mb388 is committed to protecting the privacy of every player on our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you hold as a data subject. Please read this document carefully before registering or continuing to use the mb388 platform.
Last updated: June 2026
For the purposes of applicable data protection legislation, the data controller responsible for the personal information collected via the mb388 platform (accessible at mb388.win) is mb388 ("mb388", "we", "us", "our"). All enquiries relating to this Privacy Policy, including requests to exercise your data subject rights, should be directed to our support team as described in Section 13 of this document.
By creating an account on mb388 or continuing to use the platform, you acknowledge that you have read this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. This policy forms part of, and should be read alongside, our Terms & Conditions.
mb388 collects the following categories of personal data from players and platform visitors:
| Category | Examples |
|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (MyKad / passport) |
| Contact Data | Email address, mobile phone number, residential address (including city, state, postcode) |
| Financial Data | e-Wallet identifiers (Touch n Go / Boost), bank account details for FPX withdrawals, transaction history in MYR |
| Technical Data | IP address, browser type and version, device identifiers, operating system, timezone, session data |
| Usage Data | Pages visited, games played, wagers placed, bet amounts, session durations, bonus uptake |
| Communications Data | Live chat transcripts, support email content, feedback submissions |
| Verification Data | Copies of identity documents, selfies, utility bills or bank statements submitted during KYC |
mb388 does not collect or store full payment card numbers. Any card-related processing is handled directly by certified payment processors in accordance with PCI-DSS standards.
mb388 collects personal data through the following means:
mb388 processes personal data only for specified, explicit, and legitimate purposes. The primary purposes and corresponding legal bases are as follows:
mb388 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Data shared with partners is limited to what is strictly necessary for the purposes described above.
mb388 may share your personal data with carefully selected third parties in the following circumstances:
All third-party data processors engaged by mb388 are bound by contractual data processing agreements that require them to maintain appropriate technical and organisational security measures and to process data only on mb388's documented instructions.
mb388 operates in an international gaming environment, and some of the third parties described in Section 5 may be located or process data in jurisdictions outside Malaysia. Where personal data is transferred internationally, mb388 implements appropriate safeguards — such as standard contractual clauses or equivalent mechanisms — to ensure that your data receives a standard of protection consistent with applicable data protection law. If you would like further information about the specific safeguards in place for any particular transfer, please contact us as described in Section 13.
mb388 retains personal data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law. The following general retention periods apply:
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.
The mb388 platform uses cookies and similar tracking technologies to provide a functional, personalised, and secure user experience. The types of cookies used include:
You may manage cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the availability of some platform features. mb388 does not use cookies to track players across third-party websites for advertising purposes.
Subject to applicable data protection law, you have the following rights in relation to the personal data mb388 holds about you:
To exercise any of the above rights, please submit a request to mb388 support as described in Section 13. mb388 will respond within 30 calendar days. In complex cases this period may be extended by a further 60 days, with notification provided.
The mb388 platform is strictly intended for adults aged 21 and over. mb388 does not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the registration and KYC process. If mb388 becomes aware that personal data has been collected from an individual under 21, the account will be immediately suspended and all associated data deleted, with any deposits returned to the source payment method. If you believe a minor has registered an mb388 account, please contact support immediately.
mb388 implements technical and organisational measures appropriate to the sensitivity of the personal data we process. These measures include:
While mb388 takes all reasonable precautions, no internet-based service can guarantee absolute security. Players are encouraged to use strong, unique passwords for their mb388 accounts and to enable two-factor authentication. Never share your login credentials with anyone — mb388 support staff will never ask for your password.
mb388 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. Material changes will be communicated to registered players via email notification or a prominent platform notice at least 7 days before the revised policy takes effect. The "Last Updated" date at the top of this page is revised each time an update is made. Continued use of the mb388 platform after the effective date of any revision constitutes your acceptance of the updated Privacy Policy.
We encourage you to review this policy periodically to stay informed about how mb388 protects your data.
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact mb388 through the following channels:
mb388 is committed to resolving privacy enquiries promptly and fairly. If you are not satisfied with mb388's handling of your data or response to a data subject rights request, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.
Six ways mb388 safeguards your personal data every day.
Every byte of data between your device and mb388's servers is encrypted with 256-bit SSL/TLS — the same standard used by Malaysian banks for internet banking.
mb388 does not sell, rent, or trade your personal data to third parties for their marketing purposes. Full stop. Your data serves your mb388 account — nothing else.
Access, rectify, erase, or port your data. mb388 responds to all data rights requests within 30 days. Your information belongs to you — and you can manage it.
Data is kept only as long as legally required or operationally necessary. Once the retention period expires, data is securely deleted or anonymised — not stored indefinitely.
Identity documents are encrypted at rest and accessible only to authorised mb388 personnel with a legitimate need. Documents are never shared with third parties beyond regulated KYC partners.
In the unlikely event of a data breach, mb388 follows a documented incident response procedure to contain the incident and notify affected players and regulators within legally required timeframes.