Mibox Privacy Policy – Your Data Protection

1

Information We Collect

To provide a secure, efficient and personalised service to every user, mibox collects several categories of information during the registration process and ongoing use of the platform.

Information you provide directly:

• Full name as per identity card
• Active email address
• Mobile number registered in Malaysia
• Date of birth (for age verification)
• Bank account or digital wallet details for financial processing
• Identity document (copy of MyKad or passport) during the KYC process

Information collected automatically during use:

• IP address and general geolocation information
• Device type, operating system, and browser version
• Activity log including login times, games played, and transactions made
• Cookie data and session identifiers for security purposes
• Communication records with our customer support team

All data collection is carried out on the principle of minimisation — we only collect what is strictly necessary for the safe and compliant operation of the platform.

2

How We Use Your Data

Personal data collected by mibox is used solely for legitimate platform operations and to enhance the user experience. The following are the primary purposes for which data is used:

Mibox does not use users' personal data for third-party advertising, commercial profiling or any activity not directly related to the operation of the gaming platform.

3

Information Sharing with Third Parties

Mibox does not sell, rent or disclose users' personal data to external parties for commercial purposes. However, in certain limited situations, data sharing may occur with the following parties:

• Payment service provider — Trusted and licensed payment processors to facilitate deposit and withdrawal transactions on the mibox platform.
• Game software provider — Companies such as Evolution Gaming, Pragmatic Play and PG Soft that provide games on our platform, and for which minimal data is required to log game sessions.
• Legal authorities — Malaysian government agencies or law enforcement bodies when required to do so by law or a valid court order.
• Identity verification service — Licensed third-party KYC providers to assist with the identity verification process for new users.

In all of the above data-sharing cases, mibox ensures that recipients are bound by strict data protection agreements and use the information solely for the specified purposes. Data is never shared for external marketing or commercial purposes.

4

Data Storage and Security

All mibox user personal data is stored on secure servers with strict access controls. We apply multiple layers of technical protection to ensure your data remains protected at all times:

• Encryption in transit — TLS 1.3 and 256-bit SSL protocols ensure that all data in transit between your device and our servers cannot be intercepted.
• Encryption at rest — Sensitive data such as financial information and identity documents are encrypted at the database level using AES-256.
• Internal access controls — Only mibox staff who require data access for specific tasks are authorised to do so, based on the principle of least privilege.
• Regular security audits — The mibox platform undergoes regular penetration testing and independent security audits.
• Continuous threat monitoring — Automated monitoring systems operate around the clock to detect and respond to any suspicious activity.

Personal data is retained for as long as the user account remains active, plus any additional period required by Malaysian law — typically seven years for financial records. After that period, data will be securely deleted or anonymised.

While we take all reasonable precautions, no security system is 100% guaranteed. In the event of a data breach affecting users, mibox will notify impacted users within the timeframe required by applicable law.

5

Cookies and Tracking Technologies

Mibox uses cookies and similar tracking technologies to enhance platform functionality and security. Cookies are small text files stored on your device by your web browser when you visit our site.

Types of cookies we use:

• Essential cookies — Required for core platform functions such as login authentication, session management and security. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies — Collects information about how users interact with our platform (pages visited, time spent) to help us improve the user experience. This data is processed in aggregate and anonymised form.
• Functional cookies — Stores user preferences such as language, interface theme and display settings for a more personalised experience.

You can manage or delete cookies through your web browser settings. However, disabling essential cookies may affect your ability to log in and use certain platform features. mibox does not use third-party cookies for advertising purposes.

6

KYC and Identity Verification

As a responsible and legally compliant gaming platform, mibox conducts a Know Your Customer (KYC) process for all users who wish to make a withdrawal. This process is mandatory under anti-money laundering (AML) requirements and responsible gaming protection standards.

Documents that may be requested during the KYC process include:

• Copy of National Identity Card (MyKad) — front and back
• Copy of passport (for eligible foreign nationals)
• Proof of current address (utility bill or bank statement not older than three months)
• Selfie holding identity document (if required)
• Bank statement or proof of source of funds (for certain withdrawal limits)

All KYC documents are encrypted and stored securely. They are accessible only by staff specifically authorised for verification purposes. Once the verification process is complete, unnecessary document copies will be deleted in accordance with our data retention policy.

7

User Rights Relating to Personal Data

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by mibox:

• Right of Access — You have the right to request and receive a copy of the personal data we hold about you.
• Right to Rectification — If your data is inaccurate or outdated, you have the right to request immediate correction.
• Right to Erasure — In certain circumstances, you may request the deletion of your personal data, subject to legal data retention obligations.
• Right to Restriction of Processing — You may request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability — You have the right to receive your personal data in a machine-readable format for transfer to another platform.
• Right to Object — You may object to the processing of your data for specific purposes such as behavioural analytics.

To exercise any of the rights above, please contact the mibox privacy team by email at [email protected], clearly stating your request. We will process your request within 30 business days and notify you of the action taken.

8

Children's Data and Age Restrictions

The mibox platform is strictly for adults aged 18 and above. We do not accept registrations from individuals under 18 and do not knowingly collect personal data from minors.

If we confirm that personal data of an individual under 18 has been collected, we will take immediate steps to delete that information and close the associated account. Parents or guardians who suspect their child has registered on the mibox platform without their knowledge are urged to contact us immediately at [email protected].

The rigorous KYC process we conduct is one of the key mechanisms ensuring full compliance with this 18-year age requirement.

9

Links to Third-Party Sites

The mibox platform may contain links or references to third-party websites or services in certain contexts, such as payment providers or game suppliers. This Privacy Policy applies solely to the mibox platform and does not cover the privacy practices of those third parties.

Mibox is not responsible for the content, privacy policies or security practices of any third-party websites. We encourage users to read the privacy policy of each platform they use separately. Access to third-party sites is at the user's own risk.

10

Changes to This Privacy Policy

Mibox reserves the right to update or amend this Privacy Policy from time to time in line with changes to law, technology or platform operations. Any changes will be published on this page with the latest update date.

For significant changes that affect how we use your personal data, mibox will endeavour to notify active users via in-platform notifications or email at least 14 days before the changes take effect.

Your continued use of the mibox platform after any amendment takes effect constitutes your acceptance of the updated policy. If you disagree with any changes, please stop using the platform and contact us to close your account.

11

Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding how mibox handles your personal data, our privacy team is ready to assist.

• Privacy Email: [email protected]
• Live Chat: Available on the platform after login, 24 hours a day
• FAQ: Browse FAQ page for answers to frequently asked questions

All privacy complaints will be acknowledged within 3 business days and resolved within 30 business days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant Malaysia Personal Data Protection Department.