mibox88 Privacy Policy

This Privacy Policy ("Policy") is published by mibox88 ("mibox88", "we", "us", "our"), the operator of the English-language online entertainment platform accessible at https://mibox88.cam ("the Platform"). It sets out how mibox88 collects, uses, stores, shares and protects the personal information of users who access or interact with the Platform ("User", "you").

By registering an account, submitting personal information or continuing to use the mibox88 Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact mibox88 to request account closure if applicable.

mibox88 serves adult users primarily located in Malaysia. References to Malaysian payment services — including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX — reflect the payment channels available to our users and are not indicative of any formal partnership or data-sharing arrangement with those entities beyond what is necessary to process transactions.

This Policy should be read alongside the mibox88 Terms & Conditions, which together form the complete user agreement governing your relationship with mibox88.

The following definitions apply throughout this Privacy Policy:

mibox88 collects Personal Data only where it is necessary for a legitimate operational, regulatory or user-service purpose. The categories of data we may collect are set out in the table below:

mibox88 does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, health records or biometric data, except where identity documents submitted during KYC incidentally contain such information. In that case, the document is used solely for verification and the sensitive fields are not stored separately or used for any other purpose.

mibox88 processes the Personal Data described above for the following clearly defined purposes:

1. Account creation and management: To register, verify, maintain and support your mibox88 user account, including KYC checks for age and identity confirmation (mandatory for all users, who must be aged 21 or above).
2. Transaction processing: To facilitate deposits and withdrawals through your chosen Malaysian payment channel — including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX and approved cryptocurrency networks.
3. Platform operation and personalisation: To deliver game content, manage session state, remember preferences and present relevant promotional information where you have indicated willingness to receive such communications.
4. Fraud prevention and compliance: To detect, investigate and prevent fraudulent activity, money laundering, underage gambling and other prohibited conduct as described in the mibox88 Terms & Conditions.
5. Responsible gambling: To apply deposit limits, self-exclusion settings or cooling-off periods you have requested, and to monitor account behaviour for indicators of potential problem gambling in line with our Responsible Gambling commitments.
6. Customer support: To respond to your enquiries, resolve disputes and maintain records of communications for quality and compliance purposes.
7. Analytics and platform improvement: To understand aggregate usage patterns across the mibox88 Platform and improve the user experience. Analytics are conducted at an aggregate level and do not involve profiling individuals for commercial targeting.
8. Legal obligations: To comply with any applicable legal requirement, regulatory order or lawful request from a competent authority.

mibox88 relies on one or more of the following legal bases when processing Personal Data:

• Contractual necessity: Processing required to perform the mibox88 user agreement, including account registration, KYC verification, transaction facilitation and customer support.
• Legitimate interests: Processing necessary for mibox88's legitimate operational interests — such as fraud prevention, platform security, responsible-gambling monitoring and aggregate analytics — provided those interests are not overridden by the User's fundamental rights.
• Legal obligation: Processing required to comply with an applicable law, regulation or lawful order from a competent authority.
• Consent: Where mibox88 relies on your consent for a specific processing activity — for example, sending promotional communications — you may withdraw that consent at any time by contacting mibox88 or adjusting your account communication preferences. Withdrawal of consent does not affect the lawfulness of any processing that occurred before withdrawal.

mibox88 does not sell, rent or trade your Personal Data to third parties. We may share Personal Data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment service providers: Banks, e-wallet operators and payment networks (including Maybank, CIMB, Public Bank, Hong Leong, DuitNow and FPX) receive only the transaction and account-name data required to process your specific deposit or withdrawal.
• Identity verification services: KYC and anti-fraud service providers who assist mibox88 in verifying user identity and detecting fraudulent activity. These providers process data under binding contractual confidentiality obligations.
• Cloud and hosting infrastructure: Service providers that host the mibox88 Platform and data on servers subject to appropriate security standards.
• Regulatory and law-enforcement authorities: Where mibox88 is required by a lawful order, warrant or regulatory directive to disclose Personal Data. mibox88 will, where legally permissible, notify the affected User of such a disclosure.
• Professional advisers: Legal counsel, auditors and compliance consultants under professional-secrecy obligations, strictly for the purpose of advising mibox88 on its legal and regulatory obligations.

Any third-party Data Processor engaged by mibox88 is subject to a formal data-processing agreement that prohibits the use of User data for any purpose beyond the specific task for which it was shared.

mibox88 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Active account data (identity, contact, payment references) — retained for the duration of account activity plus a minimum of five years following account closure, to satisfy anti-money-laundering and financial-record obligations.
• Transaction records — retained for a minimum of seven years following each transaction to meet financial compliance requirements.
• KYC documents — retained for the duration of the account relationship plus five years following closure, or longer if required by regulatory instruction.
• Responsible-gambling records (self-exclusion, deposit limits, cooling-off requests) — retained for a minimum of five years to protect User wellbeing and ensure self-exclusion commitments are honoured.
• Support communications — retained for three years from the date of last correspondence.
• Technical and device logs — retained for up to 12 months for security and fraud-prevention analysis, then deleted or anonymised.

When Personal Data is no longer required and retention obligations have been met, mibox88 will delete or irreversibly anonymise it in a secure manner.

mibox88 implements a range of technical and organisational measures designed to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. These measures include:

• Encryption of data in transit using industry-standard TLS protocols.
• Encryption of sensitive data at rest, including identity and payment references.
• Role-based access controls limiting data access to personnel with a legitimate operational need.
• Regular internal security reviews and vulnerability assessments.
• Formal incident-response procedures to identify, contain and report data breaches in a timely manner.

Users also have an important role in protecting their own data. mibox88 strongly advises all users to:

• Use a unique, strong password for their mibox88 account that is not shared with any other service.
• Never disclose their password, OTP codes or account-verification details to anyone claiming to represent mibox88 via informal channels.
• Contact mibox88 support immediately if they suspect unauthorised access to their account.

mibox88 uses cookies and similar technologies to support essential platform functionality and to understand how users interact with the site. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security cookies and cookies that maintain your login state. These cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences such as language settings and last-used payment method, so you do not need to re-enter these on each visit.
• Analytics cookies: Used to collect aggregate, anonymised data about how users navigate the mibox88 Platform. This information helps mibox88 improve page structure, content and performance. No individual user is identified through this data.

mibox88 does not use third-party advertising cookies or behavioural tracking technologies for commercial targeting purposes. Users may manage cookie preferences through their browser settings. Disabling strictly necessary cookies will impair or prevent access to the Platform.

mibox88 may engage Data Processors whose infrastructure is located outside Malaysia. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to applicable Malaysian standards, mibox88 will implement appropriate safeguards — such as contractual clauses or equivalent measures — to ensure that the data is protected to a standard consistent with this Policy.

Users who have questions about the specific safeguards applied to international data transfers may contact mibox88 using the details in the Contact Us section of this Policy.

mibox88 is strictly intended for adults aged 21 and above. mibox88 does not knowingly collect Personal Data from individuals under the age of 21. If mibox88 becomes aware that it has inadvertently collected data from a person under 21, the account will be suspended immediately, the data will be deleted, and any deposits associated with the account will be handled in accordance with applicable responsible-gambling obligations.

If you believe a person under the age of 21 has created a mibox88 account, please notify us immediately at the email address in the Contact Us section. We will investigate and act promptly.

Subject to applicable law and certain operational limitations, mibox88 users have the following rights in relation to their Personal Data:

To exercise any of the above rights, please contact mibox88 in writing using the contact details in Section 14. mibox88 will respond within a reasonable period, and in any case within 30 days of receiving a valid, verifiable request. We may ask you to confirm your identity before processing a data rights request.

mibox88 reserves the right to amend this Privacy Policy at any time. Changes are effective from the date the updated Policy is published on this page, as reflected in the effective date shown at the top. For material changes that affect how your Personal Data is used, mibox88 will take reasonable steps to notify registered users — for example, by displaying a notice on the Platform or sending a notification to your registered email address.

Continued use of the mibox88 Platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms. Users who do not accept the amended Policy should discontinue use of the Platform and may request account closure in accordance with the mibox88 Terms & Conditions.

If you have any questions, concerns or requests relating to this Privacy Policy or the way mibox88 handles your Personal Data, please contact us using the details below. All privacy correspondence is handled in English.

• Email: [email protected]
• Subject line (for data rights requests): PRIVACY REQUEST — [your request type]
• Subject line (for data breach concerns): DATA SECURITY CONCERN
• Response target: Within 5 business days for acknowledgement; within 30 days for a substantive response

mibox88 takes all privacy communications seriously. Please provide your registered email address and a clear description of your request so we can respond accurately and efficiently.