BD303 Privacy Policy – Member Data Protection & Security

BD303 is a trusted online casino platform in Malaysia, operating with full commitment to the safety and trust of every member. This Privacy Policy explains in detail how BD303 — as data controller — handles your personal information throughout your use of our services.

This policy applies to all users of the BD303 platform, including website visitors, registered members, active players, and those who contact our support team. It covers all interaction channels with BD303 — the official website, mobile app, live chat, email, and our official social media channels.

We understand that trust is the most valuable asset in this industry. Every decision we make regarding member data is handled with care, responsibility, and unwavering respect for your privacy rights. This policy is updated periodically to reflect changes in applicable laws, technology, or how we conduct our operations.

BD303 collects several categories of information to ensure the platform operates securely, meets legal requirements, and delivers the best experience to every member.

All data collected is used to fulfill our legal obligations under Malaysia's PDPA, comply with Anti-Money Laundering (AML) requirements and ensure the safety and integrity of the platform. We do not collect sensitive data such as health information or political views except in exceptional cases required by law.

BD303 uses your personal information for lawful, clear, and transparent purposes. The following is a full description of how your data is used in the daily operations of our platform:

• Account Management: Account registration, identity verification (KYC), password management and two-factor login security (2FA) to protect your account.
• Transaction Processing: Deposits, withdrawals, and fund transfers require valid financial information to ensure money reaches the correct destination safely.
• Legal Compliance: BD303 is legally required to verify member identities, report suspicious transactions, and retain records for periods prescribed by regulation.
• Security and Fraud Prevention: Our fraud detection system analyzes usage patterns to identify abnormal activity and protect your account from unauthorized access.
• Product Improvements: Anonymised usage data is used to understand how members interact with the platform, enabling us to make meaningful improvements.
• Service Communications: Technical notices, security updates, account information and customer support responses.
• Marketing Communications: Only with your consent — promotions, bonuses, and exclusive offers. You may withdraw consent at any time.
• Responsible Gaming: Game activity data is used to detect patterns that may indicate problem gambling and to trigger assistance interventions when necessary.

BD303 does not sell, rent, or transfer your personal information to third parties for their own marketing or commercial purposes. However, there are certain situations where data sharing is necessary and legally permissible:

• Trusted Service Providers: Companies that help us deliver our services — such as payment processors, gaming software providers and cloud service providers — may receive limited access to the data they need. They are bound by strict confidentiality agreements and are not permitted to use your data for any other purpose.
• Legal Obligation: BD303 may be required to disclose information to regulatory authorities, law enforcement bodies, or courts when mandated by applicable law within the relevant jurisdiction.
• Fraud Prevention: In cases of suspected fraud, BD303 may share necessary information with financial institutions or enforcement agencies to protect the interests of all parties.
• Corporate Transactions: In the event of a merger, acquisition or asset sale, member data may be transferred — with appropriate prior notice given to you.

BD303 maintains an up-to-date list of all third-party service providers with access to member data. This list is available upon request from our compliance team.

BD303 invests seriously in security infrastructure to ensure your personal data is always protected from unauthorised access, modification, or disclosure. The following are the security layers we apply:

While BD303 takes extensive measures to protect your data, no system can be guaranteed 100% secure. We encourage you to also safeguard your account by using a strong password, enabling 2FA, and never sharing your login details with anyone.

BD303 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy or as required by law. Our core principle is "retain only what is needed, delete as soon as possible".

Once the retention period has ended, your data will be securely deleted or anonymized so it can no longer be linked to you. The data deletion process follows verified procedures to ensure the data cannot be recovered.

Under Malaysia's PDPA and the data protection principles practised by bd303, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. Requests will be processed within 30 business days.
• Right to Rectification: If the data we hold is inaccurate or outdated, you may request a correction at any time through your account control panel.
• Right to Erasure: Under certain circumstances, you may request the deletion of your personal data — subject to the legal retention obligations we are required to comply with.
• Right to Restriction of Processing: You may request that we stop or restrict the processing of your data while a dispute is under investigation.
• Right to Data Portability: You have the right to receive your personal data in a machine-readable format for transfer to another service provider.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time, without providing any reason.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the validity of prior processing.

BD303 uses cookies and similar tracking technologies to enhance your experience on our platform, ensure session security, and understand how members use our services. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication, session security, and language preferences. Cannot be disabled.
• Performance Cookies: Collects information about how you use our website — pages visited, time spent, and errors encountered. All data is anonymised.
• Functional Cookies: Saves your preferences such as game choices, display settings and language to provide a more personalized experience.
• Analytics Cookies: Helps us understand platform performance and aggregate user behaviour for product improvement purposes.

You may manage your cookie preferences through your web browser settings at any time. Disabling certain cookies may affect the functionality of some BD303 platform features. For mobile app usage, your device privacy settings control similar tracking technologies.

BD303 may send you marketing communications about the latest promotions, exclusive bonuses, new games, and VIP offers. All marketing communications are based on your explicit, recorded consent.

You may opt out of any or all categories of marketing communications:

• Via the "Unsubscribe" link found at the bottom of every marketing email.
• Via the notification settings in your account control panel.
• By contacting our support team via live chat or email.

Once you choose to unsubscribe, we will honor your preference within 10 business days. Please note that even after unsubscribing from marketing, we will still send essential service communications such as security notices, account updates and transaction information required to manage your account.

BD303 maintains a comprehensive incident response procedure to address any data breaches that may occur. While we take extensive preventive measures, we are also fully prepared to respond swiftly and transparently should an incident arise.

• Early Detection: Our 24/7 monitoring system is designed to promptly detect any abnormal activity or security breaches.
• Impact Assessment: Within 72 hours of detection, our security team will assess the scope and impact of any suspected breach.
• Member Notifications: If a data breach poses a high risk to your rights and freedoms, bd303 will notify you directly without delay, along with details of what occurred and the steps you should take.
• Reporting to Authorities: BD303 will report material data breaches to the relevant regulatory authorities within the timeframes required by law.
• Recovery Actions: Immediate recovery steps will be taken, including changing passwords, blocking suspicious access, and reinforcing affected systems.

BD303 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. Each version of the Privacy Policy will carry a clear "Updated" date at the top of this page.

For significant changes that materially affect your privacy rights, bd303 will:

• Sending an email notice to all registered members at least 30 days before changes take effect.
• Displaying a prominent notice on the platform's home page throughout the notice period.
• Requesting fresh consent where changes involve new uses of data that require explicit consent.

Continued use of the bd303 platform after the effective date of any changes will be considered your acceptance of the updated Privacy Policy. We encourage you to review this page periodically to stay informed about how we protect your information.