Privacy Policy bagi1 — Your Information Is Fully Protected

Bagi1 understands that privacy is a fundamental right of every user. As an online gaming platform dedicated to Malaysia users, we operate to strict and transparent data protection standards. This policy applies to all information collected through the bagi1 website, mobile app, customer support services, and any other interaction channels between you and our platform.

This document is written with the intent of being as clear as possible — not filled with confusing legal language. We believe that users who understand how their data is managed are users who feel more confident and comfortable using our platform.

Bagi1 collects personal data from various sources depending on how you interact with our platform. The following is a breakdown of the types of data we collect:

The data we collect is used responsibly and only for legitimate purposes related to the operation and improvement of bagi1 services. Here is a summary of how we use your information:

• Account Management: Creating and managing your account, verifying your identity during the KYC process, and processing deposit and withdrawal transactions.
• Customer Support: Providing technical assistance and addressing enquiries related to your account, transactions, or gameplay.
• Platform Security: Detecting and preventing fraudulent activity, unauthorised access, and multi-account usage.
• Legal Compliance: Meeting compliance obligations including anti-money laundering (AML) requirements and financial reporting as required by authorities.
• Service Improvement: Analysing usage patterns in aggregate (not individually) to improve user experience and platform features.
• Service Communications: Sending important notifications regarding your account, terms changes, relevant promotions, and security updates.

Bagi1 does not sell or trade members' personal data for commercial purposes. However, in certain limited situations, we may share information with the following parties:

• Payment Providers: Required transaction details are shared with authorised payment gateways (such as DuitNow and FPX providers) to process your deposits and withdrawals.
• Game Providers: Minimal game session data is shared with licensed game providers to enable games to function properly.
• Authorities: We will disclose information when required by court order, applicable law, or law enforcement authorities.
• Technical Service Providers: Companies that assist us with technical operations (such as server hosting and cybersecurity) have limited access and are bound by strict confidentiality agreements.

All third parties working with bagi1 are bound by data protection agreements that prohibit them from using your information for any purpose other than those stated above.

Bagi1 invests seriously in cybersecurity infrastructure to protect your data. The following are the layers of protection we employ:

• Data Encryption in Transit: All communications between your device and bagi1 servers are secured by TLS 1.3 with 256-bit encryption.
• Data Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 encryption standards.
• Internal Access Controls: Only authorised staff who require access for their specific duties may view user data, in accordance with the principle of least privilege.
• Two-Factor Authentication: bagi1's internal systems use multi-factor authentication to prevent unauthorised access by any unauthorised parties.
• Regular Security Audits: Our systems undergo regular penetration testing and independent security audits to identify and patch any vulnerabilities.

Bagi1 uses cookies and similar tracking technologies to enhance the user experience on our platform. Cookies are small text files stored in your browser when you visit our website.

The types of cookies we use are:

• Essential Cookies: Required for core platform functions such as maintaining login sessions and security preferences. These cookies cannot be disabled.
• Preference Cookies: Remembering user settings such as language preferences and display options to provide a more personalised experience.
• Analytics Cookies: Collecting usage data in aggregate and anonymised form to help us understand how users interact with the platform and improve it.
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser, used to manage your active session.

You can manage and delete cookies through your browser settings. Please note that disabling essential cookies may affect the functionality of certain parts of the bagi1 platform.

The Know Your Customer (KYC) process is an industry-standard requirement in online gaming and forms part of bagi1's commitment to fraud prevention and anti-money laundering.

Documents that may be requested during the KYC process include:

• A valid copy of your MyKad or passport (front and back).
• Proof of current address (utility bill, bank statement) dated within the last 3 months for withdrawals exceeding a specified amount.
• A selfie with your identification document in certain cases for additional verification.

As a bagi1 member, you have certain rights regarding your personal data. These rights can be exercised by contacting the bagi1 customer support team at any time:

Bagi1 retains your personal data only for as long as necessary for the purposes stated in this policy or as required by law. The following are our data retention period guidelines:

• Active Account Data: Retained for the duration of your active membership plus at least 5 years after account closure for record-keeping and compliance purposes.
• Transaction Records: Retained for a minimum of 7 years in accordance with financial reporting and applicable tax legislation requirements.
• KYC Documents: Retained for 5 years after the business relationship ends, or longer if required by authorities.
• Communication Logs: Customer support interaction logs are retained for 2 years for reference and service quality purposes.
• Analytics Data: Non-identifiable usage data is retained for a longer period for service improvement purposes.

When the retention period expires, data will be securely deleted or anonymised in accordance with bagi1's integrated data deletion procedures.

Bagi1 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. When material amendments are made, we will:

• Updating the "Last Updated" date at the top of this page.
• Displaying clear notifications within the bagi1 platform and/or sending emails to registered members.
• Providing at least 7 days' notice before material amendments take effect.

We encourage you to review this Privacy Policy page periodically. Continued use of the bagi1 platform after any amendments take effect will be deemed as acceptance of the updated policy.