Privacy Policy bento123 – Your Data Protection

Bento123 collects various types of information from users to ensure the platform runs smoothly, securely, and in line with each member's needs. The information we collect falls into two main categories:

A. Information You Provide Directly

• Identity information: Full name, date of birth, gender and identity card or passport number for KYC verification purposes.
• Contact information: Email address, mobile phone number and current residential address.
• Account information: Username, password (in encrypted hashed form) and account preferences.
• Financial information: Payment method details used for deposits and withdrawals, including registered bank account numbers or e-wallet addresses.
• Supporting documents: Copies of identity documents, bank statements or other documents requested during the KYC process.

B. Information Collected Automatically

• Technical data: IP address, device type, operating system, browser type and version.
• Usage data: Pages visited, visit duration, games played, betting history and activity within the platform.
• Location data: General location information based on your IP address for legal compliance purposes.
• Cookie data: Session information and user preferences stored via cookies and similar tracking technologies.

Every piece of data we collect is used for a clear and legitimate purpose. bento123 does not use your data for any other purpose without notifying you in advance. The following are the primary purposes for data use:

Every processing of personal data by bento123 has a valid legal basis in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). We process your data on one of the following bases:

• Contract performance: Processing necessary to provide the services you requested when registering a bento123 account, including account management, payment processing and technical support.
• Legal obligation: Processing required to comply with Malaysian law, including KYC requirements under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA).
• Legitimate interest: Processing for platform security, fraud detection, risk analysis and service improvement — where these interests reasonably outweigh individual privacy rights.
• Consent: Processing for marketing, promotional notifications and communication preferences, where you have given explicit consent that may be withdrawn at any time.

Bento123 understands that your trust is our most valuable asset. We do not share, sell, or disclose your personal data to third parties, except in the following limited and controlled circumstances:

• Payment service provider: Required information is shared with certified payment gateway providers such as FPX, DuitNow, Touch 'n Go eWallet and GrabPay solely to process your financial transactions.
• KYC service provider: Identity verification documents are shared with accredited KYC partners to meet legal compliance requirements.
• Cloud infrastructure provider: Data is stored on secure cloud servers under strict data processing agreements, where providers act as data processors on our behalf.
• Competent authorities: We may be required by law to disclose information to Malaysian authorities such as the Royal Malaysia Police, Bank Negara Malaysia or the courts upon receipt of a valid written request.
• Business acquisition: In the event of a merger or acquisition, user data may be transferred to the successor entity, subject to the same privacy protections.

All third parties that receive your data are bound by strict confidentiality and data protection agreements. They are only permitted to use your data for the specifically stated purposes and may not use it for any other purpose.

The security of your personal data is bento123's absolute priority. We continuously invest in the latest security infrastructure to ensure your data is always protected from unauthorised access, leaks or misuse.

• 256-bit SSL encryption: All communications between your device and bento123's servers are protected using industry-standard SSL/TLS encryption. Data in transit cannot be read by any third party.
• Data-at-rest encryption: Sensitive data stored in our databases, including financial information and KYC documents, is encrypted using AES-256 algorithms.
• Strict access control: Only specifically authorised staff may access user data, and every access is recorded in a comprehensive audit log.
• Two-factor authentication (2FA): bento123's internal systems require 2FA for all staff access to systems containing user data.
• Regular penetration testing: bento123 performs regular security testing and code audits to identify and address any vulnerabilities before they can be exploited.
• Incident response plan: We have a comprehensive security incident response procedure. In the event of a material data breach, we will notify affected users within the timeframe required by law.

Bento123 uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and understand how users interact with our platform. The following are the types of cookies we use:

• Essential cookies (required): Required for core platform functions such as login authentication, session security and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance cookies: Collecting information on how you use the platform — pages visited, time spent and any errors encountered — to help us improve website performance.
• Functional cookies: Storing your preferences such as display settings, preferred language and your login information (if you choose to save it) to provide a more personalised experience.
• Analytics cookies: Helping us understand overall platform usage patterns through aggregated and anonymised data for service improvement purposes.

You can manage or delete cookies through your browser settings at any time. Please note, however, that disabling essential cookies may prevent you from fully using certain features of the bento123 platform.

Bento123 only retains your personal data for as long as necessary to fulfil the purposes stated in this policy, or as required by Malaysian law.

• Active account data: Retained for the duration of your active account and three (3) years after account closure for audit and compliance purposes.
• Financial transaction records: Retained for a minimum of seven (7) years in line with Malaysia's AML/CFT and tax legal requirements.
• KYC documents: Retained for the duration of the active account and five (5) years after account closure, or longer if required by the authorities.
• Support communication logs: Retained for two (2) years for reference and dispute resolution purposes.
• Analytics data: Aggregated and anonymised data may be retained indefinitely as it contains no personally identifiable information.

Once the retention period has expired, your data will be securely deleted or anonymised using methods that ensure it can no longer be linked back to you. The deletion process is final and irreversible.

Under Malaysia's Personal Data Protection Act 2010, you have certain rights regarding your personal data held by bento123. We fully respect and facilitate the exercise of these rights:

The bento123 platform is exclusively for users aged 18 and above only. We do not knowingly collect or process personal data of individuals under the age of 18.

As part of the registration process, we require age verification through a comprehensive KYC mechanism. Should we discover that a child's personal data has been collected inadvertently, we will take the following steps immediately:

• Closing the account in question without prior notice.
• Securely and permanently deleting all related personal data.
• Returning any legitimate funds to the rightful heirs or legal guardians.
• Reporting the incident to the relevant authorities if required.

If you are a parent or guardian and discover that your child under the age of 18 has registered an account at bento123, please contact us immediately at [email protected] so that we can take the appropriate action.

Bento123 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, legal requirements, or how we operate our services. Any changes will take effect immediately upon being published on this page.

For material and significant changes, we will provide you with reasonable notice through:

• Notification email sent to your registered email address.
• In-platform notifications on bento123 when you log in.
• Update the "Last Updated" date displayed at the top of this page.

Continued use of the bento123 platform after any changes are published confirms that you have read and agreed to the updated Privacy Policy. We encourage you to review this page periodically to stay informed.

If you have any questions, concerns or complaints regarding how bento123 handles your personal data, you may contact our Data Protection Officer (DPO) directly: