Privacy Policy

This Privacy Policy ("Policy") is issued by mb888 ("we", "us", "our"), the operator of the online gaming platform accessible at https://mb888.buzz (the "Site"). mb888 provides online gaming and betting services — including sports betting, live casino, slots, lottery, and arcade games — to eligible players, with a primary focus on Malaysian users.

This Policy applies to all personal data we collect and process in connection with your use of the Site and its associated services (the "Services"). It covers data collected when you browse the Site as a visitor, when you register for an account, and throughout your ongoing use of the mb888 platform.

By accessing or using the Site, you acknowledge that you have read and understood this Policy and consent to the collection and use of your information as described herein. If you do not agree with the terms of this Policy, please do not use the Site or register for an account.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference into this document.

The following definitions apply throughout this Privacy Policy:

mb888 collects personal data in the following categories:

We do not collect sensitive categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data) except where strictly required for responsible gambling assessments and only with your knowledge and consent.

mb888 collects personal data through the following channels:

• Direct interactions — data you provide when you register for an Account, complete your KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion.
• Automated technologies — data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you visit or interact with the Site.
• Payment processors — transaction confirmation data received from Malaysian payment partners including Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Boost, and GrabPay, solely to confirm and reconcile transactions.
• Third-party identity verification providers — data returned from KYC verification partners where used to confirm identity documents submitted during account verification.
• Fraud detection systems — device fingerprint data, behavioural analytics, and geo-location indicators processed by our fraud prevention infrastructure to protect all users on the platform.

mb888 uses your personal data for the following purposes:

• To create, manage, and maintain your Account and deliver the Services you have requested.
• To process deposits and withdrawals in MYR through your chosen Malaysian payment method, and to maintain accurate financial records for each transaction.
• To verify your identity and age in compliance with our KYC obligations and minimum age requirement of 21 years.
• To detect, investigate, and prevent fraudulent activity, multi-accounting, money laundering, and any other conduct prohibited under our Terms & Conditions.
• To monitor gameplay patterns for responsible gambling purposes, including identifying signs of problem gambling and triggering support interventions where appropriate.
• To communicate with you about your Account, promotions, platform updates, and support matters.
• To personalise your experience on the platform, including displaying relevant game recommendations and promotions based on your usage history.
• To improve the Site and Services through analysis of aggregated usage data.
• To comply with applicable legal, regulatory, and tax obligations.

mb888 processes your personal data on one or more of the following legal bases:

• Contractual necessity — processing required to fulfil our contractual obligations to you as a registered User, including account management, payment processing, and the delivery of gaming services.
• Legal obligation — processing required to comply with applicable laws, including anti-money laundering (AML) regulations, Know Your Customer (KYC) requirements, and age verification obligations.
• Legitimate interests — processing conducted in pursuit of our legitimate business interests, including fraud prevention, security monitoring, platform improvement, and responsible gambling enforcement, where these interests are not overridden by your fundamental rights and freedoms.
• Consent — where we rely on your consent for a specific processing activity (such as the sending of direct marketing), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

mb888 does not sell or rent your personal data to third parties. We may share your personal data with carefully selected third parties only in the following circumstances:

• Payment service providers — transaction data is shared with Malaysian payment processors (including Touch 'n Go eWallet, DuitNow, FPX, and major Malaysian banks) strictly to facilitate the processing of your deposits and withdrawals.
• KYC and identity verification providers — identity documents and personal details may be shared with licensed third-party verification partners to carry out KYC checks on our behalf.
• Game and technology providers — aggregated, anonymised gameplay data may be shared with our licensed game studio partners for the purpose of game performance monitoring and compliance reporting.
• Fraud prevention and security services — device and behavioural data may be shared with fraud detection platforms to protect the integrity of the mb888 platform and all its users.
• Legal and regulatory authorities — we will disclose personal data to law enforcement agencies, regulatory bodies, or legal advisers when required to do so by law, court order, or in connection with the investigation of illegal activity, fraud, or a breach of our Terms.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections.

All third parties with whom we share data are contractually required to handle your data in accordance with applicable data protection standards and to use it solely for the purposes for which it was shared.

mb888 uses cookies and similar tracking technologies to enhance your experience on the Site, maintain session security, and gather analytical data. The types of cookies used on the mb888 Site are as follows:

• Essential cookies — strictly necessary for the Site to function, including session management, login authentication, and security verification. These cannot be disabled without affecting Site functionality.
• Functional cookies — used to remember your preferences (such as language settings, display preferences, and last-viewed games) to provide a more personalised experience on return visits.
• Analytical cookies — used to collect anonymised data about how Users interact with the Site, including pages visited, time spent on pages, and navigation paths, to help us improve Site performance and usability.
• Security cookies — used by our fraud detection and anti-bot systems to protect the platform against unauthorised access and malicious activity.

You may control cookie settings through your browser's privacy settings. Disabling certain cookies may affect your ability to use some features of the mb888 Site. Essential cookies required for security and authentication cannot be disabled without logging out of your account.

mb888 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, as set out in this Policy, or as required by applicable legal and regulatory obligations. The specific retention periods that apply to different categories of data are as follows:

• Account and identity data — retained for the duration of your Account and for a minimum of five (5) years following Account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction and financial data — retained for a minimum of five (5) years following each transaction, in compliance with applicable financial record-keeping regulations.
• KYC documents — retained for a minimum of five (5) years following the completion of the KYC process or Account closure, whichever is later.
• Communications data — retained for two (2) years from the date of the last communication, or longer if the communication is related to an unresolved dispute or legal matter.
• Technical and usage data — retained for up to twelve (12) months in identifiable form, after which it may be aggregated and anonymised for analytical purposes.

Upon the expiry of the applicable retention period, personal data will be securely deleted or permanently anonymised. You may request early erasure of your personal data in certain circumstances as described in Section 11 (Your Rights) below.

mb888 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL (Secure Sockets Layer) encryption for all data transmitted between your device and the mb888 servers.
• Encrypted storage of sensitive personal data, including passwords (stored as salted cryptographic hashes) and KYC documents.
• Role-based access controls, ensuring that only authorised personnel with a legitimate business need may access personal data.
• Regular security audits, penetration testing, and vulnerability assessments of our platform infrastructure.
• Two-factor authentication (2FA) available as an additional Account security measure for all registered Users.
• Continuous monitoring of platform traffic for anomalous activity indicative of unauthorised access or data breach attempts.

While mb888 takes data security seriously and implements industry-standard protections, no method of electronic transmission or storage is 100% secure. We therefore cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account login credentials.

Subject to applicable law and certain conditions, you have the following rights in relation to your personal data held by mb888:

• Right of access — you have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure — you have the right to request deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. This right may be limited where we are required to retain data under applicable legal or regulatory obligations.
• Right to restriction of processing — you have the right to request that we restrict processing of your personal data in certain circumstances, for example while the accuracy of the data is in dispute.
• Right to data portability — where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — you have the right to object to processing based on legitimate interests, and to opt out of direct marketing communications at any time.
• Right to withdraw consent — where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our Data Protection team at [email protected]. We will respond to your request within 30 days. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reasons for it.

The mb888 platform is strictly for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. If you are under 21, you are not permitted to register for or use the mb888 Services.

During the registration process and KYC verification, we require Users to confirm their date of birth and to submit valid age verification documentation. If mb888 becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated Account, delete the data as far as is permissible, and refund any deposited funds to the verified payment source.

If you are a parent or guardian and believe that your child has registered on the mb888 platform without authorisation, please contact us immediately at [email protected] so that we can take appropriate action without delay.

The mb888 platform integrates with a number of third-party service providers to deliver its Services, including Malaysian payment gateways (such as Touch 'n Go eWallet, DuitNow, FPX, and major Malaysian banks), game content providers, identity verification services, and fraud detection tools. These providers operate under their own privacy policies, which are independent of this Policy.

When you interact with a third-party payment processor — for example, by completing a DuitNow transfer or authenticating via your Maybank2u account — that interaction is governed by the third party's own privacy policy, and mb888 is not responsible for the data practices of those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with your mb888 Account.

The mb888 Site does not contain links to external websites. Any third-party integrations are purely functional (payment processing, game delivery, identity verification) and do not involve the sharing of personal data beyond what is described in Section 7 of this Policy.

mb888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made, we will update the "Last updated" date at the top of this page and, where reasonably practicable, provide advance notice to registered Users via the email address associated with their Account.

Your continued use of the Site or Services after any changes to this Policy have been published constitutes your acceptance of the revised Policy. We recommend reviewing this Policy periodically to remain informed of how mb888 collects and handles your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which mb888 handles your personal data, please contact our Data Protection team using the details below. All correspondence will be handled in English and responded to within 30 days.

We take all privacy-related correspondence seriously and will make every effort to resolve your concern promptly and fairly. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.