Privacy Policy MBI18 – Our Commitment to Data Protection Malaysian Players

This Privacy Policy applies to all users of the MBI18 platform — including visitors who browse the site without registering, active registered members, and anyone who interacts with our platform on any device, whether a laptop, smartphone, or tablet.

MBI18 operates as a responsible data controller under applicable international data protection standards. This means we are accountable for ensuring that all personal data we process is handled lawfully, fairly, and transparently. We do not collect data simply because we can — we only collect what is genuinely necessary to provide you with the best possible service.

MBI18 is committed to updating this Privacy Policy from time to time to reflect changes in our practices or relevant legal requirements. We will always notify you of any significant changes before they take effect.

MBI18 only collects data that is genuinely necessary to operate the platform safely, meet licensing and legal compliance requirements, and deliver the best possible experience to Malaysian players. Below is a summary of the data we collect:

MBI18 processes your personal data on a valid legal basis — whether to fulfill our service contract with you, comply with legal obligations, or pursue legitimate interests that do not override your rights. Below are the specific purposes for which MBI18 uses your data:

• Account Management: Creating and maintaining your account, processing secure logins, and enabling full use of all MBI18 platform features including deposits, betting, and withdrawals.
• Payment Processing: Verifying and processing deposit transactions via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, FPX, Maybank2u, CIMB Clicks, and other methods; as well as processing withdrawal of winnings to your account.
• Identity Verification (KYC): Verifying that you meet the minimum age requirement of 18 years, confirming your identity for Anti-Money Laundering (AML) compliance purposes, and protecting your account from unauthorised access.
• Platform Improvement: Analyzing aggregated and anonymized usage patterns to understand which games are most popular among Malaysian players — from Gates of Olympus slots to EPL betting — and to continuously improve the overall user experience.
• Service Communications: Sending important account-related notifications, transaction confirmations, security alerts, and updates to terms relevant to your use of the MBI18 platform.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, bonus abuse, and any attempts to compromise the security of the platform or other players.
• Responsible Gaming: Monitoring activity patterns to identify signs of problem gambling and providing appropriate support when needed, including enforcing the Self-Limits you have set.
• Consent-Based Marketing: Sending promotional information, bonuses, and the latest mbi18 offers – but only if you have consented to receive them. You may withdraw this consent at any time.

MBI18 never sells your personal data to any third party for marketing or commercial purposes. This is an absolute commitment with no exceptions. However, in order to operate the platform safely and comply with applicable laws, there are limited situations in which your data may be shared:

• Payment Service Providers: Transaction data shared with payment providers such as Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, and banking institutions to process your deposits and withdrawals. This is limited strictly to the transaction information required.
• Game Software Providers: The minimum data required by third-party game providers (such as Pragmatic Play, PG Soft) to run games correctly and verify results. This does not include your full identity information.
• Regulatory Bodies & Authorities: When required by law, court order, or a regulatory body with jurisdiction over mbi18's operations. mbi18 will not disclose this information voluntarily and will notify you if permitted to do so.
• Technical Service Providers: Companies that provide mbi18's technical infrastructure, such as server hosting, cybersecurity, and analytics — bound by strict confidentiality agreements that prohibit them from using your data for their own purposes.
• Corporate Restructuring: In the event of a merger, acquisition, or asset sale, user data may be transferred to the new entity – however, that entity will be bound by a Privacy Policy at least equivalent to the one currently in place.

