Privacy Policy — 99play2

1 Introduction

This Privacy Policy ("Policy") is issued by 99play2 (hereinafter referred to as "we", "us", "our", or "the Platform") and applies to all personal data collected from individuals ("you", "Player", "User") who access, register on, or interact with the 99play2 online casino and sports betting platform at https://99play2.cam.

99play2 serves players primarily across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and surrounding regions. As a platform that handles financial transactions in Malaysian Ringgit (MYR) and processes identity documents issued by Malaysian authorities, we take our data protection obligations seriously and apply them consistently across all player interactions.

By registering an account on 99play2, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to the terms of this Policy, please do not register an account or use the Platform.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" means 99play2, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third-party entity that processes personal data on behalf of 99play2 under contractual instruction.
• "KYC" means Know Your Customer — the identity and age verification process required prior to processing withdrawals or fulfilling compliance obligations.
• "Cookies" means small text files placed on your device by the Platform to enable session management, analytics, and personalisation.
• "Platform" refers to the 99play2 website at https://99play2.cam and all associated services, games, and tools accessible therein.

3 Personal Data We Collect

We collect personal data that is necessary and proportionate to the purposes described in this Policy. The categories of data we collect include, but are not limited to:

3.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identification (MyKad, passport).
• Date of birth (used to verify minimum age of 21 years).
• Email address and mobile phone number.
• Residential address.
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (MyKad or passport).
• Proof of address (utility bill or bank statement not older than 3 months).
• Selfie or biometric image in certain verification scenarios.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method references.
• E-wallet identifiers associated with Touch 'n Go eWallet, Boost, GrabPay, or other Malaysian payment platforms.
• Bank account or FPX reference details used for DuitNow transfers (held only to the extent required by anti-money-laundering obligations).
• Cryptocurrency wallet addresses where BTC or USDT is used as a payment method.

3.4 Activity & Behavioural Data

• Game play history including games played, wagers placed, wins, and losses.
• Sports betting history including markets selected, stakes, and outcomes.
• Bonus and promotion utilisation records.
• Login history, session duration, and in-app navigation patterns.

3.5 Device & Technical Data

• IP address and approximate geolocation at time of login.
• Device type, operating system, and browser version.
• Cookie identifiers and session tokens.

3.6 Communication Data

• Records of live chat sessions, email correspondence, and support tickets submitted to 99play2.
• Voluntary survey responses and feedback submissions.

4 How We Collect Personal Data

We collect personal data through the following means:

• Directly from you: During account registration, KYC submission, deposit and withdrawal requests, and communications with our support team.
• Automatically via the Platform: Through cookies, session tokens, and server log files when you browse, log in, or interact with games and betting markets.
• From payment processors: We receive transaction references and confirmation data from Malaysian payment partners including DuitNow, FPX, and e-wallet providers when you transact on the Platform.
• From KYC verification partners: Third-party identity verification providers may return verification status, risk indicators, and document authentication results to us as part of the KYC process.
• From fraud detection systems: Automated systems may flag certain account or transaction patterns and provide risk signals to our compliance team.

5 Legal Basis for Processing

99play2 processes your personal data on the following legal grounds:

6 Data Processing — How We Use Your Data

99play2 uses personal data collected from players for the following specific purposes:

6.1 Account Operations

To create and manage your player account, authenticate your identity at login, process deposits and withdrawals in MYR through your chosen Malaysian payment method, and maintain accurate transaction records.

6.2 Regulatory Compliance

To fulfil our obligations under applicable anti-money laundering (AML), counter-terrorism financing (CTF), and responsible gambling regulations. This includes KYC verification, transaction monitoring, and the reporting of suspicious activity where required by the relevant licensing authority.

6.3 Responsible Gambling

To monitor player activity for signs of problem gambling behaviour, apply self-exclusion and deposit limit settings, and ensure compliance with our 21+ age restriction policy. Player welfare monitoring is carried out in accordance with our responsible gambling obligations and may involve automated analysis of betting patterns.

6.4 Security & Fraud Prevention

To detect and prevent fraudulent activity, account takeovers, bonus abuse, and money laundering. This may involve automated decision-making where a transaction or account behaviour triggers a predefined risk threshold. Players affected by automated decisions have the right to request human review.

6.5 Customer Support

To respond to enquiries, resolve disputes, and provide assistance via live chat and email. Support interactions are recorded and retained for quality assurance and dispute resolution purposes.

6.6 Platform Improvement

To analyse aggregated and anonymised usage data to improve game performance, payment processing efficiency, user interface design, and overall platform reliability. Individual players are not identified in analytics outputs.

