Privacy Policy

This Privacy Policy ("Policy") is issued by BD333 ("we", "us", "our") and applies to all personal data collected from individuals ("you", "the Player", "the User") who access, register on, or interact with the BD333 platform located at bd333.casa, including any associated mobile interfaces or features (collectively, "the Platform").

BD333 operates as an online entertainment platform providing casino games, sports betting, live dealer experiences, and related services primarily to players in Malaysia, including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions across the country.

We recognise that your personal information is sensitive and that you place trust in us when you share it. This Policy sets out in plain terms what data we collect, why we collect it, how it is used, who it may be shared with, and what rights you have in relation to it.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the full agreement between you and BD333.

For the purposes of this Privacy Policy, the following definitions apply:

BD333 collects the following categories of personal data from Players. In each case, we collect only the minimum data necessary for the stated purpose:

BD333 collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing the KYC process, making deposits or withdrawal requests, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically through cookies, server logs, and analytics tools when you access and navigate the Platform.
• Payment Processors: Transaction confirmation data received from payment service providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks upon completion of deposit or withdrawal transactions.
• Third-Party Verification Services: Identity verification results returned by KYC and AML screening providers used to comply with legal obligations.
• Fraud Prevention Partners: Risk signals and device fingerprinting data returned by our third-party fraud detection service providers.

BD333 processes your personal data only where a valid legal basis exists for doing so. Depending on the specific processing activity, the applicable legal basis is one of the following:

• Contractual Necessity: Processing required to fulfil the contract between you and BD333 — for example, verifying your identity to open an account, processing your deposits and withdrawals, and maintaining your gaming history.
• Legal Obligation: Processing required to comply with applicable laws and regulations — for example, KYC and AML procedures, age verification (21+ requirement), and record-keeping obligations.
• Legitimate Interests: Processing necessary for BD333's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given and informed consent — for example, the sending of promotional communications and marketing offers. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

BD333 uses the personal data collected for the following specific purposes:

• To create, manage, and maintain your player account on the BD333 Platform;
• To verify your identity and age (minimum 21 years) in compliance with applicable regulations;
• To process deposits and withdrawals via your chosen payment method, whether that is Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, USDT TRC20, or other accepted channels;
• To provide customer support and resolve disputes via live chat and email;
• To send you transaction confirmations, account notifications, and service-related communications;
• To send promotional offers and marketing communications where you have opted in to receive them;
• To monitor betting patterns and account activity for the purposes of fraud prevention, responsible gambling compliance, and AML screening;
• To analyse Platform usage in aggregate (anonymised) form for product development and performance improvement;
• To comply with legal, regulatory, and law enforcement requests where required.

BD333 does not sell your personal data to any third party. We may, however, share limited personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data processing obligations:

• Payment Service Providers: Information necessary to process transactions is shared with your chosen payment provider (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank) solely to execute the relevant transaction.
• KYC and Identity Verification Providers: Identity documents and verification data are shared with licensed third-party KYC providers for the purpose of satisfying our identity verification obligations.
• Fraud Prevention and Risk Management Partners: Technical and behavioural data may be shared with fraud detection service providers to identify and prevent suspicious activity on the Platform.
• IT and Hosting Infrastructure Providers: Data is processed on secure servers managed by contracted hosting and infrastructure partners who operate under binding data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by law, court order, or legitimate regulatory request, BD333 may disclose personal data to competent authorities. BD333 will notify you of such a request where legally permissible to do so.
• Professional Advisers: Legal, accounting, and audit professionals engaged by BD333 may access personal data on a strictly confidential basis where necessary for their advisory role.

All third parties with whom BD333 shares personal data are required to maintain appropriate technical and organisational security measures and to process data solely in accordance with BD333's documented instructions.

BD333 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential / Session Cookies: Required for the Platform to function correctly. These cookies maintain your login session and ensure that game states and account balances are preserved during your visit. They cannot be disabled without impairing Platform functionality.
• Analytics Cookies: Used to collect anonymised data about how players navigate and use the Platform. This data helps us identify performance issues, improve page layouts, and optimise the gaming experience. Identifiable information is not included in analytics reports.
• Fraud Prevention Cookies: Used to detect and prevent suspicious access patterns, account takeover attempts, and other security threats. These cookies generate a device fingerprint that is cross-referenced against our fraud detection database.
• Preference Cookies: Store your language preferences, currency display settings, and other user interface choices so that your preferences persist across sessions.

BD333 does not use third-party advertising cookies, behavioural targeting cookies, or tracking pixels that transmit your data to external advertising networks.

BD333 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. Our standard retention guidelines are as follows:

• Account Data: Retained for the duration of your active account plus a period of five (5) years following account closure, to comply with AML, financial record-keeping, and dispute resolution obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of your last transaction, whichever is later, in accordance with applicable regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Support Communications: Live chat transcripts and email correspondence are retained for up to three (3) years from the date of the interaction.
• Marketing Consent Records: Retained for as long as you hold an active account and for up to two (2) years following account closure or the date of consent withdrawal.
• Technical Logs: Server access logs and fraud detection data are retained for up to twelve (12) months unless specific security incidents require longer retention.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

BD333 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage of sensitive account and payment data at rest using industry-standard encryption algorithms;
• Two-factor authentication (2FA) options available to all account holders;
• Role-based access controls limiting internal staff access to personal data strictly on a need-to-know basis;
• Regular third-party security audits and penetration testing of the Platform infrastructure;
• Real-time fraud monitoring and anomaly detection systems operating 24 hours a day, 7 days a week;
• Secure disposal procedures for physical and digital records containing personal data.

While BD333 takes all reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, BD333 will notify you and relevant authorities in accordance with applicable legal obligations and without undue delay.

As a player on the BD333 Platform, you hold a number of rights in relation to your personal data. You may exercise these rights at any time by contacting our support team. BD333 will respond to all data rights requests within thirty (30) days.

To exercise any of these rights, please contact BD333 using the details in Section 15. We may need to verify your identity before processing your request.

The BD333 Platform is strictly intended for individuals who are 21 years of age or older. We do not knowingly collect personal data from persons under the age of 21. Age verification is performed as part of the KYC process for all new accounts, and any account found to belong to a minor will be immediately closed and all associated data deleted.

If you believe that a minor has provided personal data to BD333, please contact us immediately at the email address provided in Section 15. We take the protection of children's data and the prevention of underage gambling extremely seriously.

The BD333 Platform does not contain links to external third-party websites as a general practice. To the extent that any game provider or payment processor interface includes links to their own external pages, BD333 has no control over the content or privacy practices of those third-party sites and accepts no responsibility for them.

We recommend that you review the privacy policy of any third-party service you interact with when using the BD333 Platform — including your chosen payment provider (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank) and cryptocurrency wallet services — before sharing personal data with those parties.

BD333 reserves the right to update or amend this Privacy Policy at any time. When changes are made, the "Last Updated" date at the top of this page will be revised accordingly. For material changes that significantly affect how we use your personal data, BD333 will make reasonable efforts to notify you via the email address registered to your account.

Continued use of the BD333 Platform following the publication of any amended Privacy Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you must discontinue use of the Platform and contact us to close your account.

We encourage you to review this Privacy Policy periodically to remain informed about how we protect your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by BD333, please contact our Data Protection team through the channels below. All data-related enquiries will be acknowledged within 5 business days and resolved within 30 days wherever possible.

We serve players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam. Our support team is able to assist in both English and Bahasa Melayu.