Privacy Policy

This Privacy Policy ("Policy") describes how MCB66 ("MCB66", "we", "us", "our") collects, uses, discloses, stores, and protects the personal data of individuals ("Members", "Users", "you") who access or use the MCB66 online casino and sports betting platform at https://mcb66.cam and all associated services.

MCB66 operates as an online entertainment platform serving the Malaysian market. All member transactions are conducted in Malaysian Ringgit (MYR) through locally integrated payment channels including Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX. The nature of our services requires us to collect and process certain categories of personal data to operate the platform lawfully, verify identities, process payments, and fulfil our responsible gambling obligations.

This Policy is intended to be read in conjunction with our Terms & Conditions. By registering an account with MCB66 or otherwise using the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For data collected through the MCB66 platform, MCB66 is the Data Controller.
• "Data Processor" — a third party that processes personal data on behalf of MCB66 under a contractual data processing agreement, strictly in accordance with MCB66's documented instructions.
• "Data Subject" — the natural person whose personal data is being processed. In the context of this Policy, this refers to MCB66 Members and website visitors.
• "Cookies" — small text files placed on your device by the MCB66 website or platform to store session information, preferences, and usage analytics data.
• "KYC Data" — identity documents and supporting materials submitted by Members as part of the Know Your Customer verification process, including but not limited to MyKad copies, passport pages, utility bills, and selfie photographs.
• "Sensitive Personal Data" — a sub-category of personal data deserving heightened protection, including financial account information, identity document numbers, and any data from which a person's health, financial, or identity status could be inferred.

MCB66 is the Data Controller responsible for your personal data collected through the platform at https://mcb66.cam. As Data Controller, MCB66 determines the purposes for which your personal data is collected and the manner in which it is processed.

MCB66 operates its platform for the Malaysian market and serves players located across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, Kota Kinabalu, and surrounding regions. The platform supports MYR transactions exclusively through verified Malaysian payment partners.

Where MCB66 engages third-party service providers to process personal data on its behalf — such as payment gateway operators, identity verification services, or cloud infrastructure providers — those providers act as Data Processors under binding contractual obligations that restrict their use of your data strictly to the purposes for which it was shared.

MCB66 collects personal data through several channels: directly from you during account registration and use, automatically through your interaction with the platform, and from third-party service providers in specific circumstances described below.

When you access or use the MCB66 platform, we automatically collect certain technical and behavioural data including:

• IP address and approximate geolocation derived from it.
• Device type, operating system, browser type and version.
• Referring URL and navigation path through the platform.
• Session timestamps, pages viewed, and time spent on each page.
• Betting and gaming activity logs, including bet reference numbers, amounts, odds, results, and timestamps.
• Cookie identifiers and similar tracking technology data (detailed in Section 9).

MCB66 may receive limited personal data from third-party sources in specific circumstances, including:

• Identity verification service providers who return a verification result (confirmed / not confirmed) and flag any identity document authenticity concerns.
• Payment processors who return transaction status, reference numbers, and the payment method name or masked account identifier associated with a deposit or withdrawal.
• Fraud detection and anti-money laundering screening services that return risk scores or watchlist match flags based on publicly available databases.

MCB66 processes your personal data only for specific, legitimate purposes. The primary purposes and their corresponding legal basis are as follows:

MCB66 does not sell, trade, or commercially transfer your personal data to any third party. Data is shared only in the following specific circumstances:

We engage carefully selected third-party service providers to assist with the operation of the MCB66 platform. These providers process your data solely on our instructions and are bound by data processing agreements that prohibit any independent use or disclosure of your data. Categories of service providers include:

• Payment gateway operators — for processing MYR deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect.
• Identity verification providers — for processing KYC documents and returning verification results.
• Cloud infrastructure providers — for secure hosting, data storage, and backup services.
• Fraud detection and AML screening services — for risk scoring and watchlist matching.
• Customer support platform providers — for delivering live chat and ticket-based support services.
• Analytics services — for aggregated, anonymised platform usage analytics.

MCB66 may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or other governmental bodies where required to do so by applicable law, a valid legal order, or regulatory directive. In all such cases, MCB66 will disclose only the minimum data necessary to satisfy the legal requirement and will notify the affected Member where legally permissible to do so.

In the event of a merger, acquisition, restructuring, or sale of all or part of MCB66's business, personal data held by MCB66 may be transferred to the acquiring or successor entity as part of the transaction. Members will be notified of any such transfer and the privacy terms applicable to their data following the transition.

