Privacy Policy — bd678

This Privacy Policy ("Policy") is published by bd678 ("Company", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at bd678.casa ("Platform"). It describes how bd678 collects, uses, stores, discloses, and protects the personal data of individuals who register as members or otherwise interact with the Platform ("you", "your", "Member", "User").

bd678 takes its data protection obligations seriously. Our platform is designed to serve players across Malaysia — including major cities such as Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — and we recognise that the trust our members place in us extends beyond the gaming experience to how we handle their most sensitive personal information.

By creating an Account on bd678, using the Platform, or interacting with our customer support team, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

For the purposes of this Policy, the following terms carry the meanings assigned below:

bd678 collects personal data across the following categories, depending on how you interact with the Platform:

We do not intentionally collect special categories of sensitive personal data (such as health information, biometric data, or racial/ethnic origin) unless specifically required by applicable law or regulatory directive and with appropriate safeguards in place.

bd678 processes personal data only where a valid legal basis exists. The primary legal bases we rely upon are:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you as a Member — including account management, transaction processing, game delivery, and customer support.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, age verification requirements, and regulatory reporting duties.
• Legitimate Interests: Processing is necessary for our legitimate business interests — including fraud prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your rights.
• Consent: For processing activities not covered by the above bases, such as sending direct marketing communications, we will obtain your explicit prior consent and provide a clear, accessible mechanism to withdraw that consent at any time.

bd678 uses the personal data we collect for the following specific purposes:

• Account Creation and Management: To register and maintain your bd678 Account, authenticate your identity upon login, and administer your membership.
• Transaction Processing: To process deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, and other Approved Payment Methods, and to execute withdrawal requests to your verified payment instruments.
• Identity Verification (KYC): To verify your age, identity, and source of funds in compliance with applicable anti-money laundering and responsible gambling regulations.
• Customer Support: To respond to your enquiries, resolve disputes, manage escalated complaints, and maintain a record of interactions for quality assurance and regulatory purposes.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account takeovers, collusion, money laundering, and other prohibited conduct on the Platform.
• Responsible Gambling: To monitor wagering patterns that may indicate problem gambling behaviour, administer self-exclusion requests, enforce deposit limits, and fulfil our duty-of-care obligations to Members.
• Platform Improvement: To analyse Platform usage and performance data, identify and resolve technical issues, and develop new features and services.
• Legal Compliance and Reporting: To meet our obligations under applicable laws, including financial regulation, data protection law, and gambling regulation, and to respond to lawful requests from competent authorities.
• Marketing Communications (with consent): Where you have opted in, to send you information about promotions, new game releases, and VIP programme updates relevant to your account activity. You may withdraw consent at any time by contacting our support team.

bd678 does not sell, rent, or transfer your personal data to third parties for their independent marketing or commercial purposes. We share personal data with third parties only in the following limited circumstances:

• Payment Processing Partners: Financial data is shared with payment gateway operators and financial institutions (including those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, and related services) to the extent necessary to process your transactions.
• Identity Verification Providers: KYC documents and identity data may be shared with accredited third-party identity verification service providers operating under confidentiality obligations.
• Game Content Providers: Technical and behavioural data necessary for game delivery and integrity monitoring may be shared with the studios and platform providers whose games are hosted on bd678.
• Regulatory and Law Enforcement Authorities: We are legally obligated to disclose certain personal data to competent regulatory bodies, law enforcement agencies, or courts where required by applicable law, court order, or binding regulatory directive.
• Professional Advisors: Legal, accounting, or auditing professionals engaged under binding confidentiality obligations may have limited access to personal data where necessary for their professional engagement.
• Business Transfers: In the event of a merger, acquisition, or transfer of all or substantially all of bd678's assets, personal data may be transferred to the successor entity, subject to equivalent data protection standards being maintained.

bd678 uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are described below:

• Essential Cookies: Strictly necessary for the Platform to function. They enable core features such as session authentication, account login persistence, and fraud detection. These cookies cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings, responsible gambling tool configurations, and game display preferences — to provide a personalised experience.
• Analytical Cookies: Used to collect aggregated, anonymised data about how Members use the Platform, enabling us to identify performance issues and improve user experience. These do not individually identify you.
• Security Cookies: Used to support fraud detection and account security processes, including device fingerprinting and session integrity checks.

You may control cookie preferences through your browser settings. Disabling non-essential cookies may affect certain Platform features but will not prevent you from accessing core gaming services. Note that essential and security cookies cannot be disabled as they are integral to the Platform's operation and legal compliance obligations.

bd678 retains personal data for the minimum period necessary to fulfil the purposes outlined in this Policy, subject to any longer retention periods required by applicable law or regulation. The following retention schedule provides indicative guidance:

Upon expiry of the applicable retention period, personal data is securely deleted from active systems or anonymised where deletion is not technically feasible for specific backup or archival systems.

As a data subject, you hold the following rights in respect of your personal data processed by bd678. These rights are subject to applicable legal limitations and bd678's ability to verify your identity before fulfilling any request.

To exercise any of the above rights, please contact our support team via live chat or email at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. Complex requests may require an extension, of which you will be notified in advance.

bd678 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, or destruction. Key security measures include:

• Encryption in Transit: All communications between your browser and bd678 servers are encrypted using TLS 1.3. HTTPS is enforced across the entire Platform.
• Encryption at Rest: Sensitive personal data, including identity documents and financial records, is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
• Two-Factor Authentication: Internal systems holding personal data are protected by multi-factor authentication for all authorised users.
• Security Monitoring: bd678 operates continuous security monitoring and anomaly detection systems to identify and respond to potential data security incidents promptly.
• Regular Security Assessments: Periodic penetration testing and security audits are conducted by independent specialists to identify and remediate vulnerabilities.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, bd678 will notify affected Members without undue delay and report the breach to the competent supervisory authority within the timeframe required by applicable law.

bd678's Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Account registration requires age verification, and withdrawals are only processed following completion of KYC verification confirming the Member's age.

If bd678 becomes aware that personal data has been collected from an individual under the age of 21, such data will be deleted immediately and the associated Account will be permanently closed. If you have reason to believe that an underage individual has registered an Account on bd678, please contact our support team immediately at [email protected].

bd678 operates infrastructure and engages service providers across multiple jurisdictions. As a result, your personal data may be transferred to, stored in, or processed in countries outside Malaysia. Where such transfers occur, bd678 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which applies within Malaysia and the jurisdiction of our incorporation.

Applicable safeguards may include contractual obligations — such as standard data protection clauses — technical measures, or transfers to jurisdictions recognised as providing adequate data protection standards by relevant regulatory authorities. You may request information about the specific safeguards applicable to any international transfer of your data by contacting our support team.

The bd678 Platform integrates third-party services including payment processors (such as those facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Hong Leong, and USDT TRC20 transactions), game content providers, identity verification services, and analytics tools.

When you interact with these third-party services, your data may be processed by them under their own privacy policies and data protection practices. bd678 conducts due diligence on its service providers and requires them to maintain appropriate security and data protection standards by contract. However, bd678 is not responsible for the independent data processing activities of third parties outside the scope of their engagement with bd678.

This Policy does not apply to any third-party websites, platforms, or services that may be referenced on the Platform. You should review the privacy policies of any third-party services independently.

bd678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. In the event of material changes, we will notify registered Members via email or a prominent Platform notice prior to the changes taking effect.

The "Effective Date" and "Last Reviewed" date at the top of this Policy will be updated to reflect the date of the most recent revision. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy.

The current version of this Privacy Policy is always accessible at bd678.casa/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or bd678's data processing practices, please contact our team through the following channels:

bd678 is committed to resolving all privacy-related enquiries promptly, professionally, and in compliance with applicable data protection obligations. We welcome feedback from our Members and will use it to continuously improve our privacy practices.