MBS66 Privacy Policy – Personal Data Protection for Malaysian Users

This Privacy Policy ("Policy") describes how MBS66 ("we", "the platform", or "mbs66"), which operates the website mbs66.top and all related services, collecting, using, storing, disclosing, and protecting your personal data as a user of the platform.

This Policy is drafted in accordance with the provisions of Personal Data Protection Act 2010 (PDPA) Malaysia and adhere to the seven personal data protection principles set out in the Act — namely the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle, the Access Principle, and the Data Transfer Principle.

By registering an account, accessing, or using any part of the platform mbs66, you confirm that you have read and understood this Privacy Policy, and agree to the way we manage your personal data as described herein. If you do not agree, please discontinue use of the platform and contact us to close your account.

Mbs66 collects your personal data through several channels — directly from you during registration and platform use, automatically via tracking technologies as you browse the platform, and in certain cases from legitimate third-party sources.

Data you provide directly:

• Full name as stated on a valid Malaysian identity document (MyKad or Passport).
• An active Malaysian mobile phone number.
• A valid and active email address.
• Date of birth for age verification (18 years and above).
• Malaysian bank account or digital wallet details for deposit and withdrawal purposes (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks).
• A copy of your identity document (MyKad or Passport) when requested for KYC verification.
• Proof of residential address when requested.

Automatically collected data:

• IP address and geographic location information (at city or state level, not precise location).
• Device type, operating system, and browser version you are using.
• Pages you visit within the mbs66 platform and the time spent on them.
• Transaction history — deposits, withdrawals, bets, and casino gameplay.
• Account activity logs including login times, logout times, and settings changes.
• Cookie data and session identifiers to maintain your login status and preferences.

Mbs66 uses collected personal data for legitimate and specific purposes. We do not use your data for anything unrelated to platform operations without your consent. The primary purposes for which your personal data is used are as follows:

• Account Management: Creating, verifying, and managing your user account on the mbs66 platform.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as processing withdrawal of winnings to your bank account or digital wallet.
• Identity Verification (KYC): To fulfil legal requirements for verifying user identity and preventing money laundering.
• Platform Security: To identify and prevent fraudulent activity, multi-account usage, bonus abuse, and other security threats.
• Customer Support: Providing effective support whenever you reach out to the mbs66 support team, available 24/7 in Bahasa Melayu.
• Personalise Your Experience: Personalising the platform display, game recommendations, and relevant promotions based on your usage habits and preferences.
• Service Communications: Sending important account notifications — such as transaction confirmations, security alerts, and promotional updates you have consented to receive.
• Legal Compliance: Fulfilling legal obligations under Malaysia's PDPA, anti-money laundering regulations, and other applicable reporting requirements.
• Platform Improvement: Analysing usage data in aggregate (not at an individual level) to improve the performance, design, and features of the mbs66 platform.

Mbs66 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, in the course of operating the platform, we may need to share certain data with the following categories of third parties, subject to strict confidentiality agreements:

• Payment Service Providers: Providers such as Touch 'n Go eWallet, GrabPay, DuitNow, and FPX banking institutions receive the transaction data necessary to process your deposits and withdrawals. This data is strictly limited to what is required to complete each transaction.
• Game Providers: Casino and sports game providers such as Evolution Gaming, Pragmatic Play, and Betradar receive the session data necessary to run games and determine outcomes. They do not receive your full personal identity information.
• Technical Service Providers: Companies that support the technical operations of our platform — such as cloud service providers, cybersecurity firms, and analytics providers — operating under service contracts with binding confidentiality clauses.
• Legal Authorities: mbs66 may be required to disclose certain data to Malaysian authorities — such as the police, courts, or regulatory bodies — when mandated by law or a valid court order.

In all data-sharing scenarios, mbs66 ensures that receiving parties use the data solely for the specific stated purpose and are subject to data protection standards equivalent to those of mbs66. We do not permit our service providers to use users' personal data for their own purposes.

Mbs66 takes a multi-layered approach to protecting users' personal data. The technical and organisational measures we implement include:

• 256-bit SSL Encryption: All data transmitted between your device and mbs66 servers is encrypted using 256-bit TLS/SSL protocols — ensuring no third party can intercept or read your data in transit.
• Data-at-Rest Encryption: Sensitive data stored in the mbs66 database — including passwords (stored as salted hashes), banking information, and identity documents — is encrypted using modern encryption algorithms.
• Internal Access Controls: Access to personal data within the mbs66 organisation is restricted to staff who require it for their job responsibilities, based on a strict need-to-know principle.
• 24/7 Security Monitoring: Automated monitoring systems operate around the clock to detect and flag suspicious activity, intrusion attempts, or anomalies in data access patterns.
• Regular Security Testing: The mbs66 platform undergoes regular penetration testing and independent security audits to identify and address potential vulnerabilities.
• Two-Factor Authentication: Users are encouraged to enable two-factor authentication (2FA) for an added layer of protection on their accounts.

