BP9MY Privacy Policy

This Privacy Policy ("Policy") is issued by BP9MY ("the Platform", "we", "us", "our"), the operator of the online gaming and sports betting services accessible at bp9my.cam. This Policy governs the collection, use, storage, disclosure, and protection of personal data provided by or collected about individuals ("Players", "you", "your") who access, register on, or interact with the BP9MY platform.

BP9MY is committed to handling personal data with transparency, integrity, and respect for the privacy rights of every individual. This Policy is designed to clearly communicate what data we collect, why we collect it, how long we retain it, and what choices and rights you have in relation to that data.

By registering an account on BP9MY or continuing to use the platform after this Policy takes effect, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue use of the platform and may request account closure in accordance with our Terms and Conditions.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial account details, IP address, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, alteration, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means BP9MY as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means a third party that processes personal data on behalf of BP9MY in accordance with BP9MY's instructions and this Policy.
• "KYC Data" means identity verification documents and associated personal data submitted by Players during the Know Your Customer verification process.
• "Sensitive Data" means personal data that warrants heightened protection due to its nature, including financial account details, identity document numbers, and data relating to health or welfare concerns disclosed in the context of responsible gambling tools.
• "Cookies" means small text files or similar tracking technologies placed on a Player's device by the BP9MY platform for purposes described in Clause 8.

BP9MY collects the following categories of personal data from Players and visitors to the platform:

BP9MY applies data minimisation principles and collects only the personal data that is necessary for the specified purposes outlined in this Policy. Providing inaccurate or incomplete registration or KYC data may result in account suspension or denial of withdrawal requests.

BP9MY collects personal data through the following channels and mechanisms:

4.1 Direct Collection

Data you provide directly when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or participating in promotions and surveys.

4.2 Automated Collection

Technical and behavioural data collected automatically when you access the BP9MY platform, including through cookies, web beacons, server logs, and similar tracking technologies as described in Clause 8. This data is collected regardless of whether you are logged into your Player Account.

4.3 Third-Party Sources

In certain circumstances, BP9MY may receive personal data from authorised third-party sources in order to verify identity, prevent fraud, or fulfil regulatory obligations. These sources include:

• Identity verification and KYC service providers engaged by BP9MY to cross-reference submitted documents against official databases.
• Payment processors including FPX, DuitNow, and e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay) in connection with transaction processing and chargeback investigations.
• Fraud detection and anti-money-laundering (AML) screening services that assess transactional risk profiles.

BP9MY processes personal data for the following specific, documented purposes:

• Account Management: Creating, maintaining, and administering Player Accounts, including authentication, account recovery, and the enforcement of platform eligibility rules including the 21+ age requirement.
• Identity Verification (KYC): Verifying the identity and age of Players in compliance with applicable gaming regulatory requirements and anti-money-laundering obligations.
• Payment Processing: Facilitating deposits and withdrawal transactions via local Malaysian payment channels including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay.
• Platform Delivery: Operating and improving the BP9MY gaming platform, sportsbook, and associated services, including personalisation of the gaming experience.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account compromise, bonus abuse, money laundering, and other prohibited conduct.
• Responsible Gambling: Monitoring player behaviour to identify potential signs of problem gambling, applying self-imposed limits, and facilitating responsible gambling tool usage as required by applicable regulations.
• Legal & Regulatory Compliance: Meeting obligations imposed by applicable gaming licensing authorities, financial intelligence units, and data protection regulators.
• Marketing Communications (opt-in only): Sending promotional offers, bonus notifications, and platform updates to Players who have expressly consented to receive such communications.
• Customer Support: Responding to player queries, investigating complaints, and resolving disputes via live chat and email channels.

BP9MY processes personal data on one or more of the following legal bases, depending on the nature and purpose of the processing activity:

• Contractual Necessity: Processing required to fulfil BP9MY's contractual obligations to you under the Terms and Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable law, including KYC verification obligations, AML screening, age verification, and regulatory reporting to licensing authorities.
• Legitimate Interests: Processing necessary for BP9MY's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and analytical improvement of platform performance — provided such interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily applicable to marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

BP9MY does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Data is shared with external parties only where strictly necessary for service delivery or legal compliance, under the following categories:

7.1 Service Delivery Partners

BP9MY engages third-party service providers who process personal data as Data Processors acting on our behalf. These include KYC and identity verification providers, payment gateway operators (including FPX, DuitNow, and e-wallet platforms), game studio technology partners, and customer support platform providers. All such partners are subject to data processing agreements that bind them to handle personal data only as instructed by BP9MY and in accordance with this Policy.

7.2 Regulatory and Law Enforcement Authorities

BP9MY may disclose personal data to gaming licensing authorities, financial intelligence units, law enforcement agencies, or courts where required to do so by applicable law, regulatory direction, or valid legal process. BP9MY will, where legally permissible, notify affected Players of such disclosures.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of BP9MY's business, personal data held by BP9MY may be transferred to the acquiring or successor entity as part of that transaction, subject to the acquirer being bound by obligations equivalent to those in this Policy.

BP9MY uses cookies and similar tracking technologies to operate and improve the platform, maintain session state, prevent fraud, and (where consented) deliver relevant promotional content. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They enable core functionality such as account authentication, session management, security token validation, and payment flow integrity. No consent is required for strictly necessary cookies as they are required for contractual performance.

8.2 Analytical Cookies

These cookies collect aggregated, anonymised information about how Players use the platform — including which pages are visited most frequently, how long sessions last, and where errors occur. This data is used solely to improve platform performance and user experience and is not linked to individual Player profiles for marketing purposes.

8.3 Functional Cookies

These cookies remember your preferences, such as your preferred language, notification settings, and previously visited game categories, to provide a more personalised experience. They are not used for advertising profiling.

8.4 Marketing Cookies (Consent Required)

Where you have expressly opted in to marketing communications, BP9MY may use cookies to track which promotions you have viewed or interacted with, in order to avoid sending duplicate offers. These cookies require your consent and may be disabled at any time via your browser settings or account notification preferences without affecting your access to the platform.

BP9MY retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where a Player submits a valid deletion request prior to the end of the retention period, BP9MY will delete data that is not subject to a legal hold obligation within 30 days of receipt of the request.

Subject to applicable law and the retention obligations described in Clause 9, Players have the following rights in relation to their personal data held by BP9MY:

• Right of Access: You may request a copy of all personal data BP9MY holds about you. Requests will be fulfilled within 30 calendar days.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. Certain corrections (such as name changes) may require supporting documentation.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to BP9MY's legal retention obligations.
• Right to Restrict Processing: You may request that BP9MY limits the processing of your data in certain circumstances, such as while a dispute regarding its accuracy is under review.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another service, where technically feasible.
• Right to Object: You may object to processing based on BP9MY's legitimate interests or for direct marketing purposes. Objections to marketing processing will be actioned immediately.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact BP9MY's support team via live chat or email at [email protected]. All rights requests are handled at no charge. BP9MY may require verification of your identity before processing any rights request to prevent unauthorised access to Player data.

BP9MY implements a multi-layered security framework designed to protect personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between Player devices and BP9MY servers.
• AES-256 encryption for sensitive data at rest, including KYC documents and financial account identifiers.
• Role-based access controls ensuring that only authorised BP9MY personnel with a demonstrable operational need can access Player personal data.
• Continuous intrusion detection and network monitoring to identify and respond to security anomalies in real time.
• Regular independent security audits and penetration testing of platform infrastructure.
• Two-factor authentication (2FA) available to all Player Accounts and mandatory for internal BP9MY administrative access.
• Contractual and technical controls imposed on all third-party Data Processors who handle BP9MY Player data.

In the event of a personal data breach that poses a risk to Player rights and freedoms, BP9MY will notify affected Players without undue delay and will report the breach to the relevant regulatory authority within the timeframe required by applicable law.

If you have any questions, concerns, or requests relating to this Privacy Policy or BP9MY's handling of your personal data, please contact us using the channels below. All privacy-related enquiries are handled by BP9MY's dedicated support team with a target response time of one business day.

12.1 Privacy Enquiries and Rights Requests

Email: [email protected]
Subject line: "Privacy Request — [your Player Account username]"
Live Chat: Available 24/7 via the BP9MY platform — average response under 3 minutes.

12.2 Policy Updates

BP9MY reviews this Privacy Policy periodically and will publish updates at bp9my.cam/privacy-policy. Where changes are material, registered Players will be notified by email at least 7 days before the revised Policy takes effect. The effective date at the top of this document reflects the date of the most recent revision.