Privacy Policy bvbx2 — Data Protection Your Privacy

Introduction and Scope of the Privacy Policy

Bvbx2 ("we", "Platform") understands that privacy is a fundamental right of every individual. We take this responsibility seriously and have developed a comprehensive data protection framework to ensure your personal information is always kept safe.

This Privacy Policy is drawn up in accordance with the Malaysia Personal Data Protection Act 2010 (PDPA) and international data security industry best practices. This document clearly outlines the types of data we collect, the purpose of collection, how it is stored, who can access it, and your rights as a data subject.

This Policy applies to all registered bvbx2 members, guest users browsing our website without an account, and any individual who interacts with our customer support team. If you disagree with any part of this Privacy Policy, we encourage you to contact us before continuing to use the platform.

Personal Data We Collect

Bvbx2 only collects data that is genuinely necessary to provide our members with a secure, transparent, and high-quality service. We do not collect data that is excessive or irrelevant to the purpose of our services.

Data Provided Directly by You

• Identity information: Full name, date of birth, identity card number (MyKad) or passport.
• Contact information: Email address, mobile phone number, residential address.
• Financial information: Bank account number, bank name, account holder name (for deposit and withdrawal processing purposes).
• KYC documents: A copy of your identification card, passport, bank statement, or utility bill for the identity verification process.
• Login information: Username and password stored in hashed form — we do not store passwords in plain text.

Automatically Collected Data

• Technical data: IP address, device type, operating system, browser type and version.
• Usage data: Pages visited, session duration, buttons clicked, games played and time spent playing.
• Location data: General location based on IP address (country and city) — we do not collect precise GPS coordinates.
• Cookie and tracking data: Session information, user preferences and analytics data required to improve the platform experience.

Data Type	Primary Purpose	Mandatory?
Name & MyKad / Passport	Identity verification (KYC), legal compliance	Yes
Email & Phone Number	Account communications, security notifications	Yes
Bank / e-Wallet Information	Deposit and withdrawal processing	Yes (for transactions)
IP Address & Device Data	Account security, fraud detection	Automatic
Game History	Internal audits, dispute resolution, responsible gaming	Automatic
Analytics Cookies	Platform enhancements, traffic analysis	Options

How We Use Your Data

Personal data collected by bvbx2 is used solely for the purposes stated below. We will not use your data for any other purpose without obtaining your consent first.

• Account management: Creating, verifying and maintaining your bvbx2 account securely.
• Transaction processing: Processing deposits, withdrawals and all financial transactions accurately and promptly.
• KYC and AML Compliance: Meeting legal requirements related to identity verification and anti-money laundering.
• Platform security: Detecting and preventing fraud, unauthorised access and suspicious activity.
• Customer support: Providing technical support and resolving complaints efficiently and effectively.
• Service Improvements: Analysing usage patterns to improve the performance and features of the bvbx2 platform.
• Responsible gaming: Monitoring gameplay patterns to identify players who may need support and early intervention.
• Marketing communications: Sending promotional information and exclusive offers — only to members who have given their consent.

Data Sharing with Third Parties

Bvbx2 respects the trust you place in us. We do not sell or disclose your personal data to third parties for their own marketing purposes. However, there are certain situations where we need to share your information with the following parties:

Trusted Service Providers

Bvbx2 works with third-party service providers that help us operate the platform, including payment gateway providers (DuitNow, FPX, TNG eWallet, GrabPay), cloud service providers, data analytics companies, and licensed KYC service providers. All such providers are bound by strict data protection agreements and may only use your data for purposes specified by bvbx2.

Legal and Regulatory Requirements

Bvbx2 may be required to disclose your personal data to the relevant authorities when mandated by Malaysian law, court order, or legitimate regulatory requirements. In such situations, we will endeavour to notify you in advance unless prohibited by law from doing so.

Business Transfers

If bvbx2 is involved in any merger, acquisition, or transfer of business assets, member personal data may be transferred as part of that transaction. We will notify members of any such changes and ensure that appropriate data protection standards continue to be maintained.

Data Security and Protection

Bvbx2 continuously invests in sophisticated cybersecurity infrastructure to keep your personal data safe at all times. The technical and organisational security measures we implement include:

• Encryption of data in transit and at rest: All data transmitted between your device and bvbx2's servers is protected by TLS 1.3 protocol. Data stored in our databases is also encrypted using AES-256 standards.
• Role-based access control: Only authorised personnel who require access to specific data to carry out their assigned duties are granted permission. All access is logged and monitored.
• Two-Factor Authentication (2FA): bvbx2's internal systems require multi-factor authentication for all staff access to sensitive member data.
• Periodic security audits: bvbx2 undergoes independent security assessments on a regular basis to identify and address any system vulnerabilities before they can be exploited.
• 24-hour monitoring: Our threat detection system operates around the clock to identify suspicious activity and respond swiftly to any threats.

Use of Cookies

Cookies are small text files stored on your device when you visit the bvbx2 website. We use cookies to ensure the platform functions correctly, enhance the user experience and understand how members use our services.

Types of Cookies Used by bvbx2

• Essential Cookies (Required): Required for core platform functions such as login authentication, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies (Optional): Collecting information on how visitors use our website, such as the most frequently visited pages. This data is used for platform improvement and is aggregated without identifying individuals.
• Functional Cookies (Optional): Allows the platform to remember your preferences such as preferred language, geographic region and display settings for a more personalised experience.

You may manage or disable optional cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality and user experience of the bvbx2 platform.

Data Retention Period

Bvbx2 does not retain your personal data longer than is necessary to fulfil the purpose for which it was collected or to meet applicable legal requirements. Our general data retention policy is as follows:

• Active account data: Stored for the duration your account remains active and in use.
• Financial transaction data: Stored for a minimum of 7 years after the transaction date, in accordance with Malaysian legal requirements regarding financial records and AML compliance.
• KYC documents: Stored for 5 years after account closure or the date the document was submitted, whichever is later, in accordance with PDPA requirements and regulatory guidelines.
• Support communication logs: Stored for 2 years for service quality and dispute resolution purposes.
• Analytics and cookie data: Aggregated analytics data is stored for a maximum of 26 months. Session cookies expire when you close your browser; persistent cookies expire after a set period, typically no longer than 12 months.

Once the retention period ends, your personal data will be securely deleted or anonymised in accordance with approved procedures and cannot be recovered.

Your Rights as a Data Subject

Under the Malaysia Personal Data Protection Act 2010 (PDPA) and bvbx2's internal policies, you have the following rights regarding your personal data:

• Right of Access: You have the right to know what personal data we hold about you and to request a copy of it.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request a correction or update.
• Right to Erasure: In certain circumstances, you may request that we delete your personal data ("right to be forgotten"), subject to legal obligations that prevent such deletion.
• Right to Restrict Processing: You may object to or restrict the processing of your personal data for certain purposes, particularly direct marketing.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Withdraw Consent: You may withdraw consent previously given for specific data processing at any time, without affecting the validity of processing carried out prior to withdrawal.

International Data Transfers

The bvbx2 technical infrastructure may involve processing or storing data in data centres located across various locations. When your personal data is transferred outside Malaysia, bvbx2 ensures that such transfers are carried out with adequate safeguards, including:

• Data processing agreements that meet or exceed Malaysia's PDPA standards.
• Use of internationally recognised standard contractual clauses.
• Transfers only to countries or entities that provide an equivalent level of data protection.

Your data will not be transferred to jurisdictions lacking an adequate data protection framework without appropriate additional safeguards in place.

Amendments to This Privacy Policy

Bvbx2 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. The latest version of the Privacy Policy will always be available on this page with a clear last-updated date.

For significant amendments that affect how we use your personal data, bvbx2 will notify you via your registered email or an in-platform notification at least 14 days before the amendment takes effect. Continued use of the bvbx2 platform after the effective date of any amendment constitutes acceptance of the updated terms.