Privacy Policy

1. Introduction

MB8 ("MB8", "we", "us", "our") respects the privacy of every individual who accesses or uses the MB8 platform at mb8.cam ("the Platform"). This Privacy Policy ("Policy") sets out in clear, plain language how MB8 collects, uses, stores, shares, and protects personal data in connection with the operation of our online casino and sports betting services.

This Policy applies to all users of the Platform, including registered players, visitors, and any individual who interacts with MB8 through any digital channel associated with the Platform. By registering an Account or using the Platform, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

This Policy should be read together with our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference. If you do not agree with this Policy, you must cease using the Platform and may request account closure via our support team.

2. Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Controller" means MB8, as the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of MB8 under a contractual arrangement.
• "Account" means a registered player account on the MB8 Platform.
• "KYC Data" means identity documentation and verification materials submitted as part of the Know Your Customer process.
• "Payment Data" means financial account details used to process deposits and withdrawals, including e-wallet references, bank account numbers, and cryptocurrency wallet addresses.
• "Cookies" means small text files placed on your device by the Platform to support functionality and analytics.

3. Data Controller

MB8 is the Data Controller responsible for the Personal Data collected and processed in connection with the Platform. MB8 determines the purposes for which your data is collected and the means by which it is processed.

Where MB8 engages third-party service providers — such as payment processors, identity verification platforms, or cloud infrastructure providers — those entities act as Data Processors under contractual data processing agreements that require them to process Personal Data only on MB8's instructions and in accordance with applicable data protection obligations.

For any questions or requests relating to the processing of your Personal Data, you may contact MB8 via the channels listed in Section 17 of this Policy.

4. Data We Collect

MB8 collects Personal Data in the following categories:

5. How We Collect Data

MB8 collects Personal Data through the following channels:

5.1 Directly From You

The majority of Personal Data MB8 holds is provided directly by you during the account registration process, KYC submission, deposit and withdrawal requests, and interactions with our customer support team. You are responsible for ensuring that all information you provide is accurate and kept up to date.

5.2 Automatically Through the Platform

When you access the Platform, MB8's systems automatically collect certain Technical Data and Usage Data via server logs, session tracking technologies, and cookies. This data is collected to maintain platform security, analyse performance, and improve the user experience.

5.3 From Third-Party Service Providers

MB8 may receive Personal Data from third-party identity verification services engaged to assist with KYC compliance, as well as from payment processors (including DuitNow, FPX, and participating banks) to confirm the status of deposit and withdrawal transactions. MB8 does not purchase contact lists or personal data from external marketing sources.

6. Legal Basis for Processing

MB8 processes Personal Data on the following legal grounds:

• Contractual necessity: Processing required to fulfil MB8's obligations under the Terms & Conditions you accepted upon registration — including Account management, payment processing, and game provision.
• Compliance with legal obligations: Processing required to meet Know Your Customer (KYC) requirements, anti-money laundering (AML) obligations, and any regulatory or law enforcement requests lawfully received by MB8.
• Legitimate interests: Processing carried out for the purposes of platform security, fraud prevention, responsible gambling monitoring, and internal analytics — where such interests are not overridden by your fundamental privacy rights.
• Consent: Where MB8 seeks to send you marketing communications or optional promotional notifications, processing will be based on your explicit consent, which you may withdraw at any time through your Account settings or by contacting support.

7. How We Use Your Data

MB8 uses the Personal Data it collects for the following specific purposes:

• To create, maintain, and administer your MB8 Account;
• To verify your identity and age (21+) through the KYC process;
• To process deposits and withdrawals via your chosen payment method (Touch 'n Go eWallet, DuitNow, Maybank, CIMB, and others);
• To deliver the sports betting and casino gaming services you have requested;
• To calculate, allocate, and track bonuses, loyalty rewards, and VIP programme benefits;
• To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct;
• To monitor Account activity for responsible gambling indicators and, where appropriate, to apply player-protection interventions;
• To communicate with you regarding Account status, security alerts, deposit confirmations, and withdrawal updates;
• To send promotional offers and bonus notifications — only where you have provided consent or have an active Account relationship with MB8;
• To improve the Platform through aggregated, anonymised analytics;
• To comply with applicable legal and regulatory obligations.

8. Data Sharing and Disclosure

MB8 does not sell, rent, or trade your Personal Data to any third party. MB8 may share Personal Data only in the following limited circumstances:

8.1 Service Providers and Data Processors

MB8 engages carefully selected third-party service providers to assist with specific operational functions, including payment processing (e-wallet operators, banks, and FPX network participants), identity verification (KYC platforms), cloud hosting infrastructure, and customer support tools. These providers are contractually bound to process your data solely on MB8's instructions and to maintain appropriate data security standards.

8.2 Legal and Regulatory Authorities

MB8 will disclose Personal Data to law enforcement agencies, regulatory bodies, or other governmental authorities where required by applicable law, a court order, or a lawful regulatory direction. MB8 will, where legally permissible, notify you of such disclosure.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of MB8's business or assets, Personal Data may form part of the transferred assets. In such circumstances, MB8 will ensure that any acquiring entity is bound by privacy obligations no less protective than those set out in this Policy.

8.4 Fraud Prevention and AML

MB8 may share Personal Data with fraud prevention services and financial intelligence units where there is a reasonable basis for suspecting illegal activity. Such sharing is conducted strictly within the bounds of applicable law and our AML compliance programme.

