Privacy Policy MB99 – Our Commitment to Protecting the Personal Data of Malaysian Members

MB99 is an online sports betting and casino platform serving the Malaysian market. We understand that trust is the foundation of the relationship between a platform and its users — and a key part of that trust is the confidence that your personal data is handled with care, responsibility, and security.

This Privacy Policy ("Policy") describes how mb99 collects, stores, uses, discloses, and protects your personal data when you use the mb99-khelo.com website, the mb99 mobile application, and all related services ("Platform"). This Policy applies to all registered members, website visitors, and any individual who interacts with the mb99 platform in any capacity.

In the context of the mb99 platform, "personal data" refers to any information that can identify you directly or indirectly as an individual — including your name, phone number, email address, banking information, transaction history and platform usage data. MB99 complies with Malaysia's Personal Data Protection Act 2010 (PDPA) in all aspects of managing our members' personal data.

MB99 collects your personal data through several channels — directly when you register or use the platform, automatically through standard tracking technologies, and in certain cases from legitimate third-party sources. The table below outlines the data we collect and the purposes for doing so:

MB99 does not collect sensitive data categories such as medical information, biometric verification or precise location data without a clear necessity and your explicit consent. In the context of a betting platform like mb99, Malaysia's anti-money laundering (AML) laws require us to collect and verify certain identity data — this is not optional but a legal compliance requirement.

The personal data mb99 collects is used exclusively for legitimate purposes directly relevant to the operation of the platform. The following are the primary uses of mb99 members' personal data:

• Account management and administration: Activating your mb99 account, processing logins securely, updating profile information, and maintaining accurate member records.
• Financial transaction processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or FPX, processing withdrawals to your Malaysian bank account and maintaining complete transaction records.
• Identity verification and legal compliance: Complying with KYC (Know Your Customer), AML (Anti-Money Laundering) and financial reporting requirements under applicable Malaysian law.
• Platform security and fraud prevention: Detecting and preventing unauthorised access, duplicate accounts, bonus abuse, payment fraud and any activity that violates mb99's Terms & Conditions.
• Service communications: Sending important account notifications such as deposit confirmations, withdrawal notices, security alerts and material policy updates.
• Customer support: Enabling mb99's 24-hour support team to assist you effectively with account-related enquiries, complaints and requests.
• Platform improvements and user experience: Analysing usage patterns in aggregate (not at an individual level) to improve platform design, introduce new features and ensure that mb99's sports betting, slots and Live Casino experience remains seamless and relevant for Malaysian users.
• Responsible gaming: Monitoring activity patterns to identify possible signs of problem gambling and enabling mb99 to respond proactively in supporting members who may need help.
• Marketing (with consent): Sending information about relevant mb99 promotions, bonuses and offers — but only to members who have opted in to receive marketing communications. You may withdraw this consent at any time.

MB99 does not sell, rent, or disclose members' personal data to external parties for commercial purposes. However, in the course of operating the platform effectively, there are limited situations where data may be shared with carefully selected third parties:

• Payment providers: Required transaction information is shared with Malaysian payment providers such as FPX processors, e-wallet operators (Touch 'n Go, GrabPay, Boost, ShopeePay), and DuitNow to enable secure transaction processing. These providers are subject to their own privacy policies and security standards.
• Game providers: Where necessary, game session data is shared with world-class game providers that supply slots, Live Casino, and virtual sports to the mb99 platform. Such sharing is limited strictly to the information required to run the game session.
• Statutory authorities: MB99 may disclose personal data to Malaysian government authorities, law enforcement bodies or courts when required by law, court order or regulatory compliance obligations. MB99 will notify affected members of any such disclosure where permitted by law to do so.
• Technical service providers: Technology infrastructure providers — such as cloud server services and cybersecurity systems — may process data in a processor capacity on behalf of mb99. All such providers are bound by strict confidentiality agreements and are not permitted to use the data for their own purposes.

In all of the data-sharing scenarios above, MB99 ensures that adequate contractual and technical safeguards are in place to protect your personal data. MB99 remains accountable for how data is used by third parties acting on our behalf.

The security of members' personal data is a technical priority that mb99 takes very seriously. We continuously invest in security infrastructure and industry best practices to ensure your data is protected in the most effective way possible.

The technical security measures mb99 employs include:

• 256-bit SSL/TLS Encryption: All communications between your browser or app and mb99's servers are encrypted using the latest TLS protocols. This means that even if your data is intercepted in transit, it cannot be read without the corresponding encryption key.
• Encrypted data storage: Sensitive data such as banking information and passwords are stored in encrypted or hashed form in mb99's database. Passwords are never stored in plain text.
• Two-factor authentication (2FA): MB99 offers and strongly encourages two-factor authentication via Malaysian phone number OTP for all accounts. This adds an extra layer of protection even if your password is compromised.
• Internal access controls: Access to mb99 members' personal data within our systems is restricted to employees with a legitimate operational need. All access is logged and audited on a regular basis.
• 24-hour security monitoring: mb99's systems are continuously monitored to detect suspicious activity, unauthorised access attempts and other cybersecurity threats.
• Periodic security audits: MB99 conducts regular internal and external security assessments to identify and address potential vulnerabilities before they can be exploited.

MB99 retains your personal data only for as long as necessary for the purposes stated in this Policy, or as required by applicable Malaysian law. The general principles we follow are:

• Active account data: For as long as your mb99 account remains active, we retain all data necessary to manage your account and provide our services effectively.
• Data after account closure: When an mb99 account is closed at the member's request or by mb99, we retain financial transaction records and identity data for a minimum of 7 years to meet anti-money laundering compliance and financial reporting requirements in Malaysia.
• Communication log data: Customer support chat logs, complaint tickets and emails are retained for 3 years from the date of communication for reference and dispute resolution purposes.
• Technical data and logs: Access logs, IP address data, and technical records are retained for 12 months for security and fraud detection purposes.
• Marketing data: If you have given consent for marketing communications but subsequently withdraw that consent, we will remove your marketing information within 30 days. However, account and transaction data remains subject to the retention periods stated above.

Once the retention period expires, your personal data will be securely deleted or anonymised in accordance with industry-standard procedures. MB99 conducts regular data reviews to ensure that data no longer required is not retained unnecessarily.

The mb99 platform uses cookies and standard tracking technologies to enhance the user experience, maintain platform security and understand how members interact with mb99's various features. The types of cookies used are as follows:

• Required session cookies: These cookies are essential for the mb99 platform to function properly — they store your login status, language preferences and current session settings. Without them, you will not be able to use the mb99 platform. They are automatically deleted when you close your browser.
• Preference cookies: Saving your preferences such as display settings, language selection and interface specifications so you don't have to reconfigure them each time you log in to mb99.
• Security cookies: Used to detect unauthorised access attempts, verify user identity and protect accounts from suspicious activity.
• Analytics cookies: Collecting statistical information on how visitors use the mb99 platform — such as the most frequently visited pages, navigation paths and time spent in each section. This data is collected in aggregate form and does not identify individuals personally.

You can manage your cookie preferences through your browser settings. Please note, however, that blocking all cookies may affect the functionality of the mb99 platform — particularly session cookies required for login and security. The mb99 mobile app uses local storage technology that serves an equivalent function to cookies within the app environment.

As an mb99 member in Malaysia, you have certain rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). MB99 respects and facilitates the exercise of these rights:

To exercise any of the rights above, submit a written request to support@mb99-khelo.com stating the right you wish to exercise along with your mb99 account details for identity verification purposes. MB99 will respond within 21 days. In complex cases, this period may be extended to 30 days with notice to you.

Please note that certain requests may not be fully actionable if they conflict with mb99's legal obligations — for example, we are unable to delete transaction records required for AML compliance. In such cases, mb99 will clearly explain why the request cannot be fulfilled in full.

The mb99 platform is a service intended solely for adults aged 18 and above. MB99 does not knowingly collect, store, or process the personal data of individuals under the age of 18. Registration by minors is a violation of mb99's Terms & Conditions and is strictly prohibited.

During registration, mb99 collects date of birth and a Malaysian phone number as part of basic age eligibility verification. For accounts requesting withdrawals or where age is in question, mb99 reserves the right to request additional identity verification, including a copy of the member's MyKad or Malaysian passport.

If mb99 discovers that personal data belonging to anyone under the age of 18 has been collected inadvertently, we will take immediate steps to close the account in question, delete the data, and refund any deposits where applicable. Parents or guardians who suspect their child has registered with mb99 are encouraged to contact us at support@mb99-khelo.com without delay.

MB99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or relevant technological developments. We are committed to notifying you of any material changes that affect your privacy rights.

When we make material changes to this Policy, we will:

• Updating the "Last Updated" date at the top of this Policy
• Displaying a notice on the mb99 platform for logged-in members
• Sending email notifications to registered members when changes are material in nature

Continued use of the mb99 platform after the effective date of an amended Policy constitutes your acceptance of the updated Policy. If you do not agree with any changes, please discontinue use of the platform and contact mb99 for information on closing your account.

If you have any questions, concerns or requests regarding this Privacy Policy or how mb99 handles your personal data, we encourage you to reach out to us directly. The mb99 privacy team is here to help.

Ways to contact mb99 regarding privacy matters:

• Privacy Email: support@mb99-khelo.com — please state "Privacy Enquiry" in the subject line of your email
• Live Chat: Via the chat icon on the mb99 platform — available 24 hours a day, 7 days a week with an average response time of under 3 minutes

MB99 will endeavour to respond to all privacy-related enquiries within 5 business days. For data rights requests (access, rectification, deletion), the response period is up to 21 days as stated in Section 8 above. If you believe mb99 has failed to handle your personal data in accordance with this Policy or applicable law, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia.