Privacy Policy

Introduction

This Privacy Policy ("Policy") is published by bm8 ("bm8", "we", "us", "our"), the operator of the online gaming platform accessible atbm8.casa and all associated subdomains, mobile applications, and digital services (the "Platform"). This Policy applies to all users who register an account, visit the Platform, or interact with bm8 in any capacity ("User", "you", "your").

bm8 is committed to processing personal data responsibly, transparently, and in full compliance with applicable data protection legislation. We collect only what is necessary to provide and improve our services, to comply with our legal and regulatory obligations, and to safeguard the integrity of the Platform.

By registering an account on bm8 or otherwise accessing the Platform, you acknowledge that you have read and understood this Privacy Policy, and you consent to the collection, use, and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should refrain from using the Platform and contact us to request Account closure.

Definitions

The following definitions apply throughout this Privacy Policy:

Term	Meaning
"Personal Data"	Any information that identifies or can be used to identify a natural person, directly or indirectly, including name, identification number, location data, or online identifier.
"Processing"	Any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, erasure, or destruction.
"Data Controller"	bm8, which determines the purposes and means of processing Personal Data collected through the Platform.
"Data Processor"	Any third-party service provider that processes Personal Data on behalf of bm8 under a written data processing agreement.
"Sensitive Data"	A subset of Personal Data warranting heightened protection, including financial account details, identity document scans, and biometric information submitted during KYC verification.
"Cookie"	A small data file placed on a User's device by the Platform for session management, analytics, or personalisation purposes.
"KYC"	Know Your Customer — the process of verifying a User's identity and age in compliance with anti-money laundering and responsible gambling obligations.

Data We Collect

bm8 collects Personal Data through several channels — directly from you during registration and Account use, automatically via your interaction with the Platform, and occasionally from third-party verification or payment service providers. The categories of data we collect are set out below.

3.1 Account Registration Data

When you create an Account on bm8, we collect:

• Full legal name
• Date of birth (for age verification — Players must be 21 or older)
• Residential address, including city and postcode
• Email address
• Mobile phone number
• Preferred currency (MYR/RM for Malaysian users)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations and responsible gambling requirements, we may collect:

• Copy of government-issued photo identification (MyKad, passport, or driving licence)
• Proof of residential address (utility bill, bank statement dated within three months)
• Selfie or live photo for biometric verification purposes
• Proof of payment method ownership (e.g., screenshot of eWallet account, bank statement header)

3.3 Financial Transaction Data

When you make deposits or withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, or cryptocurrency channels, we collect transactional metadata including:

• Transaction amount, date, and currency
• Payment method type and partial payment identifier (e.g., last four digits of bank account, wallet reference)
• Transaction status and processing timestamps

bm8 does not store full payment card numbers or full bank account credentials. All financial data is transmitted via encrypted connections to our payment processing partners.

3.4 Gaming & Betting Activity Data

• Game history, bet placement records, and outcomes
• Session duration, login timestamps, and session frequency
• Sports betting selections, including Liga Super Malaysia, English Premier League, and other markets
• Bonus claims, wagering progress, and promotional participation

3.5 Technical & Device Data

When you access the Platform, we automatically collect:

• IP address and approximate geolocation
• Browser type, version, and operating system
• Device type (mobile, tablet, desktop) and unique device identifiers
• Referral URL and session navigation data
• Platform interaction logs for fraud detection and security monitoring

3.6 Communication Data

If you contact bm8 Support via live chat, email, or WhatsApp, we retain records of those communications — including the content of messages, timestamps, and any supporting documentation you provide — for quality assurance, training, and dispute resolution purposes.

Legal Basis for Processing

bm8 processes your Personal Data under one or more of the following legal bases:

Legal Basis	Processing Activity
Contractual necessity	Account creation, transaction processing, game delivery, bonus administration, and withdrawal processing — all required to fulfil our service agreement with you.
Legal obligation	KYC identity verification, anti-money laundering (AML) screening, age verification (21+), and responsible gambling compliance reporting.
Legitimate interests	Fraud prevention, platform security monitoring, service analytics, and improving bm8's products and user experience.
Consent	Marketing communications (email or push notifications about promotions) and non-essential cookies, where your explicit consent has been obtained and can be withdrawn at any time.

How We Use Your Data

bm8 uses the Personal Data we collect for the following purposes:

1. Account administration: Creating, maintaining, and securing your bm8 Account, and processing your requests for account changes or closures.
2. Service delivery: Enabling you to access casino games, live dealer tables, sports betting markets (including EPL and Liga Super Malaysia), and promotional offers.
3. Payment processing: Facilitating deposits and withdrawals via your chosen Malaysian payment method (DuitNow, FPX, Maybank, etc.) and cryptocurrency channels.
4. Identity and age verification: Conducting KYC checks to confirm that you are 21 years of age or older, and to verify the source of your funds in accordance with AML obligations.
5. Responsible gambling: Monitoring gaming behaviour for signs of problem gambling, administering self-exclusion and deposit limit tools, and responding to responsible gambling support requests.
6. Fraud prevention and security: Detecting and preventing unauthorised access, fraudulent activity, multiple account creation, and bonus abuse.
7. Customer support: Responding to enquiries, resolving disputes, and providing technical assistance in English, Bahasa Melayu, and 中文.
8. Marketing communications: Sending promotional offers, new game announcements, and VIP programme updates where you have consented to receive such communications. You may opt out at any time.
9. Legal compliance: Retaining records and cooperating with regulatory authorities, law enforcement, or licensing bodies as required by applicable law.
10. Platform improvement: Analysing aggregated, anonymised usage data to improve the bm8 user experience, optimise performance, and develop new features.

Data Sharing & Disclosure

bm8 does not sell, rent, or trade your Personal Data to unafiliated third parties for their own marketing purposes. We may share your data in the following limited and controlled circumstances:

6.1 Payment Service Providers

We share transaction-related data with payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network service providers, solely to execute your requested financial transactions. These providers are contractually bound to handle your data securely and only for the specified purpose.

6.2 Identity Verification Partners

KYC and AML verification is conducted with the assistance of accredited third-party identity verification services. These services receive only the minimum data required to complete verification and are bound by strict data processing agreements.

6.3 Technology & Platform Partners

bm8 operates using technology infrastructure and game content provided by third-party software vendors and hosting partners. These partners may process limited technical data (such as session tokens and game state data) in order to deliver their services. They do not receive personal profile or financial data beyond what is technically necessary.

6.4 Legal and Regulatory Disclosure

We may disclose Personal Data to regulatory bodies, law enforcement agencies, licensing authorities, or courts where we are required to do so by applicable law, court order, or where we have a good-faith belief that such disclosure is necessary to prevent fraud, protect the safety of a person, or enforce our Terms and Conditions.

6.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of bm8's assets, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections remaining in place.

Cookies & Tracking Technologies

bm8 uses cookies, pixel tags, and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit bm8.casa. They serve the following functions:

Cookie Type	Purpose	Required?
Strictly Necessary	Session management, authentication, security tokens, and core Platform functionality. Cannot be disabled without affecting Platform operation.	Yes
Functional	Remembering your language preference, game settings, and UI customisations to deliver a personalised experience.	Optional
Analytics	Aggregated, anonymised usage data collected to understand how Users navigate the Platform, which features are most used, and where improvements can be made.	Optional
Marketing	Tracking promotional campaign effectiveness and personalising bonus offers where you have provided consent.	Consent required

You may manage your cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use certain Platform features.

Data Retention

bm8 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. Our general retention periods are as follows:

• Account data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in compliance with AML recordkeeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable law.
• Financial transaction records: Retained for a minimum of five (5) years in accordance with financial recordkeeping obligations.
• Gaming and betting history: Retained for five (5) years from the date of each session for responsible gambling monitoring and dispute resolution purposes.
• Support correspondence: Retained for three (3) years from the date of last contact, unless the correspondence relates to an ongoing dispute or legal matter.
• Marketing consent records: Retained until you withdraw consent, and for a reasonable period thereafter as evidence of prior consent.

When data is no longer required for any retention purpose, it is securely deleted or anonymised in manner that makes re-identification impossible.

Data Security

bm8 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security infrastructure includes:

• SSL/TLS 256-bit encryption on all data in transit between your device and the bm8 Platform.
• Encryption at rest for all stored sensitive Personal Data, including identity documents and financial information.
• Access controls ensuring that internal bm8 personnel can access Personal Data only on a strict need-to-know basis, with all access logged and audited.
• Intrusion detection and real-time monitoring to identify and respond to suspicious activity or potential data breaches promptly.
• Regular security assessments conducted by qualified third-party security professionals.
• Secure credential management — passwords are stored using industry-standard hashing algorithms and are never accessible in plaintext by bm8 staff.

Notwithstanding these measures, no data transmission or storage system can be guaranteed to be 100% secure. In the event of a data breach that is likely to result in a high risk to your rights, bm8 will notify affected Users without undue delay in accordance with applicable law.

International Data Transfers

As a platform serving Malaysian users from internationally distributed infrastructure, bm8 may transfer your Personal Data to servers and service providers located outside of Malaysia. Where such transfers occur, bm8 takes the following steps to ensure your data remains adequately protected:

• Transfers are made only to countries or service providers that offer equivalent data protection standards through contractual safeguards or established certification frameworks.
• All third-party Data Processors who receive Personal Data from bm8 are required to enter into data processing agreements that impose binding obligations equivalent to those set out in this Policy.
• Where you are a Malaysian user, bm8 processes the majority of your Account and transactional data on servers that comply with applicable standards for data protection and financial data handling.

Your Data Rights

Subject to applicable law and certain limitations, you have the following rights in respect of the Personal Data bm8 holds about you. To exercise any of these rights, please contact us at the details set out in Section 15.