Bakso108 Privacy Policy – Our Commitment to Protecting Your Personal Data

This Privacy Policy is published by Bakso108 ("we", "the platform") and applies to all users who register, browse, or use the Bakso108 platform at bakso108.asia and all associated subdomains or applications.

We recognise that privacy is a fundamental right. Malaysians deserve to know exactly what data is collected about them, how it is used, and who can access it. That is why the Bakso108 Privacy Policy is written in clear, plain language — not buried under confusing legal jargon.

This policy does not apply to third-party websites or services you may access via links on the Bakso108 platform. We recommend reading the privacy policy of any third-party website you visit separately.

Bakso108 collects various types of personal data depending on how you interact with the platform. Below is a full breakdown of the data we may collect:

We only collect data that is genuinely necessary for the stated purpose. The principle of data minimisation is central to Bakso108's approach to privacy — we do not collect data simply because we can, but only when there is a legitimate and clearly defined need.

Bakso108 uses the personal data collected for the following purposes:

• Service Provision: Processing account registrations, verifying identities, handling deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u and CIMB Clicks, and managing access to games.
• Security & Fraud Prevention: Monitor account activity to detect and prevent fraud, money laundering, unauthorised access, and platform abuse. This includes usage pattern analysis and the verification of suspicious transactions.
• Legal Compliance: Fulfilling legal obligations, including requirements under Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA).
• Customer Support: Resolving queries, complaints, and technical issues submitted by members via live chat, email, or other support channels.
• Platform Improvements: Analysing usage patterns on an aggregated (not individual) basis to understand how the platform is used and to make relevant improvements to the user experience.
• Marketing Communications: Sending information about promotions, bonuses, and new offers – but only where you have given consent to receive marketing communications. You may withdraw this consent at any time.
• Responsible Gaming: Monitoring gaming patterns to identify members who may benefit from responsible gaming support, and reaching out with relevant assistance resources.

Under Malaysia's PDPA 2010, Bakso108 processes your personal data on the following legal bases:

• Consent: For most data processing activities, we rely on the consent you provide at registration or through your communication preference settings. You may withdraw this consent at any time, although doing so may affect our ability to deliver certain services.
• Contract Performance: Data processing required to deliver Bakso108's services to you — including account verification, payment processing, and game management — is carried out on the basis of contractual necessity.
• Legal Obligations: Certain data processing is required to comply with applicable Malaysian laws, including anti-money laundering requirements and financial reporting obligations.
• Legitimate Interests: In certain circumstances, we process data based on Bakso108's legitimate interests — such as fraud detection and platform security — provided those interests do not override your fundamental rights and freedoms.

Bakso108 does not sell members' personal data to any third party. However, we may share personal data in the following limited and controlled circumstances:

• Payment Service Providers: Required transaction information is shared with digital wallet providers (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay), payment processors DuitNow and FPX, and the relevant banks (Maybank, CIMB, and others) solely for the purpose of processing your financial transactions.
• Game Software Providers: Minimum technical data required for game delivery may be shared with licensed game software providers we work with. All agreements with these providers include strict data protection clauses.
• Regulatory Authority: We may be required to disclose certain information to Malaysian authorities such as Bank Negara Malaysia or law enforcement agencies when compelled by a valid court order or applicable legal provision.
• Technical Service Providers: Bakso108's technical infrastructure may involve cloud and hosting service providers that store data under binding data protection agreements, which do not permit them to use your data for their own purposes.
• Fraud Detection: In cases of serious fraud or platform abuse, we may share necessary information with Malaysian law enforcement agencies for investigation purposes.

All third parties with whom we share data are bound by strict confidentiality agreements and are prohibited from using Bakso108 members' personal data for any purpose beyond what is contractually specified.

