Privacy Policy

bumi303 (hereinafter referred to as "bumi303", "we", "us", or "the Platform") operates the online casino and sports betting platform accessible at https://bumi303.cam. This Privacy Policy (hereinafter referred to as "this Policy" or "the Policy") sets out the manner in which bumi303 collects, uses, stores, discloses, and otherwise processes the personal data of individuals who register for, access, or otherwise use the bumi303 platform and its associated services (hereinafter collectively referred to as "the Services").

This Policy is incorporated by reference into the bumi303 Terms and Conditions, which constitute a binding agreement between bumi303 and each registered Member. By accessing the bumi303 platform, registering a Member account, or using any feature of the Services, you acknowledge that you have read, understood, and consent to the data practices described in this Policy.

If you have any questions regarding this Policy or the manner in which bumi303 handles your personal data, please contact our Data Protection team via the details provided in Section 14 of this Policy.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, location data, online identifiers, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure by transmission, dissemination, restriction, erasure, or destruction.
• "Data Controller" means bumi303, which determines the purposes and means of processing personal data collected via the platform.
• "Data Subject" means the natural person whose personal data is being processed — in the context of this Policy, the registered Member or platform visitor.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the Data Subject of agreement to the processing of their personal data.
• "Third Party" means any natural or legal person, public authority, agency, or body other than bumi303 and the Data Subject.
• "KYC Data" means identity verification documents and associated personal information collected as part of bumi303's Know Your Customer and Anti-Money Laundering compliance procedures.

bumi303 collects personal data from Members through various channels in connection with the provision of the Services. The categories of personal data we collect and the circumstances of collection are described below.

bumi303 does not knowingly collect sensitive personal data (including racial or ethnic origin, political opinions, religious beliefs, or health data) unless required by applicable AML or regulatory obligations. Where the collection of sensitive data is required, explicit consent will be sought from the Data Subject prior to collection.

bumi303 collects personal data through the following mechanisms:

• Direct Provision: Data you submit directly during registration, profile updates, KYC document uploads, withdrawal requests, or support communications;
• Automated Technical Collection: Data collected automatically when you access the platform, including IP address, device identifiers, browser fingerprint, and session activity logs through server-side logging and platform analytics systems;
• Payment Processing Partners: Transaction confirmation data received from Malaysian payment processors including FPX, DuitNow, and integrated e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay) when you initiate or complete a financial transaction;
• Third-Party Verification Services: Identity verification data received from licensed KYC/AML service providers used to confirm the authenticity of documents submitted during the identity verification process;
• Cookies and Tracking Technologies: Behavioural and session data collected via cookies, web beacons, and similar technologies as described in Section 10 of this Policy.

bumi303 processes personal data for the following specified, explicit, and legitimate purposes. We do not process personal data in a manner incompatible with these stated purposes.

1. Account Administration: To create, manage, and maintain your bumi303 Member account, including processing deposits and withdrawals, managing account balances denominated in MYR, and administering loyalty points and tier status;
2. Service Delivery: To provide access to the bumi303 platform's games, sports betting markets, and associated features in accordance with the Terms and Conditions;
3. Identity Verification (KYC): To verify the identity of Members as required by applicable AML obligations and to confirm minimum age eligibility (21+ years) before processing first withdrawals;
4. Payment Processing: To facilitate deposits and withdrawals via supported Malaysian payment channels and to maintain accurate financial records in MYR;
5. Regulatory Compliance: To comply with applicable anti-money laundering, counter-terrorist financing, and other regulatory obligations including transaction monitoring and suspicious activity reporting;
6. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct as described in the Terms and Conditions;
7. Responsible Gambling: To monitor betting patterns that may indicate problem gambling behaviour, to implement deposit limits and self-exclusion requests, and to administer responsible gambling tools;
8. Marketing Communications: To send promotional offers, bonus notifications, and platform updates to Members who have opted in to marketing communications — subject always to the right to opt out;
9. Customer Support: To respond to Member enquiries, resolve disputes, and maintain records of support interactions;
10. Platform Improvement: To analyse aggregated, anonymised usage data to improve platform performance, game selection, and user experience.

bumi303 processes personal data under one or more of the following legal bases, each of which is applied to specific processing activities as described in this Policy:

• Contractual Necessity: Processing required to perform bumi303's contractual obligations to Members under the Terms and Conditions, including account management, payment processing, and service delivery;
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC verification, AML transaction monitoring, and regulatory reporting;
• Legitimate Interests: Processing conducted in furtherance of bumi303's legitimate business interests, including fraud prevention, platform security, system analytics, and responsible gambling monitoring — where such interests are not overridden by the fundamental rights and freedoms of Data Subjects;
• Consent: Processing undertaken on the basis of the Data Subject's explicit, freely given consent — primarily applicable to optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

bumi303 does not sell, rent, or trade personal data to third-party marketing organisations under any circumstances. Personal data may be disclosed to third parties only in the following limited circumstances:

• Payment Service Providers: Transaction data shared with Malaysian payment processors (including FPX, DuitNow, and e-wallet platforms) solely to the extent necessary to process deposit and withdrawal transactions in MYR;
• KYC and AML Verification Providers: Identity data shared with licensed identity verification service providers engaged by bumi303 to conduct KYC verification and AML screening;
• Game Studio Partners: Session identifiers and technical data shared with certified game studio partners to facilitate game loading, session continuity, and round result logging — no personally identifiable data is shared beyond what is technically necessary;
• Legal and Regulatory Authorities: Data disclosed to competent legal authorities, regulators, or law enforcement agencies where required by applicable law, court order, or lawful regulatory request;
• Professional Advisers: Data shared with lawyers, auditors, or compliance consultants under binding confidentiality obligations, solely to the extent required for the specific professional engagement;
• Business Successors: In the event of a merger, acquisition, or sale of substantially all assets of bumi303, personal data may be transferred to the acquiring entity subject to equivalent privacy protections.

bumi303 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or regulatory reporting requirements. The following retention schedules apply to the primary categories of data processed by bumi303:

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or aggregated in a manner that renders individual identification impossible. Data retained solely for compliance purposes will be stored in restricted-access archives inaccessible to operational platform systems.

bumi303 implements a comprehensive suite of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. The principal security measures in place include:

• Transport Layer Security: All data transmissions between Member devices and bumi303 servers are encrypted using 256-bit TLS/SSL encryption, ensuring that no data is transmitted in plaintext over the network;
• Data Encryption at Rest: Sensitive personal data and financial records stored on bumi303's systems are encrypted at rest using industry-standard encryption algorithms;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff members with access to Member data are subject to binding confidentiality obligations and undergo regular data protection training;
• Multi-Factor Authentication: Administrative access to systems containing personal data requires multi-factor authentication. Members are strongly encouraged to enable available two-factor authentication options on their accounts;
• Intrusion Detection and Monitoring: Continuous automated monitoring systems are in place to detect and respond to potential security incidents, including anomalous login patterns and unauthorised data access attempts;
• Regular Security Audits: bumi303 conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities in its infrastructure and platform code.

bumi303 uses cookies and similar tracking technologies on its platform to facilitate core functionality, improve the Member experience, and support platform security. A cookie is a small text file placed on your device by a website server. Cookies do not contain executable code and cannot harm your device.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to access and use the bumi303 platform. Adjusting optional cookie settings will not affect your ability to play games or transact on the platform.

As a Data Subject, you hold a range of rights in relation to the personal data that bumi303 processes about you. These rights are described below, along with guidance on how to exercise each one. Requests to exercise data subject rights should be submitted to bumi303's Data Protection team via the contact details in Section 14.

bumi303 operates a strict minimum age policy of 21 years for all Members. The bumi303 platform is not directed at, and is not intended for use by, individuals under the age of 21. We do not knowingly collect or process personal data from individuals under this age threshold.

At the point of registration, all Members are required to confirm that they are aged 21 or above. KYC verification procedures, which include age verification via government-issued identity documents, are conducted prior to the processing of first withdrawals. Where bumi303 becomes aware or reasonably suspects that a Member is under the age of 21, the account will be immediately suspended, all pending transactions voided, and the matter referred for investigation.

If you have reason to believe that a person under the age of 21 has registered a bumi303 account or has accessed the platform, please report this immediately to our support team via live chat or by contacting [email protected] (plain text — not a clickable link). We take underage gambling concerns with the utmost seriousness and will act on all credible reports without delay.

bumi303 reserves the right to amend, update, or replace this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, platform functionality, or data processing practices. The "Last Updated" date displayed at the top of this page reflects the most recent revision.

Where amendments to this Policy are material — that is, where they substantively alter the manner in which bumi303 processes personal data or affect the rights of Members — bumi303 will endeavour to provide advance notice via registered email or a prominent notification on the platform prior to the changes taking effect. For non-material amendments (such as editorial clarifications or formatting updates), changes will take effect immediately upon publication.

Continued use of the bumi303 platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree to the revised Policy, you should cease use of the platform and contact our Data Protection team to arrange account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the manner in which bumi303 processes your personal data — including the exercise of any Data Subject rights described in Section 11 — please contact the bumi303 Data Protection team using the details below:

This Privacy Policy was last reviewed and updated on 1 January 2026. All previous versions of this Policy are superseded by this document with effect from that date.