Privacy Policy bika9 – Malaysia User Data Protection

Bika9 ("we", "Platform") is committed to protecting the privacy of all users who access and use our services through the bika9.org website and the bika9 mobile app. This Privacy Policy clearly explains how we collect, use, store, and protect your personal data.

This document applies to all bika9 users in Malaysia, including those browsing the website without an account, registered members, and active users making full use of our services. By using the bika9 platform, you agree to the practices described in this policy.

This Privacy Policy should be read together with the Terms and Conditions bika9. In the event of any conflict between both documents regarding data privacy, this Privacy Policy shall take precedence.

Bika9 only collects data that is strictly necessary to provide you with a safe and efficient service. We do not collect irrelevant or excessive data. The following are the types of data we collect:

In addition to data you provide directly, we also collect data automatically through cookie technology and server logs when you use our platform.

The personal data we collect is used solely for legitimate purposes directly related to the provision of bika9 services. Specifically, we use your data to:

• Managing your account — registration, login, password recovery, and account verification.
• Processing financial transactions — deposits, withdrawals, and transfers you make on the platform.
• Complying with KYC and AML requirements — identity verification to fulfill anti-money laundering legal obligations.
• Providing customer support — handling your enquiries, complaints, and support requests effectively.
• Sending important communications — security notifications, policy updates, and critical account information.
• Improving user experience — analyzing usage patterns to improve platform functionality and offer relevant content.
• Preventing fraud and illegal activities — monitoring suspicious activity to protect all platform users.

Every personal data processing activity we carry out has a solid legal basis under the Malaysia Personal Data Protection Act 2010 (PDPA). These bases are as follows:

• Your consent — by registering and using the bika9 platform, you consent to the data processing described in this policy.
• Contract performance — data processing is required to fulfill our obligations to you as a bika9 user.
• Legitimate interest — some processing is carried out on legitimate business interests, such as fraud prevention and platform security.
• Legal compliance — some data is processed to fulfill legal obligations under applicable Malaysian legislation.

Bika9 does not share your personal data with third parties except in the following specific and limited circumstances:

• Payment service providers — to process your deposits and withdrawals securely. These providers are bound by strict confidentiality agreements.
• Technology service providers — companies that help us operate the platform's technical infrastructure, subject to data protection agreements.
• Regulatory bodies and authorities — when required by law or official directive from Malaysian authorities.
• Fraud prevention — sharing limited information with trusted security partners to detect and prevent fraudulent activity.

In all cases of data sharing, we ensure that recipients are bound by data protection standards equal to or higher than those we apply ourselves.

The security of your data is bika9's top priority. We implement multiple layers of technical and organisational safeguards to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS Encryption for all data transmitted between your device and bika9 servers.
• Encryption of data at rest for all sensitive information stored in our databases.
• Two-factor authentication (2FA) available to all user accounts as an additional layer of protection.
• Secure 24/7 monitoring by the bika9 cybersecurity team to detect any suspicious activity.
• Periodic penetration testing by independent security experts to identify and address any system vulnerabilities.
• Internal access controls strict access controls — only authorized personnel may access user data, and every access is meticulously logged.

While we take all reasonable precautions, no security system can be guaranteed 100% safe. We encourage you to help protect your account by using a strong password and never sharing your login details with anyone.

Bika9 uses cookies and similar tracking technologies to enhance your experience on the platform. There are several types of cookies we use:

• Essential Cookies — required for core platform functions such as login and session security. These cookies cannot be disabled.
• Performance Cookies — helping us understand how users interact with the platform for continuous improvement purposes.
• Functional Cookies — storing your preferences such as language and display settings for a more personalized experience.
• Analytics Cookies — collecting statistical data that does not personally identify you, used for traffic and usage analysis.

You can manage cookie settings through your web browser. Please note that disabling certain cookies may affect the functionality of some parts of the bika9 platform.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by bika9:

To exercise any of these rights, please contact the bika9 support team via live chat or email at [email protected]. We will process your request within 30 days of receipt.

Bika9 retains your personal data only for as long as necessary for the purposes stated in this policy, or as required by applicable law. General data retention guidelines are as follows:

• Active account data — retained for the duration your account is active plus 5 years after account closure for legal compliance.
• Financial transaction records — retained for a minimum of 7 years as required by Malaysian financial legislation.
• Support communication logs — retained for 3 years for reference and service improvement purposes.
• Cookie and session data — automatically deleted upon session end or according to the set duration for each cookie type.
• KYC verification data — retained for 5 years after account closure or as required by anti-money laundering legislation.

Once the retention period has ended, your data will be securely deleted or anonymised so it can no longer be linked to your identity.