Privacy Policy — MB99

This Privacy Policy (the "Policy") issued by MB99 (hereinafter "MB99", "we", "us", or "the Operator") and applies to all personal data collected, processed, stored, and used in connection with the MB99 online gaming platform accessible at mb99.buzz (the "Platform"), including any associated mobile interfaces, subdomains, and customer communication channels.

MB99 is committed to protecting the personal data of all Members and visitors to the Platform. We process personal data in accordance with applicable data protection legislation and the requirements of our international gaming licence. This Policy describes our data handling practices in clear, plain English so that you can make informed decisions about your use of the Platform.

This Policy should be read alongside MB99's Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference and form part of the overall agreement between you and MB99.

For the purposes of this Policy, the following definitions apply:

• "Data Controller" means MB99, the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Processor" means any third party engaged by MB99 to process personal data on MB99's behalf and under MB99's documented instructions.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed by MB99 — principally, registered Members and visitors to the Platform.
• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, date of birth, identification documents, IP address, and payment details.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "KYC Documentation" means identity and address verification documents submitted by Members during the Know Your Customer verification process.
• "Member" means any natural person who has completed MB99's registration process and holds active account.
• "Sensitive Data" means categories of personal data warranting heightened protection, including financial account details, identification document numbers, and data relating to criminal convictions or offences.

MB99 collects the following categories of personal data in connection with the operation of the Platform. We collect only what is necessary for the purposes described in Section 6 of this Policy.

MB99 collects personal data through the following methods:

4.1 Direct Submission. Data you provide directly when creating an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or responding to surveys and promotions.

4.2 Automated Technical Collection. Data collected automatically when you access or use the Platform, including IP address, device identifiers, browser fingerprint, navigation patterns, and session activity. This data is collected via server logs, session cookies, and similar tracking technologies (see Section 8).

4.3 Third-Party Sources. In certain circumstances, MB99 may receive personal data from third-party sources for the purpose of identity verification, fraud prevention, or regulatory compliance. Such third parties include identity verification service providers, payment processors (including FPX operators, DuitNow, and e-wallet providers), and fraud detection partners.

4.4 Affiliate and Referal Channels. Where you access MB99 via a referral link or affiliate programme, MB99 may receive limited data confirming the source of your referral. This data is used solely for the purposes of managing affiliate relationships and processing referral-based incentives.

MB99 processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which MB99 relies are:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and MB99 — specifically, the provision of gaming services, account management, and payment processing.
• Legal Obligation: Processing is necessary for MB99 to comply with legal and regulatory obligations under its gaming licence, including KYC requirements, anti-money laundering (AML) obligations, and responsible gambling duties.
• Legitimate Interests: Processing is necessary for MB99's legitimate interests in fraud prevention, security monitoring, platform improvement, and responsible gambling risk management, where those interests are not overridden by your rights and interests.
• Consent: Where MB99 relies on consent as its legal basis — in particular for marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Consent may be withdrawn via your Account settings or by contacting support.

MB99 uses personal data for the following purposes:

• Account creation and administration — creating, maintaining, and managing your MB99 Member account.
• Identity verification — verifying your identity and age to ensure compliance with our21+ age policy and KYC requirements under our gaming licence.
• Payment processing — facilitating deposits and withdrawals via your chosen Malaysian payment method, including Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency options.
• Fraud and AML compliance — detecting, investigating, and preventing fraudulent activity, money laundering, and other financial crimes.
• Responsible gambling — monitoring gameplay patterns to identify potential problem gambling indicators and to enforce deposit limits, cooling-off periods, and self-exclusion requests.
• Customer support — responding to your queries, complaints, and support requests.
• Regulatory compliance — fulfilling record-keeping, reporting, and audit obligations under MB99's gaming licence.
• Platform security — monitoring for and responding to security threats, unauthorised access attempts, and technical vulnerabilities.
• Service improvement — analysing aggregated usage patterns to optimise platform performance, game selection, and user experience.
• Marketing communications — sending you promotional offers, bonus notifications, and news about MB99 services, subject to your marketing preferences and applicable opt-in requirements.

MB99 does not sell, rent, or share personal data with third parties for their own marketing or commercial purposes. Personal data may be disclosed to the following categories of recipients where strictly necessary and for the purposes described in this Policy:

7.1 Payment Service Providers. Personal and financial data is shared with payment processors — including operators of FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and major Malaysian banks including Maybank, CIMB, Public Bank, and Hong Leong — solely to facilitate deposit and withdrawal transactions authorised by you.

7.2 Identity Verification Providers. KYC documentation may be processed by third-party identity verification service providers engaged by MB99 under strict data processing agreements. These providers are not permitted to use your data for any purpose other than identity verification on MB99's behalf.

7.3 Game Software Providers. Your gameplay data (including bets placed and game session activity) may be shared with third-party game providers solely to facilitate the delivery of their games and to support dispute resolution processes.

7.4 Regulatory and Legal Authorities. MB99 may be required to disclose personal data to its licensing authority, financial intelligence units, law enforcement agencies, or other competent authorities where required by law or where MB99 reasonably believes such disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

7.5 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of MB99's business or assets, personal data held by MB99 may be transferred to the acquiring entity, subject to that entity honouring the terms of this Privacy Policy.

MB99 uses cookies and similar tracking technologies to operate the Platform, maintain session continuity, enhance security, and analyse usage patterns. The following types of cookies are used:

• Essential Cookies: Strictly necessary for the Platform to function. These include session authentication cookies that keep you logged in, security tokens, and cookies that store your language and display preferences. These cookies cannot be disabled without materially impairing Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members use the Platform — pages visited, time spent, navigation patterns, and error events. This data is used to improve platform performance and user experience. Analytics processing does not identify individual users.
• Security Cookies: Used to detect and mitigate fraudulent activity, bot access attempts, and suspicious login behaviour. These cookies help protect your account and the integrity of the Platform.
• Preference Cookies: Store your voluntarily provided preferences, such as preferred payment method display and notification settings, to improve your experience on return visits.

You may manage cookie settings through your browser configuration. Please note that disabling essential cookies will prevent normal access to and use of the MB99 Platform. MB99 does not use third-party advertising or behavioural profiling cookies.

MB99 retains personal data only for as long as it is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as general guidelines:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in accordance with MB99's licensing obligations and applicable AML regulations.
• KYC Documentation: Retained for a minimum of five (5) years following the date of verification or the date of account closure, whichever is later, as required by our gaming licence and anti-money laundering obligations.
• Transaction and Financial Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with standard financial record-keeping requirements under our licensing framework.
• Customer Support Communications: Retained for a period of three (3) years from the date of the communication, for quality assurance and dispute resolution purposes.
• Technical and Session Data: Typically retained for twelve (12) months for security monitoring and fraud detection purposes, after which it is aggregated or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with MB99's data destruction procedures.

MB99 employs a layered, defence-in-depth approach to data security, implementing technical and organisational measures comensurate with the sensitivity of the data held. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and MB99's servers;
• AES-256 encryption for sensitive data at rest, including KYC documents and financial records;
• Two-factor authentication (2FA) available to all Members for enhanced account protection;
• Role-based access controls ensuring that staff members can only access personal data strictly relevant to their job function;
• Real-time intrusion detection and automated alerting for suspicious access patterns;
• Regular penetration testing and security audits conducted by independent third-party security specialists;
• Isolated storage environments for KYC documentation, with strict access logging.

Notwithstanding these measures, no data transmission over the internet or data storage system can be guaranteed to be completely secure. Members are encouraged to use strong, unique passwords and to enable2FA on their MB99 accounts. If you suspect any unauthorised access to your account or personal data, please contact MB99 support immediately.

As a data subject, you hold the following rights in respect of your personal data held by MB99. These rights are subject to applicable law and to MB99's legitimate interests and legal obligations, which may limit their exercise in specific circumstances.