Privacy Policy

1. Scope & Data Controller

This Privacy Policy applies to all personal data processed by 99laju in connection with the operation of the 99laju Platform at 99laju.asia, including all services, products, promotions, and customer support functions offered thereon. It applies to all individuals who register an account, visit the Platform, or otherwise interact with 99laju's services ("Players", "Users", "you").

99laju acts as the data controller in respect of the personal data it collects and processes. As data controller, 99laju determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

This policy is to be read in conjunction with the 99laju Terms & Conditions and Responsible Gaming Policy, both of which are published on this Platform.

2. Personal Data We Collect

99laju collects the following categories of personal data in the course of operating the Platform:

2.1 Identity Data

• Full legal name as it appears on government-issued identification;
• Date of birth;
• MyKad number, passport number, or other government-issued identification number;
• Copies of identity documents submitted for KYC verification, including photographs;
• Selfie photographs taken for biometric identity verification purposes.

2.2 Contact Data

• Email address;
• Malaysian mobile telephone number;
• Residential address including postcode and state (e.g., Kuala Lumpur, Selangor, Penang, Johor).

2.3 Financial Data

• Bank account details (account number, bank name) associated with withdrawal requests;
• E-wallet account identifiers for Touch n Go eWallet, Boost, or other linked payment methods;
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment method identifiers.

2.4 Gaming Data

• Betting history, including markets wagered, stakes placed, and outcomes;
• Game session data including session durations, games played, and in-session activity;
• Bonus claims and wagering requirement completion records;
• Responsible gaming settings including any deposit limits, session limits, or self-exclusion requests.

2.5 Technical Data

• IP address at the time of registration and subsequent logins;
• Device identifiers, browser type and version, operating system;
• Login timestamps and session activity logs;
• Geolocation data derived from IP address for jurisdictional compliance purposes.

2.6 Communications Data

• Records of communications between you and 99laju's customer support team via live chat, email, or other channels;
• Feedback, complaints, and dispute records.

3. How We Collect Your Data

99laju collects personal data through the following means:

• Direct provision by you — when you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a promotion;
• Automated technical collection — via cookies, server logs, and session tracking technologies when you access and navigate the Platform;
• Third-party sources — including identity verification service providers used to authenticate KYC documents, payment processors who confirm transaction details, and fraud screening services that flag suspicious patterns.

4. Purposes & Legal Basis for Processing

99laju processes your personal data for the following purposes, each supported by a lawful basis under applicable data protection law:

• Account registration and management — necessary for the performance of the contract between you and 99laju;
• Identity and age verification (KYC) — necessary for compliance with legal obligations and to fulfil contractual obligations, including the 21+ age restriction;
• Payment processing — necessary for the performance of the contract and to comply with financial regulatory obligations;
• Anti-money laundering (AML) and fraud prevention — necessary for compliance with legal obligations applicable to gaming operators;
• Customer support — necessary for the performance of the contract and pursuant to our legitimate interest in resolving player queries;
• Responsible gaming monitoring — necessary for compliance with responsible gaming obligations and in the legitimate interest of protecting vulnerable players;
• Marketing communications — based on your consent, which may be withdrawn at any time;
• Platform improvement and analytics — pursuant to 99laju's legitimate interest in improving the Platform experience for all Players.

5. Cookies & Tracking Technologies

99laju uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies — essential for the Platform to function. These cannot be disabled without impairing core functionality such as login session maintenance.
• Performance cookies — collect anonymised data about how Players use the Platform in order to improve performance and user experience.
• Functional cookies — remember your preferences (such as language or display settings) to personalise your experience.
• Analytics cookies — used to understand aggregate usage patterns and improve Platform features. Data is anonymised where possible.

You may manage non-essential cookies through your browser settings. Disabling performance or analytics cookies will not affect your ability to use core Platform features. Disabling strictly necessary cookies may prevent you from logging in or using certain services.

6. Disclosure to Third Parties

99laju does not sell, rent, or exchange your personal data with third-party marketers. Personal data may be shared in the following circumstances only:

• Service providers — third parties engaged by 99laju to provide services necessary to operate the Platform, including payment processors (e.g., FPX, e-wallet providers), identity verification providers, cloud hosting services, and customer support platform providers. These parties are bound by data processing agreements and may only use your data for the specified service purpose;
• Regulatory and law enforcement authorities — where required by applicable law, court order, or regulatory directive, including disclosure to financial intelligence units in connection with AML obligations;
• Gaming regulators — as required under the applicable gaming licence and regulatory framework under which 99laju operates;
• Fraud prevention agencies — where sharing is necessary to detect, prevent, or investigate fraudulent activity affecting the Platform or its Players;
• Business transfers — in the event of a merger, acquisition, or sale of all or part of 99laju's business assets, personal data may be transferred to the acquiring entity subject to equivalent data protection obligations.

