Privacy Policy mbi33 – Personal Data Protection for Malaysian Players

This Privacy Policy describes mbi33's privacy practices regarding the collection, use, storage, sharing, and protection of your personal data as a user of the mbi33 platform. It applies to all your interactions with mbi33, including account registration, platform use, deposits and withdrawals, and communications with our customer support team.

Mbi33 acts as the responsible data controller for all personal data collected through this platform. This policy was developed in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and leading international data protection standards.

When we refer to "personal data" in this document, we mean any information that can be used to identify you, directly or indirectly, as an individual – including your name, phone number, email address, financial information, and platform usage data.

Mbi33 collects various types of personal data depending on how you interact with our platform. The table below clearly outlines each category of data we collect and the purpose for collecting it:

We do not collect sensitive data categories such as health information, political affiliations, or religious beliefs, unless directly relevant to a specific service requirement and you have provided explicit consent.

Mbi33 uses your personal data only for purposes that are lawful, necessary, and relevant to the delivery of our online casino platform services. The specific purposes for which your data is used are as follows:

• Account Management – Creating and managing your mbi33 account, ensuring secure access, and handling the required identity verification processes.
• Transaction Processing – Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u, and CIMB Clicks, as well as handling withdrawals in Malaysian Ringgit (RM).
• Service Provision – Gives you access to all games on mbi33, including Live Casino, slots, 4D lottery, Toto, Keno, EPL football betting, and the Malaysia Super League.
• Security & Fraud Prevention – To detect and prevent fraudulent activity, money laundering (AML), multi-account abuse, and unauthorized access.
• Responsible Gaming – Monitors gameplay patterns to identify signs of problem gambling and reaches out to members who may need support, in line with mbi33's commitment to responsible gaming.
• Service Communications – Delivers important notifications about your account, policy changes, security updates, and transaction information you need.
• Legal Compliance – To fulfil legal obligations under Malaysia's PDPA, anti-money laundering regulations, and the requirements of relevant regulatory bodies.
• Platform Improvement – Analyses aggregated, anonymised usage data to improve the overall performance, stability, and user experience of mbi33.

Mbi33 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, there are limited circumstances in which we may need to share your data with certain parties:

All third parties working with mbi33 are bound by strict data processing agreements, requiring them to use any data received solely for the specified purposes and to protect it to security standards on par with mbi33's own practices.

Mbi33 implements multiple layers of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption – All communications between your device and mbi33 servers are encrypted using TLS 1.3 with 256-bit key strength.
• Encryption of Data at Rest – Sensitive data stored in our databases is encrypted using the industry-recognised AES-256 algorithm.
• Multi-Layered Access Control – Access to user data within mbi33's internal systems is restricted to staff who require it to perform their duties, and no one else (principle of least privilege).
• 24/7 Monitoring – Automated security monitoring systems operate around the clock to detect and flag any suspicious activity or unauthorized access attempts.
• Two-Factor Authentication (2FA) – 2FA is available for all mbi33 accounts, adding an extra layer of protection at login.
• Regular Security Audits – mbi33 conducts regular internal and external security assessments to identify and address potential vulnerabilities before they can be exploited.
• Staff Training – All mbi33 staff who handle personal data undergo regular data protection and privacy training to ensure compliance with best practices.

Mbi33 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or to comply with applicable legal requirements. The table below outlines the retention periods we apply to each data category:

Once the retention period expires, your personal data will be securely deleted or anonymised using procedures that ensure the data cannot be recovered. If your account is closed at your request, the data deletion process will be initiated within 30 business days.

Mbi33 uses cookies and similar tracking technologies to enhance your experience on our platform, maintain secure login sessions, and understand usage patterns for continuous improvement. Below are the types of cookies we use:

You can manage or delete cookies at any time through your web browser settings. Please note that disabling essential cookies may affect the functionality of the mbi33 platform. For guidance on managing cookies in popular browsers, please refer to your browser's support documentation.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have several important rights regarding the personal data mbi33 holds about you. We are committed to making it easy for you to exercise these rights — promptly and at no charge:

To exercise any of the rights above, please contact our Data Protection Officer at support@mbi33.biz by stating your request type, mbi33 account number, and the required identity verification details. All requests will be acknowledged within 3 business days and resolved within 30 business days from the date your identity is verified.

Mbi33 strictly prohibits the use of the platform by individuals under the age of 18. This platform is not intended for minors, and we do not knowingly collect personal data from underage individuals.

Should we discover that personal data belonging to an individual under 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the relevant account. Parents or guardians who find that their child has registered an account on mbi33 should contact us immediately at support@mbi33.biz so that action can be taken without delay.

Mbi33 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or improvements to how we protect your personal data. All material amendments will be communicated to you via:

• An in-platform notification on mbi33 the next time you log in after the amendment takes effect, requiring your acknowledgement of consent.
• A notification email will be sent to the address registered on your account at least 14 days before any significant amendment takes effect.
• An update to the "Last updated" date displayed at the top of this page.

Your continued use of the mbi33 platform after an amendment takes effect constitutes your acceptance of the revised policy terms. The current version of this document is effective from: 1 January 2026. If you do not agree with any amendment, you have the right to close your account and withdraw your remaining balance before the amendment takes effect.

If you have any questions, concerns, or complaints regarding how mbi33 handles your personal data, or if you wish to exercise any of your privacy rights, please contact our Data Protection Officer (DPO):

For formal privacy complaints, please use the subject line "Privacy Complaint – [Account Number]" in your email. All privacy complaints will be acknowledged within 3 business days and resolved within 30 business days. If you are not satisfied with our response, you have the right to file a complaint with the Department of Personal Data Protection Malaysia.