9. Payment Data

MB8 takes the security of payment-related Personal Data extremely seriously. The following principles apply to the processing of your Payment Data:

• All payment transactions are encrypted in transit using TLS 1.2 or higher;
• MB8 does not store full bank account numbers, card numbers, or e-wallet credentials on its own servers — payment tokenisation is used where supported by the payment provider;
• Payment Data is shared only with the specific payment processor or financial institution required to execute the requested transaction (e.g., Maybank, CIMB, Public Bank, DuitNow, FPX, Touch 'n Go eWallet operators);
• Cryptocurrency wallet addresses are stored in encrypted form and accessed only for withdrawal processing purposes;
• MB8 maintains a strict one-name matching policy — withdrawals are processed only to accounts held in the same name as the registered MB8 Account holder.

10. Cookies and Tracking Technologies

MB8 uses cookies and similar technologies to operate the Platform efficiently and to understand how players interact with it. The categories of cookies used are:

• Essential Cookies: Required for the Platform to function. These include session authentication tokens, load-balancing cookies, and security cookies. These cannot be disabled without rendering core platform features inoperable.
• Analytics Cookies: Used to collect anonymised information about how pages are used, which features are most popular, and where technical errors occur. This data is aggregated and does not identify individual users.
• Preference Cookies: Store your language preference, display settings, and last-visited lobby section so that your experience is consistent across sessions.

MB8 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. You may manage or delete cookies through your browser settings at any time, although disabling essential cookies may impair your ability to log in or use the Platform.

11. Data Retention

MB8 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligations. The following retention periods apply as a general guide:

• Account and Identity Data: Retained for the duration of the Account relationship and for a minimum of five (5) years following Account closure, in accordance with AML regulatory requirements.
• Transaction Data: Retained for a minimum of five (5) years following the date of each transaction, or longer if required by applicable financial regulations.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the completion of the KYC process, whichever is later.
• Support Communications: Retained for up to three (3) years from the date of the communication, unless the subject matter relates to an ongoing legal or regulatory matter.
• Technical and Usage Data: Retained in anonymised or aggregated form for analytics purposes for up to two (2) years.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with MB8's data disposal procedures.

12. Data Security

MB8 implements a layered security framework to protect Personal Data from unauthorised access, disclosure, alteration, or destruction. Key technical and organisational measures include:

• 256-bit SSL/TLS encryption for all data in transit between the Platform and user devices;
• AES-256 encryption for sensitive data fields stored at rest, including KYC documents and payment references;
• Two-factor authentication (2FA) available for player accounts and enforced for all administrative access;
• Role-based access controls limiting internal access to Personal Data on a strict need-to-know basis;
• Regular third-party penetration testing and vulnerability assessments;
• Intrusion detection systems and 24/7 security monitoring;
• Documented incident response procedures for data breach identification, containment, and notification.

Despite these measures, no digital platform can guarantee absolute security. In the event of a data breach that poses a significant risk to your rights and interests, MB8 will notify affected individuals as required by applicable law and will take immediate steps to contain and remediate the breach.

13. Your Rights

Subject to applicable law, you have the following rights with respect to your Personal Data held by MB8:

• Right of Access: You may request a copy of the Personal Data MB8 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. You can update most Account details directly through your Account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to MB8's legal retention obligations (see Section 11).
• Right to Restriction: You may request that MB8 restrict the processing of your Personal Data in certain circumstances — for example, while a dispute regarding its accuracy is under investigation.
• Right to Data Portability: Where technically feasible and legally applicable, you may request your Personal Data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (such as for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Object: You may object to processing carried out on the basis of MB8's legitimate interests where you have grounds relating to your particular situation.

To exercise any of these rights, please contact MB8 support via live chat or email at [email protected]. MB8 will respond to all verifiable rights requests within thirty (30) calendar days. Requests may require identity verification before they can be actioned.

14. International Data Transfers

MB8 operates globally and may transfer your Personal Data to servers or service providers located outside Malaysia. Where such transfers occur, MB8 takes steps to ensure that appropriate safeguards are in place — including contractual protections equivalent to those applicable in Malaysia — to protect your data to the same standard required under this Policy.

By using the Platform, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Malaysia as described above, subject always to the safeguards outlined in this Policy.

15. Children's Privacy

MB8 is strictly an adult platform. We do not knowingly collect or process Personal Data from individuals under the age of 21. All users are required to confirm their age at registration and to complete age verification through our KYC process before accessing real-money features.

If MB8 discovers that Personal Data has been collected from an individual under the age of 21, that Account will be immediately suspended and all associated Personal Data will be deleted from our systems as promptly as technically possible. If you believe a minor may have registered on the Platform, please contact our support team immediately.

16. Changes to This Policy

MB8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. Where a material change is made, MB8 will provide advance notice via a prominent Platform notification or by email to your registered address.

The "Last updated" date at the top of this page indicates when this Policy was most recently revised. We encourage you to review this Policy periodically. Continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

17. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please contact MB8 through the following channels:

• 24/7 Live Chat: Available directly within the Platform at all times — the fastest way to reach us.
• Email: [email protected] — for formal data rights requests and privacy inquiries.

MB8 aims to acknowledge all privacy-related communications within 48 hours and to provide a substantive response within thirty (30) calendar days. Complex data access or erasure requests may require additional time, and we will communicate an estimated timeline where necessary.