Privacy Policy MBI360 – User Personal Data Protection

01 Introduction and Scope of Privacy Policy

This Privacy Policy describes the personal data protection practices of mbi360 ("we", "Platform") regarding information collected from users ("you") who access or use the mbi360 platform via the official website, iOS and Android mobile apps, and any related integrated services.

Mbi360 operates in full compliance with the Malaysian Personal Data Protection Act 2010 (PDPA). We recognise that user trust is our most valuable asset, and our commitment to privacy is the cornerstone of that trust. Every decision we make regarding data management is guided by the principles of security, transparency, and the best interests of our users.

This policy applies to all mbi360 users across Malaysia, including registered members, casual visitors, and anyone who interacts with our platform in any capacity. By continuing to use the mbi360 platform after reading this document, you agree to the practices described herein.

02 Types of Personal Data We Collect

Mbi360 collects only the information necessary to operate our services safely and effectively. Below are the categories of data we collect along with their primary purposes:

03 How We Collect Personal Data

Mbi360 collects personal data through several different channels depending on the nature of your interaction with our platform. It is important for you to understand these channels so you know when and how your information is collected.

• Account Registration: When you register an mbi360 account, you directly provide your name, email, phone number and other basic information required to create your profile.
• KYC Verification: The identity verification process requires you to upload an official document such as a national ID or passport, along with a selfie to confirm the authenticity of the document.
• Gaming Activity: Every bet placed, win recorded, session duration and game played is automatically logged as part of account management.
• Financial Transactions: Deposit and withdrawal details — including payment method, amount, and transaction timestamp — are collected for every financial transaction.
• Automatic Technical Data: Our system automatically records your IP address, device type, app version and other technical data each time you access the platform.
• Cookies and Tracking Technologies: The mbi360 website uses session cookies and persistent cookies to enhance your browsing experience and understand usage patterns.
• Customer Support: When you contact our support team via live chat or email, conversations are recorded for training and service improvement purposes.

04 Purpose of Personal Data Use

Every piece of information we collect has a clear and legitimate purpose. mbi360 does not use your data for purposes unrelated to the services we offer. The following are the primary purposes for which your data is used:

• Creating and managing your user account and ensuring login security through two-factor authentication
• Processing deposits, withdrawals, and all financial transactions securely and accurately
• Complying with anti-money laundering (AML) and know-your-customer (KYC) obligations as required by the relevant authorities
• Detecting and preventing fraud, unauthorised access, and suspicious activity on the platform
• Providing effective customer support and resolving complaints promptly
• Sending important notifications related to your account, transactions, and security updates
• Personalising your gaming experience by recommending relevant games and promotions
• Analysing platform usage patterns to improve performance, usability, and new features
• Implementing responsible gaming programmes, including monitoring playing habits and sending session time alerts

05 Data Sharing and Disclosure

Mbi360 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. This is our absolute commitment. However, there are limited situations where we need to share certain information with trusted parties to enable our services to function:

• Payment Providers: Transaction information is shared with licensed payment processors such as FPX, Touch 'n Go, and our partner banks solely to process your financial transactions.
• KYC Service Providers: Your identification documents are submitted to a certified third-party identity verification service to complete the KYC process.
• Game Providers: Minimum game session data is shared with licensed third-party game providers to ensure games function correctly.
• Legal Authorities: mbi360 will disclose user information to the relevant authorities if required by a court order, applicable law, or a legitimate criminal investigation.
• Business Transfer: In the event of a business merger or acquisition, user data may be transferred to the new entity subject to the same or stricter privacy protections.

All third parties with whom we share data have strict data protection agreements with mbi360 and are not permitted to use your information for any purpose other than those specified.

06 Data Security and Encryption

Mbi360 invests seriously in cybersecurity infrastructure to ensure your personal data is always protected. We employ a multi-layered security approach that combines the latest technology with stringent operational procedures.

