1 Introduction
This Privacy Policy ("Policy") is published by the operator of mandiribet ("we", "us", "our", "the Platform"), an online gaming platform accessible at mandiribet.cam. mandiribet operates under an international gaming licence (Curaçao eGaming jurisdiction) and provides online casino games, live dealer tables, and sports betting services primarily to players in Malaysia and other eligible markets.
This Policy explains what personal data we collect from you when you visit, register with, or use the Platform; how we use and process that data; with whom we may share it; how long we retain it; and what rights you have in relation to your personal information.
We are committed to handling your personal data with care, transparency, and in accordance with applicable data protection principles. By accessing the Platform, registering an account, or submitting any personal information to us, you acknowledge that you have read and understood this Policy and consent to the processing of your data as described herein.
Malaysian Players: While Malaysia's Personal Data Protection Act 2010 (PDPA) applies to data processors operating within Malaysia, mandiribet as an international operator processes data under the governance framework of its licensing jurisdiction. Regardless of the applicable legal framework, we apply data protection principles consistent with international best practices, including purpose limitation, data minimisation, and security by design.
2 Definitions
For the purposes of this Policy, the following terms have the meanings given below:
- "Personal Data" means any information that identifies or can reasonably identify a natural person, directly or indirectly — including name, identification number, contact details, financial information, and device identifiers.
- "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, and deletion.
- "Data Subject" means the natural person to whom the Personal Data relates — in this context, a Player or website visitor.
- "KYC Data" means identity verification documents submitted by Players in fulfilment of Know Your Customer requirements, including government-issued ID, proof of address, and selfie images.
- "Cookies" means small text files placed on your device by the Platform that store session and preference information.
- "Third-Party Service Provider" means any external vendor, partner, or sub-processor engaged by mandiribet to deliver aspects of the Platform's services — such as payment processors, KYC verification providers, or analytics tools.
- "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
3 Personal Data We Collect
We collect Personal Data through various touchpoints across the Platform — at registration, during ongoing account use, through customer support interactions, and via automated technical means. The categories of data we collect are set out in the table below.
| Category | Examples | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, MyKad number, Passport number | Registration form; KYC document upload |
| Contact Data | Email address, Malaysian mobile number, residential address (Kuala Lumpur, Penang, Johor Bahru, etc.) | Registration form; Account settings |
| Financial Data | Deposit and withdrawal history, preferred payment method (Touch 'n Go eWallet, DuitNow, Maybank, CIMB, etc.), transaction amounts in MYR or cryptocurrency equivalent | Transaction processing; cashier system |
| KYC Documents | Scanned/photographed copies of MyKad (NRIC), Driver's License, Passport, utility bills, selfie images | KYC verification portal (submitted by player) |
| Technical Data | IP address, browser type, operating system, device identifiers, session duration, referral URL | Automated collection via server logs and cookies |
| Usage Data | Games played, bets placed, session duration, sports markets wagered on (EPL, Liga Super Malaysia, UFC), bet amounts | Platform activity logging |
| Communications Data | Live chat transcripts, email correspondence, support ticket records | Customer support interactions |
| Marketing Preferences | Email/SMS opt-in status, preferred language (English, Bahasa Melayu, Chinese), communication channel preferences | Account settings; opt-in forms |
3.1 Data You Provide Directly
The majority of Personal Data we hold is provided directly by you — at account registration, during KYC submission, when contacting support, or when updating your Account profile. Provision of certain data categories (particularly Identity Data and KYC Documents) is a mandatory requirement for continued access to withdrawal functionality and higher deposit tiers.
3.2 Data Collected Automatically
When you access the Platform, we automatically collect certain Technical Data through server logs, cookies, and similar tracking technologies. This data is used for security monitoring, fraud prevention, platform performance optimisation, and anonymised analytics. We do not use this data to build advertising profiles or to share with third-party ad networks.
4 How We Use Your Personal Data
mandiribet processes your Personal Data for the following purposes. Each purpose is supported by a legal basis as described in Section 5.
- Account creation and management — to register your Account, authenticate logins, and maintain your player profile.
- Transaction processing — to process deposits and withdrawals via your chosen Malaysian payment method (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, cryptocurrency, etc.).
- Identity verification (KYC) — to comply with our licensing obligations by verifying your identity, age (21+), and source of funds before processing withdrawals.
- Fraud prevention and security — to detect, investigate, and prevent fraudulent activity money laundering, multi-accounting, and other prohibited conduct.
- Customer support — to respond to enquiries, resolve disputes, and provide assistance via live chat, email, or other support channels in English, Bahasa Melayu, or Chinese.
