MB388 Privacy Policy

MB388 ("we", "us", "our", "the Company") operates the online gaming platform accessible at https://mb388.cam. We recognise that when you register an account, make deposits, or use any feature of our platform, you are entrusting us with personal information. We take that responsibility seriously.

This Privacy Policy ("Policy") describes the categories of personal data we collect from players ("you", "your", "User"), the purposes for which we process that data, the third parties with whom it may be shared, and the rights you have in relation to your personal information.

This Policy applies to all data processing activities conducted by MB388 in connection with the operation of the Platform, including sports betting, live casino, slots, poker, promotional programmes, customer support interactions, and KYC (Know Your Customer) verification procedures.

If you have any questions about this Policy or wish to exercise any of your data rights, please contact our Data Protection team at [email protected]. We aim to respond to all privacy-related enquiries within 30 days.

The following terms have the meanings ascribed to them throughout this Policy:

MB388 collects personal data through several channels — directly from you during registration and account operation, automatically through your use of the Platform, and from third-party verification or payment service providers. The categories of data we collect are described below.

3.1 Identity and Contact Data

3.2 Financial Data

MB388 collects limited financial data necessary to process deposits and withdrawals via supported Malaysian payment methods, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency wallets (BTC, ETH, USDT, LTC). This includes:

• Payment method type and last four digits of account/card identifiers where applicable.
• Transaction amounts, dates, and reference numbers in MYR or cryptocurrency equivalent.
• Withdrawal destination account details as required by applicable anti-money-laundering procedures.

MB388 does not store full banking credentials, card numbers, or online banking passwords. Payment processing is handled by certified third-party payment service providers operating under applicable financial regulatory standards.

3.3 Technical and Usage Data

When you access the Platform, we automatically collect the following technical information:

• IP address, browser type and version, operating system, and device identifiers.
• Session duration, pages visited, features used, and interaction patterns on the Platform.
• Geolocation data at the country or region level to enforce jurisdictional restrictions.
• Game history, wagering records, betting patterns, and account balance history.

3.4 Communications Data

We retain records of communications between you and MB388, including live chat transcripts, email correspondence, and support ticket records. This data is retained for service improvement, dispute resolution, and regulatory compliance purposes.

MB388 processes your personal data only for specified, explicit, and legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which we process personal data are as follows:

4.1 Account Management and Service Delivery

We process your identity and contact data to create and maintain your MB388 account, authenticate your login, process deposits and withdrawals via Malaysian payment channels, award and track loyalty points, and deliver customer support.

4.2 Regulatory Compliance and KYC

As an internationally licensed gaming operator, MB388 is obligated to verify the identity and age of all registered players before processing withdrawals. We process government ID details, proof-of-address documents, and other verification materials for this purpose. KYC data is retained for the minimum period required by our licensing obligations.

4.3 Fraud Prevention and Security

MB388 analyses account activity, transaction patterns, IP data, and device information to detect and prevent fraudulent activity, money laundering, multiple-account abuse, and other prohibited conduct. This processing is a legitimate interest of MB388 and is necessary to protect the integrity of the Platform and the financial security of all players.

4.4 Responsible Gambling Monitoring

We monitor player behaviour patterns — including session frequency, deposit velocity, and wagering patterns — to identify potential signs of problem gambling. Where patterns of concern are identified, we may proactively reach out to offer responsible gambling resources or apply protective account restrictions in accordance with our responsible gaming policy.

4.5 Marketing and Promotional Communications

With your consent, MB388 may use your email address and, where applicable, phone number to send you information about promotions, bonuses, new game launches, and platform updates relevant to your interests. You may withdraw your consent to marketing communications at any time by updating your account preferences or contacting our support team.

4.6 Platform Improvement and Analytics

We use aggregated and anonymised usage data to analyse platform performance, identify bugs, improve user experience, and develop new features. This analytics processing does not involve data that can identify you as an individual.

MB388 processes personal data under the following legal bases, depending on the purpose of processing:

MB388 does not sell, rent, or trade your personal data to third parties for their own marketing purposes under any circumstances. Your data may be shared in the following strictly controlled circumstances:

6.1 Payment Service Providers

We share necessary transaction data with certified payment service providers to facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks. These providers are contractually bound to process your data only for transaction processing purposes.

6.2 Identity Verification Partners

KYC document verification may be conducted by authorised third-party identity verification service providers operating under binding data processing agreements. These partners process your government ID and proof-of-address documents solely for the purpose of confirming your identity and age, and are prohibited from using this data for any other purpose.

6.3 Regulatory and Law Enforcement Authorities

MB388 may be required by applicable law, licensing regulation, or court order to disclose personal data to regulatory bodies or law enforcement agencies. We will disclose only the minimum data necessary to comply with such obligations and will, where legally permissible, notify affected players of such disclosure.

6.4 Game Content Providers

Where required for the delivery of specific game services, limited technical data (such as player session tokens) may be shared with licensed game content providers in our library. These providers do not receive personally identifiable information beyond what is technically necessary to initialise game sessions.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of MB388's business assets, player data may form part of the transferred assets. You will be notified of any such transfer and any changes to this Privacy Policy that result from it.

