Privacy Policy

1. Introduction

1.1 This Privacy Policy applies to all personal data processed by bp99.asia in connection with the provision of its online gambling services, including the bp99 Sportsbook, bp99 Casino, Slots, Lucky Dice, EPL Betting, and all associated account, payment, promotional, and support services accessible via bp99.asia.

1.2 By registering a bp99 account, accessing the bp99 website, or using any bp99 service, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. Where consent is the lawful basis for processing, you may withdraw that consent at any time by contacting bp99 support; however, withdrawal will not affect the lawfulness of processing carried out prior to withdrawal.

1.3 This Privacy Policy should be read in conjunction with the bp99 Terms and Conditions, which govern the overall relationship between bp99 and its Members.

2. Data Controller

2.1 bp99.asia is the data controller for personal data collected through the bp99 platform. As data controller, bp99 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully and transparently.

2.2 bp99 operates under an international gaming authority licence. Our licensing obligations include data protection requirements that complement and supplement the obligations set out in this Policy.

2.3 For all data protection enquiries, please contact: support at bp99.asia (plain text — not a clickable link). bp99's data protection team aims to respond to all enquiries within 10 business days.

3. Personal Data We Collect

3.1 bp99 collects the following categories of personal data from Members and website visitors:

3.1.1 Identity Data

• Full legal name;
• Date of birth;
• Malaysian NRIC number or passport number (collected as part of KYC verification);
• Photographs of identity documents where submitted for KYC purposes.

3.1.2 Contact Data

• Email address;
• Malaysian mobile phone number;
• Residential address (required for full KYC verification and regulatory compliance).

3.1.3 Financial Data

• Payment method details — for eWallet methods (Touch n Go eWallet, Boost): registered phone number; for bank transfer methods (Maybank, CIMB, Public Bank): bank account number; for cryptocurrency: wallet address;
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used;
• Account balance information.

3.1.4 Gambling Activity Data

• Bet history — sports bets, casino game sessions, slot play history, Lucky Dice rounds;
• Win and loss records;
• Bonus and promotion usage history;
• Responsible gaming settings applied to your account (deposit limits, loss limits, self-exclusion status).

3.1.5 Technical Data

• IP address;
• Device type, operating system, and browser version;
• Session duration and login timestamps;
• Cookies and similar tracking technologies (see Section 10).

3.1.6 Communications Data

• Live chat transcripts;
• Email correspondence with bp99 support;
• Records of complaints or disputes submitted to bp99.

3.2 bp99 does not collect sensitive personal data (also referred to as special category data) such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where strictly required for identity verification under anti-money laundering (AML) obligations, and then only to the minimum extent necessary.

4. How We Collect Your Data

4.1 bp99 collects personal data through the following means:

• Direct collection — data you provide when registering a bp99 account, completing KYC verification, making deposits or withdrawals, participating in promotions, or contacting bp99 support;
• Automated collection — technical data collected automatically when you access the bp99 website or use bp99 services, including through cookies, log files, and session tracking;
• Third-party sources — identity verification agencies engaged for KYC and AML compliance; payment processors including Touch n Go eWallet, Boost, and banking partners; game providers who supply data relating to your in-game activity on their certified platforms; and fraud prevention databases.

5. Lawful Basis for Processing

5.1 bp99 processes personal data only where one or more of the following lawful bases applies:

• Contract performance — processing necessary to provide bp99 services under the Member Agreement (Terms and Conditions), including account management, bet settlement, payment processing, and customer support;
• Legal obligation — processing required to comply with bp99's obligations under its gaming licence, anti-money laundering regulations, and other applicable law, including KYC verification, transaction monitoring, and regulatory reporting;
• Legitimate interests — processing necessary for bp99's legitimate business interests, including fraud prevention, security monitoring, platform improvement, and responsible gaming compliance, provided such interests are not overridden by your privacy rights;
• Consent — processing based on your freely given, specific, and informed consent, principally for marketing communications. You may withdraw consent for marketing at any time.

6. How We Use Your Personal Data

6.1 bp99 uses your personal data for the following purposes:

• To create and maintain your bp99 account and verify your identity and age (21+) at registration and on an ongoing basis;
• To process deposits, settle bets and game outcomes, and process withdrawal requests in MYR to your verified payment method;
• To administer promotions, bonuses, and loyalty programmes applicable to your bp99 account;
• To provide customer support through live chat and email, and to maintain records of those interactions;
• To monitor your account for unusual activity, fraud, collusion, bonus abuse, or match-fixing as required by our licensing obligations and legitimate security interests;
• To fulfil bp99's AML obligations, including transaction monitoring and reporting to relevant authorities where required by law;
• To implement and monitor responsible gaming measures including deposit limits, loss limits, session reminders, and self-exclusion;
• To send you service communications including transaction confirmations, security alerts, and material changes to bp99's terms or policies;
• To send you marketing communications about bp99 promotions, new games, and offers — only where you have given consent or where permitted under applicable law, and only in relation to bp99's own services;
• To analyse platform usage data in aggregate to improve bp99's products, performance, and user experience;
• To comply with orders, directives, or requests from courts, regulators, or law enforcement authorities.

7. Sharing Your Personal Data

7.1 bp99 does not sell, rent, or trade your personal data to any third party for marketing purposes.

7.2 bp99 may share your personal data with the following categories of recipients, strictly to the extent necessary for the purposes described in this Policy:

• Payment processors — Touch n Go eWallet, Boost, Malaysian banking partners (Maybank, CIMB, Public Bank), and cryptocurrency payment processors, for the purpose of processing deposits and withdrawals;
• Identity verification and AML service providers — third-party KYC and fraud prevention agencies engaged to verify Member identities, screen against sanctions lists, and perform AML transaction monitoring;
• Game providers — licensed game studios and live casino operators who provide games accessible through the bp99 platform, to the extent necessary to facilitate gameplay and resolve disputes;
• IT and infrastructure providers — cloud hosting, CDN, and cybersecurity service providers engaged by bp99 under contractual data processing agreements that bind them to the same data protection standards;
• Regulatory and law enforcement authorities — bp99's gaming licensing authority, Malaysian or international financial intelligence units, and law enforcement agencies, where disclosure is required by applicable law or a valid legal order;
• Professional advisers — lawyers, accountants, and auditors engaged by bp99, bound by professional confidentiality obligations.

7.3 Where bp99 shares data with third-party data processors, bp99 ensures that contractual safeguards are in place requiring those processors to handle data securely and only for the purposes specified.

8. International Data Transfers

8.1 bp99 is operated under an international gaming authority licence, and some of bp99's service providers and data processors may be located outside Malaysia. Where personal data is transferred to a recipient in a country that does not provide an equivalent level of data protection, bp99 will implement appropriate safeguards — such as standard contractual clauses or binding processor agreements — to ensure your data remains protected to the standard described in this Policy.

8.2 bp99 will not transfer your personal data to any jurisdiction that is subject to a binding financial sanctions regime applicable to bp99's licensing authority without first ensuring that the transfer is permitted under applicable law and accompanied by all required protective measures.

9. Data Retention

9.1 bp99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by our licensing and regulatory obligations. The following indicative retention periods apply:

• Account and identity data — retained for the duration of your bp99 membership and for a minimum of 5 years following account closure, to meet AML and gaming regulatory record-keeping obligations;
• Transaction and gambling activity data — retained for a minimum of 5 years following each transaction or bet, in accordance with financial record-keeping requirements under bp99's licence;
• Support communications — retained for 3 years from the date of the communication;
• Marketing consent records — retained for 3 years from the date of consent or from the date of last interaction, whichever is later;
• Technical and log data — retained for 12 months from collection.

9.2 Where personal data is retained beyond the periods above due to an ongoing legal dispute, regulatory investigation, or licensing obligation, that data will be retained until those proceedings are concluded and any further retention obligations have expired.

9.3 Upon expiry of the applicable retention period, bp99 will securely delete or anonymise your personal data so that it can no longer be associated with you as an individual.

10. Cookies & Tracking Technologies

10.1 bp99.asia uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly necessary cookies — essential for the operation of the bp99 website, including maintaining your login session and security tokens. These cookies cannot be disabled without affecting the functionality of the platform;
• Performance and analytics cookies — used to collect anonymous aggregate information about how visitors use bp99.asia, enabling bp99 to identify areas of improvement. No personally identifiable information is included in analytics data;
• Functionality cookies — used to remember your preferences (such as language or display settings) to provide a more personalised experience on bp99;
• Security cookies — used to support bp99's fraud detection and account security systems, including detecting unusual login patterns and preventing cross-site request forgery.

10.2 bp99 does not use third-party advertising cookies or permit external advertising networks to place cookies on bp99.asia.

10.3 You may control cookie settings through your browser. Disabling strictly necessary cookies will impair the functionality of the bp99 platform. Disabling performance or functionality cookies will not prevent you from using bp99 but may affect your experience.

11. Security Measures

11.1 bp99 implements technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and bp99's servers;
• Encryption of passwords and sensitive data at rest using industry-standard hashing algorithms;
• Role-based access controls limiting bp99 staff access to personal data to those with a legitimate operational need;
• Regular security audits and penetration testing of the bp99 platform;
• Intrusion detection systems and real-time monitoring of platform activity;
• Two-factor authentication (2FA) available for all Member accounts and mandatory for bp99 administrative access.

11.2 No method of data transmission over the internet or electronic storage is completely secure. While bp99 takes all reasonable precautions, absolute security cannot be guaranteed. In the event of a data breach affecting your personal data, bp99 will notify affected Members and relevant regulatory authorities in accordance with applicable law.

12. Your Rights

12.1 Subject to applicable data protection law and bp99's licensing obligations, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data bp99 holds about you;
• Right to rectification — you may request correction of inaccurate or incomplete personal data;
• Right to erasure — you may request deletion of your personal data in certain circumstances (noting that bp99's regulatory retention obligations may prevent immediate deletion);
• Right to restriction of processing — you may request that bp99 restrict the processing of your data in certain circumstances;
• Right to data portability — where processing is based on consent or contract, you may request a copy of your data in a structured, machine-readable format;
• Right to object — you may object to processing based on legitimate interests, including profiling for marketing purposes;
• Right to withdraw consent — where processing is based on consent, you may withdraw consent at any time without affecting prior processing.

12.2 To exercise any of the above rights, please contact bp99 at: support at bp99.asia. bp99 will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case you will be notified.

12.3 bp99 reserves the right to refuse requests that are manifestly unfounded, excessive, or that would conflict with bp99's legal obligations under its gaming licence or applicable AML law.

13. Children's Privacy

13.1 Age verification is a mandatory step in the bp99 registration and KYC process. bp99 takes all reasonable technical and procedural steps to prevent access by persons under 21, consistent with its responsible gaming obligations under the bp99 licence.

13.2 If you believe a minor has registered on bp99 or has been exposed to bp99 content, please contact bp99 support immediately so that appropriate action can be taken without delay.

14. Marketing Communications

14.1 bp99 may send you marketing communications about bp99 promotions, new games, special offers, and platform updates by email or SMS, subject to the following conditions:

• You have given your express consent to receive marketing communications from bp99 at the time of registration or subsequently through your account settings;
• You have not withdrawn that consent or opted out of marketing communications.

14.2 You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any bp99 marketing email;
• Updating your communication preferences in your bp99 account settings; or
• Contacting bp99 support and requesting removal from marketing lists.

14.3 Opting out of marketing communications will not affect service communications — bp99 will continue to send you transactional messages required for the operation of your account, including deposit confirmations, withdrawal notifications, and security alerts.

14.4 bp99 will not share your contact details with third-party marketers or permit any third party to send you marketing communications using data provided to bp99.

15. Changes to this Privacy Policy

15.1 bp99 reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, applicable law, or bp99's services. When material changes are made, bp99 will notify affected Members by email to the registered address and by a prominent notice on the bp99 website, not less than 14 days prior to the changes taking effect.

15.2 The "Last Updated" date at the top of this Policy indicates when it was most recently revised. bp99 encourages Members to review this Policy periodically. Continued use of bp99 services after the effective date of a revised Policy constitutes acceptance of the changes.

16. Contact Us

16.1 For any questions, concerns, or requests relating to this Privacy Policy or bp99's data processing practices, please contact the bp99 data protection team through the following channels:

• Live Chat: Available 24/7 on bp99.asia — fastest response channel
• Email: support at bp99.asia with the subject line "Privacy Policy Enquiry"
• Response Time: Live chat immediate; email within 10 business days

16.2 bp99 takes all privacy enquiries seriously. Where you are not satisfied with bp99's response to a data protection concern, you have the right to escalate the matter to the relevant data protection supervisory authority or to bp99's licensing authority's dispute resolution process.