Privacy Policy – mbi99 Online Casino

1. Who We Are

mbi99 operates mbi99.club, an online gaming platform providing live casino, slots, sportsbook, and live game services to registered players. References to "mbi99," "we," "us," or "our" in this Privacy Policy refer to the operating entity responsible for the platform. mbi99 acts as the data controller in respect of personal data collected through mbi99.club, meaning we determine the purposes and means of processing player data. For data processing activities carried out by third-party game providers and payment processors on our platform, those parties act as independent data processors subject to contractual data processing agreements with mbi99.

2. Data We Collect

2.1 Registration Data

When you create an mbi99 account, we collect the information you provide in the registration form, which includes:

• Full legal name;
• Date of birth (for age verification — mbi99 is strictly 21+ only);
• Residential address;
• Email address;
• Mobile phone number;
• Username and encrypted password.

2.2 Identity Verification (KYC) Data

As required under mbi99's operating licence, we collect documentary evidence of identity and address at the verification stage, including:

• Government-issued photo identity document (e.g., Malaysian MyKad, passport);
• Proof of residential address (e.g., utility bill, bank statement dated within three months);
• Evidence of payment method ownership (e.g., screenshot of registered e-wallet account, bank statement header showing account holder name).

2.3 Financial Transaction Data

We collect records of all deposits and withdrawals made to and from your mbi99 account, including transaction amounts, timestamps, payment method identifiers (e.g., registered e-wallet IDs, partial bank account numbers), and transaction reference numbers. We do not store full payment card numbers.

2.4 Gaming Activity Data

We collect records of your gaming activity on mbi99, including game sessions, bet amounts, bet outcomes, and balance changes. This data is used for account administration, dispute resolution, responsible gaming monitoring, and regulatory reporting.

2.5 Technical & Device Data

When you access mbi99.club, we automatically collect certain technical data, including your IP address, browser type and version, operating system, device type, referring URL, pages visited, and session timestamps. This data is used for security monitoring, fraud prevention, and platform performance analysis.

2.6 Communications Data

We retain records of communications between you and the mbi99 support team, including live chat transcripts, email correspondence, and records of any formal complaints made. These records are used for quality assurance, dispute resolution, and regulatory compliance purposes.

3. How We Use Your Data

mbi99 uses the personal data we collect for the following purposes:

• Account administration: Creating and managing your mbi99 player account, processing login authentication, and maintaining your account settings;
• Payment processing: Processing deposits and withdrawals via Touch n Go eWallet, Boost, Maybank, CIMB, and Public Bank; reconciling transaction records; and handling payment disputes;
• Identity verification: Conducting KYC checks required under our operating licence, including age verification (21+), identity confirmation, and anti-money laundering screening;
• Customer support: Responding to your support queries, resolving account disputes, and providing assistance with login, payments, and gameplay issues;
• Security and fraud prevention: Detecting and preventing unauthorised account access, fraudulent transactions, money laundering, bonus abuse, and other prohibited conduct;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators and administering self-exclusion, deposit limit, and session time control requests;
• Regulatory compliance: Meeting mbi99's obligations under its international gaming licence, including maintaining records, responding to regulatory enquiries, and fulfilling reporting obligations;
• Platform improvement: Analysing aggregated, anonymised usage data to improve the mbi99 platform, identify technical issues, and optimise the player experience;
• Marketing communications: Sending promotional communications to players who have consented to receive them, subject to the opt-out rights described in Section 12.

4. Lawful Basis for Processing

mbi99 processes personal data only where a lawful basis exists. The primary bases on which we rely are:

• Contractual necessity: Processing required to fulfil our obligations under the player account agreement — including account administration, payment processing, and customer support;
• Legal obligation: Processing required to comply with mbi99's regulatory obligations under its gaming licence — including KYC verification, age verification, anti-money laundering checks, and transaction record-keeping;
• Legitimate interests: Processing undertaken for mbi99's legitimate operational interests where those interests are not overridden by player rights — including security monitoring, fraud prevention, platform analytics, and responsible gaming monitoring;
• Consent: Processing for which mbi99 has obtained the player's explicit consent — specifically, the sending of direct marketing communications. Consent may be withdrawn at any time.

5. Data Sharing & Disclosure

mbi99 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following circumstances:

• Payment processors: We share the transaction data necessary to process your deposits and withdrawals with our payment service partners (Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank). These parties receive only the data required to complete the specific transaction;
• Game providers: Third-party game studios and live dealer operators on mbi99 receive a player session identifier to manage your game session. Full registration data is not passed to game providers;
• Identity verification services: Where mbi99 uses a third-party KYC platform to assist with document verification, the relevant identity documents are shared with that service under a strict data processing agreement;
• Regulatory and law enforcement authorities: mbi99 may be required to disclose player data to its licensing authority, financial intelligence units, law enforcement agencies, or courts where required by law or regulatory obligation. We will notify you of such disclosure where legally permitted to do so;
• Fraud prevention agencies: Where mbi99 reasonably suspects fraud, money laundering, or other criminal activity, relevant player data may be shared with fraud prevention and financial crime agencies;
• Professional advisers: mbi99 may share data with legal counsel, auditors, and compliance advisers under confidentiality obligations where necessary for the conduct of legitimate business operations.

