Privacy Policy KL99 – Personal Data Protection for Malaysian Players

Kl99 (hereinafter referred to as "we", "kl99", or "the Platform") is an online entertainment platform operating in Malaysia via the domain kl99.cash. We are fully committed to safeguarding the privacy and personal data of every user who uses our services.

This Privacy Policy is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and transparently explains how kl99 collects, processes, stores, shares, and protects your personal data. It also outlines your rights as a data subject under Malaysian law.

This Policy applies to all users who access the kl99 platform via web browser, mobile app, or any other digital interface we provide. Continued use of the kl99 platform following any amendments to this Policy will be considered your acceptance of the latest version.

Kl99's Privacy Policy applies in the following situations:

• When you register for or log in to your kl99 account.
• When you carry out any financial transaction on the kl99 platform, including deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX.
• When you play any game available on kl99, including Live Casino, slots, baccarat, blackjack, roulette, and e-sports.
• When you contact the kl99 customer support team via live chat, email, or WhatsApp.
• When you browse the kl99.cash website, even without registering an account.
• When you receive marketing or promotional communications from kl99.

Kl99 collects various categories of personal data based on the requirements of the services we provide. Below is a summary of the data collected:

Kl99 collects personal data through a variety of transparent and lawful methods:

• Account Registration: Information you provide directly when registering a new kl99 account.
• Platform Usage: Data generated automatically when you play games, carry out transactions, or interact with the platform.
• Identity Verification (KYC): Documents submitted for verification purposes, such as a copy of your MyKad or bank statement.
• Financial Transactions: Information shared by payment providers (Touch 'n Go, GrabPay, DuitNow, FPX, and others) when you make a deposit or withdrawal.
• Communications: Data you provide when contacting kl99 customer support.
• Cookies & Tracking Technologies: Data collected automatically by cookies and website analytics technologies.

Kl99 uses your personal data solely for the following legitimate and stated purposes:

• Account Management: Securely create, verify, manage, and monitor your kl99 account.
• Transaction Processing: Accurately and securely process deposits and withdrawals via your chosen Malaysian payment method.
• Service Delivery: To provide access to all kl99 platform games and services that you use.
• Legal Compliance: To fulfil kl99's obligations under Malaysian law, including Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.
• Platform Security: Detect and prevent fraud, hacking, account abuse, and other unauthorised activities.
• Service Communications: Send important notifications regarding your account, transactions, and platform updates.
• Marketing (with consent): Sending kl99 promotions, bonuses, and exclusive offers where you have given consent to receive them.
• Platform Enhancement: Analyse usage patterns to improve kl99's overall performance, interface, and user experience.

Kl99 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, under certain limited circumstances, kl99 may share your data with the following parties:

• Payment Providers: Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX (Maybank2u, CIMB Clicks) — to process your financial transactions. Such sharing is kept to the minimum necessary and is solely for payment settlement purposes.
• Game Providers: Game providers such as Evolution Gaming, Pragmatic Play, and PG Soft that supply games on the kl99 platform — to ensure games function correctly and that betting records are accurate.
• Technology Providers: Companies that provide the technical infrastructure, hosting, and cybersecurity services that kl99 relies on to operate.
• Regulatory Authority: Malaysian law enforcement agencies or regulatory bodies when kl99 is required by law or court order to disclose specific information.

All third parties who receive data from kl99 are bound by strict confidentiality obligations and are prohibited from using that data for any purpose other than those authorised by kl99.

Kl99 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All communications between your device and kl99's servers are encrypted using industry-standard TLS/SSL protocols.
• Data Encryption at Rest: Sensitive data stored in kl99's databases, including financial information and passwords, is encrypted using robust cryptographic algorithms.
• Access Controls: Only kl99 staff with a legitimate need to access specific data are permitted to do so, based on the principle of least privilege.
• Two-Factor Authentication (2FA): Available and encouraged for all kl99 accounts as an additional layer of protection.
• Continuous Monitoring: An intrusion detection system monitors kl99 platform activity 24/7 to identify security threats.
• Regular Security Audits: Independent security assessments are conducted periodically by external specialists to ensure kl99's infrastructure remains secure at all times.

Kl99 retains your personal data only for as long as necessary for the purposes stated in this policy or as required under Malaysian law:

• Active Account Data: Retained for as long as your account remains active on kl99 and for a reasonable period following account closure.
• Financial Transaction Records: Retained for a minimum of 7 years in compliance with Malaysia's financial and taxation legal requirements.
• Game Records: Retained for 2 years from the date of play for dispute resolution purposes.
• Technical Logs: Typically retained for 90 days for security and technical troubleshooting purposes.
• KYC Records: Retained for a minimum of 5 years after the business relationship ends, in accordance with AML requirements.

When data is no longer needed and there is no legal obligation to retain it, kl99 will delete or destroy it in a secure and irreversible manner.

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices, you have the following rights regarding your personal data at kl99: