BP99 Privacy Policy – Personal Data Protection for Malaysian Players

BP99 ("we", "the Company") takes the privacy and protection of our members' personal data extremely seriously. This Privacy Policy has been formulated in compliance with the Malaysia Personal Data Protection Act 2010 (PDPA) and sets out transparently how BP99 collects, uses, stores, discloses and protects your personal data ("Data") when you use the bp99.click website, the BP99 mobile application, and all related services (collectively referred to as the "Platform").

This Policy applies to all registered BP99 members, website visitors, and any individual who interacts with the BP99 Platform in any capacity. By accessing or using the BP99 Platform, you acknowledge that you have read and fully understood this Privacy Policy.

If you do not agree with any part of this Privacy Policy, please discontinue your use of the BP99 Platform and contact our support team at support@bp99.click for any privacy-related enquiries or concerns.

Bp99 collects various types of personal data depending on how you interact with our Platform. The following are the categories of data we collect:

BP99 only collects data that is necessary and relevant to the stated purposes. We do not collect sensitive data categories such as health information, religious beliefs, or political views unless required by law.

Bp99 processes your personal data for legitimate and specific purposes only. We will not use your data for any other purposes not stated here without obtaining your consent first:

• Account Management: Creating and maintaining your bp99 account, verifying your identity, and processing account-related requests.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow and FPX, as well as managing withdrawals to your bank account or e-wallet.
• Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, money laundering, platform abuse, and violations of our terms of service.
• Legal Compliance: Fulfilling Malaysian legal obligations, including Anti-Money Laundering (AMLA) requirements and other applicable regulations.
• Customer Support: Resolving enquiries, complaints, and technical support requests efficiently and effectively.
• Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling and providing timely assistance to members who need it.
• Platform Enhancements: Analysing aggregated and anonymised usage data to improve the performance, usability, and overall experience of the BP99 Platform.
• Marketing Communications: Sending promotional information, bonus offers, and the latest BP99 news to members who have given their consent – you may unsubscribe at any time.

Under Malaysia's PDPA 2010, bp99 processes your personal data on the following legal bases:

• Consent: For direct marketing and promotional communications. You may withdraw your consent at any time by contacting us at support@bp99.click.
• Contractual Requirement: Processing necessary to fulfil the service contract between you and BP99, including account management and financial transaction processing.
• Legal Obligations: Processing required under applicable Malaysian law, including KYC and AML obligations.
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement where our legitimate interests do not override your fundamental rights.

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

Bp99 does not sell, rent, or trade your personal data. However, we may share your data with the following parties in limited situations and under strict controls:

• Payment Service Providers: To process financial transactions through the FPX payment gateway, e-wallet providers (Touch 'n Go, GrabPay, Boost, ShopeePay), and banking institutions to facilitate your deposits and withdrawals.
• Game Software Providers: Gaming software companies that provide slots, Live Casino, and table games on the bp99 Platform may process the minimum game data required to operate the games.
• Identity Verification Companies: Third-party KYC service providers that assist BP99 in verifying member identities for legal compliance purposes.
• Authorities: Malaysian law enforcement agencies, courts, or regulatory bodies where required by court order or applicable law.
• Professional Consultants: Lawyers, accountants, and auditors bound by strict confidentiality obligations.

All third parties that receive your personal data from bp99 are required to uphold the same data protection standards as bp99 itself. Data processing agreements are formally signed with all service providers.

Bp99 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction, or disclosure:

• Data Encryption: All data in transit is protected by TLS 1.3 and 256-bit SSL encryption. Sensitive data such as financial information is stored in encrypted form using AES-256 algorithms.
• Access Controls: A least privilege principle is enforced – only staff who require data access for their specific duties are permitted. All access is logged and audited on a regular basis.
• Two-Factor Authentication: All bp99 internal systems containing user data are protected by mandatory two-factor authentication (2FA) for staff.
• Penetration Testing: Security audits and penetration testing are conducted regularly by accredited independent cybersecurity firms.
• Data Backup: Member data is automatically backed up to geographically separate servers with full encryption to ensure service continuity.
• Continuous Monitoring: Threat detection systems and 24/7 monitoring are in place to detect and respond to any security threats promptly.

While BP99 takes all reasonable precautions, no system can be guaranteed 100% secure. In the event of a data breach that affects your rights, we will notify you and the relevant authorities within the timeframe prescribed by Malaysian law.

Bp99 does not retain your personal data longer than necessary for the stated purposes or as required by Malaysian law. Our data retention guidelines are as follows:

When personal data is no longer required, BP99 will securely delete or anonymise it in accordance with recognised industry standards.

BP99 uses cookies and similar tracking technologies to enhance your experience on the Platform. The following are the types of cookies we use:

• Essential Cookies: Required for core Platform operations such as login, session security, and language preferences. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how visitors use the Platform (most visited pages, error messages) to help us improve our services. All data is aggregated and anonymised.
• Functional Cookies: Allows the Platform to remember your preferences such as username, language, and region to provide a more personalised experience.
• Analytics Cookies: Used to understand how members interact with the Platform for the purposes of product improvement and user experience enhancement.

You can manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the BP99 Platform. For more information on managing cookies, refer to the Help section of your internet browser.

In certain situations, your personal data may be transferred to and processed in countries outside Malaysia. This may occur when our third-party service providers have operations outside Malaysia.

Bp99 ensures that any international data transfers are carried out with adequate safeguards, including:

• Ensuring that the recipient country has data protection laws equivalent to or stricter than those of Malaysia.
• Implementing approved standard contractual clauses to safeguard your personal data.
• Obtaining your explicit consent where required for specific data transfers.

BP99 does not transfer personal data to countries without adequate data protection without appropriate additional safeguards.

The BP99 Platform is strictly intended for individuals aged 18 and above. BP99 does not knowingly collect personal data from individuals under the age of 18. If you believe that BP99 has collected personal data from someone under 18, please contact us immediately at support@bp99.click.

Should BP99 discover that personal data of a child has been collected without parental or guardian knowledge, we will take immediate steps to delete that data and close the relevant account. BP99 employs age verification procedures during registration to prevent use of the Platform by underage individuals.

Bp99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or service improvements. The "Last Updated" date at the top of this document indicates when the most recent amendments were made.

For material amendments that significantly affect how we use your personal data, bp99 will notify you via email to your registered address, or through a prominent notice on the Platform, at least 14 days before the amendments take effect.

Your continued use of the BP99 Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, please discontinue use of the Platform and contact us to request account closure and data deletion.

Bp99 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with Malaysia's PDPA 2010 and this Privacy Policy. For any privacy or data protection enquiries, requests, or complaints, please contact us via:

• Privacy Email: support@bp99.click (please mark the subject: "Pertanyaan Privasi / Privacy Enquiry")
• Live Chat: Available 24/7 directly on the BP99 Platform – please indicate that your enquiry relates to privacy
• Response Time: We are committed to responding to all privacy inquiries within 14 business days.

If you are dissatisfied with how bp99 handles your privacy request, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia, the regulatory body responsible for enforcing the PDPA 2010 in Malaysia.

We value the trust you place in BP99 and are continually working to strengthen our privacy practices to provide the best possible protection for all our valued members in Malaysia.