Privacy Policy

01 Introduction

bm96 is an online gaming platform serving Malaysian players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Ipoh, and beyond. As an operator subject to international gaming authority licensing obligations, bm96 is required to collect, process, and in some cases retain personal data as a condition of lawful operation. This Privacy Policy explains precisely what data bm96 collects, the purposes for which it is processed, with whom it may be shared, and the rights you hold in relation to your personal data.

bm96 takes data privacy seriously. We collect only what is necessary, retain it only for as long as required, and implement technical and organisational safeguards to protect it from unauthorised access or disclosure. We do not sell personal data to third-party marketing organisations and we do not profile players for commercial purposes unrelated to the operation of the bm96 platform.

02 Data We Collect

bm96 collects personal data through several channels, including account registration, ongoing account use, payment processing, customer support interactions, and automated technical collection during site visits. The categories of data collected include:

bm96 does not collect sensitive personal data categories (such as racial or ethnic origin, political opinions, or health data) unless specifically required for regulatory compliance purposes and with your explicit consent.

03 How We Use Your Data

bm96 processes your personal data for the following purposes:

• Account Management: To create, maintain, and administer your bm96 player account, including authentication and access control.
• Service Delivery: To provide the bm96 platform services you have registered for, including sports betting, live casino, slots, and e-sports wagering.
• Payment Processing: To process deposits and withdrawals through your chosen payment method, including Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, and USDT TRC20.
• Identity Verification (KYC): To verify your identity and age in compliance with our international gaming authority licensing obligations and anti-money laundering regulations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and money laundering on the bm96 platform.
• Regulatory Compliance: To fulfil our legal and regulatory obligations as a licensed gaming operator, including reporting requirements to relevant authorities.
• Responsible Gaming: To monitor gaming behaviour, apply responsible gaming tools you have configured, and intervene proactively where required by our responsible gaming obligations.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions.
• Platform Improvement: To analyse aggregated usage data to improve bm96's products, features, and performance.
• Communications: To send you service-related notifications (account activity, security alerts, withdrawal confirmations) and, where you have consented, promotional communications.

04 Legal Basis for Processing

bm96 processes personal data under the following legal bases:

• Contractual Necessity: Processing required to perform the bm96 Terms & Conditions contract with you — including account creation, game access, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/KYC obligations under international gaming authority licensing terms.
• Legitimate Interests: Processing necessary for bm96's legitimate operational interests, including fraud prevention, platform security, and service improvement, where such interests do not override your privacy rights.
• Consent: Processing based on your freely given, specific consent — primarily for marketing communications. You may withdraw consent at any time by updating your communication preferences in account settings.

05 Data Sharing & Third-Party Disclosure

bm96 does not sell, rent, or trade your personal data to third-party organisations. bm96 may share your personal data with the following categories of recipients where necessary for the purposes described in this Policy:

• Payment Service Providers: E-wallet operators (Touch n Go, Boost, GrabPay), banks (Maybank, CIMB, Public Bank), and cryptocurrency processing services, solely for transaction processing purposes.
• Identity Verification Providers: Third-party KYC and identity verification services used to verify your identity and age in compliance with regulatory requirements.
• Game Content Providers: Certified gaming software providers whose games are accessible through the bm96 platform. These providers receive only the technical data necessary to run game sessions.
• Regulatory Authorities: Government bodies and international gaming authority regulators to whom bm96 is obligated to report under its operating licence.
• Law Enforcement: Where required by applicable law, court order, or to protect the rights, property, or safety of bm96, its players, or the public.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by bm96, subject to professional confidentiality obligations.

All third-party service providers engaged by bm96 are required to process your personal data only for the specific purpose for which they are engaged and in accordance with data protection standards consistent with this Policy.

06 Cookies & Tracking Technologies

bm96.app uses cookies and similar tracking technologies to ensure the platform functions correctly and to improve your experience. The categories of cookies used include:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your bm96 account during an active session. These cannot be disabled without rendering the platform non-functional.
• Functional Cookies: Store your preferences, such as preferred language, game lobby filters, and responsible gaming settings, so that your configuration persists across sessions.
• Analytical Cookies: Aggregate, anonymised data used to understand how players navigate bm96.app, identify performance issues, and measure the effectiveness of platform features. No individual player is identified through analytical data.
• Security Cookies: Support fraud detection and anomalous login identification by recording device fingerprint and session metadata.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use core bm96 platform functions, including the bm96 Login portal.

07 Data Retention

bm96 retains personal data for the minimum period necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory obligations. Indicative retention periods are as follows:

• Active Account Data: Retained for the duration of your active bm96 account plus a minimum of five (5) years following account closure, as required under international gaming authority AML record-keeping obligations.
• KYC & Identity Documents: Retained for a minimum of five (5) years from the date of verification, in compliance with anti-money laundering regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Records: Retained for three (3) years following the resolution of the relevant support interaction.
• Technical & Log Data: Retained for up to twelve (12) months, after which it is anonymised or deleted.

Where retention beyond these periods is required by a specific legal obligation or ongoing regulatory investigation, bm96 will retain the relevant data for the duration of that requirement.

08 Data Security

bm96 implements the following technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction:

• SSL/TLS Encryption: All data transmitted between your device and bm96.app is encrypted using 256-bit SSL/TLS protocols. The padlock icon in your browser confirms an encrypted connection on every bm96 page.
• Access Controls: Access to personal data within bm96's systems is restricted on a need-to-know basis. All internal access to player data is logged and audited.
• Password Security: Player passwords are stored in hashed, salted form. bm96 staff cannot retrieve your plain-text password — only reset it via a verified identity challenge.
• Two-Factor Authentication: Optional 2FA is available for all registered bm96 accounts, providing an additional authentication layer at login and for sensitive account actions.
• Anomaly Detection: bm96's security systems monitor for unusual access patterns, including unfamiliar IP addresses and device changes, and trigger alerts for suspicious activity.
• Incident Response: bm96 maintains a data breach response procedure. In the event of a breach affecting your personal data, bm96 will notify affected players and relevant authorities in accordance with applicable reporting obligations.

09 Your Rights

Subject to applicable data protection law and the conditions of bm96's gaming licence, you hold the following rights in relation to your personal data processed by bm96:

• Right of Access: You may request a copy of the personal data bm96 holds about you. bm96 will respond within 30 days of a verified request.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Many data fields can be updated directly through your bm96 account settings.
• Right to Erasure: You may request deletion of your personal data where processing is no longer necessary and where no overriding legal obligation requires retention. Note that AML and gaming licence record-keeping obligations may limit the scope of erasure requests.
• Right to Restriction: You may request that bm96 restrict processing of your personal data in certain circumstances, such as while a rectification request is under review.
• Right to Data Portability: You may request a copy of your account and gaming activity data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests. Where you object to receiving marketing communications, bm96 will action this request immediately upon verification.
• Right to Withdraw Consent: Where processing is based on consent (primarily marketing), you may withdraw consent at any time through your bm96 account settings without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact bm96 customer support via live chat (9 AM – 2 AM MYT) or by email at [email protected]. bm96 will verify your identity before processing any data rights request.

10 Children's Privacy

bm96 is strictly an adults-only platform. We do not knowingly collect personal data from individuals under the age of 21. If bm96 discovers that a registered account is held by a person under 21 years of age, the account will be suspended immediately, all pending transactions will be cancelled, and the matter will be handled in accordance with bm96's underage gambling policy.

If you believe that a person under 21 may have registered a bm96 account, please contact bm96 customer support immediately at [email protected] so that the matter can be investigated and resolved promptly.

11 International Data Transfers

bm96's operations and some of its third-party service providers are based outside Malaysia. Your personal data may be transferred to, stored in, and processed in jurisdictions outside your country of residence. Where such transfers occur, bm96 ensures that appropriate safeguards are in place — including contractual data protection clauses consistent with applicable international data protection standards — to maintain the level of protection described in this Policy.

By using the bm96 platform, you acknowledge and consent to the potential transfer of your personal data across international borders for the purposes described in this Policy.

12 Changes to This Privacy Policy

bm96 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, bm96 will notify registered players via their registered email address or through an in-platform notification prior to the changes taking effect. The "Last Updated" date at the top of this document will reflect the most recent revision.

Your continued use of the bm96 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised Policy. We recommend reviewing this page periodically to stay informed of how bm96 handles your personal data.

13 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or bm96's data processing practices, please contact bm96 through the following channels:

• Live Chat: Available on-site daily, 9 AM – 2 AM MYT (recommended for urgent matters)
• Email: [email protected]

bm96 aims to respond to all written data protection enquiries within five (5) business days. For subject access requests or data erasure requests, bm96 will complete its response within thirty (30) days of identity verification.