MCB66 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, accounting, or reporting obligations. Our primary retention periods are as follows:

• Account and registration data: Retained for the duration of the active membership and for a minimum of 5 years following account closure, to satisfy potential regulatory audit or dispute resolution requirements.
• KYC documentation: Retained for a minimum of 5 years from the date of verification in accordance with standard anti-money laundering record-keeping obligations.
• Transaction and betting records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements.
• Customer support records: Retained for 3 years from the date of the interaction, unless the matter relates to an open dispute or regulatory inquiry, in which case records are retained until final resolution plus 12 months.
• Marketing consent records: Retained for 3 years from the date of consent grant or revocation, whichever is later, as evidence of consent compliance.
• Technical logs and analytics data: Retained in identified form for 12 months, after which they are anonymised and may be retained indefinitely in aggregated, non-identifiable form.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data.

MCB66 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the MCB66 platform is encrypted using TLS (Transport Layer Security) with a minimum of 256-bit encryption strength.
• Encryption at rest: Sensitive personal data stored on MCB66 servers, including KYC documents and financial account references, is encrypted at rest using AES-256 or equivalent cryptographic standards.
• Access controls: Access to personal data within MCB66 is restricted on a strict need-to-know basis. Role-based access controls (RBAC) ensure that staff can only access data relevant to their operational function.
• Multi-factor authentication: Administrative access to systems containing personal data requires multi-factor authentication. Members are also offered optional two-factor authentication on their accounts.
• Security audits: MCB66's infrastructure and data security practices are subject to periodic third-party security assessments and penetration testing.
• Staff training: All MCB66 staff with access to personal data receive regular data protection and security awareness training.

MCB66 uses cookies and similar tracking technologies to enable the platform to function correctly, remember your session and preferences, and collect anonymised usage analytics to improve our services. The following categories of cookies are used:

You may manage or delete cookies through your browser's cookie management settings. Note that disabling essential cookies will impair or entirely prevent your ability to log in and use the MCB66 platform. For instructions on managing cookies in popular browsers, please refer to your browser's official help documentation.

If MCB66 becomes aware that personal data has been submitted by or on behalf of a person under the age of 21, the associated account will be immediately suspended, all data will be securely deleted to the extent technically practicable, and any funds held in the account will be handled in accordance with MCB66's underage account closure procedure.

If you believe that a person under 21 has created an account or submitted personal data on the MCB66 platform, please contact our Customer Support team immediately at [email protected] so that we may investigate and take appropriate action.

As a data subject, you hold the following rights in relation to your personal data processed by MCB66. To exercise any of these rights, please contact our Customer Support team via live chat or email. We will respond to all verified data rights requests within 14 business days.

Please note that certain data rights may be limited where MCB66 has a legal obligation to retain specific data (such as KYC records or financial transaction logs) or where the exercise of a right would affect MCB66's ability to fulfil its contractual obligations to you. We will always explain the specific reason if we are unable to fully satisfy a data rights request.

MCB66's primary operations and data processing activities are oriented toward the Malaysian market. However, certain third-party service providers engaged by MCB66 — including cloud infrastructure providers and identity verification services — may process personal data on servers located outside Malaysia.

Where personal data is transferred to a jurisdiction outside Malaysia, MCB66 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. Such safeguards may include contractual data protection clauses, certification frameworks, or equivalent protective mechanisms recognised by applicable data protection standards.

MCB66 does not transfer personal data to jurisdictions that do not provide adequate data protection safeguards without implementing contractual or technical compensatory measures.

The MCB66 platform does not contain links to third-party websites or services beyond those integral to platform operation (such as payment gateway redirects during deposit and withdrawal flows). Payment gateway redirects are operated by our contracted payment processing partners and are subject to those partners' privacy policies.

MCB66 is not responsible for the data collection, privacy practices, or content of any third-party sites or services accessed outside the MCB66 platform. We recommend reviewing the privacy documentation of any third-party service you interact with independently of MCB66.

MCB66 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. The "Last Updated" date at the top of this page will be revised accordingly with each update.

For material amendments — those that significantly affect Member rights or alter how personal data is used — MCB66 will provide advance notice via email to the registered address on file and/or via a prominent in-platform notification at least 7 days prior to the changes taking effect.

Continued use of the MCB66 platform following notification of material policy changes constitutes your acceptance of the updated Privacy Policy. If you do not accept the updated Policy, you must close your Account and discontinue use of the platform. Account closure instructions are available via our 24/7 Customer Support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by MCB66, please contact our dedicated support team through either of the following channels:

• 24/7 Live Chat: Available directly within your MCB66 Member Account dashboard. This is the fastest channel for privacy queries, with typical first-response times under 2 minutes during peak hours.
• Email: [email protected] — please include "Privacy Query" in the subject line. We aim to respond to all privacy-related email enquiries within 2 business days.

When submitting a data rights request or privacy complaint, please include your registered Member ID and a clear description of your request or concern to allow us to process it efficiently. We will acknowledge receipt of your request within 2 business days and provide a full response within 14 business days.