Privacy Policy Club99 – Malaysia Member Personal Data Protection

Club99 is committed to protecting the privacy and security of every member's personal information on our platform at club99.express. This Privacy Policy clearly and transparently explains how we handle your personal data — from how it is collected and what it is used for, to how it is protected and your rights as a user in relation to that data.

We understand that trust is built slowly and can be lost in an instant. That is why Club99 choose to be fully transparent about our data handling practices — not through hard-to-understand legal jargon, but in plain, clear language for Malaysian users.

This Privacy Policy is drawn up in accordance with responsible data protection principles and covers all services provided by Club99, including online casino games, Sports Betting, e-sports, poker, and all related platform features.

Club99 only collects personal data that is strictly necessary to provide members with a safe, efficient, and responsible service. We do not collect information beyond what is needed for the purposes stated in this policy.

We collect this data through several channels: the account registration form, direct use of the platform, interactions with our customer support team, and automatically via cookie technology and server logs as you browse our platform.

Club99 uses collected personal data solely for legitimate, stated purposes. We do not use your data for anything unrelated to the provision of our platform services without obtaining your consent first.

• Account Management: Creating and maintaining your account, verifying your identity at login, and protecting your account from unauthorised access.
• Transaction Processing: Processes deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow and FPX, as well as withdrawals back to the same payment methods.
• Regulatory Compliance: Fulfilling legal obligations including age verification, Anti-Money Laundering (AML) procedures and Know Your Customer (KYC) requirements.
• Platform Security: Detecting and preventing fraud, account abuse, game manipulation and any activity that violates the platform's Terms and Conditions.
• Customer Support: Helps us resolve issues, answer enquiries and handle complaints effectively by referencing your account history.
• Responsible Gaming: Monitoring usage patterns to identify concerning signs and reaching out to members who may need support, in line with Club99's commitment to member wellbeing.
• Platform Improvements: Analysing aggregated, anonymised usage data to understand general usage patterns and make better-informed platform improvement decisions.
• Communications: Sending important account notifications, security updates, transaction confirmations and — with your consent — the latest promotional offers and bonus information.

Club99 does not use any fully automated decision-making systems that materially impact members' rights without human involvement in the final assessment process.

Club99 does not sell, rent or share members' personal data with third parties for advertising, marketing or any other commercial purpose without your explicit consent. This is a core commitment we do not compromise on.

However, there are limited circumstances in which Club99 needs to share data with certain parties to keep the platform running properly and securely:

• Gaming Service Provider: Selected game providers such as Evolution Gaming and Pragmatic Play receive only the minimum session data required to technically deliver the games. They are bound by strict confidentiality agreements.
• Payment Processors: Required transaction information is shared with legitimate payment processors such as FPX and DuitNow gateways to complete your deposits and withdrawals.
• Regulatory Authorities: Club99 will disclose information to government authorities or law enforcement when required by court order, warrant, or applicable legislation — including in investigations relating to money laundering or fraud.
• Technical Service Provider: Cloud infrastructure providers, cybersecurity services and analytics tools that process data on behalf of Club99 are subject to strict data processing agreements and may only use data for the specified purposes.

Club99 continuously invests in security infrastructure to ensure that members' personal and financial data remains protected to the highest practicable standard. We employ a combination of technical measures and operational procedures to achieve this.

• 256-bit SSL Encryption: All communications between your device and our servers Club99 is encrypted using TLS protocol with 256-bit encryption — the same security standard used by Malaysia's leading banking institutions.
• Stored Data Encryption: Sensitive data stored in our databases — including financial information and passwords (in hashed form) — is protected with an additional layer of encryption at rest.
• Strict Access Controls: Internal access to member data Club99 is based on a strict need-to-know basis — only staff who genuinely require access to carry out their duties are permitted to view the relevant data.
• 24/7 Threat Monitoring: An automated security monitoring system operates around the clock to detect unauthorised access attempts, cyberattacks, and suspicious activity patterns.
• Two-Factor Authentication: Members are encouraged to enable two-factor authentication in their account settings as an additional layer of protection against unauthorised access.
• Regular Security Audits: Club99 conducts regular security audits and penetration testing to identify and address vulnerabilities before they can be exploited.

While we take all reasonable steps to protect your data, no online security system can guarantee absolute 100% protection. We encourage members to take their own precautions as well — such as using a strong password, not sharing login credentials, and regularly reviewing their account activity.

Club99 uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device when you visit our website. They help the platform remember your preferences and deliver a smoother experience.

