BP9 Privacy Policy — Our Commitment to Protecting Malaysian Players' Data

Welcome to BP9's Privacy Policy. This document explains how BP9 ("we," "the company," or "the platform") collects, uses, processes, stores, and protects your personal information when you use our online casino and Sports Betting platform, accessible at bp9-bangla.com.

BP9 is committed to protecting the privacy of all our Malaysian players. We understand that when you register and use our platform, you are entrusting us with sensitive personal information — and we take that trust seriously. This Privacy Policy is written in plain, straightforward language so you know exactly what happens to your information.

This Privacy Policy applies to all users of the BP9 platform, including registered players, website visitors, and anyone who interacts with BP9 services in any capacity. By using the BP9 platform, you agree to the collection and use of your personal information as described in this document.

If you have any questions, concerns, or requests relating to the privacy and protection of your personal data at BP9, you may contact us through the communication channels listed at the end of this document. We will endeavour to respond to all privacy enquiries within 3 business days.

BP9 collects personal information necessary to provide our platform services safely and efficiently. The following are the categories of data we may collect:

BP9 only collects data required for the purposes stated in this document, in line with the principle of data minimisation. We do not collect sensitive personal data such as medical information, political views, or religious beliefs unless specifically required by law.

BP9 uses the personal data we collect for legitimate and transparent purposes. Below is a full list of how your data may be used:

• Account Management: Creating, verifying, and managing your BP9 account, including the KYC process and identity verification
• Transaction Processing: Processing deposits and withdrawals via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, FPX, Maybank2u, and CIMB Clicks
• Service Delivery: Providing access to slots, Live Casino, Baccarat, Sports Betting, and all other games on the BP9 platform
• Platform Security: Detecting and preventing fraud, money laundering, multiple account use, and any other unlawful activity
• Legal Compliance: Meeting applicable legal and regulatory obligations, including anti-money laundering (AML) requirements
• Service Communications: Sending important account notices, BP9 promotions, terms updates, and relevant technical information
• Customer Support: Processing and responding to player enquiries, complaints, and support requests
• Platform Improvement: Analysing usage patterns to improve service quality, interface design, and the overall player experience
• Responsible Gaming: Monitoring gambling patterns to identify players who may need support or self-control tools

BP9 will not use your personal data for any purpose other than those stated above without first obtaining your consent or without a valid legal basis for doing so.

Under Malaysia's PDPA 2010, BP9 processes your personal data on the following lawful bases:

• Consent: You provided explicit consent for the collection and use of your personal data during the BP9 account registration process. You may withdraw this consent at any time; however, doing so may affect our ability to provide services to you.
• Contractual Fulfilment: Processing is necessary to fulfil the service agreement between you and BP9 — including payment processing, account management, and the delivery of gaming services.
• Legal Obligation: Certain data processing is mandatory to meet Malaysian legal requirements, such as KYC obligations under the Anti-Money Laundering Act and the requirements of PDPA 2010.
• Legitimate Interests: BP9 processes certain data on the basis of our legitimate interests, such as preventing fraud, ensuring platform security, and improving service quality — provided these interests do not override your fundamental rights and freedoms.

BP9 does not sell players' personal data to third parties. However, in certain limited and controlled situations, we may share your personal data with the following categories of third parties:

• Payment Service Providers: Required transaction information is shared with providers such as DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and FPX solely for the purpose of processing your deposits and withdrawals. These providers have their own privacy policies governing the use of such data.
• Game Providers: Minimum necessary data may be shared with game providers such as Pragmatic Play, Evolution Gaming, PG Soft, and others for the purposes of game delivery and winnings verification.
• Regulatory & Law Enforcement Bodies: BP9 will disclose personal data to the relevant authorities when required by law or court order, including to anti-money laundering agencies.
• Audit & Compliance Services: Independent auditors conducting security, game fairness, and compliance audits may access certain data within the scope of their audit, subject to strict confidentiality agreements.
• Technical Service Provider: Companies providing technical support, data storage, and cybersecurity services may access data in their capacity as data processors, subject to strict data protection agreements.

In the event of a company merger, acquisition, or sale of BP9 assets, players' personal data may be transferred to the successor entity, subject to notification of affected players and the maintenance of equivalent protections.

BP9 implements a range of technical and organisational security measures to protect players' personal data against unauthorised access, use, disclosure, alteration, or destruction. The key measures we apply are:

• 256-bit SSL Encryption: All data transmitted between your device and BP9's servers is encrypted using Transport Layer Security (TLS) with 256-bit keys — the same standard used by Malaysia's leading financial institutions
• Secure Password Storage: Player account passwords are stored in hashed form using strong cryptographic algorithms — they cannot be read or recovered by anyone, including BP9 staff
• Internal Access Controls: Access to players' personal data within BP9's internal systems is restricted to staff who genuinely require it to perform their duties, based on a strict need-to-know principle
• 24/7 Security Monitoring: An automated monitoring system continuously tracks suspicious activity on the BP9 platform and takes immediate action when a threat is detected
• Regular Security Testing: BP9 conducts regular penetration testing and independent security audits to identify and address any vulnerabilities
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA to add an extra layer of protection to their accounts

While we take all reasonable precautions, no data transmission over the internet or electronic storage method can be guaranteed to be 100% secure. In the event of a material data security breach, BP9 will notify affected players and the relevant authorities within the timeframe required by law.

BP9 retains players' personal data only for as long as necessary for the purposes set out in this policy, or to meet applicable legal requirements. Our general data retention guidelines are:

• Active Account Data: Retained for as long as your BP9 account is active and in use, plus a further 5 years after account closure for audit and legal compliance purposes
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysian legal requirements relating to accounting and finance
• KYC & Identity Verification Records: Retained for 5 years after the account closure date in accordance with anti-money laundering requirements
• Customer Support Logs: Retained for 2 years for reference and service improvement purposes
• Technical Log Data: Retained for 90 days, then deleted or anonymised
• Cookie Data: Depends on the type of cookie — please refer to the Cookies section of this document for further details

Once the applicable retention period has expired, your personal data will be securely deleted or anonymised so that it can no longer be linked to you. Requests for early data deletion may be submitted, subject to the minimum retention obligations prescribed by law.

The BP9 website uses cookies and similar tracking technologies to enhance the user experience and analyse platform usage. Below is an overview of the types of cookies we use:

• Strictly Necessary Cookies: These cookies are essential for core BP9 website functions such as login authentication, session management, and security. They cannot be disabled as they are critical to the platform's proper operation.
• Preference Cookies: Saves your preferences such as language, currency denomination, and other display settings so you do not need to reconfigure them each time you visit BP9.
• Analytics Cookies: Helps us understand how players use the BP9 platform — including the most frequently visited pages, time spent, and navigation patterns. This information is used to improve the platform's design and content.
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser. They are used to maintain your session state while you are using the BP9 platform.

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality and user experience of the BP9 platform. For more information on managing cookies, refer to your web browser's help documentation.

Under Malaysia's PDPA 2010, you have the following rights in relation to the personal data held by BP9:

• Right of Access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 14 business days and may be subject to a small administrative fee.
• Right to Rectification: You have the right to request corrections to any inaccurate or incomplete personal data we hold about you. You can also update certain information directly through your BP9 account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data — however, this right is subject to the minimum retention obligations set out under Malaysian law.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing that took place prior to the withdrawal.
• Right to Object: You may object to the processing of your personal data for specific purposes, such as direct marketing.
• Right to Data Portability: You may request your personal data in a machine-readable format for transfer to another service provider where this is technically practicable.

To exercise any of the rights above, please contact BP9's customer support team by email at support@bp9-bangla.com or via live chat on the platform. We will verify your identity before processing any data-related request to ensure the security of your information.

In the course of operating the BP9 platform, your personal data may be transferred to and processed in countries outside Malaysia. This occurs when we use services from international game providers such as Evolution Gaming or Pragmatic Play, which operate from servers located outside Malaysia.

Where such data transfers occur, BP9 ensures that adequate safeguards are in place before any transfer takes place, including:

• Conducting data protection adequacy assessments in the recipient country
• Entering into data transfer agreements containing standard data protection clauses
• Ensuring recipients comply with data protection standards equivalent to those in Malaysia
• Limiting data transferred to the minimum necessary for the specific purpose only

The BP9 platform is a service strictly restricted to individuals aged 18 and above. BP9 does not intentionally collect, process, or store personal data from individuals under the age of 18.

All registration applicants are required to confirm that they are aged 18 or above during the registration process. Further age verification is conducted during the KYC process using valid identification documents.

Should BP9 discover that personal data from a minor has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question. Parents or guardians who believe their child has registered a BP9 account without authorisation should contact us immediately at support@bp9-bangla.com.

BP9 reserves the right to update or amend this Privacy Policy at any time in response to changes in law, technology, or our business practices. Any amendments will take effect immediately upon publication on the BP9 website.

For material amendments — that is, changes that significantly affect how we handle your personal data — BP9 will endeavour to provide advance notice through:

• A clear notice on the BP9 platform's main page
• Email to the address registered to your account
• A pop-up notice when you log in to your BP9 account for the first time after an amendment

The "Last Updated" date at the top of this document indicates when this Privacy Policy was last reviewed. We encourage you to check this page periodically to stay informed about how we protect your information. Continued use of the BP9 platform following any amendments constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or how BP9 handles your personal data, please contact us through the following channels:

• Email: support@bp9-bangla.com (please mark the email subject as "Privacy / PDPA")
• Live Chat: Available 24/7 via the live chat button on the BP9 platform
• WhatsApp: BP9 support WhatsApp number available within your account

If you are dissatisfied with how BP9 handles your personal data or with our response to your request, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia under PDPA 2010.

This Privacy Policy takes effect on: 1 January 2026.