Reference

How mbi23 Handles Your Personal Information

When you open an account with us, we collect only what we need to run your account and process your payments — including transactions made via Touch 'n Go eWallet, Boost, and GrabPay.

Account data collected at registrationPayment data via Touch 'n Go eWallet, Boost, GrabPayData retained only as long as neededYour right to request access or deletionContact us anytime via live chat
mbi23 How mbi23 Handles Your Personal Information
PRIVACY CONTACT PATHS

How to Reach Us About Your Privacy Rights

If you want to access, correct, or request deletion of your personal data, our support team handles these requests directly. Reach us through any of the channels below and quote your registered account email so we can locate your record quickly. We aim to respond to all data-related requests within a reasonable timeframe in line with applicable law.

Team online

Live Chat

Start a live chat session from any page on mbi23. Available during operating hours — quote your account email for faster handling of your data request.

Email Support

Send your privacy or data request to our support email address listed in your account dashboard. Include your registered name and the nature of your request.

Account Settings

Some data corrections — like updating your contact number or email address — can be done directly inside your account settings without contacting support.

DATA HANDLING PRACTICES

How We Protect and Manage Your Information

We approach data handling the same way we approach payments — with minimal friction and nothing held that we do not need. Account data is encrypted in transit and at rest. Session tokens expire automatically after inactivity, which means your account does not stay open on a shared device without your action. We review data retention schedules periodically and delete records that no longer serve a purpose under our policy or applicable law.

Encryption in Transit and at Rest

All data moving between your device and our servers is protected with SSL encryption. Stored account records are encrypted at rest so they cannot be read if accessed without authorisation.

Cookie and Session Controls

We use session cookies to keep you logged in during a visit and analytics cookies to understand how the site is used. You can manage cookie preferences through your browser settings at any time.

Retention and Deletion Policy

We keep your account data for as long as your account is active and for a period afterwards as required by applicable law. Once that period ends, records are deleted or anonymised.

Third-Party Data Sharing

We share data with payment processors like Touch 'n Go eWallet, Boost, and GrabPay only to complete transactions. No personal data is sold or shared with advertisers.

Common Questions About Your Privacy on mbi23

These are the questions we hear most often about how your data is handled on mbi23. If your question is not covered here, reach out via live chat or email and we will respond directly.

We collect your name, email address, phone number, and date of birth at registration. Payment references from Touch 'n Go eWallet, Boost, or GrabPay are also recorded per transaction.

No. We receive only a transaction reference from your payment provider. Your wallet PIN, full account number, and credentials are never stored on our servers.

Yes. Contact us via live chat or support email with your registered account email address. We will compile and send you a copy of the data we hold within the timeframe required by applicable law.

Send a deletion request to our support team with your account email and a note that you want your data removed. We will process it subject to any legal retention obligations that apply.

Only with payment processors and identity verification partners, and only the minimum data needed to complete a transaction or verify your account. We do not sell data to advertisers.

We retain records for a period after account closure as required by applicable law in Malaysia. Once that period ends, your data is deleted or anonymised and no longer accessible.
Reference

Privacy Policy

Service availability depends on eligible regions and local law. Users should check local rules before opening an account.

Access may be available only where local law permits.