bp77 Privacy Policy

1Overview & Data Controller

bp77 ("bp77", "we", "us", "our") operates the online gaming platform accessible at bp77.asia and is the data controller in respect of personal data collected through the platform and its associated services.

This Privacy Policy applies to:

• Registered bp77 account holders ("Players");
• Visitors to bp77.asia who have not registered an account;
• Former registered players whose data is retained in accordance with Section 7 of this Policy.

By accessing bp77.asia or registering an account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not use the bp77 platform.

For enquiries relating to data privacy, please contact bp77 using the details in Section 13 of this Policy.

2Personal Data We Collect

bp77 collects the following categories of personal data from players and visitors:

bp77 does not knowingly collect special category data (such as health data, racial or ethnic origin, or political opinions) except where directly relevant to a responsible gaming assessment or required by applicable law.

3How Personal Data Is Collected

bp77 collects personal data through the following means:

• Direct collection: Data you provide during registration, KYC submission, account settings updates, support communications, and manual form submissions on the bp77 platform;
• Automated collection: Technical data collected automatically during your use of bp77.asia, including IP address, session data, cookies, and device fingerprint data;
• Third-party verification providers: Identity verification and liveness check data processed through bp77's KYC partners for the purpose of satisfying regulatory verification obligations;
• Payment processors: Financial transaction data shared by payment providers (including Touch n Go eWallet, Boost, and banking institutions) in connection with deposit and withdrawal processing;
• Game providers: Gaming activity data (bet records, game session data) provided by bp77's licensed game studios as part of the integrated platform operation.

4How bp77 Uses Your Personal Data

bp77 uses collected personal data for the following purposes:

• Account creation and management: To register, maintain, and administer your bp77 account, including processing your login credentials, balance, and transaction history;
• Identity verification (KYC): To verify your identity, age, and residency in compliance with bp77's licensing obligations and AML requirements;
• Payment processing: To process deposits and withdrawals to and from your verified payment channels in MYR;
• Fraud prevention and security: To detect and prevent unauthorised account access, bonus abuse, multi-accounting, money laundering, and other fraudulent or prohibited activities;
• Responsible gaming: To monitor gaming activity for indicators of problem gambling behaviour, apply deposit and session limits configured by the player, and manage self-exclusion requests;
• Customer support: To respond to support enquiries, resolve disputes, and communicate account-related information;
• Legal and regulatory compliance: To satisfy obligations under bp77's international gaming licence, including AML reporting, record-keeping, and responses to lawful requests from regulatory or law enforcement authorities;
• Platform improvement: Aggregated and anonymised technical data may be used to analyse platform performance and improve the user experience — this does not involve processing individual personal data for marketing profiling.

bp77 does not use personal data for automated decision-making that produces significant legal effects on players, except where required for AML screening or identity verification processes, in which case you have the right to request human review.

5Legal Basis for Processing

bp77 processes personal data on the following legal bases:

• Contract performance: Processing necessary to fulfil the bp77 Terms & Conditions — including account registration, payment processing, and platform access;
• Legal obligation: Processing required to comply with AML legislation, KYC regulatory requirements under bp77's gaming licence, and lawful requests from regulatory or law enforcement authorities;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where those interests are not overridden by your data protection rights;
• Consent: Where you have provided specific, informed consent for a particular processing activity (such as optional marketing communications) — consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6Data Sharing & Third Parties

bp77 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes. bp77 shares personal data only in the following circumstances:

• KYC and identity verification providers: Identity documents and liveness data are shared with bp77's contracted KYC verification partners for the sole purpose of completing identity verification. These providers are bound by confidentiality obligations and data processing agreements;
• Payment processors: Financial data necessary to process deposits and withdrawals is shared with the relevant payment service providers (Touch n Go, Boost, Maybank, CIMB, Public Bank, and crypto processing partners);
• Game providers: Account identifiers and session data are shared with bp77's licensed game studios as necessary to deliver and record gaming transactions. Game providers do not receive contact or identity document data;
• Regulatory and law enforcement authorities: bp77 will disclose personal data to regulatory or law enforcement bodies where required by law, court order, or in connection with bp77's gaming licence obligations — including mandatory AML reporting;
• Corporate transactions: In the event of a merger, acquisition, or sale of bp77's business or assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third-party data processors engaged by bp77 are required to handle personal data in a manner consistent with this Privacy Policy and applicable data protection standards.

7Data Retention

bp77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Active account data: Retained for the duration of your active bp77 account;
• KYC and identity documents: Retained for a minimum of 5 years following account closure, in compliance with AML regulatory requirements applicable under bp77's gaming licence;
• Financial transaction records: Retained for a minimum of 5 years following the date of each transaction;
• Gaming activity records: Retained for a minimum of 5 years following account closure for dispute resolution, regulatory audit, and responsible gaming monitoring purposes;
• Self-exclusion records: Retained for the duration of the self-exclusion period and for a minimum of 5 years thereafter, to prevent re-registration in breach of the exclusion;
• Technical and log data: Typically retained for up to 12 months unless a longer retention period is required for a specific security or fraud investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data may be retained indefinitely for aggregated analytics purposes.

8Security Measures

bp77 implements technical and organisational security measures appropriate to the sensitivity of the personal data it processes. These include:

• SSL/TLS encryption for all data transmitted between your device and bp77's servers;
• Encryption at rest for sensitive personal data, including KYC documents and financial records;
• Hashed password storage — bp77 does not store passwords in plaintext;
• Two-factor authentication (2FA) available to all registered players and strongly recommended;
• Access controls limiting internal access to personal data to personnel with a need-to-know;
• Automated monitoring for suspicious account access patterns and login anomalies;
• Regular security assessments of the bp77 platform and infrastructure.

While bp77 takes appropriate measures to protect your personal data, no digital platform is entirely immune from security risk. In the event of a data breach that poses a material risk to registered players, bp77 will take reasonable steps to notify affected individuals in accordance with applicable notification obligations.

9Cookies & Tracking Technologies

bp77 uses cookies and similar tracking technologies on bp77.asia. Cookies are small data files placed on your device that help the platform function correctly, remember your preferences, and provide analytics data. The following cookie types are used:

• Strictly necessary cookies: Required for the platform to function — including session authentication, security tokens, and login state. These cannot be disabled without breaking core platform functionality;
• Functional cookies: Remember your preferences such as language settings and display preferences — these improve your experience but are not essential;
• Analytics cookies: Aggregated data on how visitors navigate bp77.asia, used to identify usability improvements. Data collected is anonymised and does not identify individual users.

You may manage cookie preferences through your browser settings. Disabling cookies may affect platform functionality — in particular, disabling session cookies will prevent you from remaining logged in to your bp77 account.

10Your Data Rights

Subject to applicable law and bp77's regulatory obligations, you have the following rights in respect of your personal data held by bp77:

• Right of access: You may request a copy of the personal data bp77 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data in your account;
• Right to erasure: You may request deletion of your personal data, subject to bp77's legal obligation to retain certain records for regulatory compliance purposes (see Section 7). Erasure requests cannot override mandatory regulatory retention obligations;
• Right to restriction: You may request that bp77 restrict processing of your personal data in certain circumstances — for example, while a correction request is under review;
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to bp77, to the extent technically feasible;
• Right to object: You may object to processing based on legitimate interests, subject to bp77 demonstrating compelling legitimate grounds that override your objection;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time — this does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact bp77 using the details in Section 13. bp77 will respond to data rights requests within 30 calendar days. Identity verification may be required before bp77 can fulfil a data rights request.

11Children & Minors

bp77 strictly enforces a minimum age requirement of 21 years for all registered accounts. bp77 does not knowingly collect personal data from individuals under the age of 21. Age is verified through the KYC process, and accounts that cannot satisfy age verification are not granted full platform access.

If bp77 becomes aware that personal data has been collected from a person under 21 years of age, bp77 will promptly close the relevant account, delete associated personal data (except where retention is required for regulatory purposes), and retain a record of the closure sufficient to prevent re-registration. Parents or guardians who believe a minor has registered on the bp77 platform should contact bp77 support immediately using the contact details in Section 13.

12Changes to This Privacy Policy

bp77 reserves the right to update or amend this Privacy Policy at any time. When a material change is made, bp77 will post a notice on the platform and update the "Last updated" date at the top of this page. Where required by applicable law, bp77 will seek fresh consent for material changes to the ways in which your data is processed.

Your continued use of the bp77 platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms. bp77 recommends that you review this Policy periodically. If you do not accept a material change to this Policy, you should close your account and cease using the platform.

13Contact & Data Enquiries

For questions, data rights requests, privacy complaints, or any other privacy-related enquiries, please contact the bp77 data team through the following channels:

bp77 Privacy & Data Team
Email: [email protected]
Live chat: Available 24/7 from within your bp77 account dashboard
Website: bp77.asia

bp77 aims to acknowledge all privacy-related enquiries within 2 business days and to resolve data rights requests within 30 calendar days of receipt. Where a request is complex or high-volume, bp77 may extend this period by up to a further 60 days, with notice given to the requestor.