Privacy Policy

This Privacy Policy ("Policy") issued by BMM88 ("BM88", "we", "us", "our") and applies to all personal data collected, processed, stored, and shared in connection with your use of the BMM88 website located at https://bmm88.lat and any associated services, features, or communications (collectively, the "Platform").

BM88 operates as an online gaming and sports betting platform principally serving adult Malaysian users and other internationally eligible users. In the course of providing our services, we necessarily collect and process certain categories of personal information about you. This Policy describes those practices in full, in plain and transparent language.

We take your privacy seriously. We are committed to processing your personal data lawfully, fairly, and transparently, and to maintaining appropriate technical and organisational safeguards against unauthorised access, loss, or misuse of your information.

By registering an account, accessing the Platform, or providing us with your personal information in any way, you acknowledge that you have read and understood this Policy and consent to our data processing practices as described herein.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

BMM88 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, we are responsible for ensuring that your personal data is processed in accordance with this Policy and applicable data protection principles.

BM88 operates under international licensing from a recognised offshore jurisdiction. While we are not regulated by any Malaysian government authority, we voluntarily adopt data handling standards aligned with internationally recognised privacy frameworks, including principles consistent with the General Data Protection Regulation (GDPR) and Malaysia's Personal Data Protection Act 2010(PDPA) where applicable to our operations.

BM88 collects personal data across several categories depending on how you interact with the Platform. The following table sets out the categories of data we collect and their primary purposes:

We do not collect special categories of sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes, unless strictly required by applicable law or KYC regulations — and only then with your explicit consent where required.

BM88 collects personal data through the following mechanisms:

• Directly from you: When you register an account, complete the KYC process, make a deposit or withdrawal, contact our support team, participate in promotions, or otherwise interact with Platform features;
• Automatically: When you access the Platform, our servers and analytics systems automatically collect technical and behavioural data including your IP address, device identifiers, session duration, and clickstream data via cookies and similar tracking technologies;
• From payment processors: When you make a deposit or withdrawal via Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or cryptocurrency networks, our payment processing partners share transaction confirmation data with us for reconciliation and fraud prevention purposes;
• From identity verification partners: Third-party KYC service providers may share the results of identity checks conducted on our behalf;
• From fraud prevention services: We may receive risk signals and indicators from third-party fraud detection and AML screening services;
• From publicly available sources: We may supplement your profile with data from publicly available registers where required for compliance screening purposes.

BM88 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to provide our services to you under the Terms & Conditions, including account management, deposits, withdrawals, and customer support;
• Legal obligation: Processing required to comply with our obligations under applicable laws, including anti-money laundering (AML) requirements, KYC regulations, and data retention laws;
• Legitimate interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, product improvement, and responsible gambling monitoring — provided these interests are not overridden by your rights and freedoms;
• Consent: Processing for purposes where you have provided explicit and freely given consent, such as receiving promotional communications, personalised offers, or participating in optional data analytics programmes. You may withdraw consent at any time without affecting the lawfulness of prior processing.

BM88 uses your personal data for the following purposes:

• To create, manage, and maintain your BM88 Account;
• To verify your identity and age in accordance with our KYC obligations (21+ verification is mandatory);
• To process deposits and withdrawals through Malaysian payment channels including Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, and others;
• To detect and prevent fraud, money laundering, collusion, and other prohibited activities;
• To provide customer support via live chat, email, and other communication channels;
• To monitor and manage your gaming activity for responsible gambling purposes, including identifying patterns that may indicate problematic gambling behaviour;
• To administer promotions, bonuses, and VIP programme benefits;
• To send you transactional communications such as deposit confirmations, withdrawal notifications, and security alerts;
• To send you marketing and promotional communications where you have consented to receive them;
• To analyse Platform usage, identify technical issues, and improve our services;
• To comply with our legal and regulatory obligations, including records retention requirements;
• To enforce our Terms & Conditions and protect the rights, property, and safety of BMM88 and our users.

BMM88 does not sell your personal data. We share your data only with the following categories of recipients, and only to the extent strictly necessary:

• Payment service providers: Banks and e-wallet operators (including Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, and FPX gateway operators) receive the minimum data necessary to process your transactions;
• Identity verification and KYC providers: Third-party KYC platforms that conduct identity checks on our behalf, operating under strict data processing agreements;
• Fraud prevention and AML screening services: Providers of risk scoring, sanctions screening, and anti-fraud intelligence services;
• Customer support technology providers: Platforms that power our live chat, ticketing, and communication infrastructure;
• Analytics and platform technology providers: Services that help us maintain, secure, and improve the Platform's technical performance;
• Regulatory and law enforcement authorities: We may be legally required to disclose your data to regulators, law enforcement agencies, or courts in response to a lawful order or request. We will not disclose data voluntarily to any authority without a valid legal mandate;
• Professional advisers: Lawyers, auditors, and compliance consultants acting on BM88's behalf, subject to confidentiality obligations;
• Business successors: In the event of a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom we share your data are required to process it only for the specified purpose, maintain appropriate security standards, and comply with applicable data protection laws.

