M99my Privacy Policy – Personal Data Protection for Malaysian Players

This Privacy Policy is published by m99my, an online sports betting and casino gaming platform operating under the domain name m99my.xyz. This document outlines our privacy practices — what data we collect from you, why we collect it, how we use it, who we may share it with, and what rights you have as a user of the m99my platform.

We understand that when you register with m99my, make a deposit via Touch 'n Go eWallet or DuitNow, place a bet on the Malaysia Super League, or play Live Casino, you are entrusting us with sensitive personal information. We take that trust seriously. This policy is written in plain, straightforward language — not deliberately obscure legal jargon — so you know exactly what happens with your data.

This Privacy Policy applies to all users of the m99my platform, including website visitors, registered members, active players and former members whose accounts have been closed. It also covers all m99my communication channels, including the website, mobile platform and customer support channels.

M99my collects personal data from several sources depending on how you interact with our platform. We only collect data that is strictly necessary for the stated purposes — we do not collect data in excess of what is needed. The following are the categories of data we collect:

The data we collect is used solely for purposes related to providing m99my's services to you and fulfilling our legal obligations. The following are the specific purposes for which your data is used at m99my:

• Account Management: Creating and maintaining your m99my account, processing registration, verifying your identity, and enabling you to log in to the platform securely.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, DuitNow, GrabPay, Boost, ShopeePay or FPX, and processing your winnings withdrawals to the same methods within the stipulated timeframe.
• Provision of Betting Services: Enables you to place sports bets on the Malaysia Super League, EPL and other leagues, play slots, Live Casino and poker, and view your betting history within your m99my account.
• Fraud Prevention: Detecting and preventing fraudulent activity, money laundering, multi-account usage, and platform abuse that harms other legitimate players.
• Customer Support: Responding to enquiries, resolving complaints and assisting you with any technical or financial issues you encounter while using the m99my platform.
• Responsible Gambling: Monitoring your gaming patterns to identify signs of problem gambling and reaching out to you where necessary to offer assistance or betting limit tools.
• Service Communications: Sending important notifications about your account, changes to our terms, promotions you are eligible for and relevant m99my platform updates.
• Platform Improvements: Analysing aggregated, anonymised usage patterns to understand how Malaysian players use the m99my platform and improve the user experience.
• Legal Compliance: To fulfil the reporting and record-keeping obligations required under Malaysian law, including Anti-Money Laundering (AML) requirements and the PDPA 2010.

M99my does not sell, rent or commercialise your personal data to any third party for their own benefit. However, there are limited situations where we need to share certain information with trusted parties in order to deliver the m99my service to you:

• Payment Processors: Required transaction information is shared with Malaysian payment providers such as Touch 'n Go eWallet, DuitNow, GrabPay, and local banks to process your deposits and withdrawals. This sharing is strictly limited to information necessary for transaction processing.
• Game Providers: Required session information is shared with licensed game providers such as Pragmatic Play and Evolution Gaming to allow their gaming platforms to function correctly within the m99my environment. These providers are bound by strict data protection agreements.
• Technical Service Providers: Infrastructure and security service providers that support the operation of the m99my platform may require access to certain data. All such providers are bound by confidentiality agreements and are not permitted to use that data for their own purposes.
• Legal Authorities: m99my will disclose information to Malaysian law enforcement authorities, regulatory bodies or courts where required by a valid court order, criminal investigation or applicable legal obligation.
• Business Transfers: In the event of a merger, acquisition, or transfer of m99my's business assets, user data may be transferred as part of those assets, subject to appropriate notice being given to users and continued protection of their data.

In all instances of data sharing described above, m99my ensures that the receiving party is bound by confidentiality and data protection obligations equivalent to or stricter than our own. We do not share data with any other parties beyond the situations outlined above.

Your data security is m99my's top technical priority. We invest in industry-grade security infrastructure to ensure your personal data and financial information remain protected at all times. This goes beyond legal compliance — it is about the trust you place in us.

• Data Encryption in Transit: All data transmitted between your device and m99my's servers is encrypted using TLS 1.3 with AES-256-bit encryption. This means no one can read your data while it travels across the internet.
• Data Encryption at Rest: Sensitive personal data stored in m99my's databases is encrypted at rest. Your password is stored as an irreversible hash — even we cannot view your password.
• Strict Access Controls: Access to user data within m99my's internal systems is governed by the principle of least privilege — only staff who genuinely require access to carry out their duties are granted permission. All access is logged and monitored.
• 24/7 Security Monitoring: m99my's automated security monitoring system operates around the clock to detect unauthorised access attempts, cyberattacks and suspicious activity. All threats are responded to in real time.
• Regular Security Testing: m99my conducts regular penetration testing and security audits with independent expert firms to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: m99my has a clear incident response procedure in place for situations where a data breach occurs. Should any incident affect your data, we will notify you within the timeframe stipulated by PDPA 2010.

M99my uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit a website. They help us remember your preferences and understand how you use the m99my platform.

You can manage your cookie preferences through your web browser settings. Please note, however, that disabling certain cookies may affect the functionality of the m99my platform. Essential cookies cannot be disabled without impacting the platform's core usability.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a user of the m99my platform have the following rights regarding your personal data. m99my is committed to facilitating the exercise of these rights without unnecessary bureaucratic hurdles.

M99my does not retain your personal data for longer than is necessary for the purposes for which it was collected, or as required by Malaysian law. Retention periods vary by data type:

• Active Account Data: For as long as your account remains active on m99my, we retain all data related to your account and betting activity to keep the platform functioning and to maintain your account history.
• Data After Account Closure: After an m99my account is closed, financial and betting records are retained for a minimum of 7 years in accordance with Malaysian legal requirements relating to anti-money laundering and tax compliance.
• Customer Support Data: Customer support conversation records are retained for 2 years after the last interaction for reference and service improvement purposes at m99my.
• Technical Logs: Technical access logs and security logs are retained for 90 days for troubleshooting and security investigation purposes before being automatically deleted.
• Marketing Data: Data used for marketing communications is retained until you withdraw your consent. Once consent is withdrawn, your data will be removed from our marketing communications list within 5 business days.

Once the designated retention period has lapsed and there is no legal requirement to retain the data further, m99my will delete or anonymise your personal data using secure, irreversible procedures.

M99my reserves the right to amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements or the services we offer. You will be notified of any material amendments via an in-platform notification or by email to the address you registered with.

The "Updated" date at the top of this page reflects the date of the most recent amendment to this Privacy Policy. We encourage you to check this page periodically — especially before making any new transaction on m99my — to ensure you are always informed of our latest privacy practices.

If any amendments we make are material and require your renewed consent, we will request that consent explicitly before the changes take effect. Your continued use of the m99my platform following the publication of non-material amendments constitutes acceptance of the updated policy.