Policy Privacy bila2 —
Protection Data Member Profile

This Privacy Policy is issued by bila2, an online gaming platform trusted by over 500,000 active members in Malaysia. This document clearly and transparently explains how we collect, process, use, store, disclose and protect your personal information when you use the platform, website, mobile app and all services offered by bila2.

This Privacy Policy is prepared in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data protection. By registering and using bila2 services, you acknowledge that you have read, understood and agreed to the terms set out in this Privacy Policy.

Bila2 reserves the right to update this Privacy Policy from time to time to reflect changes in business practices, legal requirements, or new technologies we adopt. Any material changes will be communicated to members via email or in-platform notification at least 7 days before taking effect. Continued use of the bila2 platform after the effective date constitutes your acceptance of the latest version of this Privacy Policy.

Bila2 collects various categories of information to enable us to provide a secure, personalised, and high-quality service to every member. We only collect information that is strictly necessary for the stated purposes — no excessive data collection is carried out.

Sensitive financial information such as credit/debit card numbers is not stored directly by bila2. Payment processing is handled by authorised third-party payment processors that comply with PCI-DSS (Payment Card Industry Data Security Standard).

Every piece of information we collect has a clear and lawful purpose. bila2 uses member personal data responsibly and in accordance with data minimisation principles — meaning we do not process your data for any purpose beyond those stated below.

• Identity Verification & KYC: To verify that you meet the age and identity eligibility requirements, comply with anti-money laundering (AML) legal obligations, and prevent identity fraud on our platform.
• Service Delivery: To process deposits and withdrawals, manage your account, provide customer support, and ensure a smooth, uninterrupted gaming experience.
• Security & Fraud Prevention: To detect unusual activity, prevent unauthorised access, identify fraud patterns, and protect your account from security threats.
• Legal Compliance: To fulfil reporting obligations to relevant authorities, comply with court orders, and meet other legal obligations.
• Communications & Notifications: To send transaction notifications, account updates, promotional information (with your consent), and important service communications.
• Platform Improvements: To analyse aggregated usage patterns for the purpose of improving the bila2 platform's design, performance, and new features.
• Responsible Gaming: To monitor gambling patterns and identify members who may need assistance or self-control tools, ensuring a healthy and safe gaming experience.

Bila2 does not sell, rent, or exchange members' personal data with any third party for marketing or commercial purposes. However, there are limited situations where we need to share your information with certain parties in order to deliver our services properly.

• Payment Processors: Required transaction information is shared with licensed payment processors such as FPX, DuitNow and digital wallet providers to securely process your deposits and withdrawals.
• Game Software Providers: Limited technical data is shared with licensed game providers for the purpose of delivering games and ensuring game integrity.
• Legal Authorities: bila2 will disclose member information when ordered by a court, law enforcement authorities, or a competent regulatory body in accordance with applicable Malaysian law.
• Analytics Providers: Anonymised and aggregated usage data is shared with analytics tools to help us understand platform usage patterns without exposing individual identities.

Protecting your personal data is bila2's highest priority. We continuously invest in security infrastructure, staff training and the latest technology to ensure your information is always safe from both internal and external threats.

• 256-bit SSL/TLS Encryption: All data communications between your device and bila2's servers are encrypted using the latest TLS 1.3 protocol, making your data unreadable to any party that intercepts the connection.
• Layered Security Architecture: bila2's infrastructure utilises firewalls, intrusion detection systems (IDS), network segmentation and multi-layered security zones to protect data servers against all forms of cyber attacks.
• Two-Factor Authentication (2FA): Members are encouraged and supported to activate 2FA on all withdrawals to add an extra layer of security that prevents unauthorised access even if your password is compromised.
• 24/7 Monitoring: bila2's cybersecurity team monitors the platform continuously, 24 hours a day, 7 days a week, to detect and respond to any threats or suspicious activity in real time.

While we take all reasonable precautions, no system is entirely foolproof. In the event of a data breach that materially affects your personal information, bila2 will notify you and the relevant authorities within the timeframe required by law.

Bila2 uses cookies and similar tracking technologies to enhance the user experience, analyse usage patterns, and ensure platform security. Understanding how we use these technologies will help you make informed choices about your privacy.

• Essential Cookies (Required): These cookies are required for core platform functions such as maintaining login sessions, processing transactions and ensuring account security. Without them, the platform will not function properly and cannot be disabled.
• Analytics Cookies: These cookies help us understand how members use the platform — which pages are visited most often, how long sessions last and where users encounter difficulties. This information is used to improve the overall user experience.
• Preference Cookies: These cookies store your personal preferences such as language settings, display theme and platform configurations you have chosen, so you do not need to reset them every time you log in.

As a bila2 member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal data we hold. We respect these rights and will process every request carefully and promptly.

• Right of Access: You have the right to receive a copy of the personal data we hold about you. Data access requests will be processed within 21 business days from the date the request is received.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate, incomplete or outdated. Basic profile updates can be made directly through your account.
• Right to Erasure: Under certain circumstances, you have the right to request deletion of your personal data. Please note that some data may need to be retained for legal compliance purposes or unresolved dispute resolution.
• Right to Withdraw Consent: You may withdraw consent for data processing at any time, particularly for marketing purposes. Withdrawal of consent does not affect the validity of any processing carried out prior to withdrawal.
• Right to Object to Direct Marketing: You may object to the use of your data for direct marketing purposes at any time by contacting our support team or using the unsubscribe link in any marketing email.

To exercise any of the above rights, please contact the bila2 data protection team via email [email protected] or via live chat within the platform. We may need to verify your identity before processing certain requests to protect the security of your account.

Bila2 does not retain your personal data longer than necessary for the processing purpose or as required by Malaysian law. The retention periods we apply are based on the type of data and the relevant legal requirements.

• Active Account Data: While your account is active, we retain your complete profile information to deliver our services effectively.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date as required by Malaysia's anti-money laundering laws and financial regulations.
• KYC Documents: Retained for 5 years after account closure or the date of the last transaction, whichever is later, in line with AML/CFT compliance requirements.
• Communication Logs: Support chat records and email communications are retained for 2 years for quality control and dispute resolution purposes.
• Closed Account Data: Following account closure, personal data not subject to legal retention requirements will be deleted or anonymised within 90 days.

The bila2 platform may contain links to third-party websites or services such as payment processors, game providers and customer support platforms. This Privacy Policy applies only to the bila2 platform and does not cover the privacy practices of any such third-party websites or services.

Bila2 is not responsible for the content, privacy policies, or security practices of any third-party websites you visit through links on our platform. We encourage you to read and understand the privacy policy of each third-party service you use, especially payment processors, before providing them with any personal information.

If you have any questions, concerns or complaints regarding how bila2 handles your personal data, or to exercise any of the rights set out in this Privacy Policy, please contact our Data Protection Officer (DPO) through the following channels:

• Data Protection Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the chat icon at the bottom of the bila2 platform
• Response Time: Privacy-related requests will be responded to within 14 business days of receipt

We encourage you to contact us first if you have any privacy concerns. However, you also have the right to lodge a complaint directly with Malaysia's Department of Personal Data Protection (JPDP) if you believe your rights under the PDPA have been violated.