bp9 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1 Data Controller

bp9 is the data controller responsible for the personal data collected through the bp9 platform. As data controller, bp9 determines the purposes and means by which your personal data is processed. All data protection queries should be directed to bp9 via the contact details provided in Section 15 of this Policy. bp9 operates the platform at bp9.lat under applicable international gaming authority licensing frameworks and processes personal data in accordance with the requirements of those frameworks and applicable international data protection standards.

2 Personal Data We Collect

bp9 collects the following categories of personal data in connection with the operation of the platform and the provision of services to Players:

2.1 Identity Data

• Full legal name as it appears on official identification documents.
• Date of birth (used to verify the 21+ age requirement). 21+
• Government-issued identification number (e.g., MyKad NRIC, passport number).
• A copy of your identification document as provided during KYC verification.

2.2 Contact Data

• Email address registered to your bp9 Account.
• Malaysian mobile telephone number registered to your bp9 Account.
• Residential address (where provided for KYC purposes).

2.3 Financial Data

• Details of payment methods used to deposit or withdraw funds, including partial card or e-wallet account numbers as required for transaction processing.
• Transaction history — deposits, withdrawals, and Wager activity — associated with your Account.

2.4 Technical Data

• IP address and approximate geographic location derived therefrom.
• Device identifiers, browser type and version, operating system.
• Session activity logs, including login timestamps, pages visited, and features accessed.

2.5 Behavioural Data

• Game play data, including game titles accessed, bet amounts, game outcomes, and session durations.
• Bonus and promotion participation history.
• Customer support interaction records, including chat transcripts.

3 How We Collect Your Data

bp9 collects personal data through the following means:

• Direct Collection: Data you provide at the point of Account registration, during KYC verification, when making a deposit or withdrawal, or when contacting bp9 support.
• Automated Collection: Technical data collected automatically when you access the Platform, including via cookies, log files, and similar tracking technologies. See Section 8 for further detail on our use of cookies.
• Third-Party Sources: Identity and payment verification data received from our KYC and payment processing service providers in connection with verifying your identity and processing your transactions.
• Publicly Available Sources: Where necessary for compliance purposes, bp9 may supplement account data with information from publicly available sources, including sanctions screening lists and fraud prevention databases.

4 Purposes of Processing

bp9 processes your personal data for the following purposes:

• Account Management: To create, manage, and maintain your bp9 Account, including verification of your identity and eligibility to use the Platform.
• Service Delivery: To operate the Platform, process your Wagers and financial transactions, and provide customer support.
• Legal and Regulatory Compliance: To fulfil bp9's obligations under applicable gaming authority licensing requirements, including anti-money laundering (AML), know-your-customer (KYC), and age verification obligations.
• Fraud Prevention and Security: To detect, prevent, and investigate fraud, money laundering, account security breaches, and other prohibited conduct.
• Responsible Gaming: To monitor gaming behaviour and provide responsible gaming tools and interventions in accordance with bp9's Responsible Gaming Policy. See our Responsible Gaming page for details.
• Communications: To send you service communications, including Account notifications, security alerts, transaction confirmations, and, where you have consented, promotional communications about bp9 offers and updates.
• Platform Improvement: To analyse usage patterns and technical performance in order to improve the bp9 platform and user experience.

5 Legal Bases for Processing

bp9 processes your personal data on the following legal bases:

• Contractual Necessity: Processing that is necessary to perform our contractual obligations to you under the Terms & Conditions, including Account management and service delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including gaming authority licensing requirements, AML obligations, and KYC verification requirements.
• Legitimate Interests: Processing for bp9's legitimate business interests, including fraud prevention, platform security, and service improvement, provided those interests are not overridden by your rights and interests.
• Consent: Where we rely on your consent for processing — particularly for marketing communications — you may withdraw that consent at any time by contacting bp9 support or updating your communication preferences within your Account settings.

6 Sharing Your Personal Data

bp9 does not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Processors: Financial institutions and payment service providers (including but not limited to those supporting Touch 'n Go eWallet, Boost, DuitNow, FPX, and card payment networks) for the processing of deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party identity verification services engaged to assist with age verification and document authentication.
• Game Providers: Game content providers (e.g., Evolution Gaming, Pragmatic Play, PG Soft) whose systems interact with your Account for the delivery of casino and slot games. These providers receive only the data necessary to operate the game session.
• IT and Infrastructure Providers: Cloud hosting, data storage, and platform technology providers engaged to support the operation of the bp9 platform.
• Fraud and AML Services: Third-party screening services used for sanctions checking, fraud detection, and anti-money laundering compliance.
• Regulatory Authorities: Applicable gaming regulatory authorities, law enforcement agencies, and courts where disclosure is required by law or licensing obligation.