MB388 uses cookies and similar tracking technologies to operate the Platform, maintain session security, and improve your experience. The following categories of cookies are used:

7.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They are set in response to actions you take — such as logging in, depositing funds, or adjusting your account preferences. They do not store any personally identifiable information beyond what is required for session management.

7.2 Performance and Analytics Cookies

These cookies collect anonymous, aggregated information about how players use the Platform — which pages are visited most frequently, error messages encountered, and general navigation patterns. This information is used solely to improve Platform performance.

7.3 Functional Cookies

These cookies enable enhanced functionality and personalisation, such as remembering your language preferences, game lobby filters, and deposit method selections. Disabling them may result in reduced functionality.

7.4 Cookie Management

You can control cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in to or using core Platform features. For instructions on managing cookies in your specific browser, consult your browser's help documentation.

MB388 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or licensing regulation. The following retention principles apply:

• Active Account Data: Retained for the duration of your account registration and for a minimum period of 5 years following account closure, in accordance with anti-money-laundering and gaming licensing requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of verification, or longer if required by applicable regulatory obligations.
• Transaction Records: Financial transaction records are retained for a minimum of 7 years to comply with financial reporting and regulatory audit requirements.
• Support Communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the last interaction.
• Marketing Data: Retained until you withdraw your marketing consent, at which point marketing-specific data is deleted within 30 days.
• Technical and Usage Data: Aggregated and anonymised usage analytics are retained indefinitely. Individually identifiable technical data (IP logs, session records) is retained for 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with industry best practices.

MB388 implements comprehensive technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit TLS/SSL Encryption: All data transmitted between your device and MB388 servers is protected by industry-standard transport layer security.
• Encrypted Data Storage: Personal data and KYC documents stored on MB388 servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All access events are logged and audited.
• Two-Factor Authentication: Available to all registered players and mandatory for MB388 staff accounts with access to player data.
• Regular Security Audits: MB388 commissions periodic independent security assessments and penetration tests of the Platform's infrastructure.
• Incident Response: In the event of a data breach that poses a risk to player rights, MB388 will notify affected players and relevant regulatory authorities in accordance with applicable notification obligations.

MB388 respects your rights in relation to your personal data. Depending on your location and applicable data protection law, you may have the following rights with respect to the personal data we hold about you:

MB388 aims to respond to all data rights requests within 30 days of receipt. In complex cases, we may require up to 60 days and will notify you of any extension. Please note that certain rights are subject to legal limitations — for example, we cannot erase data that we are required to retain by licensing regulation.

The MB388 Platform integrates with a range of third-party services to deliver our gaming products, process payments, and maintain Platform security. All third-party data processors are bound by written data processing agreements and are prohibited from using player data for their own purposes.

Categories of third-party processors engaged by MB388 include:

• Payment processing providers for DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and bank transfers via Maybank, CIMB, Public Bank, and Hong Leong.
• Cryptocurrency transaction processors for BTC, ETH, USDT, and LTC deposits and withdrawals.
• KYC and identity verification service providers.
• Casino game content providers supplying slots, live dealer tables, and virtual game products.
• Platform hosting, cloud infrastructure, and content delivery network (CDN) providers.
• Customer support software providers for live chat and ticket management systems.
• Fraud detection and risk management service providers.

MB388 does not permit third-party processors to use player data for advertising, profiling, or any purpose beyond the specific service they are engaged to provide. We conduct periodic reviews of all data processing arrangements to ensure continued compliance.

MB388 is an internationally operated platform and some of our data processing partners may be located in jurisdictions outside Malaysia. When personal data is transferred internationally, MB388 ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses in data processing agreements requiring international recipients to maintain data protection standards equivalent to or exceeding those applicable to MB388.
• Selection of processors located in jurisdictions with recognised adequate data protection frameworks.
• Regular review of international data transfer arrangements to ensure ongoing compliance.

MB388 strictly prohibits the registration and use of the Platform by persons under 21 years of age. We do not knowingly collect personal data from individuals under this age. Age is verified during registration and confirmed as part of the KYC process.

If MB388 discovers or is notified that an account has been created by a person under 21 years of age, that account will be immediately closed, any pending transactions cancelled, and deposited funds returned to the original payment source. All personal data collected from underage users will be permanently deleted.

Parents and guardians are encouraged to use parental control and internet filtering software to prevent minors from accessing online gaming platforms. MB388 will not be held responsible for access obtained by minors circumventing parental controls.

MB388 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or business operations. When material changes are made, we will notify registered players via email or a prominent on-platform notice at least 7 days before the changes take effect.

The current version of this Policy, together with its effective date, is always published at https://mb388.cam/privacy-policy. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

Your continued use of the Platform following notification of any amendments constitutes your acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by MB388, please contact our Data Protection team using the details below:

For data rights requests (access, erasure, portability, rectification), please include your full name, registered email address, and a clear description of your request. We may need to verify your identity before processing data rights requests.