Bull98 Privacy Policy – Personal Data Protection for Malaysian Players

This Privacy Policy explains how bull98 — accessible via bull98.best — collects, uses, stores, and protects your personal information when you use our platform. It also outlines the rights you hold as a user under Malaysian data protection law.

This document applies to all individuals who register an account, use our services, access the bull98 website, or interact with our platform in any way — including via web browser on a smartphone, tablet, or computer in Malaysia.

By registering an account or using the bull98 platform, you confirm that you have read, understood, and accepted this Privacy Policy. If you do not agree with any part of this policy, you are advised not to proceed with registration or use of the platform.

This Privacy Policy should be read together with Terms & Conditions and Responsible Gaming Policy bull98, all of which together form the complete agreement between you and bull98.

Bull98 collects various categories of personal data depending on how you interact with our platform. Below is a comprehensive overview of the data that may be collected:

Please note that bull98 does not store your full credit/debit card number or online banking account password. Financial transactions are processed directly through certified third-party payment gateways — Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX (Maybank2u, CIMB Clicks) — and we only receive transaction confirmations from them, not your card details.

Every piece of data we collect from Malaysian players is used for specific and lawful purposes. bull98 will not use your data for any other purpose without first obtaining your consent. The following are the primary purposes for which your data is used:

• Account Management: Creating and maintaining your player account, processing registrations, verifying identity, and ensuring that only legitimate players can access the platform.
• Transaction Processing: Managing deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, and other supported Malaysian payment methods — as well as processing withdrawals quickly and securely to your account.
• Platform Security: Detecting and preventing fraud, multi-account usage, money laundering, and other unlawful activities that could harm the platform or other players.
• Customer Support: Processing enquiries, complaints, and assistance requests submitted to the bull98 support team via live chat or email.
• Legal Compliance: Fulfilling relevant legal and regulatory obligations, including identity verification (KYC) requirements and reporting obligations stipulated under Malaysian law.
• Platform Improvements: Analysing usage patterns in aggregate (without identifying individuals) to improve platform functionality, user experience, and game variety.
• Service Communications: Sending important account-related notifications — including deposit confirmations, withdrawal updates, and security alerts.

For marketing communications such as promotional emails and bonus notifications, bull98 will only send such materials to players who have given explicit consent during registration. You may withdraw this consent at any time through your account settings or by contacting our support team.

Bull98 does not sell, rent, or trade players' personal data to any party. However, in the course of operating the platform, we may need to share certain information with the following parties — all of whom are subject to strict confidentiality agreements:

• Payment Service Providers: The payment gateways that process your transactions — such as Touch 'n Go eWallet, GrabPay, and DuitNow — receive only the information necessary to securely process your deposits and withdrawals. They do not receive any more information than is required for that purpose alone.
• Game Providers: Casino and slots game providers partnered with bull98 may receive the technical data required to ensure games function correctly within your account. No complete identity data is shared without a clear and justified need.
• Technology Service Providers: Technology infrastructure providers (such as cloud computing services used to host the platform) operating under data processing agreements that comply with Malaysia's PDPA.
• Lawful Authorities: bull98 will disclose personal data to Malaysian authorities (such as the police, courts, or regulatory bodies) when required by law or a valid court order. We will not disclose data beyond what is specified in such a lawful request.

In all cases of data sharing with third parties, bull98 ensures that recipients are bound by confidentiality obligations that are equal to or stricter than those applicable to bull98 itself. Any data recipient found to be in breach of the confidentiality agreement will face legal action.

Protecting players' personal data is more than a legal obligation for bull98 — it is a moral responsibility we take seriously. The bull98 platform has been built with multiple layers of security to ensure your data remains safe at all times.

Specific security measures implemented by bull98 include:

• Data-in-Transit Encryption: All communications between your device and bull98's servers are protected using TLS 1.3 protocol with AES-256 encryption — the highest standard currently available.
• Data Encryption at Rest: Sensitive data stored in our databases — including passwords and financial information — is kept in encrypted form using strong algorithms and cannot be read in its original state.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA, which sends an OTP to your registered phone number each time a login from a new device is detected.
• Internal Access Controls: bull98 employees may only access player data to the extent required by their role. Access to sensitive data is logged, monitored, and audited on a regular basis.
• Regular Penetration Testing: The bull98 platform undergoes regular security assessments (penetration testing) conducted by independent cybersecurity experts to identify and address vulnerabilities before they can be exploited.
• Real-Time Threat Monitoring: An anomaly detection system operates around the clock to identify suspicious activity such as unusual login attempts, abnormal transaction patterns, or access from unrecognised locations.

