BP9 Privacy Policy

This Privacy Policy (the "Policy") sets out the principles and practices governing the collection, processing, storage, and disclosure of personal data by BP9 (the "Operator", "we", "us", or "our") in connection with the operation of the online gaming and sports betting platform accessible at bp9.cam and any associated mobile or desktop interfaces (the "Platform").

BP9 is committed to handling personal data responsibly, transparently, and in compliance with the data protection standards mandated by our international gaming licence. This Policy applies to all persons who register an account, visit, or otherwise interact with the Platform, including Malaysian-based players ("Players", "you", or "your").

By accessing the Platform or creating a BP9 account, you acknowledge that you have read and understood this Policy, and you consent to the data practices described herein to the extent required by applicable law. If you do not consent, you should not use the Platform or provide us with your personal data.

For the purposes of this Policy, the following terms have the meanings specified below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, date of birth, email address, phone number, financial data, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, deletion, or any combination thereof.
• "Data Subject" means the natural person to whom Personal Data relates — in this context, a BP9 Player or website visitor.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this context, the BP9 Operator.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under a contractual arrangement.
• "KYC" (Know Your Customer) means the identity and age-verification procedures required by our licensing authority prior to the processing of withdrawal requests.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the Processing of Personal Data for a stated purpose.
• "Retention Period" means the duration for which BP9 stores a category of Personal Data before it is securely deleted or anonymised.

BP9 collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The following table sets out the primary data categories and specific data points collected:

BP9 collects Personal Data through the following means:

Direct Collection

Data you actively provide to us, including information submitted during account registration, KYC document uploads, deposit and withdrawal requests, support conversations, feedback surveys, and marketing consent selections.

Automated Collection

Data collected automatically when you interact with the Platform, including through cookies, server logs, and session tracking technologies. This includes your IP address, device identifiers, pages visited, and click-path behaviour. See Section 9 (Cookies & Technologies) for details.

Third-Party Sources

In limited circumstances, BP9 may receive data from third-party sources to supplement our records, including:

• Payment processors (e.g., Maybank, CIMB Clicks, DuitNow, FPX, Touch 'n Go eWallet) — for transaction confirmation and fraud screening
• Identity verification services — for KYC document validation
• Fraud prevention and anti-money laundering screening databases — as required under our licence compliance obligations

BP9 processes Personal Data only for defined, legitimate purposes. The following table summarises our processing activities, the specific purposes, and the applicable legal basis:

BP9 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as a general framework:

• Account and Identity Data: Retained for the duration of the active account, plus a minimum of five (5) years following account closure, in accordance with anti-money laundering and licence compliance record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• KYC Documents: Retained for five (5) years post account closure, or longer if required by a specific regulatory investigation.
• Support Communications: Retained for three (3) years from the date of the interaction.
• Marketing Preferences and Consent Records: Retained until consent is withdrawn, plus a reasonable period thereafter to evidence the prior consent.
• Technical and Session Data: Retained for up to thirteen (13) months from collection.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data is no longer Personal Data and may be retained indefinitely for aggregate statistical analysis.

BP9 does not sell, rent, or commercially transfer your Personal Data to unaffiliated third parties. We may share Personal Data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Processors: Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency network processors — to facilitate deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and document verification services engaged to validate identity documents submitted during account verification.
• Fraud Prevention and AML Screening Services: Industry-standard databases and screening providers used to identify high-risk transactions or politically exposed persons.
• Licensing Authority: Our international gaming regulator, as required under the terms of our operating licence, including in response to regulatory audits or investigations.
• Legal and Compliance Advisers: Solicitors, accountants, and compliance consultants engaged by BP9 who require access to specific data to provide professional services.
• Law Enforcement and Government Authorities: Where BP9 is compelled by a valid court order, statutory notice, or equivalent legal instrument to disclose data to a public authority.
• IT Infrastructure Providers: Cloud hosting providers and platform technology vendors who host or process data on BP9's behalf, under binding data processing agreements.

As an internationally licensed platform serving players in Malaysia, BP9's data infrastructure may involve the transfer of Personal Data to countries outside Malaysia. This includes transfers to servers hosted in jurisdictions where BP9's operational and technical infrastructure is located.

Where Personal Data is transferred internationally, BP9 ensures that appropriate safeguards are in place to protect it, including:

• Contractual clauses between BP9 and recipient entities that impose equivalent data protection obligations
• Selection of vendors and processors in jurisdictions recognised as having adequate data protection frameworks
• Encryption of data in transit and at rest for all cross-border transfers

Malaysian players should be aware that while BP9 implements these safeguards, the data protection laws of the destination jurisdiction may differ from those applicable in Malaysia. By using the Platform, you acknowledge and consent to these international transfers subject to the protections described above.

BP9 uses cookies and similar tracking technologies on the Platform to support functionality, security, and analytics. The following categories of cookies are in use:

Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your login session, preserve your account settings across pages, and support security features such as CSRF protection. These cookies cannot be disabled without breaking core Platform functionality.

Performance & Analytics Cookies

These cookies collect anonymised information about how visitors use the Platform — which pages are visited most frequently, error messages encountered, and session duration patterns. This data is used exclusively to improve Platform performance and user experience. No personally identifiable data is captured in analytics cookies.

Functional Cookies

These cookies remember preferences you have set, such as your preferred language for support communications or your time-zone display preference. They are not strictly necessary but improve your experience.

Marketing & Targeting Cookies

BP9 does not use third-party advertising or retargeting cookies. No data from the BP9 Platform is shared with advertising networks to build behavioural profiles for cross-site advertising.

BP9 will only send promotional and marketing communications — including bonus offers, platform news, and event notifications — to Players who have expressly opted in to receive them during registration or via their account settings.

You may withdraw your marketing consent at any time by:

• Updating your communication preferences in your account settings panel
• Clicking the "unsubscribe" link included in any marketing email
• Contacting support at [email protected] with a written unsubscribe request

Withdrawal of marketing consent does not affect the lawfulness of any communications sent prior to the withdrawal. Operational account communications — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — are not marketing communications and will continue to be sent regardless of marketing consent status, as they are necessary for the operation of your account.

The BP9 Platform is strictly for individuals aged 21 years and above. BP9 does not knowingly collect, store, or process Personal Data from any individual under the age of 21.

If BP9 discovers or reasonably suspects that Personal Data has been submitted by or on behalf of a person under 21 years of age, the associated account will be immediately suspended, all funds held in the account will be subject to forfeiture review, and the Personal Data will be deleted or anonymised as promptly as technically feasible.

Subject to applicable law and the Retention obligations described in Section 6, BP9 recognises the following data subject rights and will honour verified requests within a reasonable timeframe (typically 30 calendar days):

To exercise any of the above rights, please submit a written request to [email protected] from the email address registered to your BP9 account. We may require proof of identity before processing your request to ensure we do not disclose data to an unauthorised party.

BP9 implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Specific measures in place include:

• Encryption in Transit: All data exchanged between your browser or device and the BP9 Platform is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive Personal Data stored in BP9's databases is encrypted using AES-256 or equivalent standards.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff accessing player data are subject to confidentiality obligations and regular security training.
• Network Security: BP9's infrastructure is protected by firewalls, intrusion detection systems, and continuous monitoring for unusual activity patterns.
• Incident Response: BP9 maintains a documented data breach response plan. In the event of a breach likely to result in a risk to the rights and freedoms of affected individuals, BP9 will notify the relevant regulatory authority and affected Players within the timeframes required by applicable law.

BP9 reviews this Privacy Policy periodically and reserves the right to update or modify it at any time to reflect changes in our data practices, applicable legal requirements, or operational developments. The "Last Reviewed" date at the top of this page will be updated whenever changes are made.

Where a proposed change materially affects your privacy rights or the way in which we process your Personal Data, BP9 will provide advance notice via a platform banner notification or email to your registered address, at least seven (7) calendar days prior to the change taking effect.

Continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree with the revised Policy, you should cease using the Platform and request account closure.

For any questions, requests, or concerns relating to this Privacy Policy or BP9's data practices, please contact us through the following channels:

• Email (Data Enquiries): [email protected] — please include "Privacy Request" in the subject line
• Live Chat: Available on-platform, 24 hours a day, 7 days a week, in English, Mandarin, and Bahasa Melayu
• Response Time: Privacy-related enquiries are acknowledged within 5 business days and responded to within 30 calendar days of receipt

If you believe that BP9 has processed your Personal Data in a manner inconsistent with this Policy or applicable data protection law, you have the right to lodge a complaint. BP9 requests that you first contact us directly to attempt an informal resolution. If you remain dissatisfied following BP9's response, you may escalate the matter to the data protection supervisory authority applicable under our licensing framework.