bp77 Privacy Policy

1. Who We Are & Scope of This Policy

1.1 bp77 is the operator of the online gaming platform accessible at bp77.one ("Platform"). References to "bp77", "we", "us", or "our" in this Privacy Policy refer to bp77 as the data controller in respect of personal data collected through the Platform.

1.2 This Privacy Policy applies to all personal data collected by bp77 in connection with your registration, use of the Platform, customer support interactions, and any other direct communication between you and bp77. It applies to all users regardless of their location, although additional or different obligations may apply in certain jurisdictions.

1.3 This Policy should be read alongside bp77's Terms & Conditions and any game-specific or promotion-specific terms that may apply to your use of the Platform. Where there is any inconsistency between this Policy and another document, this Policy shall govern in respect of privacy and data protection matters.

1.4 By registering for a bp77 account or otherwise providing personal data to bp77, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal data as described herein.

2. Data We Collect

2.1 Registration Data

When you create a bp77 account, we collect the following information:

• Full legal name as it appears on your government-issued identification;
• Date of birth (to verify that you meet the minimum age requirement of 21 years);
• Email address (used as a primary identifier and for account communications);
• Malaysian mobile number (used for SMS verification and two-factor authentication);
• Username and password (password is stored only in hashed form — bp77 does not store plain-text passwords).

2.2 Identity Verification Data

To comply with anti-money laundering obligations and our licensing requirements, bp77 may request:

• A copy of a government-issued photo identification document (e.g., Malaysian National Identity Card, passport);
• A copy of a recent utility bill or bank statement confirming residential address;
• Source of funds documentation for accounts that reach certain transaction thresholds.

2.3 Financial Data

bp77 collects details of financial transactions conducted on the Platform, including deposit amounts, withdrawal requests, payment method type, and transaction timestamps. bp77 does not store full payment card numbers or full e-wallet account credentials — payment processing is handled by certified third-party payment processors who operate under their own data protection obligations.

2.4 Usage & Technical Data

bp77 automatically collects certain technical data when you access the Platform, including your IP address, device type, browser type and version, operating system, session duration, pages visited, games played, and bet amounts placed. This data is used for security monitoring, fraud detection, platform optimisation, and responsible gaming analytics.

2.5 Communications Data

If you contact bp77 support via live chat or email, we retain records of those communications including their content, timestamps, and the outcome of any support resolution. This data is used to manage your support history, train support staff, and investigate complaints.

3. How We Collect Your Data

3.1 Directly from you — when you register an account, complete the identity verification process, make a deposit or withdrawal, contact support, or update your account settings.

3.2 Automatically through Platform use — through server logs, session tracking, and first-party cookies that record your interaction with the Platform (see Section 8 for details on cookies).

3.3 From payment processors — bp77 receives confirmation of payment transaction status from its partner payment processors to credit or debit your Wallet accordingly. bp77 does not receive raw financial account credentials from these processors.

3.4 From identity verification services — bp77 may use third-party identity verification services to assist in confirming the accuracy of identification documents submitted during the verification process. These services operate under their own privacy obligations and are contractually required to process data only for the specific verification purpose.

3.5 From fraud and compliance databases — bp77 may check user data against third-party databases used for anti-money laundering screening, sanctions list checking, and fraud prevention. Results of these checks are retained as part of the user's compliance record.

4. Purposes & Legal Basis for Processing

The following table summarises the primary purposes for which bp77 processes personal data and the corresponding legal basis:

• Account creation and management — necessary for the performance of the contract between you and bp77;
• Processing deposits and withdrawals — necessary for the performance of the contract and compliance with financial regulatory obligations;
• Age and identity verification — necessary for compliance with licensing obligations and anti-money laundering regulations;
• Fraud detection and prevention — legitimate interest of bp77 in protecting the integrity of the Platform and safeguarding other users;
• Customer support — necessary for the performance of the contract and legitimate interest in quality service delivery;
• Responsible gaming monitoring — legitimate interest and compliance with licensing authority requirements to identify and assist at-risk users;
• Platform improvement and analytics — legitimate interest in improving the user experience, subject to your ability to opt out of non-essential analytics;
• Marketing communications — based on your explicit consent, which you may withdraw at any time from your account notification settings.

5. Disclosure of Personal Data

5.1 bp77 does not sell, rent, or exchange your personal data with third-party advertisers or marketing organisations. Personal data is shared externally only in the following circumstances:

• Service providers — companies that provide services to bp77 under contract, including payment processors, identity verification providers, cloud infrastructure providers, customer support platform operators, and fraud detection services. These parties are contractually prohibited from using your data for any purpose other than providing their services to bp77;
• Game Providers — when you play games on the Platform, certain technical data (such as session identifiers and bet amounts) is shared with the relevant Game Provider to facilitate game play. Game Providers do not receive your name, contact details, or payment information;
• Regulatory and law enforcement authorities — where required by applicable law, regulation, court order, or the direction of a competent authority with jurisdiction over bp77's operations. bp77 will comply with such requirements and will notify you where legally permitted to do so;
• Business transfers — in the event of a merger, acquisition, or sale of all or substantially all of bp77's assets, user data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

5.2 All third-party service providers with whom bp77 shares personal data are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with bp77's instructions and applicable data protection law.

6. Data Retention

6.1 bp77 retains personal data for as long as your account remains active and for such additional period as is required to comply with legal, regulatory, and contractual obligations. The following retention guidelines apply:

• Account and identity data — retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements;
• Transaction data — retained for a minimum of five (5) years following the date of the transaction, in compliance with financial regulatory requirements;
• Support communication records — retained for three (3) years following the closure of the relevant support case, or for the duration of any related complaint or legal process if longer;
• Technical and usage logs — retained for up to twelve (12) months for security and fraud investigation purposes, after which they are anonymised or deleted;
• Marketing consent records — retained for as long as you remain a registered user, and for one (1) year following account closure to evidence prior consent in the event of any regulatory query.

6.2 Where the basis for retention is legal obligation rather than operational need, data will be retained in a restricted state and used only for the purpose of satisfying that obligation.

7. Security Measures

7.1 bp77 implements the following technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• SSL/TLS encryption for all data in transit between user devices and bp77 servers;
• Encryption at rest for sensitive data categories including identification documents and financial records;
• Role-based access controls ensuring that staff members can only access personal data relevant to their specific role;
• Multi-factor authentication required for all internal systems that store or process personal data;
• Regular third-party security audits and penetration testing of the Platform infrastructure;
• Incident response procedures in place to detect, contain, and respond to data security breaches within defined timelines.

7.2 In the event of a data breach that is likely to result in a risk to users' rights and freedoms, bp77 will notify affected users and relevant authorities in accordance with applicable legal requirements. Notifications will be sent to the email address registered on the affected account.

8. Cookies & Tracking Technologies

8.1 bp77 uses cookies and similar tracking technologies (including session tokens and local storage) to operate the Platform, maintain your logged-in session, and analyse usage patterns. The following categories of cookies are used:

• Strictly necessary cookies — essential for the Platform to function, including session authentication tokens and security cookies. These cannot be disabled without preventing core functionality;
• Functional cookies — remember your preferences such as language settings and game display options to improve your experience;
• Analytical cookies — collect aggregated, anonymised data about how users interact with the Platform, used to identify technical issues and improve usability. These are first-party analytics only;
• Responsible gaming cookies — track session duration and activity patterns to support the responsible gaming monitoring tools in your account settings.

8.2 bp77 does not use third-party advertising cookies or share analytical data with ad networks. You may manage functional and analytical cookie preferences through your browser settings, noting that disabling certain cookies may affect Platform functionality.

9. Your Rights

9.1 Subject to applicable law and bp77's legal obligations, you have the following rights in respect of personal data that bp77 holds about you:

9.2 To exercise any of the above rights, contact bp77 support via live chat at bp77.one. bp77 will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days with prior notification to you.

9.3 Note that the right to erasure is subject to bp77's legal obligation to retain certain data for the periods described in Section 6. Where erasure cannot be fulfilled due to a legal retention obligation, bp77 will explain the applicable constraint in its response.

10. Changes to This Policy & Contact

10.1 bp77 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform functionality. The date of the most recent revision is shown at the top of this document.

10.2 Where changes are material — for example, where we introduce a new purpose for processing or share data with a new category of third party — bp77 will notify registered users via their registered email address at least 14 days before the changes take effect. Your continued use of the Platform after the effective date of any amended Policy constitutes your acceptance of those changes.

10.3 If you have any questions about this Privacy Policy, how bp77 handles your personal data, or wish to exercise any of your data rights, please contact bp77's support team via live chat, available 24 hours a day, 7 days a week at bp77.one. You may also reach us by email at:

[email protected]