Privacy Policy

1. Introduction and Data Controller

This Privacy Policy sets out the basis on which bx99 ("bx99", "we", "us", "our"), the operator of the online platform accessible at bx99.club, collects, uses, stores, and discloses personal data relating to individuals who register for or use the bx99 Platform ("Players") and individuals who visit bx99.club without registering ("Visitors").

bx99 acts as the data controller in respect of all personal data processed pursuant to this Privacy Policy. This means that bx99 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection law.

By accessing the bx99 Platform or registering an Account, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree to this Privacy Policy, you must not use the Platform.

2. Personal Data We Collect

bx99 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

bx99 does not collect special categories of personal data (such as health data, racial or ethnic origin, or biometric data for identification purposes) except where strictly necessary for responsible gaming assessments and only with your explicit consent.

3. How We Collect Personal Data

3.1 Directly From You

The majority of personal data bx99 holds is provided directly by you during account registration, identity verification, payment processing, and when you contact our support team. This includes information submitted through the Platform interface and any documents you upload in response to verification requests.

3.2 Automatically

When you access the bx99 Platform, certain technical and usage data is collected automatically through cookies, server logs, and similar tracking technologies. This data is collected regardless of whether you are a registered Player or an unregistered Visitor and is used to maintain session integrity, detect fraud, and improve platform performance.

3.3 From Third Parties

bx99 may receive personal data about you from third-party sources including identity verification service providers, payment processors, fraud detection services, and, where applicable, gaming regulatory authorities. Data received from third parties is handled in accordance with this Privacy Policy and is used only for the purposes consistent with the original collection.

4. Purposes and Legal Bases for Processing

bx99 processes your personal data for the following purposes, each supported by a lawful basis under applicable data protection legislation:

• Account Administration: Processing is necessary for the performance of the contract between you and bx99, including creating and maintaining your Account, processing deposits and withdrawals, and providing access to Platform features.
• Identity Verification and Anti-Money Laundering (AML) Compliance: Processing is necessary to comply with legal obligations applicable to bx99 as a licensed gaming operator, including Know Your Customer (KYC) requirements and AML regulations.
• Fraud Prevention and Security: Processing is necessary for the purposes of the legitimate interests of bx99 and its Players in preventing fraud, detecting account compromise, and maintaining platform security.
• Responsible Gaming: Processing is necessary for compliance with responsible gaming regulatory requirements and, where applicable, for the protection of Players' vital interests.
• Marketing Communications: Processing is based on your prior consent. You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Platform Analytics and Improvement: Processing is based on bx99's legitimate interest in understanding how the Platform is used and improving user experience, subject to appropriate safeguards.
• Legal Claims: Processing may be necessary for the establishment, exercise, or defence of legal claims involving bx99.

5. Disclosure of Personal Data

bx99 does not sell, rent, or trade your personal data with third parties for commercial purposes. We may disclose your personal data to the following categories of recipients where necessary:

• Payment Processors and E-Wallet Providers: Including but not limited to Touch n Go eWallet, Boost, GrabPay, and Malaysian banking institutions, for the processing of deposits and withdrawals. These providers act as independent data controllers in respect of the data they process.
• Identity Verification and KYC Providers: Third-party providers engaged by bx99 to perform identity verification checks required by our regulatory obligations.
• Technology and Infrastructure Providers: Cloud hosting, security, and platform technology providers engaged by bx99 as data processors under written data processing agreements that require them to handle data securely and only as directed by bx99.
• Regulatory and Law Enforcement Authorities: Where bx99 is required by law, court order, or competent regulatory authority to disclose personal data, we will comply with such obligations. Where permitted by law, we will attempt to notify you of such disclosure.
• Professional Advisers: Lawyers, auditors, and other professional advisers engaged by bx99, subject to appropriate confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of bx99's business, your personal data may be transferred to the acquirer as part of the transaction, subject to equivalent privacy protections.

