Privacy Policy — kaya99

1. Scope and Data Controller

This Privacy Policy applies to all personal data collected, processed, or stored by kaya99 in connection with the operation of the kaya99 Platform at https://kaya99.app, including all sub-pages, games, applications, and associated services.

For the purposes of applicable data protection law, kaya99 acts as the data controller in respect of personal data collected directly from users of the Platform. Where third-party service providers process data on behalf of kaya99, they do so as data processors under appropriate contractual safeguards.

2. Personal Data We Collect

2.1 Registration Data

When you create a kaya99 Account, we collect the information you provide, including your full legal name, date of birth, email address, mobile phone number, and country of residence.

2.2 Identity Verification (KYC) Data

To comply with our licensing obligations and anti-money laundering (AML) requirements, kaya99 may collect and verify identity documents such as your national identity card (MyKad), passport, and proof of address documentation.

2.3 Financial Data

We collect transaction-related data including deposit and withdrawal records, payment method details (e.g. bank account numbers for withdrawal processing), and transaction history. We do not store full credit or debit card numbers on our servers.

2.4 Usage Data

We automatically collect data about how you interact with the kaya99 Platform, including your IP address, device type and identifiers, browser type and version, operating system, session timestamps, pages visited, games played, bets placed, and clickstream data.

2.5 Communications Data

If you contact kaya99 via live chat, email, or any other channel, we retain records of those communications for support, compliance, and training purposes.

3. How We Use Your Personal Data

kaya99 uses the personal data we collect for the following purposes:

• To create and manage your kaya99 Account and verify your identity;
• To process deposits, withdrawals, and other financial transactions in MYR;
• To provide access to games, sports betting markets, Lottery 4D, and all other Platform features;
• To communicate with you regarding your Account, transactions, promotions, and Platform updates;
• To detect, investigate, and prevent fraudulent activity, money laundering, and other unlawful conduct;
• To fulfil our obligations under applicable gaming licensing conditions and AML/CFT regulations;
• To monitor gameplay patterns for responsible gaming purposes and enforce deposit and session limits;
• To improve Platform performance, personalise your experience, and develop new features;
• To administer the kaya99 Rewards programme and calculate cashback and loyalty credits;
• To respond to your support queries and resolve complaints.

4. Legal Bases for Processing

kaya99 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contractual obligations to you as a registered Account holder, including providing Platform access and processing transactions;
• Legal obligation: Processing required to comply with applicable laws, including KYC verification, AML record-keeping, and reporting obligations to our licensing authority;
• Legitimate interests: Processing necessary for kaya99's legitimate business interests, including fraud prevention, Platform security, and product improvement, where these interests are not overridden by your rights;
• Consent: Processing based on your explicit consent, such as optional marketing communications. You may withdraw consent at any time by contacting support.

5. Sharing Your Personal Data

5.1 Service Providers

kaya99 shares personal data with third-party service providers who assist in operating the Platform, including payment processors (Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank), identity verification providers, game software suppliers, cloud hosting providers, and customer support platforms. These providers are contractually bound to process data solely on kaya99's instructions and to maintain appropriate security standards.

5.2 Regulatory and Legal Disclosure

kaya99 may disclose your personal data to our licensing authority, law enforcement agencies, financial intelligence units, or other regulatory bodies where required by law or where such disclosure is necessary to protect the rights, property, or safety of kaya99, its users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of kaya99's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

6. Cookies and Tracking Technologies

The kaya99 Platform uses cookies and similar technologies to operate core functionality, maintain your login session, detect fraud, analyse Platform usage, and personalise your experience.

6.1 Types of Cookies Used

• Essential cookies: Required for the Platform to function. Cannot be disabled without impacting core services;
• Security cookies: Used to authenticate your session, detect fraud, and protect against cross-site request forgery;
• Analytics cookies: Used to understand how users interact with the Platform in aggregate, to improve performance and usability;
• Preference cookies: Used to remember your settings and personalisation choices across sessions.

7. Data Retention

kaya99 retains personal data for the following periods, unless a longer retention period is required by law:

• Account data: For the duration of your Account and for a period of five (5) years following Account closure, in accordance with AML record-keeping requirements;
• Transaction records: Five (5) years from the date of transaction, as required by applicable financial compliance obligations;
• KYC documentation: Five (5) years following the end of the customer relationship;
• Support communications: Two (2) years from the date of communication;
• Usage and technical data: Up to thirteen (13) months from collection, unless retained longer for security or legal purposes.

Upon expiry of the applicable retention period, kaya99 will securely delete or anonymise your personal data.

8. Data Security

kaya99 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit;
• Encryption of sensitive data at rest;
• Role-based access controls limiting internal data access to authorised personnel only;
• Regular security assessments and penetration testing;
• Two-factor authentication for internal systems access.

While kaya99 takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system can be guaranteed to be completely secure. You transmit data to kaya99 at your own risk.

9. International Data Transfers

kaya99's Platform and data processing infrastructure may involve the transfer of personal data to countries outside Malaysia. Where such transfers occur, kaya99 ensures that appropriate safeguards are in place to protect your data, including contractual data protection clauses with receiving parties that meet applicable international data protection standards.

By using the kaya99 Platform, you acknowledge and consent to the transfer of your personal data as described in this section.

10. Your Data Rights

Subject to applicable law and regulatory requirements, you have the following rights in relation to your personal data held by kaya99:

• Right of access: Request a copy of the personal data kaya99 holds about you;
• Right of rectification: Request correction of inaccurate or incomplete personal data;
• Right to erasure: Request deletion of your personal data where there is no lawful basis for continued processing, subject to kaya99's legal retention obligations;
• Right to restriction: Request that kaya99 restrict processing of your data in certain circumstances;
• Right to data portability: Request a structured, machine-readable copy of data you have provided to kaya99;
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact kaya99 support via live chat or email at [email protected]. kaya99 will respond to verified requests within thirty (30) days.

11. Children's Privacy

The kaya99 Platform is strictly restricted to persons aged 21 years and above. kaya99 does not knowingly collect personal data from persons under the age of 21. If kaya99 becomes aware that personal data has been collected from an underage individual, the relevant Account will be immediately closed and all data securely deleted.

If you believe a minor has registered on the kaya99 Platform, please contact support immediately so that appropriate action can be taken.

12. Third-Party Links

The kaya99 Platform may contain links to third-party websites or services for informational purposes. kaya99 is not responsible for the privacy practices or content of such third-party sites. We encourage you to review the privacy policies of any third-party site you visit independently of the kaya99 Platform.

13. Changes to This Privacy Policy

kaya99 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform features. Material changes will be communicated to Account holders via email or prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this page. Continued use of the kaya99 Platform following notification of changes constitutes your acceptance of the revised Privacy Policy.

14. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or kaya99's data practices, please contact us through the following channels:

kaya99 serves players across Malaysia — from Kuala Lumpur and Petaling Jaya to Penang, Johor Bahru, and Bangsar. All data-related communications should be submitted in English and include your registered Account email address for verification purposes.

If you are not satisfied with kaya99's response to your privacy complaint, you may have the right to lodge a complaint with the applicable data protection supervisory authority in your jurisdiction.