The mbs66 platform uses cookies and similar tracking technologies to enhance user experience, maintain session security, and understand how the platform is used. The following are the types of cookies we use:

• Essential Cookies: Required for core platform operations — such as maintaining your logged-in status, remembering items in your betting slip, and ensuring session security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting information about how users interact with the platform — including the most-visited pages, time spent, and errors encountered — to help us improve the platform. All data is collected anonymously.
• Functional Cookies: To save your preferences such as display language, display settings, and other options so you don't have to reconfigure them on every visit.
• Marketing Cookies: Helping us measure the effectiveness of our marketing communications to users who have consented to receive promotional information from mbs66.

You can manage your cookie preferences through your web browser settings at any time. Please note that disabling certain cookies may affect the functionality and your overall experience on the mbs66 platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

As a user of the mbs66 platform, you have the following rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Right of Access: You have the right to request a copy of the personal data we hold about you. Such requests will be processed within 21 business days.
• Right to Rectification: You have the right to request the correction of any inaccurate or outdated personal data. You may also update certain information directly through your account settings.
• Right to Erasure: In certain circumstances, you have the right to request deletion of your personal data, subject to our obligation to retain certain data in order to fulfil legal requirements.
• Right to Withdraw Consent: You may withdraw your consent to certain data processing activities — such as receiving marketing communications — at any time. Withdrawal of consent does not affect the validity of any processing that took place prior to the withdrawal.
• Right to Object: You have the right to object to the processing of your personal data for specific purposes, including direct marketing.
• Data Portability Right: You have the right to receive the personal data you have provided to us in a machine-readable format, for transfer to another service provider should you wish.

To exercise any of the rights above, please contact our privacy team by email at support@mbs66.top or via the mbs66 platform's 24/7 live chat. We may need to verify your identity before processing your request.

Mbs66 retains your personal data only for as long as necessary to fulfil the purposes outlined in this Policy, or as required by Malaysian law. The following are general guidelines on retention periods:

• Active Account Data: For the duration your account remains active, plus a holding period following account closure.
• Financial Transaction Records: A minimum of 7 years from the date of transaction, in line with Malaysia's accounting and anti-money laundering legal requirements.
• Identity Verification Documents (KYC): A minimum of 5 years after account closure, or longer if required by the relevant authorities.
• Support Communication Logs: 2 years from the date of last interaction.
• Cookie & Session Data: Depending on the type of cookie — from the current session up to a maximum of 2 years for persistent cookies.

Once the applicable retention period has expired, personal data will be securely deleted or anonymised so that it can no longer be linked to you as an individual. The deletion process uses methods that ensure the data cannot be recovered.

The mbs66 platform is intended for adults aged 18 and above only. We do not knowingly collect or process personal data from individuals under the age of 18.

The mbs66 account registration process includes age verification. Should we discover that we have inadvertently collected personal data from an individual under the age of 18, we will take immediate steps to delete that data and close the account in question.

If you believe that someone under the age of 18 may have registered an account on the mbs66 platform, please notify us immediately by email at support@mbs66.top so that we can take the appropriate action promptly.

Mbs66 reserves the right to amend this Privacy Policy from time to time to reflect changes in data practices, legal requirements, or how our platform operates. We are committed to notifying users of significant amendments through:

• In-platform notification on mbs66 upon your next login after the amendment takes effect.
• Email to your registered address (for significant amendments that materially affect your rights).
• Update the "Last Updated" date at the top of this page.

For minor amendments that do not materially affect user rights — such as spelling corrections, added clarifications, or formatting changes — we may not send a separate notification. It is your responsibility to review this page periodically.

Continued use of the mbs66 platform after an amendment takes effect will be considered acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to close your account by contacting our support team.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way mbs66 handles your personal data, please do not hesitate to get in touch. We are committed to addressing every privacy enquiry seriously and within a reasonable timeframe.

Ways to reach the mbs66 privacy team:

• 24/7 Live Chat: The fastest method — available directly on the mbs66 platform in Bahasa Melayu, around the clock.
• Email: support@mbs66.top — for detailed enquiries relating to personal data. We aim to respond within 3 business days.

For formal requests relating to your rights under the PDPA (such as data access or deletion requests), please send an email with the subject line "PDPA Rights Request" along with your full name and account number so we can process your request more efficiently.