s99 Privacy Policy: How Your Data Is Protected

Introduction

This Privacy Policy sets out how s99 ("we", "us", "our" or "the platform") collects, processes, stores and discloses personal data in connection with the s99 website and its associated services, including casino content, sports betting information, account administration, payment processing, promotions and customer support.

This policy applies to all persons who access or register with s99, including visitors browsing information pages, registered account holders and players located in Malaysia. References to "you" or "your" denote the individual whose personal data is being processed.

By registering an account or continuing to use s99, you acknowledge that you have read and understood this Privacy Policy. If you have questions about how your data is handled, contact us using the details provided in Section 11.

Definitions

• Personal Data: Any information that identifies or could reasonably identify a living individual, including name, identification number, email address, phone number, payment details, device identifiers and behavioural data linked to an account.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, transfer, erasure and destruction.
• Data Controller: The party that determines the purposes and means of processing personal data. For s99 user data, this is s99 itself.
• KYC: Know Your Customer — identity, address and payment verification procedures required for account security and compliance.
• Third-Party Processor: A service provider that processes personal data on behalf of s99 under a documented agreement and subject to appropriate obligations.
• Consent: A freely given, specific, informed and unambiguous indication of agreement to personal data being processed for a stated purpose.

Categories of Personal Data Collected

The types of personal data s99 may collect include, but are not limited to:

Information may be collected directly from the player during registration, KYC submission, payment initiation or customer contact. Data may also be derived from account activity or received from payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank or Hong Leong Bank where necessary to process a transaction.

Purposes and Legal Basis for Processing

s99 processes personal data only for documented purposes. The main purposes and their corresponding basis are:

• Account Registration and Administration: To create, maintain and administer s99 accounts. Processing is necessary to perform the account agreement.
• Identity and Age Verification: To confirm that users are aged 21 or above and that their account details are accurate. Processing is necessary for compliance and to protect against underage gambling.
• Payment Processing: To facilitate MYR deposits through eligible methods and review withdrawals. Processing is necessary to perform the transaction agreement.
• Fraud Prevention and Security: To screen for misuse, duplicate accounts, unauthorised access and suspicious transactions. Processing is based on our legitimate interest in protecting the platform and its users.
• Promotion Administration: To assess promotion eligibility, apply bonus credits and investigate potential misuse. Processing is necessary to fulfil promotion conditions.
• Customer Support: To respond to enquiries, manage complaints and resolve disputes. Processing is necessary to address support requests.
• Responsible Gambling: To monitor unusual activity patterns and support account restriction requests. Processing is based on our legitimate interest in player welfare.
• Legal and Regulatory Compliance: To meet applicable obligations regarding record retention, identity verification and investigation cooperation. Processing is necessary for legal compliance.
• Platform Improvement: To analyse aggregated usage patterns and service performance. Processing is based on our legitimate interest in improving the platform, using anonymised data where possible.

Data Sharing and Third-Party Processors

s99 does not sell or rent personal data to unrelated third parties for their own commercial purposes. Personal data may be shared in the following limited circumstances:

• Payment Providers: Information necessary to process a deposit or withdrawal may be shared with the relevant payment processor, including e-wallet operators and Malaysian banking channels such as DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong Bank.
• Identity Verification Services: KYC providers who assist s99 in confirming identity, address and document authenticity may receive verification data under strict contractual obligations.
• Technology and Hosting Providers: Infrastructure, cloud or security service providers that store or process data on behalf of s99 are bound by confidentiality and data protection obligations.
• Game and Content Providers: Where a specific game requires player session data for participation, relevant technical identifiers may be shared with the provider to enable the experience.
• Legal Authorities: s99 may disclose personal data to law enforcement, regulatory bodies, courts or investigative authorities when required by applicable law, a lawful order or to protect legitimate legal interests.
• Business Transfers: In the event of a merger, acquisition or operational transfer, player records may be transferred to a successor entity subject to equivalent privacy obligations.

All third parties who access s99 personal data are required to handle it in a manner consistent with this policy and applicable standards.

Data Retention

s99 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to any longer period required by applicable obligations. General retention considerations include:

• Active account records are retained for the duration of the account relationship;
• Transaction, KYC and verification records may be retained for a period after account closure to support compliance, dispute resolution and audit requirements;
• Support and complaint records are retained for a period sufficient to allow the proper handling of related claims;
• Marketing preferences and consent records are retained until a user withdraws consent or the record is no longer relevant;
• Device and technical logs are retained for a limited period appropriate to their security and fraud prevention purpose.

After the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

Cookies and Tracking Technologies

s99 may use cookies, session tokens and similar technologies to operate core platform functions, maintain login state, remember preferences and collect aggregated analytics. These technologies may include:

• Essential Cookies: Necessary for the website to function. Disabling these may prevent login or cause features to malfunction.
• Functional Cookies: Used to remember language preferences, region settings and display choices between sessions.
• Analytics Cookies: Aggregated, anonymised data may be collected to understand how pages are used and how the platform can be improved.
• Security Tokens: Short-lived session identifiers used to verify authenticated requests and prevent session hijacking.

Users may adjust cookie settings through their browser. Disabling certain cookies may affect access to specific s99 features. Third-party analytics tools, where used, are configured to anonymise IP addresses and not combine browsing data with personal account information.

Data Security

s99 applies technical and organisational security measures proportionate to the nature of the personal data held. These measures are intended to reduce the risk of unauthorised access, disclosure, alteration, loss or destruction. Examples include access control policies, encrypted data transmission, authentication requirements and regular security review processes.

Players also bear responsibility for keeping their own credentials secure. You must not share your s99 password, one-time verification codes or account recovery details. If you believe your account has been accessed without authorisation, notify us immediately using the contact information in Section 11. Do not communicate sensitive account information through insecure channels.

User Rights

Subject to applicable requirements and the constraints of identity verification, Malaysian players and registered s99 users hold the following rights regarding their personal data:

Requests must be submitted in writing with sufficient information to verify the requester's identity. s99 will acknowledge requests within a reasonable period and respond fully as soon as practicable. Requests that cannot be fulfilled in full will be accompanied by an explanation.

Children and Minors

s99 is strictly for persons aged 21 and above. The platform does not knowingly collect personal data from individuals below this age. If s99 becomes aware that a minor has submitted personal data, reasonable steps will be taken to delete that information and prevent further access.

Age verification is conducted during the registration and KYC process. Any person who provides false information about their age to access s99 may have their account closed, promotional benefits removed and outstanding transactions reviewed.

Contact and Privacy Requests

Questions about this Privacy Policy, requests to exercise a data right or concerns about how personal data has been handled should be directed to the s99 support team using the website email address below. All privacy-related requests must be submitted in writing and should include sufficient detail to identify the account and the nature of the request.

s99 will not process privacy requests received through unverified third parties without first confirming the account holder's identity. Responses will be provided within a reasonable period, and where a request cannot be fulfilled in full, a written explanation will be given.

Website email: [email protected]

Email addresses are displayed as plain text only. Do not send passwords, one-time codes or payment PINs by email.

Policy Updates

This Privacy Policy may be revised to reflect changes in s99 operations, applicable obligations, new features or processing activities. The effective date at the top of the page will be updated whenever a material change is made. Continued use of s99 following publication of a revised policy constitutes acceptance of the updated terms.

Where a change significantly affects how personal data is handled, s99 will take reasonable steps to bring this to the attention of registered account holders. Players who disagree with a revised policy should stop using s99 and may submit a data access or erasure request as described in Section 9.