Privacy Policy

This Privacy Policy ("Policy") is issued by play99 ("play99", "we", "us", "our"), the operator of the online gaming platform accessible at https://play99.cam and any associated subdomains, mobile interfaces, and digital services. This Policy applies to all Users ("you", "your", "User") who access or use the play99 Platform, whether as registered account holders or as visitors to our website.

play99 is committed to processing personal data responsibly, lawfully, and transparently. This Policy sets out in clear and accessible terms the categories of personal data we collect, the purposes for which we process that data, the legal bases on which we rely for processing, the circumstances in which we share data with third parties, and the rights you hold over your personal information.

This Policy must be read in conjunction with play99's Terms and Conditions, which are incorporated herein by reference. By accessing the Platform, creating an Account, or otherwise interacting with play99's services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions shall apply:

• "Personal Data" means any information that identifies, or could reasonably be used to identify, a living natural person, directly or indirectly. This includes name, identification number, contact details, financial data, device identifiers, and behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, or transfer.
• "Data Controller" means play99, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of play99 in accordance with our instructions and this Policy.
• "KYC Data" means identity verification documents and associated personal information submitted by Users as part of the Know Your Customer verification process, including copies of Malaysian identity documents, proof of address, and biometric photograph data.
• "Cookies" means small text files placed on your device by the Platform to store session data, preferences, and usage analytics information.
• "Platform" means the play99 website at https://play99.cam, its mobile interface, and all associated digital services.

play99 collects the following categories of Personal Data in the course of providing our services:

When you create a play99 Account, we collect your full legal name, date of birth, email address, Malaysian mobile telephone number, and a chosen username and password. This data is necessary to create and manage your Account.

To comply with our regulatory obligations and to process withdrawals, we collect KYC documentation including a copy of your valid Malaysian identity document (MyKad, Driver's License, or Passport), a proof of residential address document (utility bill or bank statement dated within three months, issued to a Malaysian address), and in some cases a selfie photograph holding your identity document.

We collect records of all financial transactions on your Account including deposit amounts, withdrawal amounts, payment method identifiers (e.g., registered bank account numbers, Touch 'n Go eWallet identifiers, DuitNow account details), transaction timestamps, and transaction status information. We do not store full card numbers, banking passwords, or OTP codes.

We collect data about how you use the Platform including pages visited, games played, bet amounts, session durations, click patterns, and feature interactions. This data is used to improve the Platform experience and, where relevant, to support responsible gambling monitoring.

We automatically collect technical data including your IP address, device type and model, operating system, browser type and version, screen resolution, and connection type. This information is used for security monitoring, fraud detection, and service optimisation.

We retain records of communications between you and play99's support team, including live chat transcripts, email correspondence, and any support tickets raised. These records are maintained for quality assurance, dispute resolution, and regulatory compliance purposes.

play99 may collect approximate geolocation data derived from your IP address for the purposes of fraud detection, regulatory compliance, and ensuring you are not accessing the Platform from a jurisdiction where online gambling is prohibited.

play99 collects Personal Data through the following mechanisms:

• Direct Submission: Data you provide voluntarily when registering an Account, completing KYC verification, making a deposit, requesting a withdrawal, contacting our support team, or participating in promotional activities.
• Automated Collection: Technical and usage data collected automatically through cookies, server logs, and similar tracking technologies when you interact with the Platform. See Section 9 for detailed cookie information.
• Payment Processors: Transaction confirmation data received from our payment processing partners (including Malaysian payment gateways facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and RHB transactions) necessary to verify deposits and process withdrawals.
• Third-Party Identity Verification: During KYC processing, play99 may utilise the services of licensed third-party identity verification providers who return verification results (not raw document copies) to our platform.
• Fraud Prevention Databases: play99 may check submitted information against fraud prevention and anti-money laundering databases maintained by licensed third-party providers as required by our regulatory obligations.

play99 processes Personal Data for the following purposes, each supported by the indicated legal basis:

play99 does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. We may share your Personal Data with third parties only in the following limited and defined circumstances:

play99 shares transactional data with licensed payment service providers — including Malaysian payment gateways facilitating Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and interbank transfers — solely to the extent necessary to process your deposits and withdrawals. These providers are bound by contractual confidentiality obligations and applicable payment industry security standards.

KYC documentation may be processed by licensed third-party identity verification services contracted by play99. These providers process your KYC data solely on our behalf and under our instructions, and are prohibited from using your data for any other purpose.

play99 may disclose Personal Data to gaming regulators, financial intelligence units, law enforcement agencies, or other government authorities where required to do so by applicable law, court order, or regulatory requirement. Where legally permitted, play99 will endeavour to notify affected Users of such disclosures.

play99 may share limited Personal Data (such as name, date of birth, and transaction patterns) with licensed fraud prevention and anti-money laundering screening services to meet our regulatory compliance obligations. Access to these services is strictly controlled and contractually governed.

play99 uses third-party cloud infrastructure, data analytics, and security monitoring services. These providers may process certain technical data (such as IP addresses and server logs) on our behalf but are contractually prohibited from accessing, retaining, or using personally identifiable data beyond what is strictly necessary for the contracted service.

play99 retains Personal Data for defined periods that are proportionate to the purpose for which the data was collected and in accordance with our applicable regulatory obligations. The following retention guidelines apply:

• Account and identity data: Retained for the duration of your active Account relationship with play99, and for a minimum of five (5) years following Account closure to comply with anti-money laundering and gaming regulatory record-keeping requirements.
• KYC documentation: Retained for the duration of your Account and for five (5) years following Account closure, in accordance with applicable regulatory requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with financial record-keeping obligations.
• Customer support communications: Retained for three (3) years from the date of the relevant interaction for quality assurance and dispute resolution purposes.
• Behavioural and usage data: Retained in identifiable form for up to two (2) years from collection, after which it is anonymised and may be retained for statistical purposes.
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable additional period for compliance purposes.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised. Where data is subject to a legal hold or regulatory investigation, retention will be extended for the duration of the relevant proceedings.

As a User of the play99 Platform, you hold the following rights over your Personal Data. play99 is committed to honouring these rights promptly and transparently:

play99 uses cookies and similar tracking technologies on the Platform for the following purposes:

These cookies are essential for the Platform to function. They enable core features such as session authentication, security token management, account login state, and payment flow integrity. These cookies cannot be disabled without significantly impairing your ability to use the Platform.

play99 uses analytics cookies to collect anonymised data about how Users interact with the Platform, including which pages are most visited, session duration, and technical errors encountered. This information is used solely to improve the Platform experience and is not linked to any individual's personal identity in its stored form.

These cookies remember your preferences and settings — such as your preferred language, notification settings, and Platform display preferences — to provide a more personalised and consistent experience across sessions.

Security cookies are used to detect and prevent fraudulent access attempts, bot traffic, and suspicious session behaviour. They are an essential component of play99's fraud prevention and account security infrastructure.

Most modern web browsers provide settings that allow you to control or block cookies. You may also clear existing cookies from your browser at any time. Please note that disabling strictly necessary cookies will impair core Platform functionality, including your ability to log in and process transactions. For detailed browser-specific cookie management instructions, refer to your browser's help documentation.

play99 implements comprehensive technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the play99 Platform.
• Encryption of sensitive data at rest, including KYC documents, financial records, and authentication credentials.
• Strict access controls ensuring that Personal Data is accessible only to play99 staff and authorised partners who require it for specific, documented operational purposes.
• Two-factor authentication (2FA) available to all Account holders and mandatory for administrative access to internal systems.
• Regular security assessments and penetration testing conducted by qualified third-party security professionals.
• 24/7 automated monitoring for unusual activity patterns, unauthorised access attempts, and data exfiltration indicators.
• Staff training on data protection obligations, phishing awareness, and secure data handling practices.

The play99 Platform is strictly intended for adults aged 21 years and above. play99 does not knowingly collect or process Personal Data from any person under the age of 21. The Platform employs age verification mechanisms as part of the registration and KYC process to enforce this restriction.

If play99 becomes aware that Personal Data has been inadvertently collected from a person under the age of 21, we will take immediate steps to delete that data from our systems and close the associated Account. If you are a parent or guardian who believes your child may have accessed or attempted to access the play99 Platform, please contact our support team at [email protected] immediately so that we can investigate and take appropriate action.

play99 supports parental control tools and internet filtering software as additional measures to prevent underage access to online gambling platforms.

play99 may process or store Personal Data on servers located outside of Malaysia in connection with the provision of our services. Where such cross-border transfers occur, play99 ensures that appropriate safeguards are in place to protect your Personal Data, including:

• Transferring data only to countries that provide an adequate level of data protection as determined by applicable regulatory standards.
• Using contractual arrangements with data processors that impose obligations equivalent to those under applicable data protection law.
• Implementing technical and organisational security measures that apply uniformly regardless of where data is processed.

All cross-border data transfers carried out by play99 are governed by data processing agreements that require our international partners to treat your Personal Data with the same level of protection applicable to data processed within Malaysia.

play99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or regulatory requirements. Where a material change is made to this Policy, we will notify registered Users through one or more of the following channels: a prominent notice displayed on the Platform upon your next login, an email notification to your registered email address, or a notification through the Platform's internal messaging system.

The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. Where material changes are made, the updated Policy will be effective immediately upon publication unless otherwise stated in the notification. Your continued use of the Platform following publication of an updated Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to remain informed of how play99 handles your Personal Data. If you do not agree with any updated provision, please discontinue use of the Platform and contact our support team to discuss your options, including voluntary Account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or to play99's handling of your Personal Data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly on the play99 Platform. For privacy-related enquiries, please identify your query as a "Privacy Request" at the start of your chat session.
• Email: [email protected] — for formal data rights requests, please use the subject line "Privacy Request — [Your Account Username]". We will acknowledge receipt within 48 hours and provide a substantive written response within 30 calendar days.

If you believe that play99 has not handled your Personal Data in accordance with this Policy or applicable data protection law, you have the right to lodge a formal complaint. We ask that you first submit your complaint directly to play99 so that we have the opportunity to investigate and resolve the matter. play99 will acknowledge all formal privacy complaints within 48 hours and provide a final written response within 20 business days.

If you are not satisfied with play99's response to your complaint, you may escalate the matter to the applicable regulatory authority in your jurisdiction responsible for data protection enforcement.