Like most online platforms, bull98 uses cookies and similar technologies to enhance user experience, analyse platform usage patterns, and deliver certain essential functions.

Bull98 uses several types of cookies:

• Essential Cookies: These cookies are required for the platform to function properly. They manage your login session, remember your language preference, and maintain basic security. Without them, certain platform features will not work correctly. This type of cookie cannot be disabled.
• Functional Cookies: These cookies remember the preferences and settings you configure on the platform — such as your preferred bet size, game display, and account settings — so you do not have to re-enter them each time you log in.
• Analytics Cookies: We use analytics cookies to understand how players interact with the platform — which pages are visited most, where players commonly encounter issues, and how long play sessions last. This data is collected in aggregate form and does not identify individuals. You may opt out of analytics cookies.

You can manage your cookie settings through your web browser at any time. Please note, however, that disabling certain cookies may affect the functionality of the platform. Instructions on how to manage cookies are available in the help documentation of your browser — whether Chrome, Safari, Firefox, or Edge on your Android or iPhone.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a bull98 player have the following rights regarding your personal data:

To exercise any of the above rights, please contact the bull98 support team by email at support@bull98.best or via in-platform live chat. We will verify your identity before processing any request related to your personal data — this is a security measure to ensure only you can access or modify your own data.

Bull98 retains your personal data only for as long as necessary to fulfil the original purpose of collection — or as required by Malaysian law. The following is a general guide to retention periods for different data categories:

• Active Account Data: For the duration of your active account on the bull98 platform, plus the minimum retention period required by law following account closure.
• Financial Transaction Records: Minimum 7 years from the transaction date, in line with Malaysian accounting and tax law requirements.
• Identity Verification Records (KYC): Minimum 5 years after account closure, in line with applicable anti-money laundering (AML) legal requirements.
• Support Communication Logs: 2 years from the date of the last communication, to allow us to provide context should any follow-up issues arise.
• Technical Data & Security Logs: 12 months under normal circumstances, or longer if required for an ongoing investigation.
• Analytics Cookie Data: Typically no more than 13 months from the date of collection.

Once the relevant retention period has ended, your personal data will be securely deleted or anonymised so that it can no longer be linked back to you. The deletion process uses methods that ensure the data cannot be recovered.

Bull98 strictly prohibits individuals under the age of 21 years old from registering for or using our platform. This is not merely an internal policy — it reflects our commitment to protecting young people from exposure to online gambling.

From a data protection standpoint, bull98 does not knowingly collect personal data from individuals under the age of 21. Should we discover that personal data belonging to a minor has been collected — whether through error or deception — we will take the following steps immediately:

1. Closing the account in question immediately.
2. Deleting all personal data associated with that individual from our systems.
3. Returning any eligible financial balance to the rightful account holder.
4. Taking additional preventive measures to ensure the same incident does not recur.

If you suspect that someone under the age of 21 is using the bull98 platform — whether under their own identity or someone else's — please report it to us via support@bull98.best and we will investigate promptly.

Bull98 reserves the right to modify, add to, or update this Privacy Policy at any time to reflect changes in our data practices, new legal requirements, or technological developments. We are committed to communicating transparently about any changes made.

For changes that significant — such as changes to how we primarily use your data or to your rights — we will notify you via:

• Prominent notifications on the bull98.best homepage.
• Email to your registered address, at least 14 days before changes take effect.
• In-platform notifications when you log in.

For minor or technical changes — such as spelling corrections, language clarifications, or updated contact details — we may not send a dedicated notice, but we will update the "Last Updated" date displayed at the top of this page.

We recommend reviewing this Privacy Policy periodically to stay informed on how bull98 protects your personal data. Continued use of the platform after any changes take effect will be considered acceptance of the updated policy.

Current version: 2.5 | Effective date: January 2026

If you have any questions, concerns, or complaints regarding bull98's Privacy Policy or how we handle your personal data, please do not hesitate to get in touch. Our team is ready to assist and committed to providing a transparent and helpful response within a reasonable timeframe.

If you are not satisfied with how bull98 has handled your privacy complaint, you also have the right to lodge a formal complaint with the Malaysia Personal Data Protection Commissioner under the Ministry of Communications. Further information on this formal complaints process is available through official Malaysian government channels.