6. International Data Transfers

bx99 operates in a global technology environment and some of the third-party service providers engaged by bx99 may process personal data in jurisdictions outside Malaysia. Where personal data is transferred internationally, bx99 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to the protections available under Malaysian data protection law, including through contractual data protection clauses with the relevant service providers.

7. Data Retention

bx99 retains personal data for as long as is necessary for the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulation. The following general retention periods apply:

• Active Account Data: Retained for the duration of your Account's active status plus a period of 5 years following Account closure, in accordance with AML regulatory requirements applicable to gaming operators.
• Transaction Records: Retained for a minimum of 7 years from the date of the relevant transaction, consistent with financial record-keeping obligations.
• Support and Communications Records: Retained for 3 years from the date of the most recent communication, or longer if required for an ongoing legal claim or regulatory matter.
• Technical and Usage Data: Typically retained in aggregate or anonymised form after 12 months, unless specifically required for a longer period in connection with a security incident or investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with bx99's data disposal procedures.

8. Security Measures

bx99 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and bx99 servers.
• Encryption of sensitive personal data and financial data at rest.
• Access controls limiting access to personal data to bx99 personnel and service providers who have a genuine need to access the data for operational purposes.
• Regular security assessments, penetration testing, and vulnerability monitoring of the bx99 Platform and infrastructure.
• Multi-factor authentication requirements for internal systems that store or process personal data.
• Incident response procedures to detect, contain, and report personal data breaches in accordance with applicable regulatory requirements.

Notwithstanding these measures, no data transmission over the internet and no method of data storage can be guaranteed to be completely secure. You acknowledge this inherent limitation when using the bx99 Platform.

9. Cookies and Tracking Technologies

bx99 uses cookies, web beacons, and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Required for the Platform to function, including session management, login state maintenance, and security functions. These cookies cannot be disabled without preventing use of the Platform.
• Analytics Cookies: Used to collect aggregated information about how visitors use the Platform, including pages visited, session duration, and navigation paths. This data is used to improve platform performance and user experience.
• Functionality Cookies: Used to remember your preferences such as language settings and display preferences, so that you do not need to re-enter them on each visit.

You can manage or delete cookies through your browser settings. Disabling essential cookies may prevent some or all Platform features from functioning correctly. For analytics and functionality cookies, you can adjust your preferences through your browser's cookie management tools.

10. Your Data Subject Rights

Subject to applicable law, you have the following rights in respect of the personal data bx99 holds about you:

• Right of Access: You may request a copy of the personal data bx99 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Certain data, including transaction records, cannot be altered for regulatory and audit purposes.
• Right to Erasure: You may request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purpose for which it was collected. This right is subject to overriding legal obligations that may require bx99 to retain certain data.
• Right to Restriction: You may request that bx99 restrict processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request a copy of the personal data you have provided in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on bx99's legitimate interests. bx99 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact bx99 via live chat or by email at [email protected]. We will respond to requests within 30 days of receipt. We may require verification of your identity before processing a request.

11. Children and Minors

The bx99 Platform is strictly restricted to individuals aged 21 and above. bx99 does not knowingly collect personal data from persons under 21 years of age. If bx99 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the associated Account closed immediately.

If you are a parent or guardian and believe that a minor has provided personal data to bx99, please contact us immediately via live chat or at [email protected] so that we can take prompt action.

12. Changes to This Policy

bx99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, technology, legal requirements, or business operations. Material changes will be communicated to registered Players via their registered email address or mobile number and/or by a prominent notice on the Platform, not less than 14 days before the changes take effect.

Your continued use of the Platform following the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. The "Last Updated" date at the top of this page will be revised to reflect the date of the most recent changes.

13. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or wish to make a complaint about bx99's data processing practices, you may contact the bx99 data protection team through the following channels:

• Live Chat: Available 24/7 via the bx99 Platform
• Email: [email protected]

bx99 will acknowledge receipt of a complaint within 5 business days and endeavour to resolve it within 28 days. If you are not satisfied with bx99's response, you may escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.