Privacy Policy

1 Introduction

bk8my ("bk8my", "we", "us", "our") operates the online gaming and sports betting platform accessible at bk8my.one (the "Platform"). This Privacy Policy applies to all personal data collected and processed by bk8my in connection with your use of the Platform, including account registration, deposits and withdrawals, gameplay, customer support interactions, and marketing communications.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

bk8my is committed to handling your personal data responsibly, in accordance with applicable data protection laws including, where relevant, the Malaysian Personal Data Protection Act 2010 (PDPA) and any equivalent legislation in other jurisdictions in which we operate.

2 Data Controller

For the purposes of applicable data protection law, bk8my is the data controller in respect of personal data collected through the Platform. This means bk8my determines the purposes and means by which your personal data is processed.

If you have any questions about how bk8my processes your personal data, or wish to exercise any of your data rights set out in Section 10, please contact our Data Protection contact using the details in Section 15.

3 Data We Collect

bk8my collects personal data in the following categories:

3.1 Registration & Identity Data

When you create a bk8my account, we collect your full name, date of birth, nationality, residential address (including city, state, and postcode), email address, and phone number. During Know Your Customer (KYC) verification, we may also collect copies of government-issued identity documents such as your Malaysian NRIC or passport, and proof of address documents.

3.2 Financial Data

We collect data necessary to process deposits and withdrawals, including payment method details (e-wallet identifiers for Touch 'n Go or Boost, bank account details for Maybank, CIMB, or Public Bank, or cryptocurrency wallet addresses), transaction amounts, transaction dates, and transaction references. bk8my does not store full payment card numbers on its own servers.

3.3 Usage & Technical Data

We automatically collect certain technical data when you access the Platform, including your IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, session duration, and click interactions. This data is collected via server logs and cookies as described in Section 9.

3.4 Communications Data

When you contact our customer support team via live chat or email, we retain records of those communications, including the content of your messages and our responses, for quality assurance, training, and dispute resolution purposes.

3.5 Responsible Gaming Data

If you use responsible gaming tools — such as setting deposit limits, activating cooling-off periods, or requesting self-exclusion — we record and retain this information to enforce your chosen restrictions and to comply with our responsible gaming obligations under applicable licensing requirements.

4 How We Use Your Data

bk8my uses your personal data for the following purposes:

• Account Administration: To create and manage your bk8my account, verify your identity, and maintain accurate records of your membership.
• Transaction Processing: To process deposits, withdrawals, and bonus payments in Malaysian Ringgit via your chosen payment method.
• Regulatory Compliance: To comply with our anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and reporting obligations to our licensing authority.
• Responsible Gaming: To enforce your self-imposed responsible gaming restrictions, monitor for signs of problem gambling, and provide support where appropriate.
• Fraud Prevention: To detect, investigate, and prevent fraudulent activity, account misuse, and technical exploitation of the Platform.
• Customer Support: To respond to your enquiries, resolve disputes, and improve our support service quality.
• Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the functionality and user experience of the bk8my Platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about new games or features at bk8my — only where you have consented to receive such communications or where we have a legitimate interest in doing so. You may opt out at any time.

5 Legal Basis for Processing

Where applicable data protection law requires bk8my to identify a legal basis for processing your personal data, we rely on the following:

• Contractual Necessity: Processing your identity, contact, and financial data is necessary to perform our contract with you (i.e., to provide the bk8my Platform and process your bets and transactions).
• Legal Obligation: Processing for AML compliance, KYC verification, regulatory reporting, and responsible gaming enforcement is required by applicable law and our licensing conditions.
• Legitimate Interests: Processing for fraud prevention, platform security, customer support quality monitoring, and aggregated analytics is based on bk8my's legitimate interests, balanced against your rights and interests.
• Consent: Processing for direct marketing communications and optional cookies is based on your consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

6 Data Sharing & Disclosure

bk8my does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Processors: Touch 'n Go, Boost, Maybank, CIMB, Public Bank, and cryptocurrency processing partners, to the extent necessary to process your deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party identity verification services used to fulfil our KYC obligations. These providers are contractually bound to process your data only for the purpose of identity verification.
• Regulatory & Licensing Authorities: bk8my's licensing authority and relevant regulatory bodies, as required by our licensing conditions and applicable law.
• Law Enforcement: Government agencies, courts, or law enforcement bodies, where we are legally compelled to disclose data or where disclosure is necessary to prevent or investigate fraud, money laundering, or other serious crime.
• Technology Service Providers: Cloud hosting, platform infrastructure, and cybersecurity service providers who process data on our behalf under binding data processing agreements that restrict their use of your data.
• Professional Advisors: Lawyers, accountants, and auditors acting in a professional capacity, under duties of confidentiality.

