Privacy Policy bp99c — Your Data Protection

Bp99c ("we", "our platform") is an online casino platform operating under an official licence and fully committed to protecting the privacy of every user. This Privacy Policy clearly explains how we handle your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards.

By registering, accessing, or using any bp99c service, you agree that your personal data will be processed in accordance with the terms set out in this document. If you do not agree with any part of this policy, you should not continue using our platform.

This document is written in Bahasa Melayu as the primary language. In the event of any inconsistency between a translation in another language and this Bahasa Melayu version, the Bahasa Melayu version shall prevail and be binding.

Bp99c collects your personal data through several key channels: during account registration, during active use of the platform, during the KYC verification process, and automatically through industry-standard tracking technologies.

Information you provide directly:

• Full name as it appears on official identification documents.
• Date of birth for minimum age verification of 18 years.
• An active email address and mobile number registered in your name.
• Copy of identification card, passport or driving licence for the KYC process.
• Bank account or e-wallet details (TNG, GrabPay, Boost) for processing deposits and withdrawals.
• Current residential address, if required for further verification purposes.

Information collected automatically:

• Your IP address, device type, operating system, and browser version.
• Login history including timestamps, approximate location, and authentication method.
• Gaming activity data such as games played, total bets placed, and session duration.
• Cookie data and device identifiers stored in your browser.

Every piece of data we collect has a clear and legitimate purpose. bp99c uses your personal data solely for the following purposes and nothing beyond that:

• Identity verification and KYC — ensuring every account belongs to a verified individual aged 18 and above.
• Account management — allowing you to log in, manage your profile, change your password, and access all platform features.
• Financial processing — processing deposits, withdrawals, and transaction history tracking accurately and securely.
• Service communications — sending important account notices, security updates, transaction confirmations, and support responses.
• Security and fraud prevention — monitoring suspicious activity, preventing unauthorised access, and protecting the integrity of the platform.
• Legal compliance — fulfilling reporting obligations to regulatory authorities when required by law.
• Product improvement — analysing usage patterns on an aggregated and anonymised basis to improve platform features and the user experience.
• Marketing communications — sending promotional information and special offers, subject to your consent which may be withdrawn at any time.

We will not use your data for any purpose not listed above without first obtaining your fresh consent.

Bp99c processes your personal data on valid legal bases under Malaysia's Personal Data Protection Act 2010. The applicable legal basis for each category of processing is as follows:

• Contract performance — processing required to deliver the services you request, such as account management and payment processing.
• Consent — for marketing communications and certain cookie usage, where you have given explicit consent that may be withdrawn at any time.
• Legitimate interests — for fraud prevention, platform security, and service improvement purposes where our legitimate interests do not override your fundamental rights.
• Legal obligations — processing required to comply with anti-money laundering laws (AMLA), mandatory KYC requirements, and regulatory authority directives.

Bp99c does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, we may share your data in the following limited circumstances:

• Approved service providers — third parties that help us run platform operations, such as payment processors (FPX, TNG, GrabPay), KYC service providers, and cloud infrastructure providers — all bound by strict confidentiality agreements.
• Game provider partners — casino and Live Casino software providers that supply content on the bp99c platform, within the limited scope required to run the games.
• Authorities and regulatory bodies — when required by law, court order, or a valid request from a law enforcement agency.
• Business transfers — if bp99c is involved in a merger, acquisition, or asset transfer, your data may be transferred as part of that transaction, with appropriate notice provided to you.

Every third party we work with is required to meet the same or higher data protection standards that we ourselves practise. We are not responsible for the privacy practices of third parties operating outside our direct control.

Bp99c uses enterprise-grade security infrastructure to protect your personal data from unauthorised access, breaches, or misuse. The key protective measures we implement include:

• Data encryption in transit using 256-bit SSL/TLS protocols.
• Encryption at rest for all document files and sensitive financial data.
• Role-based access control (RBAC) ensuring that only authorised personnel can access specific data.
• 24/7 security monitoring with automated intrusion detection systems.
• Regular data backups to geographically separate data centres to ensure service continuity.
• Penetration testing conducted periodically by independent third parties.

Data retention period: Active account data is retained for as long as your account remains active. Upon account closure, your data is kept for the minimum period required by applicable law — typically between 5 and 7 years — before being permanently deleted or anonymised.

As a data subject, you have certain rights regarding your personal data held by bp99c. We fully respect and facilitate the exercise of these rights:

To submit any request related to the rights above, contact our privacy team via Live Chat or the email address listed at the bottom of this page. We will process your request within 30 calendar days. Some requests may require additional identity verification before they can be processed.

Bp99c uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored in your browser when you visit our website.

Types of cookies we use:

• Essential Cookies — required for core platform functions such as login session authentication and security. These cookies cannot be disabled as they are critical to platform operations.
• Performance Cookies — collecting information about how you use the platform (for example, frequently visited pages) to help us improve website performance.
• Functional Cookies — remembering your preferences such as language, display settings, and login details to make repeat visits easier.
• Analytics Cookies — used with analytics tools such as Google Analytics to understand traffic and usage patterns on an aggregated and anonymised basis.

You can manage your cookie settings through your browser at any time. Disabling certain cookies may affect the functionality of some parts of the bp99c platform. For more information on managing cookies in your browser, refer to your browser's help documentation.

As a globally operating online platform, bp99c may transfer your personal data to countries outside Malaysia for processing or storage purposes. This occurs primarily when we use cloud service providers or technical infrastructure operating across multiple locations.

Every cross-border data transfer we carry out is subject to adequate safeguards, including:

• Binding data processing agreements (DPA) with all third-party service providers.
• Use of Standard Contractual Clauses (SCCs) recognised by international regulatory bodies.
• Transfers only to countries recognised as providing an adequate level of data protection.
• Data protection impact assessments (DPIA) for high-risk transfers.

The bp99c platform is exclusively for adults aged 18 and above. We do not knowingly collect, store or process any personal data belonging to individuals under the age of 18.

If we discover that a child's personal data has been collected without proper age verification, we will take immediate action to delete that data and close the associated account. Parents or guardians who suspect their child has registered a bp99c account are encouraged to contact our support team immediately for resolution.

Bp99c reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments. The "Last Updated" date at the top of this document will be revised whenever changes are made.

For material changes — that is, changes that significantly affect how we use your data — we will provide you with appropriate notice through:

• An email to your registered address at least 14 days before the changes take effect.
• A prominent notice on the platform's home page throughout the duration of the notification period.
• An in-account notification when you log in to the bp99c platform.

Continued use of the bp99c platform after any policy changes take effect will be considered your acceptance of the updated Privacy Policy. If you disagree with the changes, you have the right to close your account before they come into effect.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact bp99c's Data Protection Officer (DPO) through the following channels:

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom corner of the platform.

We are committed to responding to all privacy-related inquiries within 5 business days. For more complex complaints requiring detailed investigation, we will update you on the progress within 30 calendar days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Malaysian Personal Data Protection Commissioner or the relevant data protection authority in your country.