Privacy Policy

mbislot ("we", "us", "our") operates the online gaming platform available at https://mbislot.cam (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who visit, register with, or otherwise interact with our Platform ("you", "your", or "Player"). This Privacy Policy ("Policy") sets out in clear and transparent terms how we collect, use, store, share, and protect your personal information in connection with your use of our services.

This Policy applies to all personal data collected through the Platform, including data provided during account registration, identity verification (KYC), payment processing, customer support interactions, and passive data collected through cookies and analytics technologies. It should be read in conjunction with our Terms & Conditions, which are available at mbislot.cam/terms-conditions.

If you have any concerns about how we handle your data, or if you wish to exercise any of your data subject rights, please contact our support team using the contact information provided in Section 16 of this Policy.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, email address, date of birth, government identification number, financial account details, IP address, and device identifiers.
• "Processing" — any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• "Data Controller" — mbislot, as the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of mbislot, acting under our documented instructions and subject to appropriate contractual safeguards.
• "KYC" (Know Your Customer) — the regulatory identity and age verification process requiring Players to submit government-issued identification and supporting documentation before accessing certain services.
• "Cookies" — small text files placed on your device by the Platform's web server to store session information, preferences, and analytical data.
• "Platform" — the mbislot website at https://mbislot.cam and all associated pages, features, and services operated by mbislot.

We collect the following categories of personal data about you, depending on how you interact with the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification document;
• Date of birth (to verify that you meet the 21+ age requirement);
• National identity number (e.g., Malaysian MyKad number) or passport number;
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam);
• Email address and mobile phone number.

3.2 Financial & Transaction Data

• Bank account details associated with your FPX, DuitNow, or other payment method registrations;
• E-wallet identifiers (e.g., Touch 'n Go eWallet, Boost, GrabPay account references);
• Cryptocurrency wallet addresses used for BTC or USDT transactions;
• Transaction history including deposit amounts, withdrawal requests, game wagers, wins, and losses.

3.3 Technical & Usage Data

• IP address, browser type and version, operating system, and device type;
• Session duration, pages visited, game categories browsed, and click-stream data;
• Login timestamps and geolocation data (country and region level);
• Referral source and marketing attribution data where applicable.

3.4 Verification & Compliance Data

• Copies of government-issued photo identification documents submitted during KYC;
• Proof of address documents (e.g., utility bills, bank statements);
• Source of funds documentation where required for high-value transactions;
• Responsible gambling self-assessment responses and tool preferences.

3.5 Communications Data

• Live chat transcripts and email correspondence with our support team;
• Feedback, complaints, and dispute records.

We collect personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in promotions;
• Automated technologies: Data collected passively through cookies, web beacons, server logs, and analytics software as you browse and use the Platform;
• Payment providers: Transaction confirmation data received from DuitNow, FPX processors, e-wallet operators (Touch 'n Go, Boost, GrabPay), and cryptocurrency payment gateways when you make deposits or request withdrawals;
• Identity verification providers: Data received from our KYC service partners when verifying the authenticity of your submitted identification documents;
• Fraud prevention services: Risk signals and device fingerprint data received from our fraud detection partners to protect both the Platform and its players.

We process your personal data on the following legal bases, depending on the purpose of processing:

We use the personal data we collect for the following specific purposes:

6.1 Service Delivery

To create and manage your Account, verify your identity and age, process financial transactions (deposits and withdrawals via DuitNow, FPX, e-wallets, and cryptocurrency), provide access to games and sports betting markets, administer bonuses and promotional offers, and maintain accurate records of your gaming activity.

6.2 Regulatory Compliance

To fulfil obligations under applicable anti-money-laundering (AML) legislation, responsible gambling regulations, and any other legal requirements imposed on us by licensing authorities or governmental bodies. This includes monitoring for unusual transaction patterns, conducting enhanced due diligence (EDD) on high-value accounts, and reporting to financial intelligence units where legally required.

6.3 Security and Fraud Prevention

To detect, investigate, and prevent fraudulent transactions, bonus abuse, multi-accounting, unauthorised account access, and other activities that may harm the Platform, other players, or our business. Security monitoring is ongoing and automated fraud detection systems are active at all times.

6.4 Customer Support

To provide assistance via live chat and email, investigate and resolve complaints and disputes, and improve the quality of our support services based on historical interaction data.

6.5 Responsible Gambling

To monitor your gaming activity for indicators of problem gambling, enforce self-imposed deposit limits and session restrictions, and respond promptly to self-exclusion requests. We may proactively reach out to players whose activity suggests they may benefit from our responsible gambling tools.

6.6 Marketing and Personalisation

With your explicit consent, we may send you promotional emails, SMS notifications, or in-Platform messages about bonuses, new game launches, and special events tailored to your preferences. You may withdraw your marketing consent at any time by updating your communication preferences in your Account settings or by contacting our support team.

6.7 Platform Improvement

To analyse usage patterns, identify technical issues, test new features, and continuously improve the performance, design, and content of the Platform for the benefit of all Malaysian players.

We do not sell your personal data to any third party under any circumstances. We may share your personal data with the following categories of recipients, strictly to the extent necessary for the stated purpose:

7.1 Payment Service Providers

We share the minimum necessary financial data with payment processors including DuitNow operators, FPX-participating Malaysian banks (Maybank, CIMB, Public Bank, Hong Leong), e-wallet providers (Touch 'n Go eWallet, Boost, GrabPay), and cryptocurrency payment gateways, solely for the purpose of processing your transactions.

