1 Introduction
This Privacy Policy ("Policy") describes how mbiplay ("mbiplay", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "Player", "User") who access, register on, or otherwise use the mbiplay online gaming platform available at mbiplay.cam and any associated services (collectively, the "Platform").
mbiplay operates under an international gaming licence and takes its data protection obligations seriously. While Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data in Malaysia in certain commercial contexts, mbiplay also applies the principles of internationally recognised data protection frameworks to the extent they are applicable to our operations. We are committed to processing your personal data lawfully, transparently, and with respect for your rights as a data subject.
By registering an account on the Platform, depositing funds, or otherwise using mbiplay's services, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform and may request account closure by contacting our support team.
Scope: This Policy applies to all personal data collected through the mbiplay website, mobile interface, customer support channels, and any other point of interaction between you and mbiplay. It covers both registered players and unregistered visitors to the Platform.
2 Definitions
For the purposes of this Policy, the following terms have the meanings set out below:
- "Personal Data" — Any information relating to an identified or identifiable natural person. This includes names, identification numbers, contact details, financial data, online identifiers, and any other information that can directly or indirectly identify a person.
- "Processing" — Any operation performed on personal data, including collection, storage, use, disclosure, transfer, amendment, or deletion.
- "Data Controller" — mbiplay, as the entity that determines the purposes and means of processing personal data collected through the Platform.
- "Data Processor" — A third party that processes personal data on behalf of mbiplay, subject to mbiplay's instructions and appropriate contractual safeguards.
- "KYC Data" — Identity and age verification documentation provided by players pursuant to Know Your Customer obligations, including government-issued photo identification and proof of address.
- "Sensitive Personal Data" — A subset of personal data that warrants heightened protection, including information relating to financial accounts, identity document numbers, and any data that could be used to cause harm if disclosed.
- "Cookies" — Small text files placed on a user's device by the Platform to store session information, preferences, and analytics data.
3 Data We Collect
mbiplay collects personal data through the following channels and in the following categories:
3.1 Data You Provide Directly
3.2 Data Collected Automatically
3.3 Data from Third Parties
mbiplay may receive personal data about you from third parties in limited circumstances, including: identity verification service providers used to process KYC checks; payment processors who confirm transaction status; and fraud prevention and anti-money laundering screening services. Data received from third parties is used only for the purposes described in this Policy.
4 How We Use Your Data
mbiplay uses the personal data it collects for the following purposes:
- Account Management: Creating, maintaining, verifying, and administering your player account, including processing login authentication and account security measures.
- Identity and Age Verification (KYC): Confirming that players are at least 21 years of age and verifying identity in accordance with our licensing obligations and anti-money laundering requirements.
- Payment Processing: Facilitating deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT TRC20, and other accepted payment channels in MYR.
- Service Provision: Delivering gaming services, processing bets and wagers, calculating winnings, and administering promotional bonuses and the VIP programme.
- Customer Support: Responding to queries, resolving disputes, and providing technical and account assistance through live chat, WhatsApp, and email channels.
- Regulatory Compliance: Meeting our obligations under anti-money laundering legislation, our gaming licence conditions, and applicable data protection frameworks.
- Fraud Prevention and Platform Security: Detecting, investigating, and preventing fraudulent activity, account abuse, collusion, and other security threats.
- Responsible Gambling: Monitoring account activity to identify indicators of problem gambling and facilitating the use of self-exclusion, deposit limits, and other responsible gambling tools.
- Platform Improvement: Analysing usage data and behavioural patterns to improve the Platform experience, fix technical issues, and develop new features.
- Communications: Sending transactional notifications (deposit confirmations, withdrawal updates, security alerts), promotional communications where you have opted in, and compliance-related notices.
5 Legal Basis for Processing
mbiplay processes your personal data on the following legal bases:
- Contractual Necessity: Processing required to perform our contract with you — including account creation, payment processing, game provision, and customer support — is carried out on the basis that it is necessary to fulfil the services you have requested.
- Legal Obligation: Processing required to comply with applicable law, including KYC and anti-money laundering obligations imposed by our gaming licence, is carried out on the basis of legal obligation.
- Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and internal analytics is carried out on the basis of mbiplay's legitimate interest in operating a secure, fair, and compliant platform, balanced against your rights and interests.
- Consent: Where mbiplay sends promotional communications or uses non-essential cookies, such processing is carried out on the basis of your consent. You may withdraw consent at any time by contacting support or adjusting your account settings.
6 Data Sharing & Disclosure
mbiplay does not sell, rent, or trade your personal data to third parties for marketing purposes. We share personal data only in the following circumstances and only to the extent strictly necessary:
- Payment Processors: Transaction data is shared with payment service providers (including FPX operators, e-wallet platforms, and banking partners) to facilitate deposits and withdrawals. These providers are contractually bound to process data only for payment purposes.
- KYC and Identity Verification Providers: Identity document data may be transmitted to third-party identity verification services to complete KYC checks. These providers operate under strict data processing agreements.
- Fraud Prevention and AML Screening: Data may be shared with anti-money laundering and fraud prevention screening services to identify and prevent financial crime.
- Game Providers: Limited technical and session data (such as player ID and session token) is shared with licensed game providers to enable game functionality. Game providers do not receive your full personal profile.
- Regulatory and Law Enforcement Authorities: mbiplay will disclose personal data to applicable regulatory bodies, gaming licensing authorities, or law enforcement agencies where required to do so by law, court order, or our licensing obligations.
- Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of mbiplay's business, player data may be transferred to the relevant successor entity, subject to equivalent privacy protections.
No Third-Party Marketing: mbiplay does not share your personal data with advertising networks, data brokers, or third-party marketers. Your data is used solely to operate and improve the Platform and fulfil our legal obligations.
8 Data Retention
mbiplay retains personal data for the periods described below. Following the expiry of applicable retention periods, data is securely deleted or anonymised in accordance with our internal data management procedures.
- Account and Registration Data: Retained for the duration of the account's active period and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping requirements.
- KYC Documentation: Retained for a minimum of five (5) years from the date of the player's last transaction or account closure, whichever is later, as required by applicable AML regulations.
- Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction for regulatory compliance and dispute resolution purposes.
- Customer Support Communications: Retained for three (3) years from the date of the relevant communication for quality assurance and dispute resolution.
- Analytics and Behavioural Data: Retained in anonymised or aggregated form for up to two (2) years for Platform improvement purposes.
- Marketing Consent Records: Retained for the period during which consent is active, plus one (1) year following withdrawal of consent.
Where mbiplay is required by law, court order, or regulatory direction to retain data beyond the periods stated above, those requirements will supersede our standard retention schedule.
9 Data Security
mbiplay implements technical and organisational security measures appropriate to the nature of the personal data processed and the risks to which it is exposed. These measures include, but are not limited to:
- TLS/SSL encryption for all data transmitted between your device and the Platform;
- Encryption of sensitive personal data and KYC documents at rest using industry-standard cryptographic protocols;
- Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis;
- Regular penetration testing and security audits of the Platform and data infrastructure;
- Multi-factor authentication options for player accounts;
- Automated monitoring systems that detect and alert on unusual access patterns or potential data breaches.
While mbiplay takes all reasonable steps to protect your personal data, no online system can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own account credentials and for notifying mbiplay immediately if they suspect unauthorised access to their account.
In the event of a data breach that poses a risk to your rights, mbiplay will notify affected players and relevant authorities as required by applicable law and our licensing obligations, without undue delay.
10 Your Rights
As a data subject, you hold the following rights with respect to your personal data processed by mbiplay. To exercise any of these rights, please contact us using the details in Section 15.
Right of Access
Request a copy of the personal data mbiplay holds about you and information about how it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your account profile.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
Right to Restriction
Request that mbiplay restrict the processing of your personal data in certain circumstances, such as while a disputed accuracy is being resolved.