BMM88 operates internationally, and your personal data may be transferred to and processed in countries outside Malaysia. Some of these countries may not have data protection laws equivalent in strength to those applicable in your jurisdiction.

Where we transfer your personal data internationally, we implement appropriate safeguards to ensure your data receives an adequate level of protection. Such safeguards may include:

• Contractual data transfer agreements incorporating standard data protection clauses;
• Transfers to jurisdictions recognised as providing an adequate level of data protection;
• Binding corporate rules where applicable to intra-group transfers;
• Your explicit consent to the specific transfer, where obtained.

By using the Platform, you acknowledge that your data may be transferred, stored, and processed internationally. You may contact our Data Protection contact (see Section 17) for details of any specific transfer safeguards applicable to your data.

BMM88 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal retention obligations. Our general retention principles are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to any identifiable individual. Where data is anonymised rather than deleted, it may be retained for statistical analysis purposes.

BMM88 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files placed on your device when you visit the Platform. They allow us to remember your preferences, keep you logged in, and understand how the Platform is being used.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. Without these cookies, core features such as login sessions, account navigation, and payment processing would not work. These cookies cannot be disabled;
• Functional Cookies: Used to remember your preferences such as language settings, display options, and previous login details to improve your experience;
• Analytics Cookies: Used to collect anonymous data about how users interact with the Platform — pages visited, session duration, and errors encountered — to help us improve performance;
• Security Cookies: Used to detect fraud, prevent unauthorised access, and identify suspicious activity patterns across sessions.

You may manage or delete cookies through your browser settings. Disabling non-essential cookies will not prevent you from accessing the Platform, but may affect the quality and personalisation of your experience. Note that disabling strictly necessary cookies may prevent core Platform functionality from operating correctly.

As a person whose data we process, you hold a number of rights with respect to your personal information. We respect and are committed to facilitating the exercise of these rights:

To exercise any of the above rights, please contact us at the details provided in Section 17. We will respond to verified requests within 30 calendar days. We may need to verify your identity before processing your request. In complex cases, we may extend the response period by an additional 30 days with notification.

The BM88 Platform is strictly intended for adults aged21 years and above. We do not knowingly collect, process, or store personal data from any person under the age of 21.

Age verification is conducted as part of the KYC process for all registered accounts. If BM88 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to:

• Suspend the relevant account;
• Securely delete the personal data concerned;
• Refund any deposited funds in accordance with applicable procedures;
• Report the matter to relevant authorities where legally required.

If you believe that a person under the age of 21 may have registered an account on the Platform, please notify us immediately at [email protected].

BMM88 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your browser and BM88 servers is encrypted using TLS 1.2 or higher (HTTPS). Payment data is additionally encrypted at the application layer;
• Encryption at rest: Sensitive personal and financial data stored on our servers is encrypted using AES-256 encryption standards;
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access to personal data undergo mandatory privacy and security training;
• Two-factor authentication: Available to all users as an additional account security layer. Our internal administrative systems require2FA for all staff access;
• Regular security audits: We conduct periodic vulnerability assessments and penetration testing to identify and address security weaknesses;
• Intrusion detection: Real-time monitoring systems are in place to detect and respond to suspicious access patterns;
• Data breach response: We maintain a formal incident response plan. In the event of a data breach that is likely to result in risk to your rights, we will notify affected users and relevant authorities within the timeframes required by applicable law.

While we invest substantially in security, no internet-based service can guarantee absolute security. You also play a role in keeping your data safe — particularly by maintaining a strong, unique password and not sharing your account credentials with any third party.

The BM88 Platform may contain references or functional integrations with third-party services such as payment gateways (Maybank2u, CIMB Clicks, Touch 'n Go eWallet, DuitNow, FPX, GrabPay, Boost), analytics providers, and identity verification platforms.

When you interact with a third-party service, you are subject to that party's own privacy policy and data processing practices. BM88 is not responsible for the privacy practices of third-party services and encourages you to review the privacy policies of any third-party platforms you use in connection with your BM88 account.

All third-party Data Processors engaged by BMM88 are required to process data solely in accordance with our documented instructions and to maintain security standards at least equivalent to our own.

BM88 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. All amendments will be posted on this page with an updated "Last Updated" date.

Where changes are material — meaning they significantly affect how we process your data or your rights in relation to it — we will provide advance notice through one or more of the following channels: a prominent notice on the Platform, an in-platform notification upon your next login, or an email to your registered address.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to any material change, you are entitled to close your account and request deletion of your data (subject to applicable legal retention requirements) by contacting our support team.

We recommend reviewing this Policy periodically to stay informed about how your data is being protected. The most current version will always be available at https://bmm88.lat/privacy-policy.

If you have any questions, concerns, or requests in relation to this Privacy Policy or BM88's data processing practices, please contact our Data Protection team using the details below. We will respond to all verified requests within 30 calendar days.

For additional resources relating to data privacy, responsible gambling, and your account rights, please visit the following pages:

• Terms & Conditions — for the full contractual framework governing your BM88 account
• Responsible Gambling — for information on self-exclusion, deposit limits, and player protection tools
• FAQ — for answers to common questions about accounts, payments, and platform features