bm96 Privacy Policy

1. Introduction

bm96 ("we", "us", "our", "the Operator") is committed to protecting the privacy and personal data of every player who accesses or uses the bm96 Platform at bm96.net. This Privacy Policy describes in plain terms what personal data bm96 collects, why we collect it, how we use and protect it, and what rights you hold in relation to your data.

By registering an account with bm96 or by continuing to use the Platform after this Privacy Policy has been published or updated, you acknowledge that you have read and understood this Policy. This Privacy Policy should be read in conjunction with the bm96 Terms and Conditions, which govern your use of the Platform as a whole.

bm96 is mindful that its player base consists primarily of Malaysian users who entrust their identity documents, payment information, and session behaviour data to the Platform. We take that trust seriously. This Policy outlines the specific ways in which that trust is honoured.

2. Data Controller

For the purposes of data protection law and international gaming authority compliance, bm96 is the data controller responsible for your personal data as collected through the bm96 Platform. All data processing activities described in this Policy are carried out by or on behalf of bm96 in accordance with applicable data protection frameworks.

If you have any queries about how bm96 processes your personal data, or wish to exercise any rights described in this Policy, please contact our Data Protection contact via the support email: [email protected] (plain text — not a hyperlink).

3. Personal Data We Collect

3.1 Registration Data

When you create a bm96 account, we collect your chosen username, email address, date of birth, and the mobile phone number used for SMS verification. This information is required to create and maintain your account and to verify that you meet the 21+ age requirement for Platform access.

3.2 Identity Verification (KYC) Data

Before processing any withdrawal, bm96 requires KYC verification. This involves collecting a copy of a government-issued identity document (Malaysian IC or passport), proof of address, and in some cases a selfie photograph for biometric comparison. KYC data is processed exclusively for identity and age verification purposes and is retained in accordance with international gaming authority guidelines.

3.3 Financial and Transaction Data

bm96 collects records of all deposits, withdrawals, bonuses, and wager transactions associated with your Account. This includes the payment method used (e.g., Touch n Go eWallet, Boost, Maybank FPX, CIMB, Public Bank), transaction amounts in MYR, timestamps, and reference numbers. Card or e-wallet numbers are not stored by bm96 directly — these are handled by our PCI-compliant payment service providers.

3.4 Technical and Device Data

When you access the bm96 Platform, we automatically collect technical data including your IP address, browser type and version, operating system, device type, screen resolution, and session timestamps. This data is used for security monitoring, fraud prevention, and performance analytics.

3.5 Gameplay and Behavioural Data

bm96 records gameplay activity including games played, wagers placed, session duration, and responsible gaming tool interactions. This data is used to operate the Platform, detect unusual activity, fulfil regulatory reporting requirements, and personalise your experience where applicable.

3.6 Communications Data

If you contact bm96 support via live chat or email, we retain records of those communications for quality assurance, training, and dispute resolution purposes.

4. How We Collect Your Data

bm96 collects personal data through the following means:

• Direct collection: information you provide during registration, KYC submission, deposit or withdrawal requests, and communications with support;
• Automatic collection: technical and behavioural data collected via server logs, session monitoring systems, and cookie-based analytics as you use the Platform;
• Third-party sources: identity verification data cross-checked against external KYC databases; fraud screening results from third-party fraud prevention services; and payment confirmation data from payment processors.

5. Legal Basis for Processing

bm96 processes your personal data under the following legal bases:

• Contractual necessity: processing required to create and maintain your account, execute transactions, and deliver platform services;
• Legal obligation: processing required to comply with international gaming authority regulations, anti-money laundering (AML) obligations, and identity verification requirements;
• Legitimate interest: processing for fraud detection, security monitoring, and platform analytics where this does not override your privacy rights;
• Consent: processing for optional marketing communications, which you may withdraw at any time.

6. How We Use Your Personal Data

bm96 uses the personal data we collect for the following purposes:

• Creating, managing, and securing your bm96 account;
• Verifying your identity and age (21+) in compliance with international gaming authority requirements;
• Processing deposits and withdrawals in MYR via your selected payment method;
• Detecting and preventing fraud, money laundering, and account abuse;
• Fulfilling responsible gaming obligations — monitoring for signs of problem gambling behaviour, administering self-exclusion and limit requests;
• Responding to your support enquiries and resolving disputes;
• Providing personalised content, offers, and promotions where you have not opted out of marketing communications;
• Conducting platform performance analytics and improving the bm96 user experience;
• Complying with applicable regulatory, legal, and reporting obligations.

7. Sharing Personal Data with Third Parties

bm96 does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. We share personal data only in the following circumstances:

• KYC and identity verification providers: to verify your identity and age against external databases as required by international gaming authority compliance;
• Payment service providers: to process deposits and withdrawals via Touch n Go eWallet, Boost, FPX, and other supported Malaysian payment methods. These providers are contractually bound to use your data solely for payment processing;
• Fraud and AML screening services: to identify and prevent money laundering, fraudulent activity, and account abuse;
• Regulatory and law enforcement authorities: where bm96 is required by law, court order, or international gaming authority direction to disclose personal data;
• Platform analytics and security providers: who process technical and session data on bm96's behalf under data processing agreements that restrict their use of the data.