Bakso108 implements comprehensive technical and organisational security measures to protect your personal data:

• Data Encryption in Transit: All communication between your browser and Bakso108's servers is encrypted using TLS 1.3 with a valid 256-bit SSL certificate, ensuring no third party can intercept or read your data in transit.
• Encryption of Stored Data: Sensitive personal data stored in Bakso108's databases is encrypted using AES-256 — an encryption standard considered unbreakable with current technology.
• Strict Access Controls: Only Bakso108 staff with a legitimate business need are permitted to access member personal data. All access is logged and monitored. Staff undergo background checks and privacy training before being granted access to systems containing personal data.
• Two-Factor Authentication (2FA): Access to Bakso108's administrative systems containing members' personal data is protected by mandatory multi-factor authentication for all staff.
• Continuous Monitoring: An automated security monitoring system operates 24/7 to detect and respond to any unauthorised access attempts or suspicious activity in real time.
• Periodic Penetration Testing: Bakso108 conducts periodic penetration testing by independent security experts to identify and address vulnerabilities before they can be exploited.
• Incident Response Plan: Bakso108 has a tested security incident response plan to ensure any data breach is detected, contained, and reported to the relevant authorities and affected individuals within the required timeframe.

Bakso108 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Active Account Data: For as long as your account is active on Bakso108 and for 5 years after account closure, in line with Malaysia's anti-money laundering legal requirements.
• Financial Transaction Records: Minimum 7 years from the date of transaction, in line with Malaysian financial and tax reporting requirements.
• Support Communication Records: 3 years from the date of last communication, for reference and dispute resolution purposes.
• Cookie Data: Depending on the type of cookie – session cookies are deleted when you close your browser, while persistent cookies have a set expiry period (see Section 8).
• Technical Data (Server Logs): Maximum 12 months unless a longer period is required for active security incident investigations.

Once the applicable retention period has elapsed, your personal data will be securely destroyed using methods that ensure the data cannot be recovered. We conduct regular data review and cleansing processes to ensure we do not retain data longer than necessary.

Bakso108 uses cookies and similar tracking technologies to enhance your experience on the platform. Below are the types of cookies we use:

• Essential Cookies (Required): Required for core platform functions such as maintaining your login session, remembering language preferences, and ensuring session security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information about how you use Bakso108 — pages visited, time spent, and any error messages encountered. All such data is aggregated and does not identify you individually. It is used solely for platform improvement.
• Functional Cookies: Allowing the platform to remember your preferences, such as font size, display settings, and other personal settings, to deliver a more personalised experience.
• Security Cookies: Used to detect unauthorised access attempts, monitor suspicious activity, and protect the platform against cyber attacks.

You can manage your cookie preferences through your browser settings. However, disabling essential cookies may affect the functionality and session security of the Bakso108 platform. For guidance on managing cookies in popular browsers, refer to your browser's help documentation.

In the course of its operations, Bakso108 may need to transfer your personal data to entities operating outside Malaysia, particularly in relation to cloud technology infrastructure and internationally licensed gaming software providers.

Bakso108 ensures that any cross-border data transfers are conducted with adequate safeguards, including:

• Contractually binding data processing agreements that require a level of protection equivalent to Malaysia's PDPA.
• Use of recognised standard contractual clauses for international data transfers.
• Ensuring that data recipients in other countries are subject to laws or data protection frameworks that provide an equivalent level of protection.

You can find out more about the protective mechanisms we use for cross-border data transfers by contacting our privacy team at support@bakso108.asia.

The Bakso108 platform is exclusively for users aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18.

If we discover that personal data has been collected from a minor without proper verification, we will take immediate steps to:

• Suspend the account in question immediately.
• Permanently deleting all personal data associated with the account from our systems.
• Returning any remaining account balance to the original payment method used for the deposit.

If you have information that someone under the age of 18 has registered on Bakso108, please contact us immediately at support@bakso108.asia so that we can take the appropriate action.

If you have any concerns about how Bakso108 handles your personal data, or wish to submit a request relating to your data rights, please follow the procedure below:

1. Contact Us Directly: Submit your query or complaint to support@bakso108.asia with the email subject "Data Privacy Enquiry". Please include your account number, details of your complaint, and any supporting documents where applicable.
2. Response Time: Our privacy team will acknowledge receipt of your complaint within 5 business days and provide a full response within 30 days.
3. If You Are Not Satisfied: If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia under the Ministry of Digital.

We take all privacy complaints seriously and are committed to resolving every issue transparently and fairly.

Bakso108 reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, new legal requirements, or improvements in how we protect your personal data.

When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Post a prominent notice on the Bakso108 platform homepage regarding the changes taking effect.
• In the case of significant changes, sending a notification directly to the email address registered to your account.

We encourage you to review this Privacy Policy periodically. Continued use of the Bakso108 platform after any changes are published will be considered acceptance of the updated privacy terms.