malaysian MyKad, passport, driver's licence, or equivalent identity document, together with a selfie holding that document, a recent utility bill, or bank statement confirming your address. These documents are processed securely and retained for the applicable regulatory period.

3.3 Financial and Transaction Data

mb8my processes deposit amounts, withdrawal requests, payment method references, transaction timestamps, account balances, wagering activity, bonus credits, cashback calculations, and currency (predominantly MYR for Malaysian players). Payment card or bank details are processed through the relevant payment provider and are not stored in full by mb8my beyond necessary reference identifiers.

3.4 Device, Technical, and Usage Data

We may collect your IP address, device type and operating system, browser version, session duration, pages accessed, game and market selections, bet history, casino round identifiers, click patterns, and technical error reports. This data supports security monitoring, fraud detection, platform performance analysis, and compliance review.

3.5 Communications and Support Data

When you contact mb8my by live chat, email, or another channel, we retain the content of those communications, your account reference, and the outcome of any action taken. This record supports quality assurance, dispute investigation, training, and compliance purposes.

3.6 Responsible Gambling Data

If you set deposit limits, request a cooling-off period, apply a session reminder, or request self-exclusion, mb8my records and processes that data to give effect to the requested control and to prevent circumvention through secondary accounts.

Purposes and Lawful Bases for Processing

mb8my processes personal data under one or more of the following lawful bases depending on the specific purpose involved:

• Performance of a contract: Processing necessary to register your account, accept your deposits, process your withdrawals, settle wagers, operate the VIP programme, and deliver other account services.
• Legal obligation: Processing required to comply with applicable laws, regulatory requirements, anti-money laundering obligations, fraud prevention duties, sanctions screening, and responses to lawful authority requests.
• Legitimate interests: Processing reasonably necessary for security monitoring, fraud prevention, platform improvement, abuse detection, KYC proportionality assessments, and responsible gambling measures, where those interests are not overridden by your interests or fundamental rights.
• Consent: Processing for optional marketing communications where you have clearly opted in. You may withdraw consent at any time by contacting support or adjusting account preferences, without affecting the lawfulness of prior processing.

mb8my does not use personal data to make solely automated decisions that produce significant legal effects unless this is expressly disclosed and a lawful basis exists. Where automated tools assist in fraud screening or account review, human review is available in material cases.

Data Sharing and Disclosure

mb8my may share personal data with the categories of recipient described below, always subject to appropriate contractual restrictions and security obligations where applicable:

5.1 Payment and Banking Providers

Processing your deposits and withdrawals requires sharing relevant account and transaction data with payment processors, e-wallet operators (including but not limited to Touch 'n Go eWallet, Boost, GrabPay), Malaysian banks (including Maybank, CIMB, Public Bank, Hong Leong, RHB), and interbank networks including DuitNow and FPX. Each provider processes data according to its own terms and applicable financial regulation.

5.2 Game and Data Providers

Live casino and slot game content may be supplied by licensed third-party studios. These providers may receive limited game-round data, stake amounts, and outcome records for their own settlement, auditing, and licensing compliance purposes.

5.3 Identity Verification Services

mb8my may use specialist identity verification, document check, or age verification services to process KYC submissions. These processors operate under binding data processing agreements and are not authorised to retain or use your documents beyond the scope of the verification service.

5.4 Technology and Infrastructure Providers

Platform hosting, data storage, security monitoring, analytics, and customer communications may involve trusted service providers who process data on mb8my's instruction. Such providers are subject to confidentiality, security, and usage restrictions.

5.5 Legal and Regulatory Disclosure

mb8my may disclose personal data where required by applicable law, court order, regulatory direction, licensing obligation, or to protect the rights, property, or safety of mb8my, its members, or the public. mb8my will, where lawful, take reasonable steps to notify you of such disclosure.

5.6 No Commercial Sale of Data

mb8my does not sell, rent, barter, or commercially license personal data to unrelated third parties for their own marketing purposes. Sharing is always for a specified operational or compliance purpose.

Data Retention

mb8my retains personal data for as long as necessary to fulfil the purpose for which it was collected, or for the period required or permitted by applicable law. The following general principles apply:

• Active account data is retained for the duration of the account relationship and for a defined period following closure, in accordance with anti-money laundering, tax, and regulatory obligations that typically require records to be kept for five to seven years.
• Identity verification documents and KYC records may be retained for the period stipulated by relevant financial crime or gaming regulations applicable to mb8my's operations.
• Transaction records, including deposit and withdrawal histories, are retained for at least the minimum period required under applicable financial record-keeping rules.
• Support communications and complaint records are retained for a reasonable period consistent with dispute resolution and quality assurance needs.
• Responsible gambling records, including self-exclusion instructions, are retained to prevent reinstatement and comply with applicable player protection requirements.
• Technical logs and device data may be retained for a shorter period consistent with security monitoring and fraud detection purposes.

Following the applicable retention period, personal data is securely deleted, anonymised, or archived in a manner that prevents its use in identifiable form.

Cookies and Tracking Technologies

mb8my and its technology partners may use cookies, web beacons, pixel tags, session tokens, and similar tracking technologies when you access the platform. These tools serve several functions:

• Strictly necessary: Session management, authentication, fraud detection, and security functions that are essential for the platform to operate correctly.
• Functional: Remembering user preferences such as language, display settings, and responsible gambling controls set during a session.
• Analytical: Collecting aggregated or pseudonymised data about page interactions, game loading performance, error rates, and navigation patterns to improve the platform.
• Marketing: Where you have given consent, delivering relevant promotional content based on inferred interests. You may withdraw consent by adjusting your browser settings or contacting mb8my support.

Most modern browsers allow you to manage or delete cookies. Disabling strictly necessary cookies may impair the functionality of your mb8my account. mb8my does not use tracking technologies to build detailed profiles of non-gambling personal behaviour outside the platform.

Security Measures

mb8my implements reasonable technical and organisational security measures commensurate with the nature and sensitivity of the data processed. These include:

• Encrypted data transmission using current industry-standard protocols for connections between your device and the mb8my platform.
• Access controls restricting access to personal data to personnel and systems with a legitimate operational or compliance need.
• Secure document handling procedures for KYC submissions, including restricted storage and access logging.
• Monitoring systems designed to detect unusual access patterns, suspected fraud, or security anomalies on a continuous basis.
• Periodic review of security practices in response to changing threat landscapes and applicable technical standards.

No online system can guarantee absolute security. You are responsible for keeping your own account credentials, one-time passwords, and device access secure. If you believe your mb8my account has been accessed without your authorisation, you should contact support immediately using the details in Section 12.

International Data Transfers

mb8my's platform infrastructure, service providers, and game content partners may be located in jurisdictions outside Malaysia. Where personal data is transferred internationally, mb8my takes reasonable steps to ensure that an adequate level of protection is maintained consistent with the purposes described in this policy.

Transfers may be based on contractual safeguards with receiving parties, the nature of the service relationship (for example, a payment network required to process a DuitNow or FPX transaction), or another lawful transfer mechanism. mb8my does not deliberately route personal data to jurisdictions without a reasonable protection framework for purely administrative convenience.

User Rights

Subject to applicable law and the conditions associated with each right, mb8my members may have the following rights regarding their personal data:

• Right of access: To request a summary of the personal data mb8my holds about you and how it is used.
• Right to rectification: To request correction of inaccurate or incomplete personal data. Certain data, such as verified identity information, may require document resubmission to update.
• Right to erasure: To request deletion of personal data in certain circumstances, such as where processing is no longer necessary or consent is withdrawn and no overriding legal basis applies. Note that regulatory retention obligations may limit the scope of deletion requests.
• Right to restrict processing: To request a temporary restriction on processing where accuracy is contested, the processing is unlawful, or you have objected and a determination is pending.
• Right to data portability: To receive personal data you provided in a structured, commonly used format, where technically feasible and where the processing is based on consent or contract.
• Right to object: To object to processing based on legitimate interests, particularly for direct marketing purposes. mb8my will stop processing for direct marketing promptly upon such a request.
• Right to withdraw consent: Where consent is the sole lawful basis for processing, to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Requests should be submitted by contacting mb8my support with your registered account details and a clear description of the right you wish to exercise. mb8my will aim to respond within a reasonable period. We may need to verify your identity before processing a request to protect the security of account data.

Changes to This Privacy Policy

mb8my may update this Privacy Policy from time to time to reflect changes in our data practices, product features, payment integrations, regulatory requirements, or legal obligations. The updated policy will be published on this page with a revised effective date.

Where a material change affects how mb8my processes your personal data in a way that requires your awareness, we may communicate this through an account notification or another reasonable channel. Continued use of mb8my following the publication of a revised policy constitutes acknowledgment of the updated terms. If you disagree with the changes, you should stop using mb8my and request account closure, which will be handled in accordance with our Terms & Conditions and applicable retention requirements.