Privacy Policy BK8MY – Malaysia Member Personal Data Protection

bk8my ('kami', 'Platform') respects the privacy of every individual who uses our services. This Privacy Policy explains in detail how we collect, use, store, protect and disclose your personal information when you register an account, make transactions or interact with any part of the bk8my platform.

By registering a bk8my account or continuing to use our platform, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the platform and contact us for further enquiries.

Bk8my collects your personal data through various means — directly when you register and fill in your information, or automatically through your use of the platform. The categories of data we collect are as follows:

Every piece of data we collect has a clear and legitimate purpose. bk8my uses your personal information for the following purposes:

• Account management: Creating, verifying, and maintaining your member account, including the KYC process.
• Transaction processing: Processing deposits, withdrawals, and all financial transactions accurately and securely.
• Fraud detection: Detecting and preventing fraudulent activity, money laundering, and platform abuse.
• Customer support: Enabling our support team to assist you more effectively when you contact us.
• Communication: Sending important information about your account, transactions, and platform updates.
• Platform improvement: Analyzing usage patterns to enhance the overall user experience.
• Legal compliance: Meeting applicable legal and regulatory obligations.

Bk8my does not sell, rent, or trade your personal data to third parties for marketing purposes. However, there are limited situations where we may need to share your information with certain parties:

• Service providers: Payment providers (DuitNow, FPX, eWallet), game providers, and technical service providers who help us operate the platform. All parties are bound by strict confidentiality agreements.
• Legal Requirements: Regulatory authorities, law enforcement agencies, or courts when we are required to do so by law.
• Fraud prevention: Background check agencies or industry anti-fraud bodies for identity verification and prevention of illegal activities.
• Business transfers: In the event of a merger, acquisition, or asset sale, data may be transferred to the acquiring party subject to equivalent privacy protections.

Bk8my takes information security seriously. The technical and organisational measures we implement to protect your data include:

• Data encryption in transit using TLS 1.3 and 256-bit SSL protocols.
• Data encryption at rest for all sensitive information, including financial data.
• Role-based access control (RBAC) — only staff who require access to perform their duties are granted permission.
• Regular security audits by independent third parties to identify and address vulnerabilities.
• Real-time threat monitoring and intrusion detection systems (IDS).
• A clear incident response plan to address any data breaches promptly.

Bk8my uses cookies and similar tracking technologies to enhance the user experience and understand how our platform is used. The types of cookies we use include:

• Essential Cookies: Required for core platform functions such as session login and security. These cookies cannot be disabled.
• Performance Cookies: Collecting information about how you use the platform to help us improve it. All data is anonymized.
• Functional Cookies: Remembering your preferences such as language and display settings for a more comfortable experience.
• Analytics Cookies: Helping us understand aggregate usage patterns to improve platform content and features.

You can manage cookie settings through your web browser settings. Please note that disabling certain cookies may affect the functionality of the bk8my platform.

As a data subject, you have the following rights regarding the personal information we hold about you:

Bk8my retains your personal data only for as long as necessary to fulfil the purpose of collection or to comply with legal requirements. General guidelines for retention periods are as follows:

• Active account data: Throughout the active period of your account and for a reasonable period following closure.
• Financial transaction records: Minimum 7 years in accordance with anti-money laundering legal requirements.
• KYC data and verification documents: Minimum 5 years after the business relationship ends.
• Customer support communication logs: 2 years from the date of last interaction.
• Anonymous analytics data: May be retained indefinitely as it cannot be linked to any individual.

Bk8my reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service expansions. When significant changes are made, we will:

• Updating the "Last Updated" date at the top of this document.
• Displaying notices on the bk8my platform to inform members of significant changes.
• Sending email notifications for changes that significantly affect your privacy rights.

Continued use of the bk8my platform after any changes take effect will be considered your acceptance of the latest version of this Privacy Policy. It is your responsibility to review this page periodically.

If you have any questions, concerns or complaints regarding this Privacy Policy or how bk8my handles your personal data, please contact our support team through the following channels:

• Live Chat: Available 24/7 directly within the bk8my platform — the fastest way to get a response.
• Email: Reach us at [email protected] for written enquiries that require documentation.

We are committed to responding to all privacy-related enquiries within 5 business days. For data access or deletion requests, the response period is up to 30 business days in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).