Privacy Policy

This Privacy Policy (hereinafter referred to as "this Policy") is issued by bm96 (hereinafter referred to as "bm96", "we", "us", or "our") and governs the collection, processing, storage, and disclosure of personal data obtained from users (hereinafter referred to as "you", "the User", or "the Player") who access or use the bm96 platform at https://bm96.cam and all associated services, features, and functionalities.

bm96 is committed to protecting your privacy and handling your personal data responsibly. We operate in accordance with internationally recognised data protection principles and in compliance with the requirements applicable under our international gaming licence.

By registering an account, visiting the bm96 platform, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the bm96 platform immediately.

This Policy should be read in conjunction with bm96's Terms & Conditions and Responsible Gambling Policy, which are incorporated herein by reference.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or could reasonably be used to identify a living individual, including but not limited to name, identification number, contact details, payment information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means bm96, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of bm96 pursuant to written instructions and data processing agreements.
• "KYC" means Know Your Customer — the identity and age verification process required by bm96 for regulatory compliance purposes.
• "Sensitive Data" means a category of personal data requiring heightened protection, including government-issued identification documents, financial records, and biometric data.
• "Cookies" means small text files stored on your device by your web browser when you visit bm96, used to remember preferences and facilitate platform functionality.
• "Platform" means the bm96 website at https://bm96.cam and all associated services, games, and betting facilities.

bm96 collects the following categories of personal data from users, depending on the nature of your interaction with the platform:

bm96 collects personal data through the following methods:

• Direct Submission: Information you actively provide during account registration, KYC document submission, deposit or withdrawal requests, promotional opt-ins, and communications with our support team.
• Automated Technical Collection: Technical and usage data collected automatically when you access the platform, including through cookies, web beacons, log files, and similar tracking technologies. This includes your IP address, device identifiers, and browsing behaviour on the platform.
• Payment Processors: Financial transaction data shared with bm96 by your payment provider (e.g., Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks) as part of deposit and withdrawal processing. bm96 does not store full payment card numbers.
• Identity Verification Providers: Where bm96 engages third-party KYC verification service providers, those providers may share identity verification results and risk assessments with bm96 as data processors acting under bm96's instructions.
• Third-Party Sources: In limited circumstances, bm96 may receive data from publicly available sources or fraud-prevention databases for the purpose of verifying identity or detecting prohibited conduct.

bm96 processes your personal data for the following purposes:

• Account Administration: To create and manage your bm96 account, authenticate your identity at login, and maintain accurate account records.
• KYC & Age Verification: To verify your identity and confirm that you are at least 21 years of age, as required by our international licensing obligations and responsible gambling commitments.
• Payment Processing: To process deposits and withdrawals in Malaysian Ringgit (MYR) through supported Malaysian payment methods, including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect.
• Service Delivery: To provide access to online casino games, sports betting markets (including Liga Super Malaysia, EPL, UFC), live dealer tables, and all other platform features.
• Customer Support: To receive, investigate, and respond to your enquiries, complaints, and support requests through live chat and email.
• Fraud Prevention & Security: To detect and prevent fraud, money laundering, identity theft, account compromise, and other prohibited conduct in accordance with our anti-money-laundering (AML) obligations.
• Legal & Regulatory Compliance: To comply with obligations under our international gaming licence, applicable anti-money-laundering frameworks, and any lawful requests from competent authorities.
• Responsible Gambling: To monitor gameplay patterns for indicators of problem gambling and to administer responsible gambling tools, including deposit limits, cooling-off periods, and self-exclusion requests.
• Platform Improvement: To analyse usage data and improve the performance, functionality, and user experience of the bm96 platform.
• Marketing Communications: To send promotional offers, bonus notifications, and relevant platform updates to users who have provided their consent to receive such communications. You may opt out at any time.

bm96 processes your personal data on the following legal bases, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform the contract between you and bm96, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required for bm96 to comply with applicable regulatory obligations, including KYC verification, AML reporting, and age verification requirements under our international licensing framework.
• Legitimate Interests: Processing carried out in pursuit of bm96's legitimate interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, and informed consent — for example, the sending of direct marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

bm96 does not sell, rent, or trade your personal data to any third party for their own independent commercial purposes. Your data may be shared in the following strictly limited circumstances:

• Payment Service Providers: Your financial data is shared with payment processors (including Touch 'n Go eWallet, DuitNow, FPX providers, and Malaysian banks) solely to facilitate deposit and withdrawal transactions.
• Identity Verification Providers: KYC documents and identity data may be shared with contracted third-party verification service providers who process such data exclusively on bm96's behalf under data processing agreements.
• Game Technology Providers: Aggregated, anonymised gameplay data may be shared with game software providers for the purpose of RNG auditing, RTP monitoring, and technical support. Individual player identity is not shared with game providers.
• Fraud Prevention & Security Services: We may share data with fraud detection and cyber-security service providers to protect the platform and its users from unlawful activity.
• Legal & Regulatory Authorities: bm96 may disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable law, court order, or as necessary to protect bm96's legal rights.
• Professional Advisers: Personal data may be disclosed to legal counsel, auditors, or other professional advisers engaged by bm96, subject to confidentiality obligations.

