Privacy Policy — 99kopitiam

Introduction

99kopitiam ("we", "us", "our", "the Platform") is an online casino and sports betting platform operated under an internationally recognised gaming licence and accessible at https://99kopitiam.cam. We serve players across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all surrounding regions.

This Privacy Policy ("Policy") sets out how 99kopitiam collects, uses, stores, shares, and protects personal data belonging to registered users ("Players", "Users", "you", "your") and website visitors. It applies to all data processing activities conducted in connection with your use of the Platform, whether via desktop browser, mobile browser, or any future dedicated application.

This Policy is to be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. Together, these documents constitute the full framework governing your relationship with 99kopitiam. By registering an account or continuing to use the Platform, you confirm your acceptance of the data practices described herein.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, IP address, device identifiers, and behavioural data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — 99kopitiam, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of 99kopitiam in accordance with our documented instructions.
• "KYC" — Know Your Customer; the identity and address verification process required for full platform access.
• "Cookie" — a small text file placed on your device by the Platform that stores session or preference data.
• "MYR" — Malaysian Ringgit; the sole transactional currency on the Platform.
• "Sensitive Data" — Personal Data warranting heightened protection, including government-issued ID numbers, biometric data captured for verification purposes, and financial account details.

Personal Data We Collect

We collect Personal Data in the categories described below. We collect only what is necessary for the stated purposes and do not seek to accumulate data beyond what is operationally or legally required.

We do not knowingly collect special categories of sensitive personal data (such as health data, racial or ethnic origin, religious beliefs, or political opinions) unless directly relevant to a responsible gambling intervention (e.g., a self-exclusion request that references a health condition), in which case such data is handled with the highest degree of protection.

How We Collect Personal Data

We collect Personal Data through the following channels:

• Direct submission by you: When you register an account, complete KYC verification, submit a support request, update your profile, or communicate with us via live chat or email.
• Automatically during Platform use: Technical and usage data is collected passively through cookies, web beacons, server logs, and analytics tools as you browse and interact with the Platform.
• From payment processors: When you initiate a deposit or withdrawal via FPX, Touch 'n Go, Boost, GrabPay, DuitNow, Visa, Mastercard, or cryptocurrency channels, our payment partners transmit transaction confirmation data and, where required, verification data to us.
• From identity verification partners: Our KYC and AML compliance partners may provide identity-check results or enhanced due-diligence data in connection with your account verification.
• From fraud prevention services: Where necessary to detect or prevent fraudulent activity, we may receive risk-scoring data from specialist fraud detection providers.

Purposes of Data Processing

We process your Personal Data for the following clearly defined purposes. We do not use your data for any purpose incompatible with those stated at the time of collection.

• Account creation and management: To register, maintain, and administer your 99kopitiam account, including authentication and security.
• Identity verification (KYC): To verify your identity and age (21+) and residential address in compliance with our gaming licence obligations and applicable anti-money laundering laws.
• Transaction processing: To process deposits and withdrawals in MYR via your chosen payment method, and to maintain accurate financial records.
• Game and betting services: To deliver the core gaming and sports betting experience, including recording bets, settling outcomes, and applying bonus credits.
• Customer support: To respond to enquiries, resolve disputes, and provide technical assistance via live chat and email.
• Legal and regulatory compliance: To meet obligations imposed by our gaming licence, AML regulations, and applicable data protection laws.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct.
• Responsible gambling: To monitor gaming patterns for signs of problem gambling behaviour and to apply player-requested restrictions (deposit limits, self-exclusion).
• Service improvement: To analyse aggregate usage data and improve Platform features, performance, and user experience.
• Marketing communications (with consent only): To send promotional offers, bonus notifications, and news relevant to your gaming interests — only where you have provided explicit opt-in consent.

Legal Basis for Processing

Each processing activity conducted by 99kopitiam is grounded in one or more of the following lawful bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions you have accepted — including account management, transaction processing, and game delivery.
• Legal obligation: Processing required to comply with our gaming licence conditions, AML regulations, age-verification requirements, and any applicable data protection legislation.
• Legitimate interests: Processing necessary for fraud prevention, platform security, internal analytics, and service improvement, where our interests are not overridden by your privacy rights.
• Consent: Processing for optional activities such as marketing communications and non-essential cookies — in each case subject to your freely given, specific, and withdrawable consent.

Data Sharing & Disclosure

99kopitiam does not sell, rent, or trade your Personal Data to third parties for marketing purposes. We share Personal Data only in the following limited and controlled circumstances:

• Payment processors: We share financial data with payment service providers (including FPX operators, eWallet providers such as Touch 'n Go and Boost, card processors, and cryptocurrency gateways) solely to execute your deposit and withdrawal instructions.
• KYC and AML compliance partners: We transmit identity documents and verification requests to licensed KYC service providers to fulfil our regulatory obligations.
• Game technology providers: Game studios and live dealer platform providers may receive session data necessary to deliver and audit their games on our Platform.
• Fraud prevention services: Anonymised or pseudonymised risk data may be shared with fraud detection services to protect all Platform users.
• Regulatory and law enforcement authorities: We will disclose Personal Data to competent authorities where required by law, court order, or regulatory demand — including our licensing authority and, where applicable, Malaysian law enforcement bodies.
• Professional advisers: Lawyers, auditors, and insurers retained by 99kopitiam may access Personal Data on a need-to-know basis and are bound by confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or transfer of assets involving 99kopitiam, Personal Data may be disclosed to the prospective or actual successor entity, subject to equivalent privacy protections.

All third parties with whom we share Personal Data are contractually obligated to process it only for specified purposes, in accordance with our instructions, and to maintain security standards at least equivalent to our own.

International Data Transfers

Some of our service providers and technology partners operate in jurisdictions outside Malaysia. Where your Personal Data is transferred to a jurisdiction that does not offer an equivalent level of data protection, we ensure that appropriate safeguards are in place. These safeguards may include:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules where applicable within corporate groups;
• Adequacy decisions where the recipient country has been recognised as providing sufficient data protection.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Malaysia in the circumstances described above.

Data Retention

We retain Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and our regulatory obligations. The following general retention periods apply:

• Account data and KYC records: Retained for a minimum of 5 years following account closure, in compliance with AML legislation and gaming licence requirements.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction.
• Communication records (live chat, email): Retained for 2 years from the date of the communication, or longer where relevant to an ongoing dispute or investigation.
• Technical and usage data: Typically retained for 12 months from collection, after which it is aggregated or anonymised.
• Marketing preference records: Retained for the duration of your account and for 1 year following account closure or opt-out, as evidence of consent management.

When retention periods expire, Personal Data is securely deleted or permanently anonymised so that it can no longer be associated with any identifiable individual.

Cookies & Tracking Technologies

99kopitiam uses cookies and similar tracking technologies to operate the Platform and improve your experience. Cookies are small text files stored on your device that enable the Platform to recognise your session, remember your preferences, and analyse usage patterns.

Types of Cookies We Use

• Strictly Necessary Cookies: Essential for Platform functionality — including session authentication, security tokens, and load-balancing. These cannot be disabled without affecting Platform operation.
• Functional Cookies: Remember your preferences (e.g., language, display settings) to personalise your experience across sessions.
• Analytics Cookies: Collect aggregated, anonymised data on Platform usage to help us understand how players interact with our features and improve performance.
• Marketing Cookies (consent required): Used only with your explicit consent to track browsing behaviour and tailor promotional communications. These are not activated unless you opt in.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Consent for non-essential cookies can be managed via the cookie preference panel displayed on your first visit to the Platform.

Your Data Rights

Subject to applicable law, you have the following rights in respect of your Personal Data held by 99kopitiam. You may exercise any of these rights by contacting our Data Protection team (see Section 16).

We will respond to all data rights requests within 30 days of receipt. Where requests are complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it. We will not charge a fee for legitimate rights requests unless they are manifestly unfounded or excessive.

Children & Minors

The 99kopitiam Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. Our registration process includes mandatory age-declaration steps, and our KYC verification process independently confirms age through government-issued identity documentation.

If we discover or have reasonable grounds to believe that Personal Data has been submitted by or on behalf of a person under 21 years of age, we will immediately suspend the relevant account, delete the associated Personal Data to the extent permitted by our legal obligations, and report the matter to our compliance team. Any funds associated with such an account will be handled in accordance with our regulatory obligations and will not be released to the account holder.

If you believe that a person under the age of 21 has registered an account or submitted Personal Data on our Platform, please notify us immediately at [email protected].

Security Measures

99kopitiam implements a multi-layered security framework to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS / SSL): All data transmitted between your device and our servers is encrypted using industry-standard 256-bit SSL/TLS protocols. Our Platform operates exclusively over HTTPS.
• Encryption at rest: Sensitive data fields — including identity document scans, financial account references, and authentication credentials — are encrypted at rest using AES-256 encryption.
• Access controls: Personal Data is accessible internally only by staff with a documented operational need. Access is governed by role-based permission systems and is logged for audit purposes.
• Penetration testing: Our infrastructure undergoes regular independent penetration testing to identify and remediate security vulnerabilities.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in high risk to your rights and freedoms, we will notify you and the relevant authorities within the timeframes required by applicable law.

Third-Party Links & Services

The Platform does not contain links to external third-party websites outside of the 99kopitiam domain, in accordance with our internal link policy. All navigation links on the Platform direct to pages within https://99kopitiam.cam.

Where third-party technology is embedded in the Platform — such as game engines, live dealer streaming infrastructure, and payment gateway interfaces — those third-party providers operate under their own privacy policies with respect to any data processed directly through their systems. 99kopitiam ensures that all embedded third-party providers are contractually bound to data processing agreements consistent with our own privacy standards.

Amendments to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, or applicable legal requirements. The date of the most recent revision is displayed at the top of this page ("Last Updated").

Where material changes are made to this Policy — particularly changes that affect how we use your Personal Data or your rights in respect of it — we will notify registered users via a prominent notice on the Platform and, where appropriate, by email to your registered address at least 7 days prior to the changes taking effect.

We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by 99kopitiam, you may contact us through the following channels:

• Live Chat: Available daily from 9 AM to 2 AM MYT via the support widget on the Platform. Live chat is the fastest channel for account-specific and time-sensitive privacy matters.
• Email: [email protected] (displayed as plain text — not a clickable link). Please allow up to 24 hours for a response on non-urgent enquiries. For formal data rights requests, please include "Data Rights Request" in your subject line.

Our support team is based in Malaysia and operates in alignment with Malaysian business hours and the Malaysian time zone (MYT, UTC+8). We aim to acknowledge all privacy-related queries within 24 hours and to provide a substantive response within 30 days.