Bandar69 Privacy Policy – Personal Data Protection for Malaysian Players

Introduction – Bandar69's Privacy Commitment

Bandar69 understands that when you register an account and play on our platform, you are trusting us with deeply personal information. That trust is not something we take lightly. This Privacy Policy exists to give you a clear and honest picture of how we handle every piece of data you share with us – from your name and phone number to your transaction history and gaming activity.

As a platform operating in Malaysia and serving Malaysian players exclusively, Bandar69 comply with Malaysia's Personal Data Protection Act 2010 (PDPA) in all aspects of personal data handling. The PDPA is Malaysia's primary legislation governing how organisations collect, process, store and disclose individuals' personal data. We also reference international best practices in data protection as additional guidance.

Bandar69 acts as the Data Controller (Data Controller) for all personal data you provide to us. This means we determine the purposes and means of processing your data, and we bear full responsibility for ensuring that data is processed lawfully, fairly and securely.

Personal Information We Collect

Bandar69 only collects information that is strictly necessary to provide our services to you. We do not collect excessive or irrelevant data beyond what is needed for platform operations. The following are the categories of information we collect:

Account Registration Information:

• Full name (as shown on your MyKad or Malaysian passport)
• An active Malaysian mobile number
• A valid and active email address
• Date of birth (for minimum age verification of 18 years)
• Your chosen username

Identity Verification (KYC) Information:

• A copy of your MyKad or Malaysian passport
• Latest Malaysian bank statement (for payment method verification)
• Proof of Malaysian residential address (where required)
• Selfie with identification document (in certain cases)

Financial and Transaction Information:

• Details of the payment methods you use – Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX (Maybank2u, CIMB Clicks)
• Deposit and withdrawal history, including amounts, dates, and times
• Bank account number or e-wallet ID (partially masked for security)

Platform Activity Information:

• Gaming history – games played, session duration, bet amounts and outcomes
• Game preferences and account settings
• Communication records with our CS team, including live chat logs and emails
• Device information — device type, operating system, browser version, and screen resolution
• IP address and approximate location data (state within Malaysia)
• Cookie data and session identifiers (see Section 9)

How We Use Your Personal Data

Every use of your personal data by Bandar69 is for legitimate and clearly stated purposes. We do not use your data for anything unrelated to the services you have subscribed to. The purposes of use are as follows:

Legal Basis for Data Processing

Under Malaysia's PDPA 2010, Bandar69 processes your personal data based on one or more of the following legal bases, depending on the nature of the processing involved:

• Performance of Contract: Processing necessary to fulfil the service agreement between you and Bandar69 – including account management, payment processing and the provision of games.
• Legal Obligation: Processing required to comply with applicable Malaysian laws, including KYC requirements, financial reporting, and anti-money laundering (AML) compliance obligations.
• Legitimate Interest: Processing for the purposes of platform security, fraud prevention, service improvement, and usage analytics – where our legitimate interests do not override your fundamental rights.
• Consent: For marketing communications and any processing that is not required by contract or law, we require your explicit consent, and you are free to withdraw that consent at any time.

Data Sharing with Third Parties

Bandar69 does not sell, rent or trade your personal data to any third party for marketing purposes or for any purpose unrelated to our services. Data sharing only takes place in the following circumstances and only to the extent necessary:

• Payment Service Providers: Transaction information that must be shared with payment providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow and Malaysian banks to process your deposits and withdrawals. All such providers are bound by their own privacy policies and industry security standards.
• Game Providers: Minimum game data required by providers such as Pragmatic Play, Microgaming and PG Soft to enable their games to function within our platform. This does not include your personal financial information.
• Regulatory Authority: Information that is legally required to be disclosed to the relevant Malaysian authorities, including in financial crime investigations or pursuant to a court order.
• Technology Providers: Cloud, analytics, and cybersecurity service providers we engage to operate the platform — all bound by strict data processing agreements and not permitted to use your data for their own purposes.

In all instances of data sharing, Bandar69 ensures that recipients meet adequate data protection standards and use the data solely for the stated purposes. We maintain records of all data sharing and can provide this information to you upon request.