All third-party service providers engaged by bm96 are required to implement appropriate technical and organisational security measures consistent with the data protection standards applicable under international gaming authority frameworks.

8. International Data Transfers

Some of bm96's service providers — particularly KYC verification and payment processing partners — may be located outside Malaysia. Where personal data is transferred internationally, bm96 ensures that appropriate safeguards are in place, including contractual data protection clauses consistent with applicable data protection frameworks. bm96 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without ensuring appropriate alternative safeguards are in place.

9. Data Retention

bm96 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account registration and KYC data: retained for a minimum of five (5) years from the date of account closure, in compliance with international gaming authority AML obligations;
• Transaction and financial records: retained for a minimum of five (5) years from the date of each transaction;
• Support and communications records: retained for a minimum of two (2) years from the date of the communication;
• Technical and session logs: retained for a minimum of twelve (12) months from the date of the session.

Where retention beyond the applicable minimum period is required for ongoing legal proceedings, regulatory investigation, or dispute resolution, bm96 will retain the relevant data until that matter is resolved.

10. Cookies and Tracking Technologies

The bm96 Platform uses cookies and similar tracking technologies. The categories of cookies in use are:

• Strictly necessary cookies: required for the Platform to function, including session authentication and security tokens. These cannot be disabled.
• Functional cookies: used to remember your preferences such as language settings and responsible gaming tool configurations.
• Analytics cookies: used to collect aggregated, anonymised data on how players navigate the Platform. This data helps bm96 improve usability and performance. Analytics cookies may be declined via your browser settings without affecting Platform functionality.

bm96 does not use third-party advertising or retargeting cookies. Your browsing activity on the bm96 Platform is not shared with advertising networks for the purpose of serving advertisements on other websites.

11. Your Privacy Rights

Subject to applicable data protection law and the legal retention obligations described in Section 9, you have the following rights in relation to your personal data held by bm96:

• Right of access: to request a copy of the personal data bm96 holds about you;
• Right to rectification: to request correction of inaccurate or incomplete personal data;
• Right to erasure: to request deletion of your personal data where bm96 no longer has a legal basis to retain it;
• Right to restriction: to request that bm96 restrict processing of your data while a correction or objection is being assessed;
• Right to object: to object to processing carried out on the basis of legitimate interest, including profiling;
• Right to data portability: to receive your personal data in a structured, machine-readable format where technically feasible;
• Right to withdraw consent: where processing is based on your consent (e.g., marketing emails), to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact bm96 at [email protected] (plain text — not a hyperlink). bm96 will respond to verified requests within thirty (30) days. Where a request is complex or numerous, this period may be extended by a further sixty (60) days with prior notice.

12. Security Measures

bm96 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• TLS encryption for all data in transit between your browser and the bm96 Platform;
• AES-256 encryption for personal data and financial records stored on bm96 servers;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Audit logs of all internal data access events;
• Regular security assessments and penetration testing of Platform infrastructure;
• SMS-verified account registration to prevent unauthorised account creation.

Despite these measures, no internet transmission or digital storage system is entirely secure. If you become aware of any security vulnerability or incident relating to your bm96 account, please notify us immediately at [email protected].

13. Children and Minors

The bm96 Platform is strictly restricted to persons aged 21 and above. bm96 does not knowingly collect personal data from persons under the age of 21. Age is verified through the KYC process prior to withdrawal processing. Where bm96 identifies or suspects that a registered account holder is under 21, the account will be suspended immediately, KYC verification will be required, and any balance may be withheld pending investigation.

If you are a parent or guardian and believe that a minor under your care has registered a bm96 account, please contact our support team immediately at [email protected] so the account can be closed and the matter investigated.

14. Marketing Communications

bm96 may send you promotional emails, SMS messages, or in-platform notifications about offers, bonuses, and new features where you have consented to receive such communications. Consent is obtained separately from the general registration process and is not a condition of account access.

You may withdraw your consent to marketing communications at any time by updating your notification preferences in the Account settings panel or by contacting support. Withdrawal of consent does not affect your ability to continue using the bm96 Platform or to receive operational communications necessary for the management of your account (such as transaction confirmations, KYC requests, or responsible gaming notifications).

15. Amendments to This Privacy Policy

bm96 reserves the right to amend this Privacy Policy at any time. Where amendments are material, bm96 will notify registered account holders via email to the address on file or via a prominent notice on the Platform prior to the amendments taking effect. The "Last Updated" date at the top of this Policy reflects the most recent revision.

Continued use of the bm96 Platform following the effective date of any amendment to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you should close your account and withdraw your balance prior to the effective date.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a data security concern, please contact the bm96 Data Protection team:

Email: [email protected] (plain text — not a clickable link)
Channel: Live chat available through the bm96 Platform during support hours

bm96 aims to respond to all privacy-related enquiries within two (2) business days. For urgent data security matters — including suspected unauthorised access to your account — live chat is recommended for the fastest response.