Mbit Privacy Policy – Data Protection Serious Malaysian Players

1 Introduction

Mbit, accessible at mbit.my, is an online entertainment platform offering casino, slots, and Sports Betting services to players in Malaysia. We understand that your trust in our platform depends greatly on how we handle your personal information.

This Privacy Policy is drafted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international data protection best practices. It applies to all users of the mbit platform — whether you are a registered member, a website visitor, or an individual contacting our support team.

Mbit is committed to protecting your privacy at every stage of your experience on our platform — from the moment you register a new account, make a deposit via Touch 'n Go eWallet or GrabPay, place a bet on the Malaysia Super League or EPL, all the way through to withdrawing your winnings. Every step of your journey with mbit is designed with privacy as a core priority.

2 Information Collected

Mbit collects personal information from various sources as you interact with our platform. The following are the categories of information we collect:

2.1 Information You Provide Directly

• Registration information: Full name, active Malaysian mobile number, email address, date of birth, and password.
• Identity verification (KYC) information: MyKad number, MyKad images (front and back), and a selfie for facial verification where required.
• Financial information: Bank account number, bank name, e-wallet phone number (Touch 'n Go, GrabPay, Boost, ShopeePay) for deposit and withdrawal purposes.
• Communications: Messages you send to our support team via live chat, email, or WhatsApp.

2.2 Automatically Collected Information

• Technical data: IP address, web browser type, device operating system, and screen resolution.
• Activity data: Pages visited, time spent, games played, bets placed, and transaction history.
• Location data: General location information derived from your IP address (state/city) for regulatory compliance and fraud detection purposes.
• Cookie data: Information stored via cookies and similar tracking technologies — please refer to Section 9 for more details.

2.3 Information from Third-Party Sources

• Verification information from approved third-party KYC service providers.
• Information from recognised gambling self-exclusion lists, to ensure mbit does not accept registrations from individuals who have self-excluded.
• Information from regulatory authorities for anti-money laundering compliance purposes.

3 How We Use Your Data

Mbit uses the personal information collected for the following purposes:

• Account management: Creating, verifying, and maintaining your account on the mbit platform.
• Transaction processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as withdrawals to your bank account or e-wallet.
• Regulatory compliance: Meeting legal obligations relating to identity verification, fraud prevention, and anti-money laundering.
• Platform security: Detecting and preventing fraud, multi-accounting, and other unlawful activities.
• Customer support: Handling your enquiries, complaints, and support requests via live chat, email, or WhatsApp.
• Service improvement: Analysing usage patterns to improve the interface, performance, and overall experience of the mbit platform.
• Marketing communications: Sending information about relevant mbit promotions, bonuses, and offers — only if you have given consent to receive such communications.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and reaching out to players who may need support.

4 Legal Basis for Data Processing

Mbit processes your personal data on valid legal bases under Malaysia's Personal Data Protection Act 2010 (PDPA). These bases are:

• Contract performance: Processing necessary to fulfil the agreement between you and mbit — including account management, transaction processing, and the provision of gaming services.
• Legal obligation: Processing required to comply with Malaysian law — including identity verification (KYC), anti-money laundering (AML) measures, and reporting to regulatory authorities.
• Legitimate interest: Processing for the purposes of platform security, fraud detection, service improvement, and business risk management — where these interests do not override your privacy rights.
• Consent: For marketing communications and the use of non-essential cookies, we require your explicit consent, which you may withdraw at any time.

5 Data Sharing with Third Parties

Mbit does not sell your personal data. However, we may share certain information with selected third parties in limited and controlled circumstances:

5.1 Service Providers

Mbit works with third-party service providers that help us operate the platform effectively. These include:

• Payment processing service providers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX gateways) to facilitate your financial transactions.
• Approved KYC and identity verification service providers.
• Cloud computing infrastructure providers that store mbit platform data in a secure and controlled environment.
• Analytics software providers that help us understand platform usage patterns (data is shared in aggregated or anonymised form wherever possible).

All third-party service providers are required to comply with strict data protection standards and are only permitted to use your data for purposes we specify — not for their own benefit.

5.2 Regulatory Authorities and Law Enforcement

Mbit may disclose your personal data to regulatory authorities, law enforcement agencies, or Malaysian government bodies when legally required to do so — including in connection with fraud investigations, money laundering, or court orders. In such circumstances, mbit is not obliged to notify you in advance if doing so is prohibited by law or by directive of the relevant authority.

5.3 Business Transfers

If mbit is involved in a merger, acquisition, or asset sale, users' personal data may be transferred as part of that transaction. You will be notified in advance via email or a prominent notice on the mbit platform before your data is transferred and becomes subject to a different privacy policy.

