Data Protection & Privacy
At mbahtoto, your privacy is not a legal checkbox — it is a genuine commitment. This Policy explains exactly what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you hold over your information as a registered player.
This Privacy Policy ("Policy") describes how Mbahtoto ("we", "us", "our", "mbahtoto") collects, processes, stores, and protects the personal data of individuals ("you", "UserPlayer") who register for and use the online betting and gaming services available at mbahtoto.cam and any associated applications or platforms operated by us.
We are committed to handling your personal data responsibly, transparently, and in compliance with applicable international data protection principles. Our processing activities are guided by principles of data minimisation, purpose limitation, accuracy, storage limitation, and integrity — meaning we collect only what is necessary, use it only for stated purposes, keep it accurate and up to date, retain it only as long as needed, and protect it throughout its lifecycle.
By creating an account and using the mbahtoto platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not register for or continue to use the platform.
This Privacy Policy is published in English. In the event of any discrepancy between this English version and any translated or summarised version, the English text shall prevail as the definitive and legally binding version.
For the purposes of this Policy, the following terms carry the meanings set out below:
Any information relating to an identified or identifiable natural person — including name, email address, date of birth, phone number, device identifiers, financial account details, and any other data that could directly or indirectly identify you.
Any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
Mbahtoto, which determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully and in accordance with this Policy.
A third party that processes personal data on behalf of mbahtoto under a contractual arrangement, such as payment service providers, KYC verification vendors, or cloud infrastructure providers.
Know Your Customer — the mandatory identity and source-of-funds verification process required of all users prior to their first withdrawal, and periodically thereafter at mbahtoto's discretion.
Small text files placed on your device by our platform to recognise your browser, remember your preferences, maintain your session, and support platform analytics and fraud prevention.
We collect personal data from you in three primary ways: directly (data you provide to us), automatically (data generated by your use of the platform), and from third parties (data received from payment providers, KYC vendors, and fraud-prevention services).
Registration details (full name, date of birth, email address, phone number, residential address, preferred currency); KYC documents (Malaysian MyKad, passport, proof of address, or equivalent government-issued ID); payment method details (bank account details for Maybank, CIMB, Public Bank, Hong Leong Bank; e-wallet identifiers for Touch'n Go eWallet, Boost, GrabPay; DuitNow reference details; USDT TRC20 wallet addresses); account preferences and communication settings; responsible gambling self-assessments and limit-setting requests; support correspondence and chat logs.
IP address and approximate geolocation; device type, operating system, and browser information; session data including login timestamps, pages visited, game history, betting activity, and session duration; cookie and similar tracking technology data; referal source (how you arrived at mbahtoto.cam).
Identity verification outcomes from our KYC service providers; fraud screening scores and alerts from anti-fraud partners; transaction confirmation data from FPX, DuitNow, and our payment gateway providers; sanctions screening data from compliance databases.
Mbahtoto collects only the personal data that is strictly necessary for the purposes outlined in this Policy. We do not collect sensitive categories of personal data (such as racial origin, religious beliefs, or health information) unless directly relevant to a responsible gambling assessment and provided voluntarily by the user.
We process your personal data one or more of the following legal bases, depending on the specific processing activity:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and management | Performance of a contract between you and mbahtoto |
| Processing deposits and withdrawals | Performance of a contract; legal obligation (AML compliance) |
| KYC identity verification | Legal obligation (anti-money laundering / know-your-customer requirements) |
| Fraud prevention and security monitoring | Legitimate interests of mbahtoto and protection of users |
| Customer support communications | Performance of a contract; legitimate interests |
| Marketing and promotional communications | Consent (you may withdraw at any time) |
| Platform analytics and improvement | Legitimate interests (improving user experience and platform stability) |
| Responsible gambling monitoring | Legal obligation; legitimate interests (player welfare) |
Mbahtoto uses your personal data for the following specific purposes:
Mbahtoto does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the following limited and controlled circumstances:
We share relevant financial data with payment processors, including FPX network operators, DuitNow system participants, e-wallet providers (Touch 'n Go, Boost, GrabPay), and major Malaysian banks (Maybank, CIMB, Public Bank, Hong Leong Bank) as necessary to process your transactions. These providers receive only the data strictly necessary to execute the transaction.
We share identity documentation and verification data with our contracted KYC service providers for the purpose of identity verification and regulatory screening. These providers act as data processors under contractual data processing agreements with mbahtoto.
We may share data with fraud-prevention platforms and security analytics providers to detect and prevent fraudulent activity. This may include sharing device fingerprints, IP addresses, and behavioural data.
We may disclose personal data to law enforcement agencies, regulatory authorities, or courts where we are required to do so by applicable law, court order, or where disclosure is necessary to protect the rights, property, or safety of mbahtoto, our users, or third parties.
In the event of a merger, acquisition, reorganisation, or sale of all or part of mbahtoto's business assets, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any material change in data controller identity.
All third-party data processors engaged by mbahtoto are subject to contractual data processing agreements that require them to process your data only on our documented instructions and to maintain appropriate security standards.
Mbahtoto uses cookies and similar technologies (including local storage and session tokens) on our platform to support essential functionality, enhance user experience, and protect platform security. The categories of cookies we deploy are as follows:
| Category | Purpose | Basis |
|---|---|---|
| Essential | Maintaining your login session, security tokens, and core platform functionality. Cannot be disabled without breaking the service. | Necessary for contract performance |
| Security | Fraud detection, bot identification, multi-account detection, and protection against cross-site request forgery (CSRF). | Legitimate interests |
| Functional | Remembering your language preference, display settings, and last-visited game categories to improve your experience. | Legitimate interests |
| Analytics | Aggregated, anonymised usage statistics to understand how users navigate the platform and where improvements can be made. | Consent |
| Marketing | Supporting personalised promotional communications where you have opted in to marketing. | Consent |
You may manage non-essential cookie preferences through your browser settings. Please note that disabling essential cookies will impair core platform functionality and may prevent you from logging in or processing transactions.