7.2 Identity Verification Providers

We share identification document data with our contracted KYC service partners to verify the authenticity of documents submitted during account verification. All such partners are contractually bound to process your data only on our instructions and to applicable data protection standards.

7.3 Fraud Prevention & Security Services

We share device and behavioural data with fraud prevention service providers to detect and prevent fraudulent activity, cheating, and multi-accounting across the Platform.

7.4 Regulatory and Law Enforcement Authorities

We will disclose personal data to government authorities, regulators, courts, or law enforcement agencies where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of mbislot, our players, or the public.

7.5 Professional Advisers

We may share personal data with our legal advisers, auditors, and compliance consultants where necessary to obtain professional advice or conduct audits, subject to appropriate confidentiality obligations.

We use cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse traffic patterns, and deliver relevant content. The following categories of cookies are used on the Platform:

You can manage your cookie preferences at any time through your browser settings. Please note that disabling certain categories of cookies may affect the functionality and performance of the Platform. Most modern browsers allow you to block, delete, or receive alerts for cookies through the browser's privacy or settings menu.

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting, or reporting obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your Account's active status plus a minimum of 5 years following Account closure, to comply with AML and regulatory record-keeping requirements;
• Transaction records: Retained for a minimum of 5 years from the date of the transaction, in accordance with financial regulations;
• KYC documentation: Retained for a minimum of 5 years following the completion of the business relationship, or longer where required by applicable law;
• Customer support communications: Retained for up to 3 years following closure of the relevant support case;
• Technical and usage data (cookies, logs): Typically retained for between 30 days and 24 months depending on the specific data type and purpose.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical and analytical purposes, as it can no longer be attributed to an identifiable individual.

mbislot implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers;
• Encryption of sensitive data at rest, including financial account details and identity document data;
• Strict access controls ensuring that personal data is accessible only to authorised personnel with a documented business need;
• Regular security audits, penetration testing, and vulnerability assessments of Platform infrastructure;
• Two-factor authentication (2FA) options for all registered player accounts;
• Comprehensive staff data protection training and confidentiality obligations for all personnel with access to personal data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players and relevant authorities in accordance with applicable legal requirements and within the legally required timeframes.

Subject to applicable law, you have the following rights regarding your personal data held by mbislot. To exercise any of these rights, please contact our support team using the details in Section 16.

We will respond to all verified data subject requests within 30 calendar days. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it. We may need to verify your identity before processing your request to protect against unauthorised disclosure.

The mbislot Platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect, process, or retain personal data from any person under the age of 21. Our KYC verification process is specifically designed to confirm that every registered player meets this minimum age requirement before they can access real-money gaming services.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data, suspend the associated Account, and, where applicable, return any funds deposited to the source payment method. If you believe that a minor has accessed or registered on our Platform, please notify us immediately at [email protected] so that we can investigate and take appropriate action.

Your personal data may be transferred to and processed in jurisdictions outside of Malaysia in the course of providing our services — for example, where our servers, KYC verification partners, or fraud prevention service providers are located in other countries. Such transfers may be to jurisdictions that have different data protection laws from those applicable in Malaysia.

Where we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to or higher than what would apply under applicable data protection law. These safeguards may include:

• Data processing agreements incorporating standard contractual clauses with recipient entities;
• Transfers to entities located in jurisdictions recognised as providing an adequate level of data protection;
• Binding corporate rules or other equivalent approved transfer mechanisms where applicable.

The Platform may contain references to our payment partners (such as Maybank, CIMB, DuitNow, and Touch 'n Go eWallet) whose services are integral to the deposit and withdrawal process. When you interact with these third-party payment services, you do so subject to those providers' own privacy policies and terms of use, for which mbislot bears no responsibility.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of the Platform. mbislot is not responsible for the privacy practices, data security measures, or content of any third-party service provider's platform or systems.

We review and update this Privacy Policy periodically to reflect changes in our data processing practices, applicable data protection laws, regulatory guidance, and business operations. When we make material changes to this Policy, we will:

• Update the "Last Updated" date at the top of this Policy;
• Notify registered players by email to the address associated with their Account at least 14 days before the changes take effect (for material changes); and
• Display a prominent notice on the Platform upon login for a period of at least 7 days following the update.

Your continued use of the Platform after the effective date of any update to this Policy constitutes your acceptance of the revised terms. We strongly recommend that you review this Policy periodically to remain informed of how we protect your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or your data subject rights, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week on the Platform. Live chat is the fastest channel for general queries and straightforward data access requests.
• Email (plain text — not a link): [email protected] — for formal data subject requests, please include "Data Subject Request" in the subject line along with your registered username and a clear description of your request. We acknowledge all email queries within 48 hours.

Formal complaints regarding our data protection practices may also be directed to the relevant data protection supervisory authority in the licensing jurisdiction under which mbislot operates. Details of the applicable supervisory authority are available upon request.

We are committed to working constructively with you to resolve any privacy concerns you may have. Please contact us in the first instance before escalating to a supervisory authority, as we are typically able to address concerns promptly through our internal resolution process.