Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how bull88 ("bull88", "we", "us", or "our") collects, processes, stores, and protects the personal data of individuals ("you", "Member", or "User") who access or use the bull88 platform, including the website at bull88.asia, the bull88 mobile application, and all associated gaming and betting services.

bull88 takes its obligations under applicable data protection legislation seriously. We process your personal data only for legitimate, specified purposes, retain it no longer than necessary, and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure.

By registering an account with bull88 or otherwise using the bull88 platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should cease using the bull88 platform and may request account closure in accordance with our Terms & Conditions.

2. Data Controller

For the purposes of applicable data protection law, bull88 acts as the data controller in respect of personal data processed through the bull88 platform. As data controller, bull88 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable legal obligations.

If you have any questions about how your data is handled or wish to exercise your data subject rights as described in Section 11 of this Policy, please contact our Data Protection team using the details set out in Section 14.

3. Data We Collect

bull88 collects the following categories of personal data in connection with the provision of its services:

• Identity Data: Full legal name, date of birth, nationality, government-issued identification number (such as MyKAD or passport number), and photographs or scans of identity documents submitted for KYC verification purposes.
• Contact Data: Registered email address, Malaysian mobile telephone number, and residential address.
• Financial Data: Payment method details (such as e-wallet identifiers for Touch n Go eWallet or Boost, or bank account details for Maybank, CIMB, or Public Bank), transaction history including deposits and withdrawals, and source of funds documentation where required.
• Account Data: Username, hashed password credentials, account preferences, language settings, responsible gaming limits and self-exclusion records, and customer support correspondence.
• Gaming Data: Wagering history, game session logs, bet amounts, winnings and losses, and game type preferences.
• Technical Data: IP address, device identifiers, browser type and version, operating system, screen resolution, session timestamps, and geolocation data derived from your IP address.
• Usage Data: Page navigation paths, feature usage patterns, click behaviour, and referral source information.
• Communications Data: Records of live chat sessions, email correspondence, and any feedback or complaints submitted to bull88.

4. How We Collect Data

bull88 collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated collection: Technical and usage data collected automatically when you access the bull88 platform, including through cookies, web beacons, server logs, and similar tracking technologies as described in Section 10.
• Third-party sources: Identity verification and fraud prevention service providers may supply supplementary data to confirm the accuracy of information you have provided. Payment processors may provide transaction confirmation data. Regulatory and sanctions screening databases may be consulted as required by our licence conditions.

5. Purpose & Legal Basis for Processing

bull88 processes your personal data only where a lawful basis exists for doing so. The table below summarises the primary purposes for which we process personal data and the corresponding legal basis:

• Account registration and management — necessary for the performance of a contract with you.
• Identity and age verification (KYC) — compliance with legal obligations and our licence conditions; also to protect the vital interests of third parties (underage gambling prevention).
• Processing deposits and withdrawals — necessary for the performance of a contract with you.
• Anti-money laundering (AML) and fraud screening — compliance with legal obligations.
• Customer support — legitimate interests (providing effective service); performance of contract.
• Responsible gaming monitoring — compliance with regulatory obligations; protection of your vital interests.
• Service improvement and analytics — legitimate interests (improving the bull88 platform for all users).
• Marketing communications — consent (where you have opted in); you may withdraw consent at any time.
• Legal claims and dispute resolution — legitimate interests; compliance with legal obligations.

6. Data Sharing

bull88 does not sell, rent, or trade your personal data to third parties. We may disclose your personal data to the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Identity and age verification providers: Third-party KYC and eKYC service providers used to confirm your identity and age before withdrawal processing.
• Payment processors: E-wallet operators (including Touch n Go eWallet and Boost), banks (including Maybank, CIMB, and Public Bank), and cryptocurrency payment processors, for the sole purpose of processing your transactions.
• Fraud prevention and AML screening services: Providers of sanctions lists, politically exposed persons ("PEP") databases, and fraud detection analytics used to meet our regulatory obligations.
• Technology and infrastructure providers: Cloud hosting, content delivery, and platform software vendors operating under data processing agreements that bind them to equivalent data protection standards.
• Regulatory and law enforcement authorities: Where we are required to do so by law, court order, or instruction from a competent regulatory authority, including our licensing authority.
• Professional advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations.

All third parties with whom bull88 shares personal data are required to handle such data in accordance with applicable data protection law and bull88's data processing requirements.

7. International Data Transfers

bull88 operates globally and some of our service providers and infrastructure partners are located outside Malaysia. Where your personal data is transferred to a country that does not provide an equivalent level of data protection to that applicable in Malaysia, bull88 will implement appropriate safeguards to ensure that your data remains protected to the standards described in this Policy.

Such safeguards may include standard contractual clauses approved by relevant data protection authorities, binding corporate rules, or transfers to countries that have been assessed as providing an adequate level of data protection. You may request further information about the specific safeguards in place for any particular transfer by contacting our Data Protection team.

8. Data Retention

bull88 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation.

• Account data and KYC documentation are retained for a minimum of five (5) years following account closure, as required by anti-money laundering regulations.
• Financial transaction records are retained for a minimum of seven (7) years for tax and audit purposes.
• Gaming session logs are retained for a minimum of three (3) years to support dispute resolution and regulatory reporting.
• Marketing consent records are retained for the duration of the consent plus two (2) years.
• Customer support correspondence is retained for three (3) years from the date of the last interaction.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with bull88's data lifecycle management procedures.

9. Security Measures

bull88 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, without limitation:

• 256-bit Transport Layer Security (TLS) encryption for all data transmitted between your device and bull88 servers.
• Encryption of sensitive data at rest, including password credentials (stored exclusively as salted hashes) and KYC documentation.
• Role-based access controls limiting employee access to personal data to those with a documented need to access it.
• Regular security assessments, penetration testing, and vulnerability scanning of the bull88 platform and infrastructure.
• Multi-factor authentication requirements for all internal systems that process personal data.
• Incident response procedures to detect, contain, and report data security incidents in accordance with applicable legal obligations.

While bull88 takes all reasonable technical and organisational precautions to safeguard your data, no system is entirely immune to risk. You are responsible for maintaining the confidentiality of your bull88 account credentials and should notify us immediately of any suspected unauthorised access to your account.

10. Cookies & Tracking Technologies

bull88 uses cookies and similar tracking technologies to operate the platform, remember your preferences, analyse usage patterns, and support fraud prevention measures. The categories of cookies used by bull88 include:

• Strictly Necessary Cookies: Required for core platform functionality, including maintaining your login session and security token validation. These cannot be disabled without impairing the usability of the platform.
• Performance Cookies: Collect anonymised data about how users interact with the bull88 platform, including page load times, error rates, and navigation paths. Used solely to improve platform performance.
• Functional Cookies: Remember your preferences such as language settings, display options, and previously used payment methods to personalise your experience.
• Analytical Cookies: Used to understand aggregate usage patterns and user behaviour on the platform. Data collected through analytical cookies does not identify individual users.

You may manage your cookie preferences through your browser settings. Note that disabling certain categories of cookies may affect the functionality or performance of the bull88 platform. bull88 does not use cookies to serve third-party advertising.

11. Your Data Subject Rights

Subject to applicable law and certain conditions and exceptions, you have the following rights in relation to your personal data held by bull88:

• Right of Access: You may request a copy of the personal data bull88 holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. Where possible, please update your account information directly through your bull88 profile settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to bull88's legal retention obligations.
• Right to Restriction: You may request that bull88 restrict the processing of your data in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to processing based on bull88's legitimate interests, including processing for direct marketing purposes. bull88 will cease processing unless it can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact bull88's Data Protection team as described in Section 14. We will respond to verified requests within thirty (30) calendar days. We may need to verify your identity before processing your request.

12. Children's Privacy

The bull88 platform is strictly intended for individuals aged 21 years and above. bull88 does not knowingly collect, process, or store personal data from any person under the age of 21. Age verification is conducted as a mandatory step in the KYC process before any withdrawal from a bull88 account can be processed.

If bull88 becomes aware that personal data has been collected from a person under the age of 21, that account will be suspended immediately, all associated data will be reviewed, and any balance remaining in the account will be handled in accordance with our Terms & Conditions and applicable legal obligations.

If you have reason to believe that a person under the age of 21 has registered an account with bull88, please contact our support team immediately.

13. Changes to This Policy

bull88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our platform's features and functionality. Material changes will be communicated to registered Members via the contact information held on their account, no less than fourteen (14) days before the updated Policy takes effect.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed about how bull88 handles your personal data. Your continued use of the bull88 platform following the effective date of any amendment constitutes acceptance of the updated Policy.

14. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or wish to raise a concern about how bull88 has handled your personal data, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 via the bull88 platform after completing bull88 Login.
• Email: [email protected] — please mark the subject line "Data Protection Enquiry".

bull88 will acknowledge your enquiry within two (2) business days and aims to resolve all data protection matters within thirty (30) calendar days. If you are not satisfied with bull88's response, you retain the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.