Privacy Policy BP9 – Protection of Malaysian Members' Personal Data

1Introduction & Scope of BP9's Privacy Policy

BP9 is an online entertainment and betting platform operating in Malaysia at bp9-jit.com. As a responsible platform operator, BP9 is committed to protecting the privacy and personal data of all members who use our services.

This Privacy Policy applies to all personal information we collect from or about you when you register, access or use the BP9 platform — including the website, mobile application (if applicable) and all related services. It also applies to communications you have with the BP9 support team.

BP9's processing of personal data complies with Malaysia's Personal Data Protection Act 2010 (PDPA) and other applicable data protection laws. We ensure that all data processing has a valid legal basis, whether that is member consent, contractual necessity, BP9's legitimate interests or legal obligations applicable to our operations.

2Types of Personal Data Collected by BP9

BP9 collects several categories of personal data from members in Malaysia for legitimate platform operations. Below is a summary of the data types collected and their purposes:

BP9 only collects data that is strictly necessary for the stated purposes. We do not collect sensitive data such as health information, religious beliefs or political views unless required by applicable law for specific purposes such as responsible gambling assessments.

3How BP9 Uses Members' Personal Data

Personal data collected by BP9 is used for the following purposes, all grounded in a valid legal basis:

• Account Management: Creating and managing your BP9 account, processing registrations, verifying identity, and granting access to platform services.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay, or FPX, and managing winnings withdrawals in Malaysian Ringgit (MYR).
• Service Delivery: Lets you play online slots, Live Casino, Poker, lottery, Malaysia Super League Sports Betting, and e-sports on the BP9 platform.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, multi-accounting, collusion in poker, and money laundering attempts that could compromise the BP9 platform.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and providing appropriate support to members in need through BP9's responsible gaming programme.
• Service Communications: Sending important account-related notifications, transaction confirmations, security alerts, and relevant BP9 service updates.
• Marketing (With Consent): Sending promotional information, bonuses and the latest BP9 offers to members who have given their consent to receive marketing communications.
• Legal Compliance: Comply with applicable legal obligations, including KYC, AML and reporting requirements mandated by the relevant Malaysian authorities.

BP9 will not use members' personal data for any purpose not stated in this Privacy Policy without first obtaining additional consent from the member concerned.

4Sharing of BP9 Members' Personal Data

BP9 does not sell, rent or trade member personal data to any third party for marketing or commercial purposes. Member personal data is shared only in the following limited circumstances:

• BP9 Service Providers: Third parties that assist BP9 in platform operations — such as technology infrastructure providers, Malaysian payment processors, and game providers — receive only the data necessary to deliver their services. They are bound by strict confidentiality agreements and are not permitted to use the data for any other purpose.
• Legal Authorities: BP9 will disclose member personal data to law enforcement agencies, regulatory authorities, or courts when required by applicable Malaysian law or a valid court order.
• Anti-Money Laundering Compliance: In cases required under Malaysia's AML laws, BP9 may be obligated to report suspicious transactions to the relevant authorities without providing prior notice to the member involved.
• Member Consent: In circumstances not described above, BP9 will only share member personal data with third parties after obtaining explicit consent from the member concerned.

5Personal Data Security on the BP9 Platform

BP9 takes the security of members' personal data very seriously and implements a range of technical and organisational measures to protect data against unauthorised access, loss, destruction or disclosure:

• Encryption in Transit: All data transmitted between your device and BP9's servers is protected by 256-bit TLS/SSL encryption. This ensures your personal data and payment information cannot be intercepted by third parties while in transit.
• Storage Encryption: Sensitive data stored in BP9's systems is encrypted to industry standards, ensuring it remains unreadable even to unauthorised BP9 staff.
• Layered Access Controls: Access to BP9 member personal data is governed by a tiered authorisation system. Only staff with a legitimate business need may access data, and all access is logged for audit purposes.
• 24/7 Monitoring: BP9's security systems continuously monitor platform activity to detect threats, intrusion attempts and suspicious behaviour that could put member data at risk.
• Regular Security Audits: BP9 undergoes periodic independent security audits conducted by qualified third parties to identify and address any security vulnerabilities before they can be exploited.
• Staff Training: All BP9 staff who handle member personal data receive comprehensive data protection training and are bound by strict confidentiality policies.

While BP9 takes all reasonable steps to protect member personal data, no security system is completely foolproof. Members also play an important role in safeguarding their own accounts — use a strong password, do not share your login credentials and log out of your BP9 account when using a shared device.