6 International Data Transfers

As an online platform, some of our service providers may operate or store data outside Malaysia. When this occurs, mbit ensures that equivalent protection is applied to your data through:

• Legally binding Data Processing Agreements (DPAs) with every international service provider.
• Selection of vendors operating under recognised data protection regimes or holding internationally recognised security standard certifications (such as ISO 27001).
• Standard contractual clauses that ensure your data protection rights are upheld regardless of where your data is physically stored.

Such data transfers are limited strictly to what is necessary to provide you with the mbit services you have requested, and we do not transfer more data than is required for the intended purpose.

7 Data Security

Mbit implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

7.1 Technical Security Measures

• Data encryption in transit: SSL/TLS 256-bit encryption for all communications between your browser and mbit's servers.
• Encryption of data at rest: Sensitive personal data and financial information are encrypted at rest using industry-recognised encryption standards.
• Access controls: Least privilege access principle — mbit employees are granted access only to the data specifically required to carry out their duties.
• 24/7 Monitoring: Intrusion detection system (IDS) and continuous security log monitoring to detect and respond to real-time threats.
• Regular penetration testing: mbit conducts regular security assessments by independent security specialists to identify and address potential vulnerabilities.

7.2 Organisational Security Measures

• Mandatory data security training for all mbit staff who handle users' personal data.
• A clearly defined and tested incident response procedure to handle any data breach efficiently.
• Data protection impact assessments (DPIA) for any system changes or new processes involving personal data.

8 Data Retention Period

Mbit retains your personal data for as long as necessary to fulfil the purpose for which it was collected, subject to applicable minimum legal requirements:

• Active account data: For the full duration your account remains active with mbit, plus any mandatory retention period following account closure.
• Financial transaction records: A minimum of 7 years from the date of the transaction, in line with Malaysia's anti-money laundering and tax legal requirements.
• KYC records: Minimum 5 years after the business relationship ends, in accordance with PDPA requirements and applicable gambling legislation.
• Customer support communication logs: 2 years from the date of communication for quality management and dispute resolution purposes.
• Analytics data: Aggregated and anonymised data may be retained for longer periods for platform trend analysis purposes.

Once the applicable retention period has expired, your personal data will be securely deleted or permanently anonymised using methods that ensure the data cannot be recovered or re-identified.

9 Cookie Policy

Mbit uses cookies and similar tracking technologies (such as web beacons and pixel tags) to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

9.1 Types of Cookies Used

9.2 Managing Cookies

You can manage cookies through your web browser settings. Most modern browsers let you view, manage, block, or delete cookies. Keep in mind, however, that blocking essential cookies may affect the core functionality of the mbit platform and your overall user experience.

10 Your Rights as a User

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by mbit:

To exercise any of the rights above, submit a written request to privacy@mbit.my or contact the mbit support team. We will process your request within 14 working days. In complex cases, this period may be extended by up to 30 days with appropriate notice.

11 Children's Data

The mbit platform is for individuals aged 18 and above only. mbit does not knowingly collect or process personal data from individuals under the age of 18. All account registrations require age verification, and mbit takes active steps to prevent access by underage individuals.

If we discover that personal data belonging to an individual under the age of 18 has been collected inadvertently, we will take immediate steps to delete that data and close the account in question. If you believe your child or a minor has registered on mbit, please contact us immediately at privacy@mbit.my.

12 Third-Party Links

The mbit platform may contain links to third-party websites or services in certain contexts. This Privacy Policy applies solely to the mbit platform. mbit is not responsible for the privacy practices or content of any third-party websites accessed through links on our platform.

We encourage you to read the privacy policies of other websites you visit, especially before providing them with any personal information. Responsibility for data you share with third parties falls outside mbit's control.

13 Privacy Policy Amendments

Mbit reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes to this policy:

• The "Updated" date at the top of this document will be revised accordingly.
• We will notify you via your registered email and/or in-platform notification at least 7 days before changes take effect.
• For highly material changes, we may request your consent again.

Your continued use of the mbit platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account before they take effect.

14 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, how mbit handles your personal data, or if you wish to exercise any of your privacy rights, please reach out to us through the following channels:

• mbit Data Protection Officer (DPO): privacy@mbit.my
• General customer support: support@mbit.my
• Live Chat: Available 24/7 via the chat icon at the bottom right corner of the mbit platform.

Mbit's privacy team will respond to all data-related enquiries within 14 business days. For urgent matters involving account security or a potential data breach, please use live chat for a faster response.

If you are not satisfied with how we have handled your privacy complaint, you also have the right to lodge a complaint with Malaysia's Personal Data Protection Department or the relevant regulatory body.

This Privacy Policy is governed by the laws of Malaysia. Any dispute arising from or in connection with this Privacy Policy shall be resolved under the jurisdiction of the competent courts of Malaysia.