Privacy Policy my99 — Member Personal Data Protection

My99 — an online gaming and Sports Betting platform operating in my99.plus — cares deeply about the privacy of every member and user who trusts us with their personal information. This Privacy Policy has been drafted with the utmost care to ensure you understand your rights and how we handle your personal data responsibly.

This document explains in detail:

• The types of personal data we collect when you use the my99 platform.
• The purpose and legal basis for processing such data.
• Parties that may receive or access your data.
• The security measures we take to protect your information.
• Your rights as a data subject and how to exercise them.

This policy should be read together with Terms and Conditions and Responsible Gaming Policy my99. By continuing to use the my99 platform after the effective date of this policy, you are deemed to have accepted and agreed to all provisions contained herein.

My99 collects various types of personal data depending on how you interact with our platform. Below is a detailed summary of the data we process:

We only collect data that is strictly necessary for the stated purposes. We do not collect sensitive personal data such as medical information, political views, or religious beliefs unless specifically required by applicable law.

My99 uses the personal data collected for legitimate and clearly defined purposes. Every instance of data processing has a solid legal basis, whether grounded in contract, legal obligation, legitimate interest, or consent you have provided.

• Account management and identity verification (KYC): Ensuring every registered account belongs to a genuine individual who meets the applicable age and location eligibility requirements.
• Financial transaction processing: Enabling deposits and withdrawals to be processed securely, quickly, and accurately to the correct account.
• Fraud prevention and anti-money laundering (AML): Detecting and investigating suspicious activity to protect the integrity of the platform and the interests of all members.
• Provision of gaming services: Running games, recording bets, calculating wins, and accurately managing your account balance.
• Customer support: Enabling our support team to understand the context of your issue and provide effective, relevant assistance.
• Service communications: Sending account-related notifications, security alerts, terms updates, and important transaction information.
• Marketing and promotions (with your consent): Sending bonus offers, the latest promotions, and campaign information that may interest you, subject to your configured notification preferences.
• Platform improvements: Analysing usage patterns to improve the user experience, enhance performance, and develop more useful new features.
• Legal compliance: Meeting reporting obligations to the relevant authorities as required by applicable Malaysian law.

My99 does not sell or rent your personal data to any third party. However, there are certain situations where we need to share your data with carefully selected parties in order to provide the services you use:

• Payment processors and financial institutions: Financial data required to process your deposits and withdrawals is shared with approved payment service providers. They are bound by strict confidentiality agreements and are not permitted to use your data for any other purpose.
• Game software providers: Gaming session data is shared with software providers that supply game content on the my99 platform for the purposes of technical maintenance and result verification.
• Cloud and infrastructure service providers: Data is stored on servers operated by certified infrastructure providers subject to strict data processing agreements.
• Regulatory authorities and law enforcement agencies: my99 will disclose personal data to competent authorities when required by law, court order, or official request from the relevant authority.
• Fraud prevention consultant: Specialised fraud prevention companies may be granted limited access to certain data to verify identities and detect suspicious activity.

All third parties that receive your personal data are required to sign a data processing agreement that imposes confidentiality and security obligations no less stringent than the standards we apply at my99.

My99 continuously invests in robust security infrastructure to ensure your personal data is always protected against unauthorised access, leakage, alteration, or destruction. The key security measures we implement include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and my99's servers.
• Encryption of data at rest for all sensitive data stored in our databases.
• Role-based access control (RBAC) ensuring that only authorised personnel can access specific data based on their job requirements.
• 24/7 security monitoring by a dedicated cybersecurity team that detects and responds to any threats in real time.
• Penetration testing conducted regularly by independent third parties to identify and close any potential vulnerabilities.
• Two-factor authentication (2FA) available to all member accounts to add an extra layer of security.
• Data backup performed automatically and periodically to different locations to ensure service continuity.

The my99 platform uses cookies and similar tracking technologies to enhance user experience, analyse platform performance, and deliver relevant content to you. The types of cookies we use include:

• Essential Cookies: Required for core platform functions such as login sessions, security, and language preferences. These cookies cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies: Helping us understand how users interact with the platform — which pages are visited most, time spent, and any errors that may occur. This data is collected in aggregate and anonymised form.
• Functional Cookies: Saving your preferences such as language, time zone, and display settings to provide a more personalised experience on future visits.
• Marketing Cookies: Used to identify your interests and deliver more relevant promotions. These cookies are only active with your consent and can be disabled at any time.

You can control and manage cookie settings through your web browser. Please note that disabling certain cookies may affect the functionality and user experience of the my99 platform.

Under the Malaysian Personal Data Protection Act 2010 (PDPA) and international privacy standards, you have the following rights regarding your personal data held by my99:

To exercise any of the above rights, please contact the my99 Privacy Officer via email [email protected]. We will process your request within 30 calendar days. For complex cases, this period may be extended with prior notice to you.

In operating the my99 platform on a global basis, your personal data may be transferred to and processed in countries other than Malaysia. Such transfers occur in the following contexts:

• Use of cloud services and server infrastructure that may be located in various countries.
• Collaboration with international game software providers that require access to gaming session data.
• Payment processing via international financial processing networks.

My99 ensures that all cross-border data transfers are carried out in compliance with Malaysia's PDPA requirements and are safeguarded by adequate protection mechanisms, including:

• Binding data processing agreements with recipient parties.
• Use of internationally recognised standard contractual clauses.
• Privacy risk assessment before any new transfer is approved.

My99 retains your personal data only for as long as necessary to fulfil the original purpose of collection or as required by applicable law. Our data retention policy is as follows:

• Active account data: Retained for the duration your account remains active and in good standing.
• KYC data (identity verification): Retained for at least 5 years after account closure, in accordance with AML and PDPA legal requirements.
• Financial transaction records: Retained for 7 years for audit and tax compliance purposes as required by Malaysian law.
• Platform activity logs: Retained for 2 years for investigation and dispute resolution purposes.
• Support communication data: Retained for 3 years to allow reference to chat history whenever required.
• Marketing data (with consent): Retained until you withdraw your consent or close your account.

Once the retention period has expired, personal data will be securely deleted or anonymised using methods that prevent re-identification.

The my99 platform may contain links or references to third-party websites in certain contexts, such as payment service providers or gaming regulatory bodies. my99's Privacy Policy not applies to those third-party websites.

My99 is not responsible for the privacy practices or content of any external websites. We recommend that you read the privacy policy of those websites before providing any personal information to them.

The presence of links to third-party websites on the my99 platform does not mean we endorse or recommend the content, products, or services offered by those websites.

My99 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our privacy practices, new legal requirements, or service improvements. Any significant changes will be communicated to you via:

• In-platform or my99 app notifications when you log in.
• Email to the address registered in your account.
• A clear notice on the my99 website home page.

The "Last Updated" date shown at the top of this document will always be updated to reflect the latest version of this policy. We encourage you to review this page periodically. Your continued use of the my99 platform after changes are published constitutes your acceptance of the latest version of this policy.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how my99 handles your personal data, please contact our officially appointed Privacy Officer:

• Official Email: [email protected]
• Operating Hours: Monday – Sunday, 24 hours a day
• Supported Languages: Bahasa Malaysia, English
• Response Time: Within 2 business days for general inquiries; 30 calendar days for formal data rights requests

For general enquiries regarding your account, promotions, or technical support, you may also visit our FAQ for instant answers to our most frequently asked questions.