bm96 uses cookies and similar tracking technologies to ensure the proper functioning of the platform, improve user experience, and gather analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These cookies enable core features such as user authentication, session management, and security controls. They cannot be disabled without significantly impairing platform functionality.
• Functional Cookies: Used to remember your preferences, language settings, and platform customisations so that you do not need to re-enter them on each visit.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the bm96 platform — including pages visited, time spent, and error occurrences. This data helps us improve platform performance and user experience.
• Security Cookies: Used to detect suspicious activity, enforce session timeouts, and protect against cross-site request forgery and other security threats.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from accessing certain features of the bm96 platform, including account login. bm96 does not use third-party advertising cookies or behavioural tracking cookies for the purpose of serving advertisements on third-party websites.

bm96 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the bm96 platform is encrypted in transit using industry-standard TLS protocols.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest within bm96's secure data storage infrastructure.
• Access Controls: Strict role-based access controls ensure that personal data is accessible only to authorised personnel with a legitimate operational need.
• Regular Security Audits: bm96 conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities in its technical infrastructure.
• Incident Response: bm96 maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to your rights and freedoms, bm96 will notify affected users without undue delay.

While bm96 applies robust security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account login credentials and for notifying bm96 immediately if you suspect unauthorised access to your account.

bm96 retains personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required to comply with applicable legal, regulatory, or licensing obligations. The following general retention periods apply:

• Account Data: Retained for the duration of your account's existence on bm96, plus a minimum period of five (5) years following account closure, to satisfy anti-money-laundering and regulatory record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, in accordance with standard AML compliance requirements applicable to internationally licensed gaming operators.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Records: Retained for two (2) years from the date of last interaction, unless a longer retention period is required for ongoing dispute resolution or legal proceedings.
• Marketing Data: Retained until you withdraw your consent to receive marketing communications, at which point it will be deleted or anonymised within a reasonable period.

Following the expiry of applicable retention periods, personal data will be securely deleted or irreversibly anonymised.

Subject to applicable law and bm96's legitimate interests and regulatory obligations, you have the following rights in relation to your personal data:

To exercise any of the rights listed above, please contact our Data Protection team via the support email address provided in Section 16 of this Policy. We will respond to verified requests within thirty (30) calendar days of receipt.

bm96 is strictly intended for use by persons who are at least 21 years of age. bm96 does not knowingly collect personal data from any person under the age of 21.

If bm96 discovers or is notified that it has collected personal data from an individual who is under 21 years of age, bm96 will immediately suspend the relevant account and take all reasonable steps to delete that individual's personal data from its systems without undue delay.

Parents and guardians who believe that a minor under their care has registered an account or submitted personal data to bm96 without their consent are encouraged to contact our support team immediately. We will investigate and act upon verified reports promptly.

As bm96 operates under an international gaming licence and engages service providers located in various jurisdictions, your personal data may be transferred to and processed in countries outside Malaysia. bm96 ensures that any such international transfers are carried out subject to appropriate safeguards, including:

• Contractual data processing agreements with all data processors that incorporate standard data protection clauses;
• Requirements that receiving parties implement technical and organisational security measures consistent with those applied by bm96; and
• Where applicable, transfers to countries that have been assessed to provide an adequate level of data protection under applicable international standards.

By using the bm96 platform, you acknowledge and consent to the international transfer of your personal data on the basis described above.

The bm96 platform may contain references to payment service providers and other third-party services (including Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect) in the context of facilitating transactions. Interaction with these providers is subject to their own respective privacy policies and terms of service.

bm96 is not responsible for the privacy practices, data handling procedures, or content of any third-party services. bm96 encourages you to review the privacy policies of any third-party service providers you interact with in connection with your use of the bm96 platform.

bm96 does not embed third-party advertising networks, social media tracking pixels, or affiliate tracking tools on its platform that would result in your personal data being shared with such third parties without your explicit consent.

bm96 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in applicable law, our business practices, or our regulatory obligations. Where amendments are material, bm96 will provide advance notice to registered users via email or a prominent platform notification prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Your continued use of the bm96 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you should cease using bm96 and may request account closure through our customer support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bm96, please contact our Data Protection team using the following channels:

• Support Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in the subject line of your email for faster routing.
• Live Chat: Available 24 hours a day, 7 days a week via the bm96 platform. Average response time under 2 minutes.

bm96 aims to acknowledge all data protection requests within two (2) business days and to provide a substantive response within thirty (30) calendar days. Complex requests may require additional time, in which case bm96 will notify you of the expected timeline.

If you are not satisfied with bm96's response to your data protection request, you have the right to escalate your complaint to the data protection authority competent for the jurisdiction under which bm96's international licence is issued.