• Data encryption in transit using TLS 1.3 and 256-bit SSL protocols, ensuring no third party can intercept communications between your device and mbi360 servers
• Sensitive data is stored encrypted using AES-256 algorithms on servers protected by enterprise-grade firewalls
• Two-factor authentication (2FA) is available for all user accounts to add an extra layer of protection during login
• Round-the-clock security monitoring by our IT security team to detect any suspicious activity or intrusion attempts
• Penetration testing is conducted regularly by independent security experts to identify and patch any system vulnerabilities
• Strict internal access controls ensure that only authorised personnel can access user data, and every access is logged for audit purposes

07 Cookies and Tracking Technologies

The mbi360 website and app use cookies and similar tracking technologies to improve the user experience and understand how our platform is used. Cookies are small text files stored on your device when you visit our website.

• Essential Cookies: Required for core platform functions such as login session management and language preferences. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use our website to help us improve platform performance and speed.
• Functional Cookies: Saving your preferences such as display settings and favourite games so you do not need to reconfigure them every time you log in.
• Analytics Cookies: Helping us understand which pages are visited most and how users navigate the platform, so we can improve design and content.

You can manage your cookie settings through your web browser at any time. Disabling certain cookies may affect some platform functionality. The mbi360 mobile app uses device identifiers similar to cookies for the same purposes.

08 User Rights Over Personal Data

Under the Personal Data Protection Act 2010 and international best practices, you have the following rights regarding your personal data held by mbi360. We are committed to respecting and facilitating the exercise of these rights.

• Right to Access: You have the right to request a copy of all personal data we hold about you. Requests will be processed within 14 business days.
• Right to Rectification: If any information we hold about you is inaccurate or outdated, you have the right to request immediate correction.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. Please note that data required for AML compliance may need to be retained for the period prescribed by law.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time, with no impact on your core services.
• Right to Data Portability: You may request your data in a machine-readable format for the purpose of transferring your information to another platform if needed.
• Right to Withdraw Consent: You may withdraw consent for optional data processing (such as marketing) at any time through your account settings.

09 Data Retention Period

Mbi360 does not retain your personal data longer than is necessary for the original purpose of collection or as required by law. Our data retention policy is as follows:

• Active account data is retained for as long as your account remains active and for 5 years after account closure for legal compliance purposes
• Financial transaction records are retained for a minimum of 7 years as required by Malaysia's anti-money laundering laws
• KYC documents are retained for the duration of account operation plus 5 years after account closure
• Customer support communication logs are retained for 2 years for quality control and dispute resolution purposes
• Anonymised analytics and technical data is retained indefinitely as it can no longer be linked to any specific individual

Once the retention period expires, your data will be securely deleted or anonymised so it can no longer be linked to your identity.

10 Child Protection

The mbi360 platform is strictly for adults aged 18 and above. We do not knowingly collect or process personal data of individuals under 18 years of age. If we discover that data from a minor has been collected without our knowledge, it will be deleted immediately and the associated account will be terminated.

11 Privacy Policy Amendments

Mbi360 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our privacy practices, legal requirements, or technological developments. We are committed to informing users of any significant changes.

• Significant changes will be communicated via in-app notifications or email at least 14 days before taking effect
• The "Last Updated" date at the top of this document will be revised whenever changes are made
• Continued use of the platform after the effective date of any amendment constitutes your acceptance of the updated terms
• Previous versions of the Privacy Policy are kept in our archives and can be requested for reference

12 How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we manage your personal data, our team is ready to assist through the following channels:

• Privacy Email: [email protected] — for official requests regarding personal data rights
• 24/7 Live Chat via the mbi360 platform — for general enquiries that require an immediate response
• General Support Email: [email protected] — for general complaints and account-related enquiries

We commit to responding to all privacy-related enquiries within 3 business days. For formal data rights requests, processing may take up to 14 business days depending on the complexity of the request. If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.