7 International Data Transfers

The bp9 platform and certain of its service providers may operate infrastructure outside of Malaysia. Where personal data is transferred to countries that do not provide an equivalent level of data protection to that applicable in Malaysia, bp9 implements appropriate safeguards — including contractual protections — to ensure that such transfers are conducted in a manner consistent with applicable data protection requirements. If you have questions about international transfers of your personal data, please contact bp9 support.

8 Cookies and Tracking Technologies

bp9 uses cookies and similar tracking technologies on the bp9 platform. Cookies are small text files stored on your device that help us operate the platform and understand how it is used.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including maintaining your logged-in session and remembering your Account preferences. These cannot be disabled.
• Performance and Analytics Cookies: Used to collect anonymised data about how Players interact with the Platform, enabling us to identify and resolve usability issues and improve performance.
• Functionality Cookies: Allow the Platform to remember your preferences, such as language settings or display options, to provide a more personalised experience.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the bp9 platform. bp9 does not use third-party advertising cookies to serve advertisements on other websites.

9 Data Retention

bp9 retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, including any applicable regulatory retention obligations. Specifically:

• Account Data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in accordance with applicable gaming authority record-keeping requirements.
• Transaction Data: Financial transaction records are retained for a minimum of five (5) years following the transaction date for AML compliance purposes.
• KYC Documents: Identity verification documents are retained in accordance with applicable anti-money laundering regulations, typically for no less than five (5) years following the end of the business relationship.
• Support Records: Customer support interaction records are retained for a period of three (3) years following the interaction date.
• Marketing Preferences: Records of your marketing consent or opt-out are retained to demonstrate compliance with your preferences.

Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised.

10 Your Data Rights

Subject to applicable law and any overriding legitimate interests or legal obligations of bp9, you have the following rights in relation to your personal data:

• Right of Access: You may request a copy of the personal data bp9 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. You may also update certain Account details directly within your bp9 Account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to bp9's legal and regulatory retention obligations.
• Right to Restriction: You may request that bp9 restrict the processing of your personal data in certain circumstances, for example while a dispute regarding the accuracy of the data is being resolved.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing based on bp9's legitimate interests. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of the above rights, please contact bp9 support via live chat or email. bp9 will respond to rights requests within a reasonable timeframe and in any event within 30 days of receipt. bp9 may ask you to verify your identity before processing a rights request.

11 Children's Privacy

The bp9 platform is strictly intended for individuals aged 21 years and above. 21+ bp9 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted at Account registration and prior to the processing of any withdrawal. If bp9 becomes aware that personal data has been collected from an individual under 21, such data will be promptly deleted and the Account closed. If you believe that a minor may have accessed the bp9 platform or submitted personal data, please contact bp9 support immediately.

12 Security of Your Personal Data

bp9 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bp9 servers.
• Access controls limiting internal access to personal data on a strict need-to-know basis.
• Two-factor authentication (2FA) available to all Players for Account access.
• Regular security assessments and penetration testing of the bp9 platform.
• Contractual security requirements imposed on all third-party service providers.

Notwithstanding the above, no data transmission over the internet or data storage system can be guaranteed to be fully secure. If you have reason to believe that your interaction with bp9 is no longer secure, please contact bp9 support immediately.

13 Third-Party Links

The bp9 platform does not contain links to third-party websites for navigation or content purposes. Where references to third-party payment service providers, game providers, or responsible gaming resources appear on the platform, please be aware that those services operate under their own privacy policies and bp9 has no control over and accepts no responsibility for those policies or the data practices of those entities. Players are encouraged to review the privacy policies of any third-party services they interact with.

14 Amendments to This Policy

bp9 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, bp9 will provide notice to active Account holders via email to the registered address or via in-platform notification, a reasonable period before the changes take effect. The effective date of the current version is displayed at the top of this Policy. Your continued use of the bp9 platform following the effective date of any update constitutes your acknowledgement of the updated Policy.

15 Contact and Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by bp9, please contact our support team through the following channels: