Privacy Policy

1. Introduction

bp8 ("bp8", "we", "us", "our") operates the online casino and sports betting platform accessible at bp8.bio (the "Platform"). We are committed to protecting the privacy and personal data of all users, visitors, and registered members ("you", "your") who interact with the Platform.

This Privacy Policy ("Policy") explains in plain terms what personal data bp8 collects about you, the purposes for which it is collected and processed, with whom it may be shared, how long it is retained, and what rights you have in relation to your personal data. This Policy should be read together with bp8's Terms & Conditions and Responsible Gaming Policy.

2. Data Controller

For the purposes of applicable data protection legislation, bp8 is the data controller responsible for the personal data collected through the Platform. bp8 operates under international gaming authority licensing and is subject to data protection obligations imposed by that licensing framework.

For all data protection enquiries, requests to exercise your rights, or complaints, please contact bp8's data protection contact via the support channel detailed in Section 15 of this Policy. bp8 will acknowledge data subject requests within five (5) business days and respond substantively within thirty (30) calendar days of receipt.

3. Data We Collect

bp8 collects the following categories of personal data in the course of providing its services:

3.1 Identity Data

• Full legal name as it appears on government-issued identification;
• Date of birth (for age verification — users must be 21 or older);
• Government-issued identification number (where required for KYC verification);
• Copies of identity documents submitted for verification purposes.

3.2 Contact Data

• Email address;
• Malaysian mobile number;
• Residential address (for KYC verification where required).

3.3 Financial Data

• Payment method details (bank account details, e-wallet identifiers) — note that bp8 does not store full card numbers or card security codes;
• Transaction history including deposits, withdrawals, and bonus transactions;
• Source of funds documentation where requested under AML obligations.

3.4 Gaming Data

• Game history, wager amounts, outcomes, and session durations;
• Sportsbook bet history, markets, stakes, and settlements;
• Bonus usage, wagering progress, and responsible gaming tool settings.

3.5 Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session timestamps, pages visited, and features used on the Platform;
• Cookie identifiers and similar tracking data as described in Section 8.

4. How We Collect Data

bp8 collects personal data through the following means:

• Direct provision: Data you provide when registering for an Account, completing KYC verification, making a deposit or withdrawal, or contacting customer support;
• Automated collection: Technical and usage data collected automatically when you access or use the Platform, including via cookies and server logs;
• Third parties: Identity verification data from KYC service providers; fraud detection signals from payment processors; compliance data from licensing authority databases where applicable.

5. Legal Basis for Processing

bp8 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to provide you with the services described in our Terms & Conditions, including Account management, payment processing, and game delivery;
• Legal obligation: Processing required to comply with our obligations under international gaming authority licensing, including KYC verification, AML compliance, responsible gaming requirements, and age verification;
• Legitimate interests: Processing for fraud prevention, platform security, service improvement, and abuse detection, where such interests are not overridden by your rights and interests;
• Consent: Processing for optional marketing communications, where you have given explicit consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. How We Use Your Data

bp8 uses the personal data it collects for the following purposes:

• To create, verify, and manage your bp8 Account;
• To process deposits, withdrawals, and internal wallet transactions in MYR;
• To verify your identity and age (21+ requirement) as required by our licensing obligations;
• To detect and prevent fraud, money laundering, and other prohibited activities;
• To enforce our Terms & Conditions and Responsible Gaming Policy;
• To provide customer support and respond to your enquiries;
• To send transactional communications relating to your Account (deposits confirmed, withdrawals processed, security alerts);
• To send marketing communications where you have opted in to receive them;
• To comply with reporting obligations to our licensing authority;
• To analyse platform usage for the purpose of improving the bp8 service.

7. Data Sharing

bp8 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. bp8 may share your personal data with the following categories of recipients, strictly to the extent necessary:

• Payment processors and e-wallet providers (Maybank2u, CIMB, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX operators) for the purpose of processing your deposit and withdrawal transactions;
• KYC and identity verification service providers for the purpose of fulfilling our licensing-mandated age and identity verification obligations;
• AML and fraud detection services for the purpose of screening transactions and player activity against legal and licensing requirements;
• Game content providers to the minimum extent necessary to deliver licensed game content to your session — typically limited to session tokens and anonymised identifiers;
• Licensing and regulatory authorities where required by law or licensing obligation;
• Law enforcement or government agencies where required by a lawful order, warrant, or regulatory instruction.

All third-party service providers engaged by bp8 are required to process personal data only for the specified purpose, in accordance with our instructions, and subject to appropriate data protection safeguards.

8. Cookies & Tracking Technologies

bp8 uses the following categories of cookies and similar technologies on the Platform:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load balancing identifiers. These cannot be disabled.
• Functional cookies: Store your preferences such as language settings and game lobby display options to improve your experience across sessions.
• Analytics cookies: Collect anonymised data about how the Platform is used — pages visited, session durations, features accessed — to help bp8 improve the service. No personally identifiable information is transmitted via analytics cookies.

bp8 does not use advertising cookies, cross-site tracking pixels, or third-party social media tracking scripts. You may manage cookie preferences via your browser settings, noting that disabling strictly necessary cookies will prevent the Platform from functioning correctly.

9. Data Retention

bp8 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods imposed by our licensing obligations:

• Account and identity data: Retained for a minimum of five (5) years following the closure of your Account, as required by AML and licensing regulations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity logs: Retained for a minimum of three (3) years;
• Customer support communications: Retained for two (2) years from the date of the communication;
• Technical and usage logs: Retained for up to twelve (12) months.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with bp8's data destruction procedures.

10. Data Security

bp8 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bp8's servers;
• Encryption of sensitive data at rest within bp8's database infrastructure;
• Role-based access controls limiting internal access to personal data to authorised personnel with a legitimate operational need;
• Regular security audits and penetration testing as required by bp8's licensing framework;
• Multi-factor authentication for internal system access;
• Incident response procedures for the detection, escalation, and notification of personal data breaches.

While bp8 takes reasonable steps to protect your data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the confidentiality of your bp8 Account credentials.

11. Your Rights

Subject to applicable data protection law and bp8's licensing obligations, you have the following rights in relation to your personal data held by bp8:

• Right of access: You may request a copy of the personal data bp8 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to restriction: You may request that bp8 restrict processing of your personal data in certain circumstances;
• Right to data portability: You may request that bp8 provide your personal data in a structured, machine-readable format;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting prior processing;
• Right to object: You may object to processing based on legitimate interests grounds in certain circumstances.

To exercise any of the above rights, contact bp8 support as detailed in Section 15. bp8 will respond to all verified data subject requests within thirty (30) calendar days. bp8 may need to verify your identity before processing a data access or erasure request.

12. International Data Transfers

bp8 operates under international gaming authority licensing and some of its service providers may be located outside of Malaysia. Where personal data is transferred internationally, bp8 ensures that appropriate safeguards are in place to protect the data, including contractual data protection clauses with service providers and assessment of the adequacy of protections in the recipient jurisdiction.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia, subject to the safeguards described above.

13. Children's Privacy

The bp8 Platform is strictly intended for adults aged 21 years and over. bp8 does not knowingly collect personal data from individuals under the age of 21. Registration requires age verification and any Account found to belong to a person under 21 will be immediately closed and any associated balance will be forfeited.

If you believe that bp8 has inadvertently collected personal data from a person under 21, please contact us immediately via the support channel in Section 15 so that the data can be identified and deleted promptly.

14. Changes to This Policy

bp8 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are material, bp8 will notify registered users via email or by prominent notice on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. Continued use of the Platform following any update constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

15. Contact

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or wish to make a privacy-related complaint, please contact bp8 via the 24/7 live chat available on the Platform.

For written data protection enquiries, you may contact us at the email address displayed in the footer of this page. bp8 acknowledges data protection enquiries within five (5) business days and provides a substantive response within thirty (30) calendar days.