- Regulatory compliance — to fulfil our anti-money laundering (AML), Know Your Customer (KYC), and responsible gambling obligations under our gaming licence.
- Platform improvement — to analyse usage patterns, diagnose technical issues, and improve the Platform's performance, game offering, and user experience.
- Marketing communications — to send promotional offers, bonus notifications, and platform updates to players who have opted in. You may opt out at any time.
- Responsible gambling monitoring — to identify indicators of problem gambling behaviour and to enforce self-exclusion or deposit limits where applicable.
- Legal proceedings — to establish, exercise, or defend legal claims where necessary.
5 Legal Basis for Processing
mandiribet processes your Personal Data one or more of the following legal bases:
- Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to operate your Account, process deposits and withdrawals, and deliver the gaming services you have registered to access.
- Legal Obligation: Processing is required to comply with our licensing conditions, including KYC identity verification, AML transaction monitoring, age verification, and responsible gambling record-keeping.
- Legitimate Interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, IT system maintenance, and internal analytics — provided those interests are not overridden by your data protection rights.
- Consent: Where we rely on your consent (e.g., for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
We do not process Special Categories of Personal Data (such as health data, racial or ethnic origin, or biometric data) in the ordinary course of our operations. To the extent any such data is incidentally present in submitted KYC documents, it is treated with heightened security and accessed only by authorised compliance personnel.
6 Data Sharing & Disclosure
mandiribet does not sell, rent, or otherwise trade your Personal Data to third parties for commercial or marketing purposes. Data is shared only in the circumstances described below.
6.1 Service Providers
We engage third-party service providers to support specific operational functions, including: payment processing (e-wallet operators, Malaysian bank FPX/DuitNow infrastructure); KYC and identity verification services; cloud hosting and data storage; IT security and fraud detection; and customer support platform infrastructure. All such providers are contractually bound to process your data only for the purposes we specify and to apply equivalent data security standards.
6.2 Regulatory and Legal Disclosure
We may disclose Personal Data to our licensing authority (Curaçao eGaming), law enforcement agencies, financial intelligence units, or other competent authorities where required to do so by law, court order, or as necessary to prevent, investigate, or prosecute fraud, money laundering, or other criminal activity.
6.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets involving mandiribet, your Personal Data may be transferred to the acquiring or successor entity, subject to that entity assuming equivalent data protection obligations. You will be notified of any such change that materially affects your data rights.
6.4 Aggregated and Anonymised Data
We may share aggregated, anonymised, or de-identified data (from which individual identity cannot be derived) for industry research, analytics, or platform benchmarking purposes. Such data does not constitute Personal Data for the purposes of this Policy.
7 KYC & Identity Verification Data
Identity verification documents submitted as part of the KYC process receive enhanced protection due to their sensitive nature. This includes Malaysian MyKad (NRIC) copies, passport photo pages, Driver's Licenses, utility bills, and selfie photographs.
7.1 Access Controls
KYC documents are stored in a secure, access-controlled environment separate from general Account data. Access is restricted to authorised compliance and KYC review personnel only. All access events are logged and auditable.
7.2 Submission Security
All document uploads are transmitted over HTTPS encrypted connections. Players should never submit KYC documents via unsecured channels (email, WhatsApp, or third-party messaging apps). mandiribet will only ever request document uploads through the official secure portal within your Account dashboard.
7.3 Retention of KYC Documents
KYC documents are retained for the duration of your Account's active status and for a minimum of five years following Account closure, in compliance with our AML obligations under international gaming licence conditions.
⚠️ Protect Your Documents: mandiribet will never request your KYC documents via live chat messages, social media, or unsolicited email. If you receive such a request from channel claiming to be mandiribet, do not comply and report it to our support team immediately.
8 Cookies & Tracking Technologies
The Platform uses cookies and similar technologies to operate correctly, remember your preferences, maintain session security, and generate anonymised analytics data. The following categories of cookies are used:
| Cookie Type | Purpose | Consent Required |
|---|---|---|
| Essential | Session management, login authentication, security tokens, fraud prevention signals | No — necessary for platform operation |
| Functional | Language preference (English/BM/Chinese), game settings, interface customisation | No — necessary for core functionality |
| Analytical | Anonymised page view tracking, error logging, performance monitoring. Data is aggregated and not linked to individual identity. | Yes — opt-out available |
| Marketing | Tracking of promotional campaign effectiveness for players who have opted in to marketing communications | Yes — opt-out available via Account settings |
You may control cookie preferences through your browser settings. Note that disabling Essential cookies will prevent the Platform from functioning correctly. Disabling Analytical or Marketing cookies will not affect your ability to play.
