SCR99 Privacy Policy – Data Protection for Malaysian Players

This Privacy Policy document sets out in detail how SCR99 ("we", "platform", "company") collects, uses, stores, and protects your personal information when you use our casino and Sports Betting platform at scr99.top. It also explains your rights in relation to your personal data and how you can exercise those rights.

Player privacy is among our highest priorities SCR99. We understand that you are entrusting us with sensitive information — including personal details, financial information, and your gaming activity history. We take this trust seriously through high-grade security systems, strict data usage policies, and ongoing staff training.

This Privacy Policy applies to all users of the SCR99 – including website visitors, registered players, and our VIP members. It covers all services we offer, including online slots, live casino, sports betting, our VIP rewards programme, and all customer support channels.

SCR99 collects various types of personal information depending on how you interact with our platform. We only collect data that is genuinely necessary for the stated purposes — the principle of "data minimisation" is fundamental to how we operate.

Data You Provide Directly:

• Registration Information: Full name, Malaysian phone number, email address, date of birth, and account password
• Identity Verification (KYC) Information: MyKad or passport number, images of identity documents, and in some cases a selfie for biometric verification — required when processing withdrawals that exceed a certain threshold
• Financial Information: Malaysian bank account number, phone number linked to e-wallets (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow) for deposit and withdrawal purposes
• Communications: Records of conversations with our customer support team via live chat or email

Automatically Collected Data:

• IP address, browser type, operating system, and device information used to access SCR99
• Cookie data and similar tracking technologies (see Section 6 for more details)
• Gaming activity history – games played, bet amounts, wins and losses, session duration
• Complete transaction records — all deposits and withdrawals with timestamps, amounts, and payment methods
• Access logs and security data used to identify and prevent fraudulent activity

SCR99 uses collected personal data solely for legitimate purposes directly related to platform operations and service improvements for players. We do not use your data for any purpose unrelated to the services you use.

The primary purposes for which your data is used by SCR99 are as follows:

• Account Management: Creating, verifying, and managing your account SCR99 yours, including the registration process, login, and identity verification
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX and other payment methods, as well as processing withdrawal of winnings to your Malaysian bank account or e-wallet
• Gaming Services Provision: Providing access to all platform games including slots, live casino, and Sports Betting, as well as maintaining game records for integrity and dispute resolution purposes
• Customer Support: Effectively addressing your enquiries, complaints, and support requests
• Security & Fraud Prevention: Identifying, investigating, and preventing fraudulent activity, money laundering, and platform abuse
• Legal Compliance: Meeting applicable legal and regulatory obligations, including anti-money laundering (AML) and know your customer (KYC) requirements
• Platform Improvements: Analysing usage patterns in aggregate and anonymised form to improve the platform's design, performance, and features SCR99
• Marketing Communications: Sending information about promotions, bonuses, and offers SCR99 that may be of interest to you – only if you have consented to receive such communications

All use of your data by SCR99 has a solid legal basis — whether grounded in contractual necessity (to provide the services you requested), our legal obligations, our legitimate interests in running a secure operation, or your explicit consent.

SCR99 does not sell, rent, or trade your personal data to any external party for marketing or any purpose unrelated to our services. However, in the course of operating the platform, there are situations where we need to share certain data with selected and trusted third parties.

The categories of third parties that may receive a portion of your data, and the purposes of such sharing, are as follows:

• Payment Service Providers: Payment processors and e-wallet providers required to process your deposit and withdrawal transactions. This includes institutions involved in processing FPX, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and DuitNow. Only the data necessary to complete a transaction is shared.
• Gaming Software Providers: Companies such as Pragmatic Play, PG Soft, Spadegaming, Evolution Gaming, and other providers that supply games to the platform SCR99 requires access to certain game session data strictly for operational purposes.
• Identity Verification Services: Third-party providers that assist us in verifying player identity during the KYC process using authorised databases.
• Legal Authorities: Law enforcement agencies, regulatory bodies, or courts issuing a lawful order requiring us to disclose specific data. SCR99 will notify you of any such disclosure where we are permitted to do so by law.

SCR99 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction.

The key security measures we have implemented include:

• Data Encryption at Rest: All personal data stored in the SCR99 — including passwords, bank account information, and e-wallet details — are encrypted using robust AES-256 encryption.
• Data Encryption in Transit: All communications between your browser and the SCR99 is protected with the latest TLS 1.3 protocol, compliant with 256-bit SSL standards.
• Strict Access Controls: Access to players' personal data is restricted to authorised staff only SCR99 who require access solely for their specific duties. All access is logged and audited regularly.
• Two-Factor Authentication (2FA): All internal systems SCR99 that contain user data are secured with 2FA. We also offer 2FA to players for their own accounts as an additional layer of protection.
• Continuous Security Monitoring: Automated monitoring systems operate 24/7 to detect any suspicious activity or unauthorised access attempts on our systems.
• Regular Security Testing: Penetration testing and security audits are conducted periodically by independent third parties to identify and address any vulnerabilities.

While we take all reasonable steps to protect your data, no security system is completely impenetrable. In the event of a data security breach that affects your data, SCR99 is committed to notifying you and the relevant authorities within the timeframe required by applicable law.

Platform SCR99 uses cookies and similar tracking technologies to enhance your experience, maintain the security of your login session, and understand how players interact with our platform. Here is an overview of the types of cookies we use:

• Essential Cookies (Required): These cookies are required for the platform SCR99 functions correctly. This includes login session cookies that keep you signed in while you play, CSRF security tokens that protect your account from cyberattacks, and language preference cookies. These cookies cannot be disabled as doing so would affect the platform's core functionality.
• Functional Cookies: These cookies remember your preferences, such as game display settings, your last used betting limits, and your language and currency choices. This helps us provide a more personalised and comfortable experience every time you use SCR99.
• Analytics Cookies: We use analytics tools to understand how players use our platform in aggregate — which pages are visited most, what the average session length is, and which features are most popular. This helps us improve the platform. Analytics data is anonymised and cannot be linked back to your personal identity.

SCR99 only retains your personal data for as long as necessary to fulfil the stated purpose of collection, or for as long as required by law and the regulatory obligations applicable to our platform's operations.

The general data retention guidelines we follow are as follows:

• Active Account Data: For as long as your SCR99 is active, we retain all information associated with that account to enable us to deliver our services effectively.
• Financial Transaction Records: Deposit and withdrawal records are retained for a minimum of 7 years from the date of the transaction, in line with anti-money laundering (AML) legislation and standard accounting requirements.
• KYC Records: Identity documents you submit are retained for a minimum of 5 years after your business relationship with SCR99 expires, in accordance with the enforced KYC requirements.
• Security Logs: Access logs and security activity records are retained for 2 years for investigation purposes in the event of a security incident.
• Closed Account Data: Once you close your account SCR99 your account, personal data that is no longer required to be retained for legal or security purposes will be anonymised or deleted within 90 days.

Once the retention period has expired and there is no longer any legal requirement to keep the data, SCR99 will delete or anonymise your data securely using industry-standard data deletion procedures.

As a data subject, you have a range of rights concerning the personal information we hold about you. SCR99 respects and facilitates the exercise of these rights in a practical and accessible manner.

Platform SCR99 is an online gambling service strictly limited to individuals aged 18 and above. We do not knowingly collect or process personal data from children or individuals under the age of 18.

SCR99 employs multiple mechanisms to prevent registration by underage individuals, including date-of-birth verification during registration, identity document checks (MyKad or passport) during the KYC process, and ongoing monitoring for usage patterns that may indicate an ineligible user.

As an online platform operating under an international licence, some of the third-party data processors we use may be based outside Malaysia. This includes gaming software providers such as Pragmatic Play and Evolution Gaming, which have operations across multiple countries.

Whenever your data is transferred outside Malaysia, SCR99 ensures that such transfers are protected by appropriate safeguards, including:

• Data Processing Agreements (DPAs) that require recipients of data outside Malaysia to uphold data protection standards equivalent to, or stricter than, our own
• Internationally recognised standard contractual clauses governing cross-border data transfers
• Confirmation that the recipient country provides adequate data protection

SCR99 reserves the right to review and update this Privacy Policy from time to time to reflect changes in our operations, the technologies we use, evolving legal requirements, or feedback received from users and regulatory bodies.

For significant or material changes to how we process your personal data, SCR99 will provide notice via email to the address registered on your account, or through a clear in-platform notification, at least 14 days before any changes take effect. For minor updates such as text corrections or clarifications that do not alter the intent of the policy, we may simply update the "Last Updated" date at the top of this document.

Continued use of the platform SCR99 after an updated Privacy Policy takes effect will be considered your acceptance of the revised policy. We encourage you to review this page periodically so you are always informed of how we protect your privacy.

If you have any questions, concerns, or complaints regarding how SCR99 handles your personal data, or if you wish to exercise any of your privacy rights, please contact our appointed Privacy Officer through the following channels:

• Dedicated Privacy Email: privacy@scr99.top – for all enquiries and requests relating to privacy and personal data protection
• General Support Email: support@scr99.top – for general enquiries that may involve privacy concerns
• Live Chat: Available 24/7 within the platform SCR99 – for privacy issues requiring immediate attention

Privacy Officer SCR99 is responsible for ensuring the platform's compliance with all applicable data protection obligations, and will respond to every enquiry received within the timeframe stipulated by law – typically within 30 days of the request being received, or sooner for urgent cases.