6. Cookies & Tracking Technologies

mbi99.club uses cookies and similar tracking technologies to operate the platform and deliver a consistent player experience. The categories of cookies used are:

• Essential cookies: Required for core platform functionality, including login session management and security tokens. These cannot be disabled without disrupting your ability to use the platform;
• Functional cookies: Used to remember your preferences, such as language settings and display configurations, across sessions;
• Analytics cookies: Used to collect aggregated, anonymised data about how players navigate and use mbi99.club, helping us identify areas for improvement. This data does not identify individual players;
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and suspicious session behaviour.

You may manage non-essential cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in to your mbi99 account.

7. Data Security

mbi99 implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and mbi99's servers;
• Cryptographic hashing of account passwords — passwords are never stored in readable form;
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis;
• Security monitoring and intrusion detection systems on mbi99's infrastructure;
• Regular security reviews and penetration testing of platform components;
• Contractual security obligations imposed on all third-party processors with access to player data.

While mbi99 takes data security seriously, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to player rights and interests, mbi99 will take prompt action to contain the breach and will notify affected players and relevant authorities as required under its licensing obligations.

8. Data Retention

mbi99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by mbi99's legal and regulatory obligations. Specific retention periods include:

• Account and registration data: Retained for a minimum of five (5) years following permanent account closure, in line with standard gaming licence requirements for record-keeping;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction;
• KYC documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later;
• Support communications: Retained for three (3) years from the date of the last communication in a support case;
• Marketing consent records: Retained for the duration of the consent and for three (3) years following withdrawal, to document compliance;
• Technical and device data: Retained for up to twelve (12) months from collection for security and analytics purposes.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised.

9. Your Rights

Subject to applicable law and mbi99's legal obligations, registered players hold the following rights in respect of their personal data:

• Right of access: You may request a copy of the personal data mbi99 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data held in your account;
• Right to erasure: You may request deletion of your personal data where it is no longer required for the purpose for which it was collected, and where no overriding legal retention obligation applies;
• Right to restrict processing: You may request that mbi99 limit the processing of your personal data in certain circumstances (for example, while the accuracy of data is under dispute);
• Right to data portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request your data in a structured, machine-readable format;
• Right to object: You may object to processing based on mbi99's legitimate interests. mbi99 will cease such processing unless it can demonstrate compelling legitimate grounds;
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, contact the mbi99 data team at [email protected] (plain text — not a link). Requests will be actioned within thirty (30) days. Identity verification may be required before a request is processed.

10. Children & Minors

mbi99 is strictly restricted to individuals aged 21 years and above. mbi99 does not knowingly collect personal data from persons under the age of 21. If mbi99 becomes aware that personal data has been collected from a minor, the account will be immediately suspended, the data will be securely deleted, and any funds held will be dealt with in accordance with mbi99's licence obligations. If you believe a minor has registered an mbi99 account, contact support immediately at [email protected].

11. International Data Transfers

mbi99's server infrastructure and certain third-party service providers may be located outside Malaysia. Where personal data is transferred internationally, mbi99 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to that required under its operating licence. These safeguards include contractual data processing agreements with international service providers incorporating standard data protection clauses. By using mbi99, you acknowledge that your personal data may be processed outside Malaysia in connection with the services described in this Privacy Policy.

12. Marketing Communications

mbi99 may send promotional communications — including bonus offers, tournament announcements, and platform updates — to players who have opted in to receive such communications at the time of registration or through their account settings. Marketing communications are sent by email to the registered address on your account.

You may opt out of marketing communications at any time by:

• Using the unsubscribe link included in any marketing email sent by mbi99; or
• Updating your communication preferences in the Notifications section of your mbi99 account settings; or
• Contacting support at [email protected] with an opt-out request.

Opting out of marketing communications does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — which are sent regardless of marketing preferences as they relate to the management of your account.

13. Changes to This Privacy Policy

mbi99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal obligations. Material changes will be communicated to registered players via the email address held on account or via a notice displayed upon next login. The "Last Updated" date at the top of this page reflects the date of the most recent revision. Continued use of mbi99 following notification of a policy update constitutes acceptance of the revised terms.

14. Contact

For any questions, concerns, or requests relating to this Privacy Policy or mbi99's handling of your personal data, please contact us: