mbiwin Privacy Policy — Your Data, Handled with Care

1Introduction

mbiwin operates an online information and gaming platform accessible at mbiwin.cam. This Privacy Policy forms part of our broader terms of service and should be read together with the Terms & Conditions. It applies to all personal information collected through registration, account management, payment activity, customer support interactions, responsible-gambling tools and general website use.

By accessing mbiwin, submitting registration data or using platform features, you confirm that you have read and understood how we process personal data as described herein. If you do not agree with any part of this policy, please discontinue use of mbiwin.

2Scope and Application

This Privacy Policy applies to all individuals who access or register with mbiwin, including users based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other locations within Malaysia. It applies to data collected through desktop browsers, mobile devices and any supported mbiwin interface.

Where mbiwin provides links to third-party services — such as a bank portal for Maybank2u, CIMB Clicks, or DuitNow — those services are governed by their own privacy policies. mbiwin is not responsible for the data practices of independent payment providers or other third-party platforms.

3Categories of Personal Data We Collect

mbiwin may collect and process the following categories of personal information:

4How Personal Data Is Collected

Personal data is collected through the following channels:

• Direct submission: data you enter during registration, verification, payment instruction, support correspondence or responsible-gambling tool activation;
• Automated technical collection: IP addresses, session metadata, cookies and device identifiers recorded when you access mbiwin;
• Payment processing: transaction references, amounts and status updates from Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay or other connected payment channels; and
• Third-party verification services: identity or address confirmation data returned by a verification provider for KYC purposes.

5Legal Basis for Processing

mbiwin processes personal data under one or more of the following legal bases depending on the activity:

• Contractual necessity: processing required to perform the services described in our Terms & Conditions, including account creation, MYR payment processing and withdrawal management;
• Legal obligation: processing required for identity verification, anti-money-laundering compliance, age verification and record-keeping as may be required by applicable law;
• Legitimate interests: fraud prevention, platform security monitoring and responsible-gambling safeguards that do not override your fundamental privacy rights; and
• Consent: optional marketing communications and personalisation features where we have obtained clear, affirmative consent that you may withdraw at any time.

6How mbiwin Uses Your Personal Data

Your personal data may be used for the following purposes:

• creating, verifying and administering your mbiwin account;
• processing MYR deposits and withdrawals through supported Malaysian banking and e-wallet channels;
• conducting identity, age and payment verification in accordance with KYC requirements;
• responding to support enquiries submitted in English, Bahasa Melayu or Chinese;
• administering responsible-gambling controls including deposit limits, cooling-off periods and self-exclusion records;
• detecting and preventing fraud, bonus abuse, money laundering and other prohibited conduct;
• managing platform security and investigating technical incidents;
• complying with applicable legal obligations and responding to lawful regulatory or enforcement requests; and
• sending service communications about account status, payment confirmation, security alerts or policy updates.

7Disclosure of Personal Data to Third Parties

mbiwin does not sell personal information to third parties for independent marketing purposes. Data may be disclosed to the following categories of recipient only where necessary and lawful:

• Payment service providers: banks, e-wallet operators (including but not limited to Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay), DuitNow, FPX or other processors required to execute a MYR transaction;
• Identity verification providers: third-party KYC services engaged to confirm identity, age or address against reference databases;
• Technology service providers: hosting, infrastructure, analytics or security vendors operating under confidentiality and data-processing agreements;
• Legal and regulatory bodies: competent authorities, courts or regulators where disclosure is required by applicable law or a valid legal order; and
• Corporate successors: in the event of a merger, acquisition or asset transfer, subject to equivalent privacy protections being maintained.

8Data Retention Periods

mbiwin retains personal data only for as long as necessary for the stated purpose or as required by applicable legal or regulatory obligations. General retention guidelines are as follows:

• Account registration data is retained for the duration of the account relationship and for a defined period thereafter to meet anti-money-laundering and record-keeping requirements;
• KYC and identity verification documents are retained for the period specified by applicable financial regulation or, if no specific period is prescribed, for a reasonable period consistent with industry practice;
• MYR transaction records may be retained for up to seven years to comply with Malaysian financial record-keeping requirements;
• Responsible-gambling records including self-exclusion history are retained for the duration of the restriction plus any applicable mandatory post-exclusion period; and
• Technical and usage logs are typically retained for 90–180 days unless a security or legal investigation requires a longer period.

When the applicable period ends, data is either securely deleted or anonymised so that it can no longer identify an individual.

9Security Measures

mbiwin implements reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These include HTTPS encryption for all data in transit, access controls restricting data access to authorised functions, and periodic review of security practices.

You can support security by maintaining a strong, unique password, never sharing one-time verification codes, checking that the mbiwin domain is correct before logging in, and notifying us promptly if you suspect unauthorised activity. No security measure can guarantee absolute protection; users are responsible for maintaining the security of their own device and credentials.

10Cookies and Similar Technologies

mbiwin may use cookies and similar session technologies to maintain login state, support platform security, understand aggregate usage patterns and improve content delivery. Cookies used for essential functions (authentication, security tokens, preference retention) operate as a necessary part of the service.

Analytics or performance cookies may be used to understand page-level engagement. Where required by applicable law, non-essential cookies will be set only after obtaining consent. You may manage cookie settings through your browser. Disabling essential cookies may impair account functionality.

11Your Data Rights

Subject to applicable law and operational constraints, you may exercise the following rights regarding personal data held by mbiwin:

• Right of access: request confirmation of whether mbiwin holds personal data about you and obtain a copy;
• Right of correction: request that inaccurate or incomplete personal data be corrected;
• Right of erasure: request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations;
• Right to restrict processing: request that processing be limited in specified circumstances while a data dispute is resolved;
• Right to object: object to processing based on legitimate interests in circumstances that relate to your particular situation; and
• Right to withdraw consent: where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise a right, submit a written request to the email address displayed in the Contact Us section of this page. mbiwin may require sufficient information to verify your identity before acting on a request. We aim to acknowledge requests within a reasonable period and provide a substantive response within 30 days where possible.

12Minors and Age Restrictions

mbiwin is intended solely for adults aged 21 and above. We do not knowingly collect personal data from individuals below the legal minimum age. If we become aware that personal data has been submitted by a person under 21, we will take reasonable steps to delete it promptly.

Where identity verification reveals that a user may be below the required age, the account will be suspended pending review and the matter handled in accordance with our responsible gambling obligations.

13Changes to This Privacy Policy

mbiwin may update this Privacy Policy to reflect changes in data handling practices, legal obligations, payment methods, technology or regulatory requirements. The effective date shown at the top of this page will be revised whenever a material change is published.

Continued use of mbiwin after an updated policy takes effect constitutes acceptance of the revised terms. Where a change significantly affects how we process your data, we will endeavour to provide reasonable notice through account communication or a visible website notice before the change applies.

14Contact Us

Privacy-related questions, data-rights requests or concerns about how mbiwin handles personal information may be submitted in writing to the website email address displayed as plain text below:

[email protected]

Please include enough information to identify the relevant account or data matter. Do not include passwords, one-time codes, full card numbers or unnecessary identity document images in general correspondence. mbiwin processes privacy requests for Malaysian users in English; Bahasa Melayu and Chinese submissions are also accepted.