Privacy Policy

This Privacy Policy ("Policy") describes how bk8app ("we", "us", "our", "the Operator", "the Platform") collects, uses, stores, discloses, and otherwise processes personal data belonging to users ("you", "User", "Player") of the bk8app online casino and sports betting platform, accessible at bk8app.cam and any associated mobile applications or digital services (collectively, the "Service").

bk8app takes the privacy of its users seriously. We understand that many of our players in Malaysia — including those accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — share sensitive financial and personal information with us in order to use the Service. This Policy is written in plain English so that you can clearly understand exactly what we do with that information.

By creating an account, depositing funds, or otherwise using the Service, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Service.

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, date of birth, identity document details, payment information, and IP address.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, modification, retrieval, use, disclosure, transfer, restriction, or erasure.
• "Data Controller" — The entity that determines the purposes and means of processing Personal Data. For the purposes of this Policy, the Operator is the Data Controller.
• "Data Processor" — A third party that processes Personal Data on behalf of the Data Controller under a written data processing agreement.
• "KYC" — Know Your Customer; the identity and age verification process the Operator is obligated to conduct under its international gaming licence and anti-money laundering obligations.
• "Cookies" — Small text files stored on your device by a web browser at the direction of a website, used to remember information about your session, preferences, and behaviour.
• "Third Party" — Any entity other than you and the Operator, including payment service providers, game developers, analytics providers, and regulatory bodies.

bk8app collects the following categories of personal data:

A. Account Registration Data

• Full legal name
• Date of birth (used for 21+ age verification)
• Email address
• Mobile phone number
• Residential address
• Username and encrypted password

B. Identity Verification (KYC) Data

• Government-issued identity document (Malaysian MyKAD, passport, or equivalent)
• Proof of residential address (utility bill, bank statement, or equivalent)
• Source of funds documentation (where required by AML compliance procedures)
• Selfie photograph or video for liveness verification (where required)

C. Financial & Transaction Data

• Payment method details (e-wallet account identifiers for Touch 'n Go eWallet, Boost, GrabPay; bank account numbers for Maybank, CIMB, Public Bank, Hong Leong Bank; DuitNow ID; FPX transaction references; cryptocurrency wallet addresses for USDT TRC20)
• Deposit and withdrawal amounts and timestamps
• Transaction history and account balance records

D. Usage & Technical Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Login timestamps and session durations
• Pages visited, features accessed, and navigation patterns
• Game play logs including bet amounts, game selections, and outcomes

E. Communications Data

• Records of live chat, email, and support ticket interactions
• Feedback, complaints, and dispute correspondence
• Marketing preferences and communication consent records

bk8app collects personal data through the following channels:

1. Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or respond to a survey or promotion.
2. Automatically through the Platform — via server logs, cookies, pixel tags, and similar technologies when you browse and interact with the website or mobile application.
3. From payment service providers — transaction confirmation data received from Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-linked banks, and cryptocurrency network records.
4. From identity verification providers — where we engage third-party KYC service providers to assist with document authentication and liveness checks.
5. From fraud prevention and AML screening services — where we check user data against watchlists, politically exposed persons (PEP) databases, and sanctions lists as required by our international licensing obligations.

We use the personal data we collect for the following purposes:

The Operator processes personal data under the following legal bases:

• Contract Performance: Processing is necessary to create and maintain your account, process transactions, and deliver the Service you have contracted with us to receive.
• Legal Obligation: Processing is required to fulfil obligations under our international gaming licence, including KYC verification, age enforcement, AML screening, and regulatory reporting.
• Legitimate Interest: Processing is necessary for purposes such as fraud prevention, platform security, responsible gambling monitoring, and aggregated analytics — provided these interests are not overridden by your rights and interests.
• Consent: For optional processing such as marketing emails and non-essential cookies, we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time.

bk8app does not sell your personal data. We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

1. Payment service providers — We share relevant transaction and identity data with payment processors (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX-connected banks, and cryptocurrency infrastructure providers) solely to process your deposits and withdrawals.
2. KYC and identity verification providers — We engage third-party verification services to authenticate identity documents and perform liveness checks as part of our mandatory KYC obligations.
3. AML and fraud screening services — We share data with licensed anti-money laundering screening providers, watchlist databases, and sanctions checking services as required by our international gaming licence.
4. Game content providers — Third-party game studios and platform providers may receive anonymised or pseudonymised session data necessary to deliver their game content within the Service.
5. Analytics providers — Aggregated, anonymised usage data may be shared with analytics services to help us understand how the Platform is used and improve user experience.
6. Regulatory and law enforcement authorities — We will disclose personal data to competent authorities where required by applicable law, court order, or at the direction of the licensing body under whose jurisdiction we operate.
7. Business transfers — In the event of a merger, acquisition, or sale of all or part of the Operator's business, personal data may be transferred to the successor entity, subject to equivalent data protection commitments.

bk8app uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your login session, and — where you have consented — to analyse usage patterns and serve relevant content.

Cookie Categories

You can manage your cookie preferences through your browser settings. Note that disabling certain cookie categories may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled without preventing the Service from operating correctly.

bk8app retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedules apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, it may be retained indefinitely for statistical and research purposes.

bk8app implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, without limitation:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform.
• AES-256 encryption at rest for sensitive personal and financial data stored on our servers.
• Hashed password storage — passwords are never stored in plain text. We use industry-standard one-way hashing algorithms.
• Two-factor authentication (2FA) available for all user accounts and mandatory for administrative access.
• Role-based access controls limiting staff access to personal data to those with a documented operational need.
• Regular security audits and penetration testing conducted by qualified independent security professionals.
• Segregated player fund accounts ensuring your deposited balance is held separately from the Operator's operational funds.

Subject to applicable law and the conditions set out below, you have the following rights in respect of your personal data held by bk8app:

To exercise any of the above rights, please contact our support team via live chat or email (details in Section 15). We will respond to verified requests within 30 days. We may request proof of identity before processing any rights request to prevent unauthorised disclosure.

The Service is strictly intended for persons aged 21 and above. bk8app does not knowingly collect or process personal data belonging to individuals under the age of 21.

All accounts are subject to mandatory KYC age verification before any withdrawal is processed. Where the Operator has reasonable grounds to believe that a user is under 21, the account will be suspended immediately and all data retained for a period sufficient to comply with our legal obligations, before being securely deleted.

If you believe that a person under 21 has registered an account on the Platform, please notify our support team immediately. bk8app takes age enforcement seriously and will act promptly on any credible report.

bk8app operates under international gaming licensing and as a result, some of the personal data we collect may be transferred to, stored, and processed in countries outside of Malaysia. These may include jurisdictions where the Operator's servers, KYC providers, payment processors, and licensing bodies are located.

Where personal data is transferred internationally, we take appropriate steps to ensure that adequate data protection standards are maintained, including:

• Engaging only third-party processors who are contractually bound to process data to equivalent standards.
• Implementing standard contractual clauses or equivalent mechanisms where required by the laws of the receiving jurisdiction.
• Applying technical safeguards including encryption to data in transit across international networks.

By using the Service, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia. bk8app makes no representations regarding the adequacy of data protection laws in any particular country and relies on its own contractual and technical safeguards to ensure equivalent protection.

bk8app reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. Where changes are material — meaning they affect how your personal data is used in ways that are significantly different from what was previously disclosed — we will provide notice via a prominent banner on the Platform or by email to your registered address before the changes take effect.

The effective date of the current version of this Policy is displayed at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Service following any update constitutes your acceptance of the revised terms.

Where an update requires fresh consent (for example, a new category of optional processing), we will seek that consent separately before commencing the new processing activity.

For all privacy-related enquiries, data subject rights requests, or concerns about how bk8app handles your personal data, please contact us using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly through the Platform. Our support agents can handle privacy enquiries in English, Bahasa Melayu, and Mandarin Chinese. Average response time: 3–5 minutes.
• Email: [email protected] — please mark the subject line "Privacy Request" or "Data Subject Rights Request" to ensure your enquiry is directed to the correct team.

We will acknowledge all data rights requests within 72 hours and aim to resolve them within 30 days. Complex requests may require up to 90 days; in such cases, we will notify you of the extended timeline and the reasons for it.

For responsible gambling tool requests, including self-exclusion and deposit limit adjustments, please visit our Responsible Gambling page. For questions about your account terms, please refer to our Terms & Conditions.