mb365 Privacy Policy

This Privacy Policy ("Policy") is issued by mb365 and describes how we collect, use, store, disclose, and protect the personal data of individuals who access or use the mb365 platform at mb365.cam ("the Platform"), including all games, financial services, promotional features, and customer support channels available therein.

mb365 is committed to handling personal data responsibly and transparently. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines.

By registering an mb365 account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood how mb365 processes your personal data as described herein. Where mb365 relies on your consent as the legal basis for processing, that consent is indicated at the relevant point of data collection and may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

For the purposes of the Philippine Data Privacy Act of 2012, the personal information controller responsible for your data is mb365, the operator of the platform at mb365.cam. mb365 operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to both PAGCOR's operational regulations and the data protection framework established by the National Privacy Commission.

mb365 has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act. The DPO is responsible for overseeing this Policy, ensuring ongoing compliance with Philippine data protection law, managing data subject requests, and acting as the primary point of contact for the National Privacy Commission on data protection matters.

Data subject requests and privacy-related inquiries may be directed to the mb365 DPO via the support email address listed in Section 14 of this Policy. All data subject requests will be acknowledged within 72 hours and resolved within the statutory timeframe of 30 calendar days.

mb365 collects personal data in the following categories, depending on your interaction with the Platform:

mb365 does not collect sensitive personal information (as defined under Section 3(l) of the Data Privacy Act) — such as race, religion, health data, or political affiliation — unless strictly required for a specific regulatory obligation and with your explicit prior consent.

mb365 collects personal data through the following channels and methods:

• Direct submission: Information you provide when registering an mb365 account, completing KYC verification, submitting a deposit or withdrawal request, or contacting customer support.
• Automated collection: Technical and gaming activity data collected automatically as you use the Platform, including via server logs, session tracking systems, and platform analytics tools operated by mb365.
• Cookies and similar technologies: Data collected through cookies placed on your device when you access the mb365 website. Full details are provided in Section 7 of this Policy.
• Third-party verification services: Identity and age verification data returned by PAGCOR-approved KYC service providers used to confirm your identity and eligibility to participate in real-money gaming.
• Payment processors: Transaction confirmation data returned by GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers upon processing of deposits and withdrawals.

mb365 processes personal data only for specified, explicit, and legitimate purposes. The table below sets out our primary processing activities and the legal basis under the Data Privacy Act for each:

mb365 does not sell your personal data. We do not rent or trade it with third-party marketers. Personal data is disclosed only to the following categories of recipients, and only to the extent necessary for the stated purpose:

• Licensed game providers: Game session data (player ID, bet amounts, game results) is shared with the licensed providers whose games are hosted on mb365 for the purpose of game delivery, integrity monitoring, and dispute resolution. All providers are contractually bound to data protection standards consistent with the Data Privacy Act.
• Payment service providers: Financial data is shared with GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors solely for the purpose of processing your deposits and withdrawals. mb365 does not retain full payment card numbers or full bank account details beyond the reference information required for transaction records.
• KYC and identity verification services: Identity data is shared with PAGCOR-approved verification service providers for age and identity confirmation purposes.
• PAGCOR: mb365 is required by its operating license to provide PAGCOR with access to player data, gaming records, and financial transaction data as part of regulatory oversight and audit processes.
• Anti-Money Laundering Council (AMLC): Certain financial transaction data is reported to the AMLC where required by RA 9160 (Anti-Money Laundering Act) and its amendments.
• Law enforcement and courts: Where mb365 is required to disclose personal data pursuant to a lawful court order, subpoena, or formal law enforcement request, we will comply to the extent required by Philippine law after undertaking reasonable verification of the request.
• Professional advisors: Legal, accounting, and compliance advisors engaged by mb365 may have access to personal data where strictly necessary for the provision of their advisory services, subject to professional confidentiality obligations.

All third parties with whom mb365 shares personal data are required to process that data only for the specified purpose, to maintain appropriate security measures, and to comply with the Data Privacy Act where applicable.

The mb365 platform uses cookies and similar local storage technologies to deliver core functionality, maintain your login session, and improve platform performance. The following cookie categories are used:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens that keep you logged in to your mb365 account. They cannot be disabled without breaking core functionality.
• Functional cookies: Remember your language preferences, game lobby settings, and responsible gaming configurations within your mb365 session.
• Analytics cookies: Used by mb365's internal analytics system to understand how players navigate the platform — which game categories are most visited, where players encounter errors, and how load times affect usage. Data collected is aggregated and does not directly identify individual players.
• Security cookies: Used to detect and prevent automated login attempts, bot activity, and session hijacking.