Mbahtoto retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve disputes or enforce our agreements.
At the end of the applicable retention period, personal data will be securely deleted or irreversibly anonymised.
Mbahtoto implements technical and organisational security measures comensurate with the risk and sensitivity of the personal data we process. These measures include, but are not limited to:
You are responsible for maintaining the confidentiality of your account credentials. Mbahtoto will never ask for your password via email, SMS, or live chat. If you suspect your account has been compromised, contact our24/7 support team immediately.
Mbahtoto is an internationally operated platform and your personal data may be processed in countries outside Malaysia where our servers, service providers, or group companies are located. Such jurisdictions may have data protection laws that differ from those in Malaysia.
Where we transfer personal data internationally, we take appropriate safeguards to ensure that your data remains protected to a standard consistent with this Policy. These safeguards may include contractual data transfer mechanisms, adequacy assessments, and binding commitments from the receiving entity.
By using mbahtoto, you acknowledge and consent to the transfer of your personal data to processing locations outside Malaysia for the purposes described in this Policy.
Subject to applicable law and any overiding legal obligations that prevent compliance, you hold the following rights in respect of your personal data processed by mbahtoto:
Request correction of inaccurate or incomplete personal data held about you.
Request correction of inaccurate or incomplete personal data held about you.
Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations.
Request that processing of your data be restricted in certain circumstances while an objection or correction request is resolved.
Receive a structured, machine-readable copy of data you have provided to us for transfer to another service where technically feasible.
Object to processing of your data for direct marketing or where processing is based on legitimate interests.
Where processing relies on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
Lodge a complaint with the relevant data protection authority in your jurisdiction if you believe your data rights have been violated.
To exercise any of the above rights, please contact us using the details provided in Section 15 of this Policy. We will respond to all valid requests within thirty (30) calendar days, or within a reasonable extended period if the request is particularly complex, in which case we will notify you of the expected response timeframe.
The mbahtoto platform is strictly restricted to persons aged21 years or older. We do not knowingly collect or process the personal data of anyone under the age of 21. Age verification is a mandatory component of our KYC process and is enforced at account registration and prior to the first withdrawal.
If we become aware that personal data belonging to an individual under 21 years of age has been submitted to us — whether through misrepresentation at registration or any other means — we will immediately suspend the relevant account, delete the associated personal data to the extent permitted by law, and contact the registered email address with instructions for any necessary account closure procedures.
If you have reason to believe that a minor has registered on our platform, please notify us immediately at [email protected].
The mbahtoto platform does not contain links to third-party websites, applications, or services in its primary navigation or content areas. Where references to third-party payment brands (such as Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, GrabPay, DuitNow, FPX) appear on our platform, these are references to payment methods integrated within our system and do not constitute outbound links to those companies' own websites.
Mbahtoto accepts no responsibility for the privacy practices or data processing activities of any third-party payment provider, and we recommend that you review the privacy policies of any external service you use in connection with your mbahtoto account.
Mbahtoto reserves the right to update or amend this Privacy Policy at any time. Changes may be necessary to reflect updates in our processing activities, technological changes, evolving legal obligations, or improvements to our data protection practices.
Where a material change to this Policy affects how we process your personal data, we will provide advance notice via email to your registered address or through a prominent notification on the platform prior to the change taking effect. For non-material clarifications or corrections, changes may take effect immediately upon publication.
The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the mbahtoto platform following publication of an updated Policy constitutes your acknowledgement of the changes.
We recommend reviewing this Policy periodically to remain informed about how mbahtoto protects your personal data. If you have any questions about a recent update, our support team is available 24/7.
If you wish to exercise any of your data rights, have questions about this Privacy Policy, or wish to raise a complaint about how mbahtoto has handled your personal data, please contact us through the following channels:
We aim to acknowledge all data rights requests within 72 hours and to provide a substantive response within 30 calendar days. Complex requests may require up to an additional 30 days, in which case we will notify you of the delay and the expected resolution date.
Our Data Protection Commitments
Privacy is built into how mbahtoto operates — not applied as an afterthought. Here are the six core data protection principles we follow every day.
We apply strict data minimisation — collecting only the personal data genuinely required for account management, payment processing, KYC compliance, and responsible gambling obligations.
All data in transit between your device and our servers is protected by 256-bit SSL/TLS encryption. Sensitive stored data — including identity documents and payment details — is encrypted at rest.
Mbahtoto never sells, rents, or commercially trades your personal data to any third party. Your data is used only for the purposes described in this Policy — nothing else.
We retain your data only as long as legally required or operationally necessary. KYC records are kept for 5 years as required by AML obligations. Marketing data is deleted within 30 days of opt-out.
You hold eight data rights under this Policy — including access, rectification, erasure, portability, and the right to object. We respond to all valid requests within 30 days.
We document the legal basis for every processing activity. You will always know why we collect your data, how long we keep it, and who we share it with — no hidden processing, no vague justifications.
Questions About Your Privacy?
If you have any questions about how mbahtoto handles your personal data, want to exercise your data rights, or simply want to understand our privacy practices better — our support team is available 24/7.