7 Data Sharing & Disclosure

99play2 does not sell, rent, or trade your personal data. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: Malaysian payment service providers including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency custodians receive the minimum transaction data required to process your deposit or withdrawal.
• KYC Verification Partners: Third-party identity verification services receive document images and personal details solely for the purpose of confirming your identity and age eligibility.
• Fraud Detection Services: Automated risk platforms receive technical and transactional signals to identify potentially fraudulent account activity. No narrative personal data is shared beyond what is technically required.
• Gaming Software Providers: Game providers receive session and wager data to facilitate game play and settle outcomes. They do not receive personally identifiable information such as name or ID documents.
• Legal and Regulatory Authorities: We may be required to disclose personal data to law enforcement agencies, licensing bodies, or courts pursuant to a valid legal order, court order, or statutory obligation. We will notify affected players where permitted to do so by applicable law.

8 Data Retention

99play2 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Deletion requests submitted by users may not override retention periods mandated by law or licensing authority requirements.

9 Cookies & Tracking Technologies

99play2 uses cookies and similar technologies on the Platform. The types of cookies we deploy are as follows:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication tokens that keep you logged in and security cookies that prevent cross-site request forgery. These cannot be disabled without impairing Platform functionality.
• Performance Cookies: Used to collect anonymised data about how players navigate the Platform — which games are most visited, where players spend the most time, and where errors occur. This data informs our product development roadmap.
• Functionality Cookies: Store your preferences such as language settings, display preferences, and notification opt-outs so they persist across sessions.
• Security Cookies: Help us identify and block suspicious login attempts, brute-force attacks, and unusual account access patterns.

99play2 does not use third-party advertising networks or retargeting pixels. We do not track your activity across other websites.

10 Data Security

99play2 implements a multi-layered security architecture to protect personal data from unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• TLS/SSL Encryption: All data in transit between your device and our servers is encrypted using Transport Layer Security (TLS 1.2 or higher).
• AES-256 Encryption at Rest: Sensitive personal and financial data stored in our databases is encrypted at rest.
• Two-Factor Authentication (2FA): Optional but strongly recommended for all player accounts. Prevents account takeover even where login credentials are compromised.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo regular privacy and security training.
• Penetration Testing: The Platform undergoes regular independent security assessments and vulnerability testing.
• Incident Response: In the event of a data breach that poses a risk to player rights or freedoms, we will notify affected players and relevant authorities within the timeframe required by applicable law.

While we apply reasonable and industry-standard security measures, no system is completely immune from risk. Players are encouraged to use a strong, unique password and enable two-factor authentication to maximise the security of their own account.

11 User Rights

Subject to applicable data protection laws and regulatory restrictions, you have the following rights with respect to your personal data held by 99play2:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond to verified access requests within 30 calendar days.
• Right to Rectification: If you believe any personal data we hold is inaccurate or incomplete, you may request that we correct it. Basic profile details can be updated directly from your account settings.
• Right to Erasure: You may request deletion of your personal data. We will comply where there is no overriding legal or regulatory obligation to retain the data (for example, AML record-keeping requirements may require us to retain certain transaction data for up to 7 years regardless of an erasure request).
• Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances, for example where you contest the accuracy of the data or have objected to our use of it.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your data in a structured, machine-readable format.
• Right to Object: You may object to processing of your personal data where it is based on legitimate interest, including profiling for responsible gambling monitoring (subject to regulatory obligations).
• Right to Withdraw Consent: Where processing is based on your consent (such as receiving promotional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

12 Children's Privacy

99play2 strictly prohibits the use of the Platform by persons under the age of 21. We do not knowingly collect personal data from individuals under this age. If you are a parent or guardian and believe that a minor has registered an account or provided personal data to 99play2 without your knowledge, please contact us immediately at [email protected].

Upon receipt of a valid notification, we will promptly investigate the report, suspend the relevant account, delete any personal data associated with the minor, and return any funds deposited where it is safe and practical to do so.

13 International Data Transfers

99play2 operates under an international gaming licence and our infrastructure may involve data storage or processing in jurisdictions outside Malaysia. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to maintain the equivalent level of data protection required under this Policy.

Safeguards for international transfers may include contractual data transfer clauses, adequacy decisions, or binding corporate rules, depending on the destination country and the nature of the data being transferred. All international transfers are conducted in strict compliance with our data processing agreements with third-party service providers.

14 Policy Updates

99play2 reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. When material changes are made, we will notify active players via email or a prominent notice within the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects the most recent revision. We encourage you to review this page periodically. Your continued use of the Platform following any update to this Policy constitutes your acknowledgement and acceptance of the revised terms.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection team through any of the following channels:

For our full legal terms governing your use of the Platform, please review our Terms & Conditions. For information on our responsible gambling tools and player protection programme, visit our Responsible Gambling page.