You can manage cookie settings through your browser preferences. Disabling strictly necessary cookies will prevent you from logging in and using the mb365 platform. Disabling functional and analytics cookies will reduce platform personalisation and our ability to optimise the user experience.

mb365 retains personal data only for as long as is necessary for the purpose for which it was collected, subject to any minimum retention periods required by Philippine law. The following schedules apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to a specific individual. Anonymised aggregated data (from which individual identification is no longer possible) may be retained indefinitely for statistical and platform improvement purposes.

mb365 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and mb365 servers;
• At-rest encryption for stored personal data and financial records in the mb365 database infrastructure;
• Access controls and role-based permissions ensuring that mb365 personnel can only access personal data where there is a defined business need;
• Multi-factor authentication requirements for administrative access to systems holding player data;
• Intrusion detection systems and real-time security monitoring to identify and respond to anomalous access patterns;
• Regular penetration testing and security audits conducted by qualified third-party security professionals;
• Data breach response plan including notification procedures consistent with NPC Circular 16-03 (Personal Data Breach Management).

While mb365 employs industry-standard security practices, no internet transmission or data storage system can be guaranteed completely secure. Players are encouraged to use strong, unique passwords for their mb365 account and to contact support immediately if they suspect unauthorised access to their account.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by mb365. All requests are processed within 30 calendar days of receipt, subject to verification of your identity:

To exercise any of these rights, contact the mb365 Data Protection Officer via the live chat support function on the Platform or by email at the address listed in Section 14. mb365 will verify your identity before processing any data subject request to protect against unauthorised access to another person's data.

The mb365 platform is strictly restricted to individuals who are 21 years of age or older, as required under PAGCOR's regulations governing online gambling in the Philippines. mb365 does not knowingly collect personal data from individuals below the age of 21.

Where mb365 discovers or has reason to believe that personal data has been collected from a person below the minimum age requirement, the following actions will be taken immediately:

• The relevant account will be suspended pending investigation;
• Any funds deposited will be returned to the verified payment source after completion of AML checks;
• The personal data of the underage individual will be deleted from mb365 systems, subject to any mandatory legal retention obligations;
• The matter will be reported to PAGCOR as required under the Platform's operating license conditions.

If you are the parent or guardian of a minor who you believe has accessed or registered with mb365, please contact mb365 support immediately via live chat so that the account can be investigated and closed promptly.

Some of the third-party service providers used by mb365 — including certain licensed game providers and infrastructure service providers — may process or store data on servers located outside the Philippines. Where such cross-border data transfers occur, mb365 ensures that:

• The recipient country provides an adequate level of data protection, or
• Appropriate contractual safeguards (such as data processing agreements incorporating standard contractual clauses consistent with NPC requirements) are in place with the recipient organisation, or
• The transfer falls within an exception recognised under the Data Privacy Act (e.g., the transfer is necessary for the performance of your account contract).

In all cases, mb365 requires contractually that any overseas recipients of Philippine player data process that data in a manner consistent with the protections afforded under Republic Act No. 10173.

mb365 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect your rights or the way mb365 processes your personal data — mb365 will notify registered players via:

• A notice displayed prominently on the Platform on next login; and/or
• An SMS or email notification to your registered Philippine mobile number or email address.

Non-material changes (such as clarifications that do not alter the substance of the Policy) will be reflected in the updated version of this page without individual notification. Your continued use of the mb365 platform after the effective date of any revised Policy constitutes acceptance of the updated terms, to the extent permitted by applicable law.

For all privacy-related inquiries, data subject rights requests, or concerns about mb365's handling of your personal data, please contact the mb365 Data Protection Officer through the following channels:

• Live Chat: Available 24/7 on the mb365 platform. Requests submitted via live chat are escalated to the DPO within one Philippine business day.
• Support Email: [email protected] — This is a plain-text address and is not a clickable link. Please include "Privacy Request" or "Data Subject Request" in the subject line of your email to ensure prompt routing to the Data Protection Officer.
• Response time: All data subject requests are acknowledged within 72 hours and resolved within 30 calendar days of identity verification, consistent with NPC requirements.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previous versions. This Policy should be read together with the mb365 Terms & Conditions and Responsible Gaming Policy.