7. International Data Transfers

Some of 99laju's service providers are located outside of Malaysia. Where personal data is transferred to third countries, 99laju ensures that appropriate safeguards are in place to protect your data, including contractual protections in the form of standard data transfer clauses or equivalent mechanisms. By using the 99laju Platform, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia in connection with the services described in this policy.

8. Data Retention

99laju retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and KYC data — retained for a minimum of five (5) years following account closure, as required under applicable AML and gaming regulatory obligations;
• Transaction records — retained for a minimum of seven (7) years to comply with financial record-keeping requirements;
• Communications records — retained for up to three (3) years from the date of communication, unless the communication forms part of a dispute or regulatory inquiry in which case it is retained until the matter is resolved;
• Technical and session logs — retained for up to twelve (12) months from the date of creation;
• Self-exclusion records — retained for the duration of the exclusion period and for a further five (5) years thereafter.

Following the applicable retention period, personal data is securely deleted or anonymised.

9. Your Data Rights

Subject to applicable law and 99laju's legitimate regulatory obligations, you have the following rights in respect of your personal data:

• Right of access — you may request a copy of the personal data held about you;
• Right of rectification — you may request correction of inaccurate or incomplete data;
• Right to erasure — you may request deletion of your personal data, subject to 99laju's legal retention obligations. Note that data required for AML, KYC, or regulatory compliance purposes cannot be deleted on demand;
• Right to restrict processing — you may request that 99laju restrict the processing of your data in certain circumstances;
• Right to data portability — you may request that data you provided to 99laju be transferred to another data controller in a structured, commonly used format;
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to object — you may object to processing based on legitimate interests where you believe your rights override those interests.

To exercise any of these rights, contact our support team via live chat or email at [email protected]. We will respond to verified requests within thirty (30) days.

10. Security Measures

99laju implements technical and organisational measures appropriate to the risk posed by our processing activities, including:

• TLS 1.3 encryption for all data transmitted between your device and the 99laju Platform;
• Encryption of stored personal data and financial records at rest;
• Role-based access controls ensuring only authorised personnel access personal data;
• Regular internal security reviews and vulnerability assessments;
• Two-factor authentication available for all Player accounts and required for administrative access;
• Incident response procedures to contain, assess, and remediate data security incidents promptly.

No data transmission over the internet is completely secure. Whilst 99laju takes every reasonable precaution to protect your data, we cannot guarantee absolute security of data transmitted to the Platform. Players are encouraged to take their own precautions, including using strong, unique passwords and enabling two-factor authentication on their 99laju account.

11. Children's Privacy

The 99laju Platform is strictly for adults aged 21 years and above. 99laju does not knowingly collect, process, or retain personal data from individuals under the age of 21. Age verification is conducted as part of the KYC process, and any account found to have been registered by or on behalf of a minor will be closed immediately. If you become aware that a minor has accessed the Platform using your or a third party's account details, contact 99laju support immediately.

12. Marketing Communications

With your consent at the time of registration or subsequently via account settings, 99laju may send you promotional communications regarding offers, bonuses, new games, and Platform updates via email or SMS to your registered Malaysian mobile number. You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email;
• Updating your communication preferences in your 99laju account settings;
• Contacting our support team and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect transactional communications necessary for account operation, such as payment confirmations, security alerts, or KYC notifications. Players who have self-excluded will not receive any marketing communications for the duration of their exclusion and for a defined period thereafter.

13. Changes to This Privacy Policy

99laju reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, our data processing practices, or the services offered on the Platform. When material changes are made, we will provide notice to registered Players via email and/or a prominent notice on the Platform. The "Effective Date" at the top of this policy indicates when the current version came into force. Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or 99laju's data processing practices, please contact our Data Protection team through any of the following channels:

• Live Chat: Available 24/7 via the 99laju Platform
• Email: [email protected]

We aim to acknowledge all data protection enquiries within two (2) business days and to resolve them within thirty (30) days of receipt.