We use several categories of cookies:

• Essential Cookies (Required): Required for the platform to function properly — including maintaining your login session, storing security settings and enabling core platform features. These cookies cannot be disabled without significantly affecting platform functionality.
• Performance Cookies: Helping us understand how members use the platform — which pages are visited most frequently, where users encounter technical issues, and how long pages take to load. This data is used in aggregated, anonymised form to improve the platform.
• Functional Cookies: Saving your preferences — such as language settings (Bahasa Melayu), limits you have set, and other display preferences — so you don't have to reconfigure them every time you log in.
• Marketing Cookies (with consent): Used only with your consent to show you more relevant promotional content based on your interests within the platform Club99.

You can control or delete cookies through your web browser settings. However, disabling essential cookies may affect platform functionality and your login experience.

Club99 retains members' personal data only for as long as it is needed for the purposes set out in this policy, or as required by applicable law. Retention periods vary by data type:

• Active Account Data: Retained for as long as your account is active and for a reasonable period after closure — typically up to seven (7) years to comply with anti-money laundering legal requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with applicable financial and tax compliance requirements.
• Technical Log Data: Server logs and technical data are typically retained for 90 days for security and incident investigation purposes.
• Customer Support Communications: Support conversation records are retained for two (2) years for service quality purposes and as a reference in the event of any related disputes.

Member data Club99 stored in secure data centres. Cross-border data transfers, where they occur, are carried out with appropriate safeguards to ensure your data remains protected to a standard equivalent to this Privacy Policy, regardless of the physical server location.

As a member Club99, you have the following rights in relation to your personal data. We are committed to respecting and facilitating the exercise of these rights, provided they do not conflict with our legal obligations:

Club99 strictly prohibits the use of the platform by anyone under the age of 18. We do not knowingly collect or process the personal data of children or minors under any circumstances.

Should we discover that personal data belonging to an individual under the age of 18 has been collected without our knowledge — whether through inaccurate information provided during registration or by any other means — we will:

• Closing the account in question with immediate effect.
• Deleting all personal data associated with that account as promptly as possible.
• Reversing any transactions that have taken place and refunding deposits where appropriate, subject to the outcome of an internal investigation.

By registering an account Club99, you may choose whether to receive marketing communications from us — including information about new bonuses, limited-time promotions, exclusive VIP member offers, and the latest game updates.

We send marketing communications through the following channels, depending on the preferences you indicated during registration or in your account settings:

• Promotional notification emails sent to your registered email address.
• In-platform push notifications when you are actively using club99.express.
• In-account messages (platform inbox) for offers tailored to your gaming activity.

You may manage or withdraw your consent to receive marketing communications at any time in the following ways:

• Click the "Unsubscribe" link included in every marketing email we send.
• Update your communication preferences in the settings section of your Club99 account.
• Contact our support team via live chat or email to request removal from our marketing communications list.

Please note that withdrawing your marketing consent will not affect your receipt of important account-related communications such as transaction confirmations, security notifications and essential service updates — these will continue to be sent for as long as your account is active, as they form part of our core service.

Club99 reserves the right to amend or update this Privacy Policy at any time to reflect changes in our privacy practices, the services we offer, or applicable legal requirements.

When we make material changes to this policy, we will:

• Updating the "Last updated" date at the top of this page.
• Displaying a prominent notice within the platform regarding policy changes for a period of at least 14 days before those changes take effect.
• Active members are notified by email of any significant changes, giving them the opportunity to review the updates and — if necessary — close their account before the changes take effect.

Continued use of the platform Club99 after the updated Privacy Policy takes effect constitutes your acceptance of those changes. We encourage members to review this page periodically to stay informed about how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by Club99, please do not hesitate to reach us through any of the following channels:

• Privacy Email: support@club99.express — please mark the email subject as "Privacy Enquiry" so it is routed to the relevant team promptly.
• Live Chat: Available 24 hours a day, 7 days a week directly within club99.express — our Malay-speaking agents are ready to assist you.
• WhatsApp Support: Access via the support button within the Club99 platform after logging in to your account.

We are committed to responding to all privacy-related enquiries within 72 hours business hours. For formal requests relating to data rights (such as access or deletion requests), the response period is up to 30 calendar days as stated in Section 8.

If you are not satisfied with the way Club99 If you are unsatisfied with how we have handled your privacy inquiry after contacting us directly, you have the right to refer the matter to the relevant regulatory authority in your jurisdiction.