Privacy Policy bm96 – Personal Data Protection for Malaysian Members

01 Introduction and Purpose of This Policy

Bm96 takes personal data protection extremely seriously. As an online entertainment platform serving Malaysian users, we understand that your trust is the most valuable asset we hold. This Privacy Policy is provided to give you a clear and transparent overview of how your personal information is managed at every stage of your interaction with the bm96 platform.

This document was drafted in accordance with the provisions of Personal Data Protection Act 2010 (PDPA) Malaysia, and we ensure all data processing complies with the principles established under that legislation. By registering as a bm96 member, you agree to the data processing terms stated here. If you do not agree with any part of this policy, please contact our support team before proceeding with registration.

02 Types of Personal Data We Collect

Bm96 only collects data that is strictly necessary for specific purposes. We do not collect excessive information beyond what is required for platform operations. The following are the categories of data that may be collected when you use the bm96 platform:

2.1 Registration and Identity Information

• Full name as per official identification document
• National identification number (MyKad) or passport number
• Date of birth for age verification (must be 18 years or older)
• A valid and active email address
• Mobile phone number for two-factor authentication (2FA)
• Current residential address

2.2 Financial and Transaction Information

• Bank account number and bank name (for deposits and withdrawals)
• E-wallet account information such as Touch 'n Go, GrabPay or DuitNow
• Deposit and withdrawal transaction history on the platform
• Betting and gaming activity records

2.3 Technical and Usage Data

• IP address and city-level geographic location information
• Device type, operating system and web browser version
• Login and logout activity logs
• Cookies and session identifiers for user experience
• Non-personally identifiable website usage analytics data

03 Purpose of Data Collection and Processing

Every piece of data we collect is used for specific and legitimate purposes. bm96 ensures your data is not used for any other unrelated purpose without your consent. The table below clearly outlines the purpose of use for each data category:

04 Data Sharing with Third Parties

Bm96 does not sell, rent, or disclose your personal data to any third party for marketing purposes. However, there are limited situations where your data may be shared with other entities, all of which are on a lawful basis and bound by strict confidentiality agreements:

• Payment Providers: Required financial information is shared with licensed payment processors such as FPX, DuitNow and e-wallet providers to enable transactions to be processed securely.
• Technology Providers: Software providers, security systems and cloud computing infrastructure that support our platform's operations, all subject to binding data protection agreements.
• Regulatory Body & Law Enforcement: When required by Malaysian law or a directive from a legitimate authority, bm96 is obligated to disclose certain information to the relevant parties.
• Audit & Compliance Service Providers: Independent auditors who assist us in verifying operational compliance and fair play, all bound by confidentiality agreements.

In all of the above data-sharing instances, bm96 ensures that the receiving parties adhere to data protection standards equivalent to or higher than those we apply ourselves.

05 Security and Data Protection

Bm96 continuously invests in the latest security technologies and procedures to ensure your personal data is always protected from unauthorised access, loss, misuse, or unintended disclosure.

5.1 Technical Measures

• 256-bit SSL/TLS encryption for all data transmission between your device and our servers
• Two-factor authentication (2FA) is available and recommended for all accounts
• Enterprise-grade intrusion detection system (IDS) and firewall
• Passwords are stored in hashed form using the bcrypt algorithm — we do not store passwords in plain text
• Automatic data backup with end-to-end encryption
• 24/7 security monitoring by a dedicated cybersecurity team

5.2 Organisational Measures

• Access to personal data is restricted only to staff who require it based on a need-to-know basis
• Mandatory data security awareness training for all bm96 staff
• Binding confidentiality agreements signed by all employees and contractors
• Regular security reviews and audits by independent third parties

06 Data Retention Period

Bm96 does not retain your personal data longer than necessary for the stated purposes, or longer than required by Malaysian law. The following are our data retention period guidelines:

• Active account data: Throughout the period your account remains active at bm96
• Financial transaction records: Minimum 7 years in accordance with Malaysia's accounting and anti-money laundering legal requirements
• Activity and login logs: 12 months for security and investigation purposes
• KYC and identity verification data: 5 years after account closure in accordance with compliance requirements
• Customer support communication data: 3 years for reference and service improvement purposes

Once the retention period expires, your data will be securely deleted using methods that ensure it cannot be recovered or reused by any party.

07 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a data subject have certain rights guaranteed by law. bm96 fully respects these rights and provides clear channels for you to exercise them:

• Right of Access You have the right to request a copy of the personal data we hold about you. Requests will be processed within 21 working days.
• Right to Rectification If any of your personal data is inaccurate or outdated, you have the right to request correction without undue delay.
• Right to Withdraw Consent You may withdraw consent for certain data processing at any time. Withdrawal does not affect the validity of processing carried out prior to the withdrawal.
• Right to Restrict Processing In certain situations, you have the right to prevent or restrict the processing of your personal data, particularly for direct marketing purposes.
• Right to Erasure You may request the deletion of your personal data when it is no longer required, subject to data retention obligations under applicable law.
• Right to Complain You have the right to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) if you believe your privacy rights have been violated.

To exercise any of the above rights, please contact the bm96 support team via the platform's live chat. We will verify your identity before processing any request related to your personal data to ensure the security of your information.

08 Cookie Usage

Bm96 uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better user experience. Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled.
• Functional Cookies: Saves your preferences such as language, display theme and other settings for your convenience on future visits.
• Analytical Cookies: Helps us understand how users interact with our platform so we can continuously improve it. Data is collected in aggregate and anonymised form.

You can manage cookie settings through your web browser settings. However, disabling essential cookies may affect certain features of the bm96 platform.

09 Cross-Border Data Transfers

In the context of bm96 platform operations, some data may be processed or stored outside Malaysia by our technology service providers. When such data transfers occur, bm96 ensures that a level of protection equivalent to Malaysia's PDPA is upheld by all parties involved, through valid data transfer agreements and adequate safeguard mechanisms.

10 Updates to This Privacy Policy

Bm96 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in business practices, legal requirements, or technological advancements. Any material changes will be communicated to you via your registered email or in-platform notification at least 14 days before the changes take effect.

The "Updated" date at the top of this document reflects the date of the latest version of the Privacy Policy. Your continued use of the bm96 platform following any updates means you accept the revised Privacy Policy.

We recommend checking this page periodically. If you have any questions or concerns regarding our Privacy Policy, the bm96 support team is available 24 hours a day, 7 days a week via live chat on the platform.