Any third party with whom bk8my shares personal data is required to maintain the confidentiality and security of that data and to process it only for the specified, disclosed purpose.

7 International Data Transfers

bk8my operates within a global technology and payments infrastructure. As a result, your personal data may be transferred to and processed in countries outside Malaysia, including countries that may not provide the same level of data protection as Malaysian law.

Where such transfers occur, bk8my ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require recipient organisations to adhere to equivalent data protection standards. If you would like more information about the safeguards bk8my relies on for international transfers, please contact us using the details in Section 15.

8 Data Retention

bk8my retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by legal and regulatory requirements:

• Account registration and KYC data is retained for a minimum of 5 years from the date of account closure, as required by AML regulations.
• Transaction records (deposits, withdrawals, bets) are retained for a minimum of 5 years from the date of each transaction.
• Customer support communication records are retained for 3 years from the date of the last communication.
• Technical and usage data collected via logs and cookies is typically retained for 12 months unless required longer for fraud investigation or legal proceedings.

When retention periods expire, bk8my securely deletes or anonymises your personal data so that it can no longer be associated with you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

9 Cookies & Tracking Technologies

bk8my uses cookies and similar tracking technologies on the Platform to provide a functioning, personalised, and secure user experience. The categories of cookies we use include:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They include session management cookies that keep you logged in to your bk8my account during a browsing session, security cookies that help detect and prevent fraudulent activity, and load-balancing cookies. These cannot be disabled without breaking core Platform functionality.

9.2 Functional Cookies

Functional cookies remember your preferences — such as your preferred language, remembered username (if you select "Remember me" at bk8my login), and display settings — so you don't have to re-configure these on every visit.

9.3 Analytics Cookies

We use analytics tools to collect aggregate, anonymised data about how visitors use the bk8my Platform — including which pages are visited most, how long sessions last, and where users navigate from. This data helps us improve the Platform experience. Analytics cookies are only placed with your consent.

You can manage your cookie preferences via your browser settings. Note that disabling certain cookies may impact the functionality of the bk8my Platform.

10 Your Data Rights

Subject to applicable law, you have the following rights in relation to your personal data held by bk8my:

• Right of Access: You may request a copy of the personal data bk8my holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Minor corrections (such as updating your phone number) can be made directly in your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to bk8my's legal retention obligations. Note that AML and regulatory requirements mean that some data must be retained for a minimum period even after account closure.
• Right to Restriction: You may request that bk8my restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or object to processing.
• Right to Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that bk8my provide your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. bk8my will cease processing for direct marketing immediately upon receiving your objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact us using the details in Section 15. bk8my will respond to verified data rights requests within 30 days. We may require identity verification before processing your request.

11 Children's Privacy

The bk8my Platform is strictly for adults aged 21 years and above. bk8my does not knowingly collect personal data from persons under 21 years of age. If we become aware that we have collected personal data from a person under 21, we will take immediate steps to delete that data and close the associated account.

If you believe that a person under 21 has registered an account on the bk8my Platform, please contact us immediately at the details provided in Section 15 so that we can investigate and take appropriate action.

12 Security Measures

bk8my implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and bk8my's servers;
• Encrypted storage of passwords using industry-standard hashing algorithms — bk8my staff cannot view your password in plain text;
• Segregation of player funds from operational funds, with independent audit;
• Role-based access controls limiting internal access to personal data to staff who require it to perform their duties;
• Regular security assessments and penetration testing of Platform infrastructure;
• Anomaly detection systems that flag unusual account activity for review.

While bk8my takes all reasonable steps to protect your data, no system is completely immune to security risks. If you believe your bk8my account has been compromised, contact our 24/7 live chat support immediately.

13 Third-Party Links

The bk8my Platform may contain references to third-party services, including payment providers and game software providers. This Privacy Policy applies only to data collected by bk8my through bk8my.one. Third-party services have their own privacy policies, and bk8my is not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you interact with in connection with your bk8my account.

14 Policy Updates

bk8my reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our licensing requirements. Material updates to this Policy will be communicated to registered Members via email to the address on record and/or via a notice displayed on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this page reflects when this Policy was most recently revised. Your continued use of the bk8my Platform following the effective date of any update constitutes your acknowledgment of the revised Policy. If you do not agree to the updated Policy, you must discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or bk8my's handling of your personal data, please contact our team through the following channels:

• Live Chat: Available 24/7 via the chat widget on the Platform. Recommended for urgent privacy concerns.
• Email: [email protected] — for formal data rights requests, complaints, and detailed privacy enquiries. Please allow up to 30 days for a full response to data rights requests.

When submitting a data rights request by email, please include your full name, registered email address, and a brief description of your request. bk8my may request additional identity verification before processing your request to protect against unauthorised access to your data.