Data Security Measures We Have in Place

The security of your personal data is Bandar69's highest priority. We continually invest in the latest security technologies and processes to ensure your data is protected at all times. Our security measures include:

• 256-bit SSL/TLS Encryption: All communications between your browser and Bandar69's servers are encrypted using 256-bit SSL/TLS — the same standard used by leading Malaysian banking institutions. This means data in transit cannot be intercepted or read by any third party.
• Secure Password Storage: Your account password is never stored in plain text. We use a strong hashing algorithm with a unique salt value for each account, ensuring your password cannot be recovered — even by our own technical team.
• Two-Factor Authentication (2FA): The 2FA feature we offer adds an extra layer of protection to your account. Even if someone knows your password, they still cannot access your account without the verification code sent to your Malaysian mobile number.
• 24/7 Security Monitoring: Our systems are continuously monitored for suspicious activity, unusual login attempts and irregular transaction patterns. Automated alerts are sent to our security team whenever anomalies are detected.
• Data Segregation: Member funds are held in accounts separate from the company's operating capital. This ensures your money cannot be used for any other purpose and remains available for withdrawal at all times.
• Regular Security Audits: The Bandar69 platform undergoes independent security audits on a regular basis to identify and address any vulnerabilities before they can be exploited.
• Internal Access Controls: Access to members' personal data by Bandar69 staff is restricted on a need-to-know basis. All access is logged and audited on a regular basis.

While we take all reasonable steps to protect your data, no security system is entirely foolproof. In the unlikely event of a data breach affecting your information, we will notify you and the relevant authorities within the timeframe required by law.

Personal Data Retention Period

Bandar69 does not retain your personal data indefinitely. We keep data only for as long as it is needed for the purposes stated in this Privacy Policy, or as required under Malaysian law. The following guidelines apply to our retention periods:

• Active Account Data: Your account data is retained for as long as your account remains active and you continue to use Bandar69's services.
• Data After Account Closure: After an account is closed, we retain your personal data for 5 years for legal compliance, dispute resolution, and fraud prevention purposes. This is the minimum retention period required under Malaysia's banking and financial regulations.
• Financial Transaction Records: All financial transaction records are retained for a minimum of 7 years in line with Malaysia's accounting and tax legal requirements.
• CS Communication Logs: Live chat session records and emails with our CS team are retained for 2 Years for quality assurance and dispute resolution purposes.
• Cookie Data: Session cookies are deleted when you close your browser. Preference cookies are stored for a maximum of 12 Months or until you delete them manually.

Once the relevant retention period has expired, your data will be securely deleted or anonymised in accordance with established data deletion procedures, ensuring it can no longer be recovered or linked back to you.

Your Rights as a Data Subject under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have certain rights in relation to the personal data we hold about you. Bandar69 respects and facilitates the exercise of these rights:

To exercise any of the above rights, you may contact the Bandar69 Privacy Officer by email at support@bandar69.best or via live chat on the platform. Please include proof of identity with your request for verification purposes. We will respond to all rights-related requests within 21 business days.

Cookies and Tracking Technologies

The bandar69 platform uses cookies and similar tracking technologies to enhance your user experience. Cookies are small text files stored in your browser when you visit our platform.

You can manage your cookie settings through your browser settings. However, disabling essential and security cookies may affect the functionality of the Bandar69 platform and your account security. We recommend keeping all cookies enabled for the best experience.

Cross-Border Data Transfers

Bandar69 prioritises storing Malaysian member data on servers located within the Asia-Pacific region. However, in the course of our operations, some data may be processed or stored by international technology service providers whose servers are located outside Malaysia.

In all cases of cross-border data transfers, Bandar69 ensures:

• The recipient country provides an adequate level of data protection, or
• Appropriate contractual agreements have been entered into with data recipients to protect your data to a standard equivalent to Malaysia's PDPA 2010, or
• You have given explicit consent for the transfer

You may request further details about specific cross-border data transfers by contacting our Privacy Officer at support@bandar69.best.

Children and Privacy

The bandar69 platform is not intended for individuals under the age of 18, and we do not knowingly collect personal data from minors. The minimum age requirement to register and use the platform is 18 years and this is enforced through an age verification process.

If we discover that we have inadvertently collected personal data from a minor, we will delete that information immediately and close the account in question. Parents or guardians who suspect their child has registered with Bandar69 are urged to contact us immediately at support@bandar69.best so that the appropriate action can be taken.

Contact Bandar69's Privacy Officer

If you have any questions, concerns or complaints regarding how Bandar69 handles your personal data, we encourage you to reach out to us directly. Bandar69's Privacy Officer is responsible for ensuring compliance with this Privacy Policy and addressing all privacy-related enquiries.

• Email: support@bandar69.best (please use the subject line: "Privacy Enquiry – [Your Name]")
• Live Chat: Log in to the Bandar69 platform and use our live chat function, available 24/7 in Bahasa Melayu
• Target Response Time: We aim to respond to all privacy-related enquiries within 3 business days and resolve issues within 21 business days

If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner (PDPC). Information on the PDPC complaints process is available on the official PDPC Malaysia website.