MBI18 makes serious investments in robust data security infrastructure. Protecting your personal and financial information is not an afterthought — it is a core component of how our platform is designed and operated. Our security measures include:

• 256-bit SSL Encryption: All data transmitted between your device and MBI18 servers is encrypted using 256-bit Secure Socket Layer (SSL) — the same standard used by major Malaysian banking institutions such as Maybank and CIMB.
• Data-at-Rest Encryption: Personal data stored in MBI18's databases is encrypted at rest, meaning that even if our servers were physically compromised, the data cannot be read without the appropriate encryption key.
• Layered Access Controls: Only MBI18 staff with a legitimate business need may access player data, and every access is logged and audited. No employee may access data beyond the scope of their responsibilities.
• Two-Factor Authentication (2FA): MBI18 offers free 2FA for all accounts. We strongly encourage all members to enable it for an extra layer of protection beyond your password.
• Real-Time Threat Monitoring: Our systems monitor for suspicious activity 24/7 — including unusual login attempts, out-of-pattern transactions, and signs of cyberattack. Any anomaly is acted upon immediately.
• Periodic Penetration Testing: MBI18 conducts regular security testing by independent cybersecurity experts to identify and address any vulnerabilities before they can be exploited.
• Incident Response Plan: MBI18 has clear protocols for responding to any data security incident — including member notification procedures within the timeframes required by applicable regulatory obligations.

The mbi18 platform uses cookies and similar tracking technologies to ensure the platform functions correctly, enhance the user experience, and understand how the platform is used on an aggregate basis. Below are the types of cookies we use and their respective purposes:

• Essential Cookies (Required): Required for the platform to function – including login session verification, basket management, and platform security. These cookies cannot be disabled as they are critical to mbi18's core operations.
• Preference Cookies: Storing your preferences such as interface language, display settings, and favourite games so you do not have to reconfigure them every time you log in to mbi18.
• Analytics Cookies: Collecting information about how you use the platform — pages visited, session duration, games tried. This data is gathered in aggregate and anonymised form to help us understand the overall needs of Malaysian players.
• Security Cookies: Helping our systems identify legitimate sessions and protecting you from session hijacking and forgery attempts. These cookies do not store any personally identifiable information.

You can manage your cookie settings through your web browser at any time. Disabling certain cookies may affect the functionality of some parts of the MBI18 platform. Note: MBI18 does not use third-party cookies for targeted advertising from external ad networks.

Mbi18 fully recognises and respects your rights over your personal data. This is not merely a legal obligation – it is a core principle in how we operate. Below are the rights you hold and how to exercise them:

MBI18 does not retain your personal data longer than necessary. Retention periods are determined by active service requirements, legal obligations (particularly relating to AML and taxation), and justifiable legitimate interests. Below is a general guide to MBI18's data retention periods:

• Active Account Data: For the full duration of your active account with MBI18 and up to 5 years after account closure, to meet legal requirements related to financial compliance.
• Financial Transaction Records: Minimum 7 years from the transaction date, in compliance with applicable tax and AML legal requirements. This covers all deposits made via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, and FPX.
• Support Communication History: 3 years from the date of last interaction, to allow for reference in the event of any subsequent dispute or complaint.
• Security Logs: 2 years to allow for security incident investigations if required. These logs do not contain detailed gameplay or financial information.
• Marketing Data (with consent): Until you withdraw your consent. Once consent is withdrawn, we will stop using your data for marketing purposes within 48 hours.

When a retention period expires or data is no longer needed, MBI18 will securely delete or anonymise it using industry-standard methods. Anonymised data (meaning data that can no longer be linked to an individual) may be retained for aggregate analytics purposes.

If you have any questions, concerns, or complaints regarding how mbi18 handles your personal data, we encourage you to reach out to us directly. The mbi18 Privacy Team should be your first point of contact, as most issues can be resolved quickly and satisfactorily through our support channels.

You can reach us via:

• 24/7 Live Chat: The fastest way to reach us for urgent privacy or account security questions. Our average response time is under 3 minutes, around the clock.
• Email: support@mbi18.com — for more detailed privacy inquiries or where written documentation is required. We will respond within 1–3 business days.
• Data Request Form: For formal data access, correction, or deletion requests, please use the form available under "Privacy Settings" in your MBI18 account after logging in.

We are committed to acknowledging every privacy complaint within 5 business days and providing a resolution or progress update within 30 days. If you are not satisfied with the resolution we provide, you have the right to escalate your complaint to the relevant data protection regulatory authority.