9 Data Retention
mandiribet retains Personal Data only for as long as is necessary to fulfil the purposes described in this Policy or as required by applicable legal, regulatory, or licensing obligations. The following general retention periods apply:
- Account data (name, contact details, login history): for the duration of the active Account plus 5 years following closure.
- Transaction records (deposit/withdrawal history in MYR): 7 years from the date of the transaction, in accordance with AML record-keeping requirements.
- KYC documents: 5 years from Account closure as detailed in Section 7.3.
- Support communications: 3 years from the date of the interaction.
- Marketing preference records: for the duration of the opt-in, plus 2 years following opt-out for compliance audit purposes.
- Technical/log data: up to 12 months on a rolling basis, unless flaged in connection with a security investigation.
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where deletion is not immediately possible (e.g., data held in backup systems), the data is isolated and protected until deletion can be completed.
10 Data Security
mandiribet implements appropriate technical and organisational security measures designed to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
- SSL/TLS encryption for all data transmitted between your device and the Platform.
- Encryption at rest for all sensitive data fields including ID numbers and financial information.
- Role-based access controls limiting employee access to Personal Data strictly on a need-to-know basis.
- Two-factor authentication requirements for internal system access by Platform staff.
- Regular security assessments, penetration testing, and vulnerability management.
- Incident response procedures for prompt containment and notification in the event of a data breach.
While we implement robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials. mandiribet will never ask for your password via any external communication channel.
11 Your Data Rights
Subject to applicable law and our licensing obligations, you have the following rights in respect of your Personal Data held by mandiribet. To exercise any of these rights, contact our support team via live chat or email.
Right of Access
Request a copy of the Personal Data we hold about you, including the categories of data, purposes of processing, and third parties with whom it has been shared.
Right to Rectification
Request correction of inaccurate or incomplete Personal Data. You may update most contact information directly within your Account settings.
Right to Erasure
Request deletion of your Personal Data where it is no longer necessary for the purposes collected, subject to our legal retention obligations (including 5-year AML retention requirements).
Right to Restrict Processing
Request that we limit how we use your Personal Data in certain circumstances — for example, while you contest the accuracy of data we hold.
Right to Portability
Request a machine-readable export of Personal Data you have provided to us, where technically feasible and where processing is based on consent or contract.
Right to Object
Object to processing of your Personal Data carried out on the basis of our legitimate interests, including direct marketing communications. Opt-out is available at any time in Account settings.
We will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, with notice provided. We may request proof of identity before actioning a request to protect against unauthorised access to another person's data.
12 Minors & Age Restriction
The Platform is strictly intended for use by individuals aged21 years and above. mandiribet does not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and Accounts found to be operated by underage individuals are immediately suspended.
⚠️ 21+ Only: If you believe that a minor has registered an Account or provided their personal data to the Platform, please contact our support team immediately so we can investigate and take appropriate action, including deletion of any data collected from that individual.
Parents and guardians are encouraged to use device parental control tools and to have open conversations with minors about online safety and the risks of underage gambling. Resources for parents concerned about online gambling exposure are available through GamCare (text-only reference — international online support).
13 International Data Transfers
mandiribet operates as an international platform, and your Personal Data may be processed and stored on servers located outside of Malaysia, including in the licensing jurisdiction (Curaçao) and in the jurisdictions of our third-party service providers (which may include countries Europe, Southeast Asia, or North America).
Where data is transferred internationally, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy. These safeguards may include: contractual data protection clauses with third-party processors; transfers to jurisdictions with adequacy determinations by recognised data protection authorities; or other legally recognised transfer mechanisms.
By using the Platform, you acknowledge and consent to the international transfer of your Personal Data as described in this section.
14 Changes to This Policy
mandiribet reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or business operations. Where amendments are material — for example, introducing new categories of data collection or new purposes for processing — we will provide advance notice to registered players via email or a prominent notice on the Platform, ordinarily no fewer than 14 days before the changes take effect.
The "Last updated" date displayed at the top of this Policy reflects the most recent revision. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you should close your Account and discontinue use of the Platform before the effective date.
The current version of this Policy is always accessible at mandiribet.cam/privacy-policy.
15 Contact Us
If you have any questions, concerns, or complaints regarding this Privacy Policy or how mandiribet handles your Personal Data — including requests to exercise your data rights under Section 11 — please contact us through the following channels.