Privacy Policy MB18 — Personal Data Protection for Malaysia Members

01 Introduction

Mb18 (“we”, “our platform” or “mb18.app”) respects the privacy of every individual who uses our services. This Privacy Policy explains in detail how we collect, process, store, and protect your personal information when you register and use the mb18 betting and gaming platform.

This document is drafted in accordance with the provisions of the Personal Data Protection Act 2010 (PDPA) of Malaysia and internationally recognised data protection principles. By registering an mb18 account and using our services, you consent to the collection and processing of your personal data as described in this Privacy Policy.

Mb18 is the responsible data controller for all personal information collected through our platform. We appoint an internal Data Protection Officer responsible for ensuring ongoing compliance with all applicable data protection laws and regulations in Malaysia.

02 Personal Data We Collect

Mb18 only collects personal data that is strictly necessary to provide our services safely and efficiently. We do not collect excessive or irrelevant data beyond the scope of our service purposes. The following are the categories of data we collect:

We may also receive information about you from trusted third-party sources such as identity verification agencies, payment service providers, and self-exclusion gambling databases, solely for compliance and platform security purposes.

03 How We Use Your Personal Data

Mb18 processes your personal data on valid legal bases including the performance of a contract, legitimate interests, legal obligations, and your consent. The following are the specific purposes for which your data is used:

• Account Management: Creating, verifying, and managing your mb18 account, including the KYC process and identity verification as required by Malaysian law.
• Transaction Processing: Processing deposits, withdrawals, and all financial transactions on the mb18 platform quickly and securely.
• Platform Security: Detecting and preventing fraud, unauthorised access, money laundering, and platform abuse that may harm other members.
• Customer Support: Providing accurate and efficient assistance when you contact the mb18 support team via live chat or other channels.
• Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling and offering appropriate self-management tools.
• Service Communications: Sending important notifications related to your account, transactions, policy changes, and security updates.
• Legal Compliance: Meeting reporting obligations to the relevant authorities in Malaysia, including requirements under the Anti-Money Laundering Act 2001.
• Service Enhancement: Analysing aggregated, anonymised usage patterns to improve the platform, features, and overall mb18 member experience.

04 Data Sharing With Third Parties

Mb18 does not sell or rent member personal data to any party for marketing or commercial purposes. However, in operating our platform lawfully and securely, we share certain data with the following categories of third parties on a strictly need-to-know basis:

• Payment Service Provider: Required financial information is shared with licensed payment providers such as FPX, Touch 'n Go, and recognised digital wallet providers to process your transactions.
• KYC Service Provider: Identity data is shared with trusted identity verification agencies for the purpose of complying with member verification legal requirements.
• Technology Infrastructure Providers: Cloud and computing service providers that process data on behalf of mb18 are subject to strict data processing agreements.
• Legal Authority: mb18 will disclose required data to the Malaysian police, courts, or government agencies when mandated by law or a valid court order.
• Regulatory Authority: Data required for licensing and compliance purposes is shared with the regulatory authority that issued mb18's operating licence.

All third parties receiving mb18 member data are required to comply with strict data protection standards and may only use such data for purposes contractually agreed upon with mb18. We ensure every data-sharing arrangement is governed by binding confidentiality and data protection agreements.

05 Data Security Measures

Mb18 continuously invests in best-in-class security infrastructure to ensure member personal data is always protected from unauthorised access, loss, damage, or accidental disclosure. The key security measures we implement are:

• 256-bit SSL Encryption: All communications between your device and mb18's servers are fully encrypted using the latest TLS 1.3 protocol, ensuring your data cannot be intercepted during transmission.
• Two-Factor Authentication (2FA): mb18 members can — and we strongly encourage you to — enable two-factor authentication for an added layer of security during login and fund withdrawals.
• Real-Time Monitoring: mb18's security monitoring system operates 24/7 to detect any suspicious activity and immediately alert our security team.
• Internal Access Controls: Only mb18 staff with specific authorisation may access member data, and such access is strictly limited on a need-to-know basis.
• Regular Security Audits: mb18 undergoes regular security audits and penetration testing conducted by accredited independent cybersecurity firms.
• Secure Data Backup: Member data is regularly backed up to a separate, secure location to ensure continuous service availability under all circumstances.

While mb18 takes all reasonable precautions to protect your data, no security system can be guaranteed 100% foolproof. We encourage you to use a strong and unique password, enable 2FA, and never share your login credentials with anyone.

06 Cookies & Tracking Technologies

Mb18 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit the mb18 website. The following are the types of cookies we use:

• Required Session Cookies: Required for core platform operations such as maintaining your login session, processing transactions, and ensuring session security. These cookies cannot be disabled as they are essential to mb18's core functionality.
• Preference Cookies: Saving your preferences such as language, display format, and other personal settings so you do not need to reconfigure them each time you log in.
• Analytics Cookies: We use designated third-party analytics tools to collect aggregated, anonymised usage statistics to help us understand how the platform is used and make appropriate improvements.
• Security Cookies: Used to detect fraudulent activity, verify user identity, and ensure the security of your account during active sessions.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect the functionality of the mb18 platform and your overall experience. For guidance on managing cookies in popular browsers, please refer to your browser's help documentation.

07 MB18 Member Privacy Rights

As an mb18 member whose personal data is processed by us, you have the following rights under Malaysia's PDPA 2010. mb18 is committed to respecting and facilitating the exercise of all these rights accurately and within a reasonable timeframe:

To exercise any of the above rights, please contact mb18's Data Protection Officer by email at [email protected] or via in-app live chat. We will process your request within 30 business days and may require identity verification beforehand to ensure the security of your account.

08 Data Retention Period

Mb18 only retains your personal data for as long as necessary to fulfil the original purpose of collection or as required by Malaysian law. The following are the key data retention guidelines we follow:

• Active Account Data: Retained for the duration your account is active and up to five (5) years after account closure, in line with PDPA requirements and Malaysian financial laws.
• Financial Transaction Records: Retained for seven (7) years in accordance with the Companies Act 2016 and anti-money laundering regulations in force in Malaysia.
• KYC Documents: Retained for a minimum of six (6) years after the business relationship ends, as required by the relevant regulatory authority.
• Support Communication Logs: Retained for two (2) years for reference purposes and resolution of any disputes that may arise.
• Analytics Data: Anonymised and aggregated usage data is retained indefinitely as it no longer contains any personally identifiable information.

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered. The deletion process is carried out automatically by the mb18 system and is periodically verified by our data protection team.

09 Cross-Border Data Transfers

In certain operational circumstances, mb18 members' personal data may be transferred to or processed outside Malaysia, particularly in the context of international cloud infrastructure or global technology service providers. mb18 takes robust measures to ensure such data transfers are conducted securely and in compliance with applicable laws:

• All international data transfers are protected by data processing agreements that comply with Malaysia's PDPA standards and the data protection regulations of the receiving country.
• We only transfer data to countries or jurisdictions that provide an equivalent or higher level of data protection than Malaysia.
• The international infrastructure providers we use are required to comply with strict confidentiality and data security agreements set by mb18.
• Any data transfer is carried out solely on legitimate operational grounds and does not exceed the scope required for mb18's service purposes.

10 Amendments to This Privacy Policy

Mb18 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or improvements in how we protect your information. Any significant amendments will be communicated through the following channels:

• In-app notifications on mb18 sent to all active members before amendments take effect
• Email notification to your registered email address summarising the key changes made
• A clearly visible “Last Updated” date at the top of this Privacy Policy page

Continued use of the mb18 platform after the effective date of any amendments constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes made, you have the right to stop using the platform and request account closure before the amendments take effect.

We encourage you to review this Privacy Policy periodically to stay informed on how mb18 manages your personal data. The latest version of this Privacy Policy is always available on this page for your reference.

11 Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or how mb18 manages your personal data, please do not hesitate to contact us. The mb18 Data Protection team is ready to assist you with all matters relating to privacy and data security.

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the mb18 app — the fastest way to get a response
• Response Time: We are committed to responding to all privacy enquiries within 5 business days and resolving formal requests within 30 business days.

You also have the right to lodge a complaint directly with the Personal Data Protection Commissioner of Malaysia if you believe that mb18 has not processed your personal data in accordance with the PDPA 2010. However, we encourage you to contact us first so we can resolve any issues promptly and to your satisfaction.