bk8mas Privacy Policy

1. Introduction

bk8mas ("bk8mas", "we", "us", "our") respects the privacy of every person who accesses the bk8mas platform at bk8mas.app ("Platform"). This Privacy Policy ("Policy") describes the categories of personal data we collect, the purposes for which that data is processed, how it is protected, and the rights available to you in relation to your personal data.

This Policy applies to all users of the bk8mas Platform, including registered Players, prospective registrants, and visitors to the website. By accessing or using the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read together with the bk8mas Terms & Conditions, which govern your use of the Platform and incorporate this Policy by reference.

2. Data Controller

bk8mas acts as the data controller in respect of personal data collected from Players and visitors via the Platform. As data controller, bk8mas determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection law.

Where bk8mas engages third-party service providers to process data on its behalf — for example, payment processors, identity verification providers, or fraud prevention services — those providers act as data processors under contracts that bind them to process data solely on bk8mas's documented instructions and to implement appropriate technical and organisational security measures.

3. Categories of Personal Data We Collect

bk8mas collects and processes the following categories of personal data:

• Identity Data: Full legal name, date of birth, nationality, gender, and government-issued identification number (e.g., Malaysian MyKad number or passport number).
• Contact Data: Registered email address, Malaysian mobile phone number, and, where provided, residential address.
• Account Data: bk8mas username, encrypted account password, account creation date, account status, and verification tier.
• Financial Data: Payment method identifiers (e.g., e-wallet account identifiers, masked bank account details), deposit and withdrawal transaction records denominated in MYR, and bonus redemption history. Full payment card numbers are never stored by bk8mas.
• Gaming Data: Complete bet history across all Platform verticals (casino, sportsbook, slots, jackpot), game session logs, wagering amounts, game outcomes, and responsible gaming tool settings and activation records.
• KYC and Verification Documents: Copies of government-issued photographic identification, proof of address documents, and source-of-funds documentation where required under our KYC programme.
• Technical Data: IP address, device type, operating system, browser type and version, time zone, and session timestamps.
• Usage Data: Platform navigation paths, page views, feature interactions, search queries within the Platform, and login history logs.
• Communications Data: Records of support interactions via live chat, email correspondence with the bk8mas support team, and dispute correspondence.

4. How We Collect Personal Data

bk8mas collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting support, or completing any form on the Platform.
• Automated Collection: Technical and usage data collected automatically when you access the Platform via cookies, server logs, and similar tracking technologies, as further described in Section 7 (Cookies & Tracking).
• Third-Party Sources: Identity and fraud risk data received from licensed identity verification providers, payment processors, and fraud prevention services where required to complete KYC verification or assess transaction risk.
• Regulatory Sources: Self-exclusion status data received from gaming authority databases or other operators where bk8mas is required to cross-check self-exclusion registers under its licence conditions.

5. Purposes and Legal Basis for Processing

bk8mas processes personal data for the following purposes, each supported by an identified legal basis:

• Account Administration and Contract Performance: Processing necessary to create and manage your bk8mas account, verify your identity, and deliver the gaming services you have contracted for. Legal basis: performance of contract.
• Payment Processing: Processing necessary to execute deposits, withdrawals, and refunds in MYR via your chosen payment method. Legal basis: performance of contract.
• Regulatory Compliance: Processing necessary to comply with KYC obligations, anti-money laundering requirements, age verification, and gaming authority licence conditions. Legal basis: compliance with legal obligation.
• Fraud Prevention and Security: Processing to detect, investigate, and prevent fraudulent transactions, account takeover attempts, and prohibited conduct as defined in the bk8mas Terms & Conditions. Legal basis: legitimate interests.
• Responsible Gaming: Processing gaming activity data to identify patterns potentially indicative of problem gambling and to administer voluntary responsible gaming tools including deposit limits, self-exclusion, and reality checks. Legal basis: legal obligation and legitimate interests.
• Customer Support: Processing communications data to manage and resolve support requests, complaints, and disputes. Legal basis: performance of contract and legitimate interests.
• Platform Improvement: Analysing aggregated usage data to improve Platform functionality, game selection, and user experience. Legal basis: legitimate interests. Aggregated analytical data used for this purpose does not identify individual Players.
• Marketing Communications: Sending promotional offers, bonus notifications, and product updates to Players who have opted in to receive such communications. Legal basis: consent. You may withdraw consent at any time via your Account Settings or by contacting support.

6. Data Sharing and Disclosure

bk8mas does not sell, rent, or share your personal data with third parties for their own commercial purposes. Data is shared only in the following circumstances:

• Payment Service Providers: Personal and financial data is shared with licensed payment processors (including providers of Touch n Go eWallet, Boost, GrabPay, and bank transfer services) to the minimum extent necessary to execute your requested transactions.
• Identity Verification Providers: Identity data and KYC documents are shared with licensed identity verification and fraud prevention service providers engaged by bk8mas to fulfil its KYC programme obligations.
• Gaming Authority and Regulatory Bodies: bk8mas may be required by its gaming authority licence or applicable law to disclose Player data to regulatory bodies, law enforcement agencies, or anti-money laundering authorities. Such disclosure is made only to the extent required by the applicable legal obligation.
• Game Providers: Session identifiers and wagering data are shared with certified game providers operating within the bk8mas Platform to the extent necessary to deliver game services and resolve game disputes. Full identity data is not shared with game providers.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of bk8mas's business, Player data may be transferred to the acquiring entity subject to that entity maintaining equivalent privacy protections. Players will be notified of any such transfer in advance.

7. Cookies and Tracking Technologies

bk8mas uses cookies and similar technologies on the Platform for the following purposes:

• Strictly Necessary Cookies: Session cookies required to maintain your authenticated login state and enable core Platform functionality. These cannot be disabled without impairing Platform operation.
• Functional Cookies: Cookies that remember your preferences — such as language settings and responsible gaming tool configurations — to improve your experience across sessions.
• Analytical Cookies: Cookies that collect aggregated, anonymised data about how Players navigate the Platform. This data informs product development and does not identify individual Players.
• Security Cookies: Cookies used to detect and prevent fraudulent access attempts and maintain session integrity.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, though some functional preferences may not be retained between sessions.

8. Data Retention

bk8mas retains personal data for the period necessary to fulfil the purposes described in this Policy, subject to the following minimum retention standards:

• Account and identity data is retained for a minimum of five (5) years following account closure, in compliance with anti-money laundering and gaming authority record-keeping obligations.
• Transaction and gaming history data is retained for a minimum of five (5) years following the date of each transaction, for the same regulatory purposes.
• Support and communications records are retained for three (3) years following resolution of the relevant interaction.
• KYC documentation is retained for the period required by the applicable regulatory framework governing bk8mas's gaming authority licence.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

9. Security Measures

bk8mas implements a layered set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption on all data transmitted between the Platform and user devices;
• Encrypted storage of all personal and financial data at rest;
• Strict role-based access controls limiting data access to authorised personnel with a documented business need;
• Two-factor authentication available for all Player accounts and mandated for internal administrative access;
• Regular third-party security audits and penetration testing of Platform infrastructure;
• Formal incident response procedures in place for potential data security events.

In the event of a data security incident that poses a material risk to affected Players, bk8mas will notify impacted individuals promptly and in accordance with applicable notification obligations under its regulatory framework.

10. Your Data Rights

Subject to applicable law and the terms of bk8mas's regulatory obligations, you have the following rights in relation to your personal data held by bk8mas:

• Right of Access: You may request a copy of the personal data bk8mas holds about you.
• Right of Rectification: You may request correction of inaccurate or incomplete personal data. Many account details can be updated directly within your bk8mas account settings.
• Right to Erasure: You may request deletion of your personal data, subject to bk8mas's legal and regulatory retention obligations. Requests for erasure cannot be fulfilled in respect of data that bk8mas is required to retain under its gaming authority licence or anti-money laundering obligations.
• Right to Restrict Processing: You may request that bk8mas restrict the processing of your personal data in defined circumstances, including while a rectification request is under review.
• Right to Data Portability: You may request that bk8mas provide your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract performance.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. Objections to marketing communications can be actioned immediately via Account Settings.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the bk8mas support team via 24/7 live chat or the support email displayed in the footer. bk8mas will respond to verified requests within thirty (30) days. Identity verification will be required before any data rights request is actioned.

11. Children's Privacy

bk8mas is strictly an adult platform. The minimum age to register and use bk8mas is twenty-one (21) years. 21+ bk8mas does not knowingly collect personal data from persons under the age of 21. If bk8mas discovers that personal data has been collected from a person under 21, the relevant account will be immediately closed, all data will be deleted to the extent permitted by regulatory retention obligations, and any funds associated with the account will be handled in accordance with applicable regulatory guidance.

If you believe that a person under the age of 21 has registered on bk8mas, please contact the support team immediately via live chat so that the matter can be investigated and resolved promptly.

12. International Data Transfers

bk8mas's Platform infrastructure and certain data processing operations may involve the transfer of personal data to jurisdictions outside Malaysia, including to countries where bk8mas's gaming authority licence is domiciled and to the locations of third-party service providers. Where such transfers occur, bk8mas ensures that appropriate safeguards are in place — including contractual data protection provisions in agreements with service providers — to protect personal data to an equivalent standard as required under applicable data protection law.

13. Changes to This Privacy Policy

bk8mas reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or Platform services. Material changes will be communicated to registered Players via the email address on their bk8mas account record, and the "Last Updated" date at the head of this Policy will be revised. Continued use of the Platform following notification of material changes constitutes acceptance of the revised Policy. If you do not accept the revised Policy, you must close your bk8mas account before the effective date of the changes.

14. Contact and Data Rights Requests

For any questions regarding this Privacy Policy, to exercise your data rights, or to raise a privacy concern, please contact the bk8mas Data Protection team via 24/7 live chat on the Platform or by writing to the support email address displayed in the site footer. All privacy enquiries and data rights requests will be acknowledged within five (5) business days and resolved within thirty (30) days of receipt, subject to identity verification requirements.