Right to Portability
Where processing is based on consent or contractual necessity, request a machine-readable copy of your personal data for transfer to another service.
Right to Object
Object to processing carried out on the basis of legitimate interests, including profiling for fraud prevention or responsible gambling monitoring, where your specific circumstances warrant it.
Withdraw Consent
Where processing is based on your consent (such as for marketing communications), withdraw that consent at any time without affecting the lawfulness of prior processing.
Right to Complain
Lodge a complaint with the relevant data protection authority in your jurisdiction if you believe mbiplay has processed your data in a manner that violates applicable law.
mbiplay will respond to data rights requests within a reasonable period, typically within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, with notification provided to the requesting player. Certain rights may be subject to limitations where mbiplay has overriding legal obligations, such as AML record-keeping requirements.
11 International Data Transfers
mbiplay operates under an international gaming licence, and certain service providers and processors engaged by mbiplay are located outside Malaysia. Accordingly, your personal data may be transferred to, stored in, and processed in countries outside Malaysia, including within the European Economic Area and other jurisdictions.
Where personal data is transferred to countries that do not provide a level of data protection equivalent to Malaysia's PDPA or applicable international standards, mbiplay implements appropriate safeguards, including contractual obligations on the receiving party to protect your personal data to a standard consistent with this Policy.
Players who wish to obtain further information about the specific safeguards applied to international data transfers are encouraged to contact our privacy team using the details in Section 15.
12 Children & Minors
The mbiplay Platform is strictly intended for use by persons aged 21 years and above. mbiplay does not knowingly collect or process personal data from individuals under the age of 21. Age verification is conducted during account registration as part of our KYC process, and access to the Platform is denied where age eligibility cannot be confirmed.
If mbiplay becomes aware that personal data has been collected from or in relation to a person under the age of 21, that data will be deleted promptly, the associated account will be closed, and any Player Funds or Bonus Funds held in that account will be handled in accordance with our Terms and Conditions and applicable law.
If you are a parent or guardian and have reason to believe that a person under 21 in your care has registered an account with mbiplay, please contact us immediately using the details in Section 15 so that we can take appropriate action.
13 Third-Party Links & Services
The Platform does not contain links to third-party websites for advertising or commercial purposes. However, mbiplay engages third-party service providers (game studios, payment processors, identity verification providers) whose services integrate with the Platform. These providers are bound by their own privacy policies and by the data processing agreements we have executed with them.
mbiplay is not responsible for the privacy practices of any third-party service provider accessed independently by the player outside of the Platform. Players are encouraged to review the privacy policies of any third-party services they use in connection with their mbiplay account, including their bank's or e-wallet provider's privacy terms.
14 Changes to This Policy
mbiplay reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or licensing requirements. Material changes will be communicated to registered players via email notification to the address on file or through a prominent notice on the Platform displayed upon next login.
The "Last updated" date at the top of this page will be revised each time the Policy is modified. Continued use of the Platform following notification of changes to this Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you should discontinue use of the Platform and may request account closure in accordance with our Terms and Conditions.
15 Contact & Data Enquiries
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mbiplay, please contact our privacy and data protection team through the following channels:
- Email: [email protected] — please include "Privacy Request" in the subject line for faster routing
- Live Chat: Available directly on the Platform, 24 hours a day, 7 days a week, in English, Bahasa Melayu, and Mandarin
- WhatsApp Support: Available through credentials provided upon account registration
When submitting a data rights request, please provide your registered account username and a brief description of the request so that our team can locate your records and respond efficiently. We aim to acknowledge all privacy-related requests within 3 business days and provide a substantive response within 30 days.
Malaysian Players: mbiplay acknowledges Malaysia's Personal Data Protection Act 2010 as a relevant data protection framework for Malaysian players. Players in Malaysia who wish to exercise their rights under the PDPA, or who believe their personal data has been processed in breach of that Act, may refer their complaint to the Personal Data Protection Commissioner of Malaysia in addition to contacting mbiplay directly.