Privacy Policy

bcaa4 ("bcaa4", "we", "us", "our") operates the online gaming platform accessible at bcaa4.cam (the "Platform"). We are fully committed to protecting the privacy and personal data of every individual who accesses or uses our services, including visitors, registered account holders, and former players based in Malaysia and elsewhere.

This Privacy Policy ("Policy") describes how bcaa4 collects, uses, stores, discloses, and otherwise processes personal data in connection with the Platform. It has been prepared in accordance with internationally recognised data protection principles and applies to all personal data we process, regardless of the medium through which it is collected.

By registering an account, accessing the Platform, or continuing to use any bcaa4 service after this Policy has been made available to you, you acknowledge that you have read and understood this Policy. This Policy is to be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the full framework governing your relationship with bcaa4.

The following definitions apply throughout this Policy:

bcaa4 collects personal data through several channels. The categories of data we collect and the circumstances in which each category arises are set out below:

3.1 Registration & Account Data

When you create an account on bcaa4, we collect the information you provide directly, which may include: full legal name, date of birth, Malaysian identity card number (MyKad) or passport number, residential address (including city — e.g., Kuala Lumpur, Petaling Jaya, Shah Alam, Johor Bahru, or Penang), email address, and phone number. This information is required to create and maintain your account in compliance with our Know Your Customer obligations.

3.2 KYC Verification Documents

To verify your identity and address prior to your first withdrawal, we may collect copies of government-issued identification documents (Malaysian MyKad, passport, or driver's licence), proof of address documents (utility bills, bank statements), and selfie photographs taken in conjunction with your ID. These are processed securely and used only for identity verification purposes.

3.3 Financial & Transaction Data

We record all deposit and withdrawal transactions processed through the Platform, including payment method details (e.g., Touch 'n Go eWallet account reference, Boost wallet ID, GrabPay account, DuitNow registered number, FPX bank code, Maybank2u account, CIMB Clicks account, Public Bank account, Hong Leong Connect account, or cryptocurrency wallet address), transaction amounts in MYR or cryptocurrency equivalent, and transaction timestamps.

3.4 Technical & Usage Data

When you access the Platform, we automatically collect technical data including: IP address, browser type and version, device type and operating system, session duration, pages visited, game activity logs, and clickstream data. This data is used for Platform security, fraud detection, and service improvement purposes.

3.5 Customer Support Correspondence

Any communications you submit through live chat, email to [email protected], or WhatsApp support channels are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

bcaa4 processes your personal data for the following purposes. Each purpose is tied to a specific lawful basis, as detailed in Section 5:

bcaa4 processes personal data under the following lawful bases:

• Contractual Necessity: Processing required to provide the services you have signed up for — account management, deposits, withdrawals, game access, and customer support.
• Legal Obligation: Processing necessary to comply with applicable laws, including anti-money laundering regulations, sanctions screening obligations, and age verification requirements.
• Legitimate Interests: Processing carried out for purposes that are in the legitimate interests of bcaa4 or third parties, such as fraud detection, platform security, and responsible gambling monitoring, provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we send direct marketing communications or use non-essential cookies, we will do so only on the basis of your prior explicit consent, which may be withdrawn at any time without detriment to your account.

bcaa4 does not sell personal data to third parties. We share personal data only in the following limited circumstances, and only to the extent necessary for each purpose:

• Payment Service Providers: To process deposits and withdrawals via Malaysian payment rails (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong) and cryptocurrency gateways. These providers receive only the transaction-specific data required for payment execution.
• KYC & Identity Verification Partners: Specialist third-party KYC service providers process your identity documents for age and identity verification. All KYC processors are bound by contractual data processing agreements that prohibit secondary use of your documents.
• Game Content Providers: Game studios powering the bcaa4 Platform may receive pseudonymised player session data (e.g., player ID, wager amounts, RNG seeds) for game integrity purposes. They do not receive personally identifiable information such as your name, IC number, or contact details.
• Regulatory & Law Enforcement Authorities: Where we are required by applicable law, court order, or regulatory directive to disclose personal data, we will do so. bcaa4 is legally obligated to report suspicious financial activity to relevant authorities under applicable AML legislation.
• Group Companies & Successors: Personal data may be shared within the bcaa4 corporate group where necessary for operational or compliance purposes. In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity, subject to the same privacy protections as set out in this Policy.

bcaa4 uses cookies and similar tracking technologies to operate the Platform effectively, personalise your experience, and support our security and analytics functions. The types of cookies we use are as follows:

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to refuse, delete, or selectively accept cookies. Note that disabling strictly necessary cookies may prevent you from logging in or using core Platform features.

bcaa4 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

bcaa4 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the bcaa4 Platform is encrypted using industry-standard Transport Layer Security (TLS). You can verify this by checking for the padlock icon in your browser's address bar when visiting bcaa4.cam.
• At-Rest Encryption: Personal data stored on bcaa4 servers is encrypted at rest using AES-256 encryption standards.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo data protection training and are bound by confidentiality obligations.
• Two-Factor Authentication (2FA): bcaa4 offers 2FA for player accounts and mandates it for all internal administrative system access.
• Intrusion Detection: Our infrastructure is monitored continuously for anomalous access patterns, with automated alerts and incident response procedures in place.
• Penetration Testing: We conduct regular third-party security assessments to identify and remediate vulnerabilities in our Platform and data infrastructure.

Notwithstanding the above, no system of data transmission or storage can be guaranteed to be completely secure. bcaa4 strongly encourages users to maintain strong, unique passwords for their account and to enable two-factor authentication.

As a data subject, you hold a number of rights in relation to the personal data that bcaa4 processes about you. These rights are set out below. To exercise any of these rights, please submit a written request to [email protected] clearly identifying the right you wish to exercise and your account details.

Age verification is a mandatory step in the bcaa4 KYC process. Where bcaa4 discovers or has reasonable grounds to believe that personal data has been provided by or on behalf of a person under the age of 21, we will:

• Immediately suspend the associated account pending investigation.
• Permanently close the account upon confirmation of underage access.
• Securely delete all personal data associated with the underage individual as soon as is legally permissible.
• Return any net deposits made by the underage individual, minus any winnings, after deducting costs associated with the investigation.

If you are a parent or guardian and believe your child has created an account on bcaa4, please contact us immediately at [email protected] so that we may take prompt action.

bcaa4 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Where changes are material, we will provide reasonable advance notice by posting a prominent announcement on the Platform and, where appropriate, sending an email notification to your registered address.

The "Effective Date" displayed at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically. Your continued use of the bcaa4 Platform after any amendment has taken effect constitutes your acceptance of the revised Policy.

The current version of this Privacy Policy is always accessible at bcaa4.cam/privacy-policy.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact the bcaa4 data team using the details below. We ask that all correspondence be submitted in English for efficient processing.