mb888 Privacy Policy

§ 1 Introduction

mb888 ("we", "us", "our", "the Company") is committed to protecting the privacy and personal data of all players who use the mb888 online gaming platform at mb888.lat. This Privacy Policy sets out how mb888 collects, processes, stores, shares, and protects your personal information in connection with your use of the platform.

mb888 operates in compliance with applicable international data protection frameworks and the privacy requirements of the international gaming authority under whose jurisdiction the platform holds its licence. The Company acts as the data controller for all personal data collected through mb888.lat.

This Privacy Policy should be read in conjunction with the mb888 Terms & Conditions, which govern your use of the platform overall. Where terms defined in the Terms & Conditions are used here, they carry the same meaning.

---

§ 2 Personal Data We Collect

mb888 collects the following categories of personal data from registered players and platform visitors:

mb888 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information, except where identity documentation provided for KYC purposes incidentally contains such information, in which case it is processed only to the extent necessary for identity verification.

---

§ 3 How We Collect Your Data

mb888 collects personal data through the following mechanisms:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or updating your account settings.
• Automated collection: Technical and usage data collected automatically via cookies, web beacons, server logs, and similar technologies when you visit or interact with mb888.lat.
• Third-party sources: Identity verification data from KYC service providers; fraud prevention signals from anti-fraud partners; payment processing data from e-wallet and banking providers such as Touch 'n Go, Boost, Maybank, and CIMB.

---

§ 4 Purpose & Legal Basis for Processing

mb888 processes your personal data only where a lawful basis exists. The following table summarises the primary purposes for which mb888 processes player data and the corresponding legal basis:

• Contract performance: Processing necessary to provide you with your mb888 account, process transactions, and deliver gaming services — the legal basis is performance of a contract to which you are a party.
• Legal obligation: Identity verification (KYC), anti-money laundering screening, age verification, and transaction monitoring required by our licensing authority and applicable law.
• Legitimate interests: Fraud prevention, platform security, abuse detection, system analytics, responsible gaming monitoring, and improving mb888's services — subject always to your interests not overriding ours.
• Consent: Sending you optional marketing communications about mb888 promotions, new games, and special offers — where you have opted in to receive such communications.

---

§ 5 Sharing Your Personal Data

mb888 does not sell or rent your personal data to third parties for their own commercial purposes. We may share your data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment service providers: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX gateway providers, Maybank, and CIMB — for the processing of deposits and withdrawals in MYR.
• KYC & identity verification providers: Third-party identity verification services used to fulfil our age verification and AML compliance obligations.
• Game software providers: Where technically necessary, session data may be shared with game studios (e.g., Pragmatic Play, PG Soft, Evolution Gaming) to deliver game content and resolve disputes.
• Fraud prevention & security: Anti-fraud platforms and cybersecurity service providers engaged to protect the mb888 platform and its players.
• Legal & regulatory authorities: Where disclosure is required by our licensing authority, law enforcement, court order, or other legally binding obligation.
• Corporate transactions: In the event of a merger, acquisition, or sale of assets, player data may be transferred to the successor entity, subject to equivalent data protection standards.

---

§ 6 Data Retention

mb888 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in compliance with international gaming authority AML record-keeping requirements.
• Transaction records: Financial transaction data is retained for a minimum of five (5) years as required for AML and tax compliance purposes.
• Gaming history: Game session and bet history is retained for a minimum of three (3) years following the last activity, or longer where required for dispute resolution or regulatory audit purposes.
• Support communications: Live chat and email records are retained for twenty-four (24) months following the last interaction.
• Marketing consent records: Retained for the duration of your consent and for two (2) years following any withdrawal, as evidence of compliance.

Upon expiry of applicable retention periods, mb888 will securely delete or anonymise your personal data in accordance with our internal data lifecycle procedures.

---

§ 7 Security Measures

mb888 implements a comprehensive range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS encryption on all pages and data transmissions;
• Passwords stored using one-way cryptographic hashing — never in plaintext;
• Two-factor authentication (2FA) available for all player accounts;
• Regular security audits and penetration testing of the mb888 platform;
• Access controls limiting employee access to personal data on a strict need-to-know basis;
• Incident response procedures with defined breach notification timelines.

---

§ 8 Cookies & Tracking Technologies

mb888 uses cookies and similar tracking technologies (including web beacons and local storage) on mb888.lat for the following purposes:

• Essential cookies: Required for basic platform functionality — login session management, security token validation, and server load balancing. These cannot be disabled without impairing your ability to use the platform.
• Analytics cookies: Used to understand how players navigate mb888.lat, which features are most used, and where improvements can be made. Analytics data is aggregated and does not identify individual users.
• Fraud prevention cookies: Device fingerprinting and behavioural signals used to detect and prevent fraudulent access, bonus abuse, and account takeover attempts.
• Preference cookies: Store your language and display preferences to improve your experience across sessions.

mb888 does not use advertising or cross-site tracking cookies. You can manage cookie settings through your browser — note that disabling essential cookies will affect platform functionality.

---

§ 9 Your Data Protection Rights

Subject to applicable law and our legitimate regulatory obligations, you have the following rights with respect to your personal data held by mb888:

• Right of access: Request a copy of the personal data mb888 holds about you.
• Right to rectification: Request correction of any inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to our legal retention obligations (e.g., AML record-keeping requirements may prevent full erasure of certain data).
• Right to restrict processing: Request that mb888 limits the processing of your data in certain circumstances.
• Right to object: Object to mb888 processing your data on the basis of legitimate interests, including profiling for responsible gaming monitoring.
• Right to data portability: Request a machine-readable copy of the data you have provided to mb888, where technically feasible.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), withdraw that consent at any time — withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, contact the mb888 support team via live chat at mb888.lat or by email at the address set out in Section 14. mb888 will respond to verified requests within thirty (30) calendar days.

---

§ 10 Children & Minors

The mb888 platform is strictly intended for persons aged 21 years and above. mb888 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the standard registration and KYC process.

If mb888 discovers that personal data has been collected from an individual who is under 21 years of age, such data will be deleted immediately and the associated account permanently closed. If you believe that an underage individual has registered with mb888, please contact our support team immediately at the contact details provided in Section 14.

---

§ 11 International Data Transfers

mb888's primary player base is in Malaysia, and data is processed in MYR. However, certain service providers engaged by mb888 — including game studios such as Pragmatic Play and Evolution Gaming, and cloud infrastructure providers — may process data in jurisdictions outside Malaysia.

Where personal data is transferred internationally, mb888 ensures that appropriate safeguards are in place, including contractual protections at least equivalent to those required by applicable data protection law. mb888 does not transfer player data to jurisdictions that do not provide an adequate level of data protection without implementing additional protective measures.

---

§ 12 Marketing Communications

mb888 sends marketing communications — including promotional offers, bonus announcements, and new game alerts — only to players who have affirmatively opted in to receive such communications at the time of registration or via account communication preferences.

You may opt out of receiving marketing communications at any time by:

• Clicking the "unsubscribe" link in any promotional email from mb888;
• Updating your communication preferences in your mb888 account settings;
• Contacting mb888 customer support via live chat.

Opt-out requests will take effect within forty-eight (48) hours. Transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — are not affected by marketing opt-out preferences and will continue to be sent as they relate to the operation of your account.

---

§ 13 Changes to This Privacy Policy

mb888 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our platform's features. When material changes are made, mb888 will notify registered players by email to the address on record and/or by a prominent notice on mb888.lat prior to the change taking effect.

We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of the mb888 platform following notification of a material change constitutes acceptance of the revised Privacy Policy.

---

§ 14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the mb888 Data Privacy team: