Privacy Policy Bull98 – Protection of Malaysian Users' Personal Data

This Privacy Policy explains how bull98 ("Platform", "we") collects, uses, stores, protects and discloses your personal information when you use the platform on the bull98.net website or the bull98 mobile app. This policy applies to all registered users as well as visitors who browse our website.

Bull98 is the data controller for personal information collected through our platform. This means we determine the purpose and manner in which your data is processed, and we are fully responsible for ensuring that processing complies with applicable privacy laws in Malaysia.

Bull98 only collects data that is strictly necessary to provide our services safely and effectively. The following are the categories of data we collect:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• IP address and IP-based location information (country, state)
• Device type, model, operating system version and screen resolution
• Web browser type and version used
• Pages visited, session duration and navigation patterns
• Technical log data including access times and error codes

Every piece of data we collect has a specific and legitimate purpose. We do not collect data in bulk without a clear reason. The following are the primary purposes of data collection at bull98:

1. Account Management: Creating and maintaining your user account, verifying identity and managing account settings.
2. Transaction Processing: Securely processing deposits, withdrawals, bonuses and all financial transactions on the platform.
3. KYC & AML Compliance: Meeting Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements under Malaysia law.
4. Customer Support: Providing technical assistance and resolving any account or transaction issues.
5. Platform Security: Detecting and preventing fraud, unauthorised access and activities that violate the terms of use.
6. Service Improvement: Analysing usage patterns to improve the performance, design and features of the bull98 platform.
7. Service Communications: Sending important notifications about your account, transactions, terms updates and security notices.

Bull98 processes your personal data on valid legal grounds under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent: For marketing communications, use of non-essential cookies, and advanced analytics.
• Contract Performance: To process registrations, transactions, and account management as part of our service agreement.
• Legitimate Interest: For platform security, fraud prevention, and service improvement.
• Legal Obligation: To fulfil KYC and AML requirements and reporting obligations to the relevant Malaysian authorities.

Bull98 does not sell or rent your personal data to any third party for marketing or other commercial purposes. However, there are limited situations where we need to share data with trusted parties for platform operations:

5.1 Authorised Service Providers

We share necessary data with third-party service providers who help us operate the platform — including payment processors, game providers and technical infrastructure providers. All providers are bound by strict confidentiality agreements and are prohibited from using your data for any other purpose.

5.2 Legal Requirements

Bull98 will disclose personal data to the relevant authorities where required by Malaysian law, court order, or to assist in legitimate financial crime investigations.

Bull98 implements multiple layers of technical and organisational security to protect your personal data from unauthorised access, loss or misuse:

• 256-bit SSL/TLS encryption for all data transmissions
• Databases are encrypted and stored in secure data centres with strictly controlled physical access
• User passwords are stored in hashed format using the bcrypt algorithm — we never store passwords in plain text
• Two-Factor Authentication (2FA) is available for all accounts and is strongly recommended
• Security scans and penetration testing are conducted periodically by both internal and external security teams
• Mandatory cybersecurity awareness training for all bull98 staff
• A comprehensive incident response plan to address any data breaches

Bull98 retains your personal data only for as long as necessary for the purposes stated in this policy, or as required by Malaysian law. Our general data retention guidelines are as follows:

• Active account data: For as long as your account remains active on the bull98 platform
• KYC and identity verification data: Minimum 7 years after account closure in accordance with Malaysia AML requirements
• Financial transaction records: Minimum 7 years in accordance with Malaysia tax and financial legal requirements
• Technical and security logs: 12 months from the date the log was generated
• Customer support communication data: 3 years from the date the case was resolved

Once the retention period expires, your data will be securely deleted or anonymised so that it can no longer be identified.

Under Malaysia's PDPA 2010 and the bull98 privacy policy, you have the following rights regarding your personal data. To exercise any of these rights, please contact our support team or email the address listed below.

Bull98 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance and deliver relevant content. Cookies are small text files stored on your device by your web browser.

9.1 Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login session management. Cannot be disabled.
• Preference Cookies: Storing your preferences such as preferred language and interface theme.
• Analytics Cookies: Helps us understand how users interact with the platform for improvement purposes. Can be disabled.

You can manage your cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality of some bull98 platform features.

The bull98 platform is intended for adult users aged 18 and above only. We do not knowingly collect personal data from individuals under the age of 18. Should we discover that a minor's data has been collected without our knowledge, it will be deleted immediately and the associated account will be closed.

If you believe a minor has registered on our platform, please contact us immediately through the bull98 support channels.

Bull98 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. You will be notified of any material changes via your registered email or a prominent notice on the platform at least 7 days before the changes take effect.

The "Last updated" date at the top of this document indicates when this Privacy Policy was last reviewed. Your continued use of the bull98 platform after changes take effect constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the bull98 Data Protection Officer (DPO) through the following channels:

• Email (plain text only): [email protected]
• Live Chat: Available 24/7 via the bull98 web platform or app
• FAQ Page: Visit our FAQ page for privacy-related frequently asked questions

We will endeavour to respond to all privacy-related enquiries within 3 working days. For more formal written requests regarding data subject rights, our response time is within 30 days as required under PDPA 2010.