Privacy Policy Bull98 – Your Personal Data Protection in Malaysia

This Privacy Policy describes Bull98's practices for collecting, using, disclosing, transferring and protecting personal data provided by users of our platform at https://bull98.xyz. It applies to all individuals who register an account, browse the website or use any service offered by Bull98.

Bull98 is a "Data Controller" as defined under Malaysia's Personal Data Protection Act 2010 (PDPA). This means we are fully responsible for determining how and why your personal data is processed, and for ensuring that all processing is carried out in accordance with applicable law.

This policy is written in Malay as the primary language to ensure it is easily understood by all Bull98 members in Malaysia. Should there be any conflict between a translated version and the Malay version, the Malay version shall prevail.

Bull98 only collects personal data that is genuinely necessary to provide our services to you. The following are the categories of data we collect and the purposes for doing so:

Bull98 does not collect sensitive personal data such as health information, religious beliefs, political views or biometric data, unless specifically required by applicable laws or regulations for identity verification purposes.

Bull98 collects your personal data through the following channels:

• Account Registration: When you register a Bull98 account, you provide basic information such as your name, Malaysia phone number, and password. This is data you voluntarily and directly provide to us.
• Deposit & Withdrawal Processing: When you make a deposit using Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, Maybank2u, or CIMB Clicks, transaction information is collected for payment processing and anti-money laundering compliance purposes.
• Platform Usage: When you use Bull98 — whether for Sports Betting on the Malaysia Super League, playing slots, betting at the Live Casino, e-sports, or Virtual Sports — our system automatically records that activity as part of normal platform operations.
• Device & Web Browser: Your web browser automatically transmits certain technical information when you browse the Bull98 website — including your IP address, browser type, operating system, and device details. This data is collected via cookies and standard tracking technologies.
• Customer Support Interactions: When you contact Bull98's support team via Live Chat or email, records of that communication are retained for quality assurance and future reference purposes.
• Referral & Affiliate Program: If you join the Bull98 referral program, additional information about your referral activity is collected for the purpose of calculating commissions and rewards.

Bull98 uses your personal data for the following purposes, in line with the limited use principle under Malaysia's PDPA 2010:

• Account Management: To create, manage and maintain your Bull98 account, including processing logins, verifying your identity and managing account settings.
• Financial Transaction Processing: To securely process your deposits and withdrawals through licensed payment gateways in Malaysia. This includes payment verification, balance reconciliation and financial settlement.
• Service Provision: To give you access to all Bull98 platform features — Sports Betting, Live Casino, slots, e-sports, and Virtual Sports — as well as to store your betting history and gaming statistics.
• Legal Compliance & Anti-Money Laundering: To fulfil Bull98's legal obligations under Malaysian law, including Know Your Customer (KYC) requirements and Anti-Money Laundering (AML) compliance.
• Security & Fraud Detection: To identify and prevent fraudulent activity, multi-account use, bonus abuse, and any other security threats to the Bull98 platform and its members.
• Customer Support: To effectively process your enquiries, complaints, and requests for assistance, and to maintain records of support interactions for quality assurance purposes.
• Service Communications: To send you important account-related notifications — such as deposit confirmations, big wins, terms updates, or critical security alerts — via SMS or email.
• Marketing (with consent): To send you information about promotions, bonuses, special offers, and Bull98 platform updates that may be of interest to you. You may opt out of marketing communications at any time.
• Platform Improvements: To analyze usage patterns and feedback in order to improve the user experience, develop new features, and ensure the Bull98 platform continues to meet the needs of Malaysian players.

Bull98 will not use your personal data for purposes unrelated to those stated above without first obtaining your additional consent.

Bull98 does not sell or rent your personal data to any party. However, there are situations where we need to share certain information with trusted parties for operational purposes. The following are the categories of third parties that may receive a portion of your data, and the reasons why:

• Payment Service Providers: Payment gateways such as FPX, DuitNow, and e-wallet providers receive the transaction information necessary to process your deposits and withdrawals. These providers have their own privacy policies and are bound by confidentiality agreements with Bull98.
• Game Software Providers: Providers such as Evolution Gaming, Pragmatic Play, Ezugi, Kiron Interactive and Sportradar Virtual may receive player identifiers necessary to deliver live casino games, slots and virtual sports to you through the Bull98 platform.
• Technology Service Providers: Server hosting providers, cybersecurity vendors and data analytics companies that assist us in operating and improving the Bull98 platform. All such providers are bound by strict data protection agreements.
• Legal Authorities: Bull98 will disclose personal data to the Royal Malaysia Police, the Malaysian Communications and Multimedia Commission (MCMC), the Inland Revenue Board (LHDN), or any other Malaysian authority where required to do so by law, court order, or in the context of a criminal investigation.
• Business Transfer: In the event that Bull98 is involved in a merger, acquisition, or asset sale, user data may be transferred to the new entity as part of that process. You will be notified in advance before any such data transfer takes place, and your rights will be upheld.

Bull98 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The security measures we have in place include:

• SSL 256-Bit Encryption: All communications between your device and Bull98's servers are encrypted using 256-bit TLS/SSL — the same technology used by leading financial institutions and banks in Malaysia.
• Data Encryption at Rest: Sensitive data stored in Bull98's databases — including passwords and financial information — is encrypted using modern encryption algorithms. Passwords are never stored in plain text.
• Layered Access Control: Access to user data within Bull98's internal systems is restricted on a role-based, need-to-know basis. Staff can only access the data required to carry out their specific duties, and all access is logged and monitored.
• Two-Factor Authentication (2FA): Two-factor authentication is available for all Bull98 player accounts and is mandatory for all internal system access by our staff.
• Continuous Security Monitoring: Bull98's cybersecurity team monitors our systems around the clock to detect any suspicious activity or security threats that could compromise the integrity of user data.
• Regular Penetration Testing: Bull98 conducts regular penetration testing through independent security experts to identify and address any vulnerabilities in our systems before they can be exploited.
• Staff Training: All Bull98 staff with access to user data undergo regular data protection training to ensure they understand and comply with best practices in handling personal data.

While Bull98 takes all reasonable steps to protect your data, no security system can guarantee absolute 100% protection. In the rare event that a data breach is identified that could affect your rights and freedoms, Bull98 will notify you and the relevant authorities within the timeframe required by Malaysian law.

Bull98 uses cookies and similar tracking technologies to enhance your experience on our platform and for analytics purposes. The following are the types of cookies we use:

• Essential Cookies: These cookies are necessary for the core functionality of the Bull98 platform — including login authentication, session management, and security. Without them, the platform cannot function properly. Essential cookies cannot be disabled.
• Preference Cookies: These cookies store your preferences — such as interface language, display settings, and login details — to make your Bull98 experience smoother in future sessions.
• Analytics Cookies: These cookies help Bull98 understand how players use our platform – which pages are visited most, how long sessions last and where traffic comes from. This information is used in aggregated form without identifying individuals, for platform improvement purposes.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorised access, and cyberattacks on the Bull98 platform.

You can control and manage cookies through your web browser settings. However, disabling certain cookies may affect the functionality or your overall experience on the Bull98 platform. Major browsers such as Chrome, Firefox, Safari, and Edge all provide options to accept, reject, or delete cookies through their settings menus.

Bull98 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by Malaysian law. The general principles we follow are as follows:

• Active Account Data: For as long as your Bull98 account remains active, we retain all data associated with that account for the purposes of service delivery, security, and compliance.
• Financial Transaction History: Deposit, withdrawal, and betting history records are retained for a minimum of 7 years from the last transaction, as required under Malaysian financial and anti-money laundering laws.
• KYC (Identity Verification) Data: Identity verification documents submitted for KYC purposes are retained for a minimum of 5 years after account closure, in line with anti-money laundering legal compliance requirements.
• Customer Support Communication Records: Live Chat transcripts and support emails are retained for 2 years for quality assurance purposes and reference in the event of a dispute.
• Technical Data & Server Logs: Server access logs and technical data are retained for 90 days for security and fraud detection purposes, then automatically deleted.
• After Account Closure: When your Bull98 account is closed, we will retain the minimum data required by law and for the resolution of any disputes that may arise. Data that is no longer needed will be deleted or anonymised within 12 months of account closure.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by Bull98:

To exercise any of the rights described above, please contact us by email at support@bull98.xyz with the subject line "Data Subject Rights Request – [Name of Right Requested]". We will acknowledge receipt of your request within 3 business days and provide a full response within 21 business days, as required under Malaysia's PDPA 2010.

Please note that some of these rights are subject to certain exceptions under PDPA 2010. For example, we are unable to delete data that is legally required to be retained, or data needed for the defence of legal proceedings. In such cases, we will inform you of the reasons why your request cannot be fully fulfilled.

The Bull98 platform is a service strictly limited to individuals aged 18 and above. Bull98 does not knowingly collect or process personal data of individuals under the age of 18.

If Bull98 discovers that personal data belonging to a minor has been collected – whether through account registration using false age information or by any other means – the account will be closed immediately and all associated data will be deleted as soon as possible in accordance with our legal obligations.

Bull98 reserves the right to amend this Privacy Policy at any time to reflect changes in law, regulations, business practices, or the technologies we use. When we make material changes, we will notify you via an in-platform notification or by email to the address registered on your account, at least 14 days before the changes take effect.

The "Updated" date shown at the top of this page reflects when this document was last materially revised. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.

Your continued use of the Bull98 platform after any amendments to this Privacy Policy take effect will be considered your acceptance of the revised terms. If you do not agree with the changes made, you have the right to close your Bull98 account and request deletion of your personal data.

Bull98 has appointed a Data Protection Officer responsible for ensuring compliance with PDPA 2010 and our internal privacy policies. If you have any questions, concerns or complaints about how Bull98 handles your personal data, please reach us through the following channels:

• Privacy Email: support@bull98.xyz – use the subject line "Data Privacy Enquiry" to ensure your email is routed to the right team. We aim to respond within 48 working hours for general enquiries, and within 21 days for formal data subject rights requests.
• Live Chat: Available 24/7 within the Bull98 platform — ideal for general privacy enquiries or for guidance on how to submit a formal request regarding your personal data.

If you believe Bull98 is not processing your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), and you have already contacted us but are unsatisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP), which operates under the Ministry of Communications and Digital.