6BP9 Personal Data Retention Period

BP9 retains members' personal data only for as long as necessary for the stated purposes or as required by applicable law. The general data retention guidelines are as follows:

• Active Account Data: For as long as your BP9 account remains active and for a reasonable period following account closure to allow for the resolution of any outstanding claims or disputes.
• Financial Transaction Records: Minimum 7 years from the date of transaction, in line with applicable Malaysian accounting and AML legal requirements.
• KYC & Identity Verification Records: For the duration of the active account and a minimum of 5 years after account closure, in line with applicable legal compliance requirements.
• Gaming & Betting History: For the duration the account remains active and for BP9's required internal audit period. This data may be anonymised for statistical analysis purposes.
• Support Communication Logs: Up to 3 years from the date of last communication, for service reference and dispute resolution purposes.

When personal data is no longer needed, BP9 will delete or anonymise it in accordance with secure data management procedures. Members may request deletion of their personal data, subject to mandatory retention requirements under Malaysian law.

7Cookies & Tracking Technologies on BP9

The BP9 platform uses cookies and similar technologies to enhance the user experience and ensure the platform functions properly. Below are the types of cookies used by BP9:

• Essential Cookies (Required): Required for core BP9 platform functions — such as maintaining your login session, remembering your language preference, and ensuring payment processes run securely. These cookies cannot be disabled without affecting essential platform functionality.
• Performance & Analytics Cookies: Used to understand how members use the BP9 platform — most frequently visited pages, time spent and navigation patterns. This information helps BP9 improve the overall user experience. Data is collected in aggregate form and does not identify individual members.
• Functional Cookies: Remembering your preferences on the BP9 platform — such as display settings, favourite game selections and language preferences — so you don't have to reconfigure them each time you log in.
• Security Cookies: Helping BP9 detect suspicious activity, prevent fraud, and protect member accounts from unauthorised access.

Most web browsers allow you to manage cookies through their settings. However, disabling certain cookies may affect the functionality of the BP9 platform and your overall gaming experience.

8BP9 Members' Rights Regarding Personal Data

As a BP9 member and data subject under the Malaysian PDPA, you have the following rights regarding your personal data processed by BP9:

• Right of Access: You have the right to request a copy of the personal data we hold about you in BP9's systems. Such requests will be processed within 21 business days from the date a completed request is received.
• Right to Rectification: If any personal data BP9 holds about you is inaccurate, incomplete, or out of date, you have the right to request a correction. Basic data such as your phone number and email address can be updated directly through your BP9 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data from BP9's systems. This right is subject to mandatory retention obligations required by law — for example, financial transaction records must be retained for a specified period under Malaysian law.
• Right to Object: You have the right to object to BP9's processing of your personal data for direct marketing purposes. Once your objection is received, BP9 will immediately stop using your data for marketing.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing carried out before the withdrawal.
• Right to Complain: If you believe that BP9 has not complied with this Privacy Policy or Malaysia's PDPA, you have the right to first raise a complaint with BP9. If you are not satisfied with our response, you may also file a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the above rights, please contact the BP9 support team by email at support@bp9-jit.com or via live chat within the platform. Please include your full name and BP9 account number to facilitate the identity verification process before your request is handled.

9Child Data Protection

The BP9 platform is strictly for adults aged 18 and above. BP9 does not knowingly collect or process personal data of children under 18.

If BP9 determines that personal data belonging to a person under the age of 18 has been collected without proper age verification, we will take immediate steps to delete that data and close the relevant account.

10Cross-Border Personal Data Transfers

In operating the BP9 platform, member personal data may need to be transferred to servers or systems located outside Malaysia — for example, to facilitate international payment processing or to use cloud infrastructure services hosted abroad.

When such data transfers occur, BP9 ensures that:

• The recipient country or entity provides a level of data protection equivalent to or higher than that required under Malaysia's PDPA.
• Appropriate data transfer agreements have been put in place with recipients to ensure that BP9 member personal data remains adequately protected.
• All data transfers comply with applicable Malaysian legal requirements governing the cross-border transfer of personal data.

For more information on cross-border data transfers carried out by BP9, please contact our support team.

11Changes to BP9's Privacy Policy

BP9 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or the services we offer to members in Malaysia.

When material changes are made to this Privacy Policy, BP9 will notify members via:

• A clear notification on the BP9 platform upon your next login
• Email to the member's registered address for significant changes
• Update the "Last Updated" date at the top of this Privacy Policy

Your continued use of the BP9 platform after any changes to this Privacy Policy take effect will be considered acceptance of the updated policy. If you do not agree with the changes, you have the right to stop using the BP9 platform and request closure of your account.

12Contact BP9 for Privacy Enquiries

If you have any questions, concerns or complaints regarding BP9's Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Privacy Email: support@bp9-jit.com — label the email subject as "Data Privacy Enquiry" to ensure it is prioritised by the relevant team
• Live Chat: Available 24 hours a day within the BP9 platform — average response time under 2 minutes
• WhatsApp: For urgent enquiries regarding privacy and BP9 account security

BP9's support team operates 24 hours a day, 7 days a week in Bahasa Melayu, English and Mandarin. For more formal data privacy enquiries, we are committed to responding within 3 business days from the date a completed request is received.